Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/

Overview

General Information

Sample URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/
Analysis ID:1377823
Infos:

Detection

GRQ Scam
Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Yara detected GRQ Scam
Creates files inside the system directory

Classification

  • System is w10x64
  • chrome.exe (PID: 5948 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 6024 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=2000,i,14316904190830729481,610904523097346633,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 6216 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5660 --field-trial-handle=2000,i,14316904190830729481,610904523097346633,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6584 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup
No configs have been found
SourceRuleDescriptionAuthorStrings
dropped/chromecache_91JoeSecurity_GRQScamYara detected GRQ ScamJoe Security
    SourceRuleDescriptionAuthorStrings
    2.1.pages.csvJoeSecurity_GRQScamYara detected GRQ ScamJoe Security
      No Sigma rule has matched
      No Snort rule has matched

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Source: https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/Avira URL Cloud: detection malicious, Label: phishing
      Source: https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/SlashNext: detection malicious, Label: Scareware type: Phishing & Social Engineering
      Source: https://2041.awlivedose.live/media/mainstream/all/cf/winner_1.jpgAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/all/cf/google_play_card.jpgAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/all/cf/style7.cssAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/all/cf/amazon_1000_summerwater.pngAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/all/cf/winner_initial_r.jpgAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/all/cf/4.jsAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/all/cf/winner_initial_m.jpgAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/all/cf/winner_heart.jpgAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/u.jsAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/all/cf/winner_2.jpgAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/all/mb/chrome58x58.pngAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/all/mb/3.jsAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/all/cf/box.pngAvira URL Cloud: Label: phishing
      Source: https://checking-browser.com?url=Avira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/all/cf/0xES5Sl_v6oyT7dAKuoni4gp9Q8gbYrhqGlRav_IXfk.woff2Avira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/all/cf/winner_cat.jpgAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/all/cf/winner_4.jpgAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/all/cf/2.jsAvira URL Cloud: Label: phishing
      Source: https://checking-browser.com/?url=https%3A%2F%2Fmygiftaward.life%2F%3Fu%3D6w3kaew%26o%3Duvdg6dv%26cid%3Duomgcwv9%26t%3DsweepstakesbbgAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/all/cf/1.jsAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/flag-icon/flags/4x3/us.svgAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/alert.mp3Avira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/all/cf/winner_cat2.jpgAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/all/cf/winner_3.jpgAvira URL Cloud: Label: phishing
      Source: https://mygiftaward.life/favicon.icoAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/all/cf/winner_initial_s.jpgAvira URL Cloud: Label: phishing
      Source: https://2041.awlivedose.live/media/mainstream/flag-icon/css/flag-icon.cssAvira URL Cloud: Label: phishing
      Source: https://mygiftaward.life/?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakesHTTP Parser: No favicon
      Source: unknownHTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49775 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49785 version: TLS 1.2
      Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
      Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
      Source: unknownTCP traffic detected without corresponding DNS query: 184.31.62.93
      Source: unknownTCP traffic detected without corresponding DNS query: 184.31.62.93
      Source: unknownTCP traffic detected without corresponding DNS query: 184.31.62.93
      Source: unknownTCP traffic detected without corresponding DNS query: 184.31.62.93
      Source: unknownTCP traffic detected without corresponding DNS query: 184.31.62.93
      Source: unknownTCP traffic detected without corresponding DNS query: 184.31.62.93
      Source: unknownTCP traffic detected without corresponding DNS query: 184.31.62.93
      Source: unknownTCP traffic detected without corresponding DNS query: 184.31.62.93
      Source: unknownTCP traffic detected without corresponding DNS query: 184.31.62.93
      Source: unknownTCP traffic detected without corresponding DNS query: 184.31.62.93
      Source: unknownTCP traffic detected without corresponding DNS query: 184.31.62.93
      Source: unknownTCP traffic detected without corresponding DNS query: 184.31.62.93
      Source: unknownTCP traffic detected without corresponding DNS query: 184.31.62.93
      Source: unknownTCP traffic detected without corresponding DNS query: 184.31.62.93
      Source: unknownTCP traffic detected without corresponding DNS query: 184.31.62.93
      Source: unknownTCP traffic detected without corresponding DNS query: 184.31.62.93
      Source: unknownTCP traffic detected without corresponding DNS query: 184.31.62.93
      Source: unknownTCP traffic detected without corresponding DNS query: 184.31.62.93
      Source: unknownTCP traffic detected without corresponding DNS query: 184.31.62.93
      Source: unknownTCP traffic detected without corresponding DNS query: 69.164.42.0
      Source: unknownTCP traffic detected without corresponding DNS query: 69.164.42.0
      Source: unknownTCP traffic detected without corresponding DNS query: 69.164.42.0
      Source: unknownTCP traffic detected without corresponding DNS query: 69.164.42.0
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: global trafficHTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /get/script.js?referrer=https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/ HTTP/1.1Host: cdnstat.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /?url=https%3A%2F%2Fmygiftaward.life%2F%3Fu%3D6w3kaew%26o%3Duvdg6dv%26cid%3Duomgcwv9%26t%3Dsweepstakesbbg HTTP/1.1Host: checking-browser.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
      Source: global trafficHTTP traffic detected: GET /?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes HTTP/1.1Host: mygiftaward.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://checking-browser.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: mygiftaward.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mygiftaward.life/?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakesAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~x0hgjdzxqkzaumrwysnznltv; p1=https://awlivedose.live/ubxplwqi/; s1=iw8r23clxymqvla7
      Source: global trafficHTTP traffic detected: GET /ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://mygiftaward.life/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/style7.css HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/flag-icon/css/flag-icon.css HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/1.js HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/u.js HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/amazon_1000_summerwater.png HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/mb/3.js HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/0xES5Sl_v6oyT7dAKuoni4gp9Q8gbYrhqGlRav_IXfk.woff2 HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://2041.awlivedose.livesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://2041.awlivedose.live/media/mainstream/all/cf/style7.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/mb/chrome58x58.png HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/box.png HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/google_play_card.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/2.js HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/4.js HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/amazon_1000_summerwater.png HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_2.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_initial_s.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/mb/chrome58x58.png HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_cat.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/google_play_card.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_1.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_initial_m.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_3.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/box.png HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookie1=true
      Source: global trafficHTTP traffic detected: GET /ExtService.svc/getextparams HTTP/1.1Host: jsontdsexit2.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://2041.awlivedose.liveSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://2041.awlivedose.live/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/flag-icon/flags/4x3/us.svg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://2041.awlivedose.live/media/mainstream/flag-icon/css/flag-icon.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookie1=true
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_cat2.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_heart.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_2.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookie1=true
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_cat.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookie1=true
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_initial_s.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookie1=true
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_4.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookie1=true
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_initial_m.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookie1=true
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_1.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookie1=true
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_initial_r.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookie1=true
      Source: global trafficHTTP traffic detected: GET /ExtService.svc/getextparams HTTP/1.1Host: jsontdsexit2.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_3.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookie1=true
      Source: global trafficHTTP traffic detected: GET /media/mainstream/flag-icon/flags/4x3/us.svg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookie1=true
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_heart.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookie1=true
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_cat2.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookie1=true
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_4.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookie1=true
      Source: global trafficHTTP traffic detected: GET /media/mainstream/all/cf/winner_initial_r.jpg HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookie1=true
      Source: global trafficHTTP traffic detected: GET /media/mainstream/alert.mp3 HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookie1=true
      Source: global trafficHTTP traffic detected: GET /media/mainstream/alert.mp3 HTTP/1.1Host: 2041.awlivedose.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookie1=true
      Source: unknownDNS traffic detected: queries for: clients2.google.com
      Source: unknownHTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
      Source: chromecache_77.2.drString found in binary or memory: http://fontawesome.io
      Source: chromecache_77.2.drString found in binary or memory: http://fontawesome.io/license
      Source: chromecache_91.2.drString found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
      Source: chromecache_78.2.drString found in binary or memory: https://awlivedose.live/ubxplwqi/
      Source: chromecache_80.2.drString found in binary or memory: https://checking-browser.com?url=
      Source: chromecache_124.2.drString found in binary or memory: https://fonts.googleapis.com
      Source: chromecache_124.2.drString found in binary or memory: https://fonts.googleapis.com/css2?family=Open
      Source: chromecache_124.2.drString found in binary or memory: https://fonts.gstatic.com
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqW106F15M.woff2)
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWt06F15M.woff2)
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtE6F15M.woff2)
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtU6F15M.woff2)
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtk6F15M.woff2)
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWu06F15M.woff2)
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2)
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuk6F15M.woff2)
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWvU6F15M.woff2)
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWxU6F15M.woff2)
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2)
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS2mu1aB.woff2)
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2)
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2)
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2)
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2)
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2)
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2)
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2)
      Source: chromecache_126.2.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2)
      Source: chromecache_112.2.dr, chromecache_129.2.drString found in binary or memory: https://getbootstrap.com/)
      Source: chromecache_112.2.dr, chromecache_129.2.drString found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
      Source: chromecache_129.2.drString found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
      Source: chromecache_80.2.drString found in binary or memory: https://mygiftaward.life/?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes
      Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
      Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
      Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
      Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49831 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
      Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
      Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
      Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
      Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
      Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
      Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
      Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
      Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
      Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
      Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
      Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
      Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49835 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49832 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
      Source: unknownHTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49775 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49785 version: TLS 1.2

      Spam, unwanted Advertisements and Ransom Demands

      barindex
      Source: Yara matchFile source: 2.1.pages.csv, type: HTML
      Source: Yara matchFile source: dropped/chromecache_91, type: DROPPED
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_BITS_5948_600872534Jump to behavior
      Source: classification engineClassification label: mal64.phis.win@21/88@20/12
      Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=2000,i,14316904190830729481,610904523097346633,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
      Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5660 --field-trial-handle=2000,i,14316904190830729481,610904523097346633,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=2000,i,14316904190830729481,610904523097346633,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5660 --field-trial-handle=2000,i,14316904190830729481,610904523097346633,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeAutomated click: Next
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeAutomated click: Next
      Source: Window RecorderWindow detected: More than 3 window changes detected
      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpactResource DevelopmentReconnaissance
      Valid AccountsWindows Management InstrumentationPath Interception1
      Process Injection
      1
      Masquerading
      OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local SystemExfiltration Over Other Network Medium1
      Encrypted Channel
      Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationAbuse Accessibility FeaturesAcquire InfrastructureGather Victim Identity Information
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
      Process Injection
      LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth3
      Non-Application Layer Protocol
      SIM Card SwapObtain Device Cloud BackupsNetwork Denial of ServiceDomainsCredentials
      Domain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration4
      Application Layer Protocol
      Data Encrypted for ImpactDNS ServerEmail Addresses
      Local AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureTraffic Duplication1
      Ingress Tool Transfer
      Data DestructionVirtual Private ServerEmployee Names
      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand
      SourceDetectionScannerLabelLink
      https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/100%Avira URL Cloudphishing
      https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/100%SlashNextScareware type: Phishing & Social Engineering
      No Antivirus matches
      No Antivirus matches
      No Antivirus matches
      SourceDetectionScannerLabelLink
      https://2041.awlivedose.live/media/mainstream/all/cf/winner_1.jpg100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/all/cf/google_play_card.jpg100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/all/cf/style7.css100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/all/cf/amazon_1000_summerwater.png100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/all/cf/winner_initial_r.jpg100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/all/cf/4.js100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/all/cf/winner_initial_m.jpg100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/all/cf/winner_heart.jpg100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/u.js100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/all/cf/winner_2.jpg100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/all/mb/chrome58x58.png100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/all/mb/3.js100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/all/cf/box.png100%Avira URL Cloudphishing
      https://checking-browser.com?url=100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/all/cf/0xES5Sl_v6oyT7dAKuoni4gp9Q8gbYrhqGlRav_IXfk.woff2100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/all/cf/winner_cat.jpg100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/all/cf/winner_4.jpg100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/all/cf/2.js100%Avira URL Cloudphishing
      https://jsontdsexit2.com/ExtService.svc/getextparams0%Avira URL Cloudsafe
      https://checking-browser.com/?url=https%3A%2F%2Fmygiftaward.life%2F%3Fu%3D6w3kaew%26o%3Duvdg6dv%26cid%3Duomgcwv9%26t%3Dsweepstakesbbg100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/all/cf/1.js100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/flag-icon/flags/4x3/us.svg100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/alert.mp3100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/all/cf/winner_cat2.jpg100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/all/cf/winner_3.jpg100%Avira URL Cloudphishing
      https://mygiftaward.life/favicon.ico100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/all/cf/winner_initial_s.jpg100%Avira URL Cloudphishing
      https://2041.awlivedose.live/media/mainstream/flag-icon/css/flag-icon.css100%Avira URL Cloudphishing
      NameIPActiveMaliciousAntivirus DetectionReputation
      cdnstat.net
      104.21.56.41
      truefalse
        unknown
        2041.awlivedose.live
        185.155.186.25
        truefalse
          unknown
          accounts.google.com
          108.177.122.84
          truefalse
            high
            checking-browser.com
            104.21.6.39
            truefalse
              unknown
              mygiftaward.life
              185.155.184.32
              truefalse
                unknown
                jsontdsexit2.com
                136.243.216.235
                truefalse
                  unknown
                  www.google.com
                  74.125.136.106
                  truefalse
                    high
                    clients.l.google.com
                    172.253.124.139
                    truefalse
                      high
                      fp2e7a.wpc.phicdn.net
                      192.229.211.108
                      truefalse
                        unknown
                        clients2.google.com
                        unknown
                        unknownfalse
                          high
                          NameMaliciousAntivirus DetectionReputation
                          https://2041.awlivedose.live/media/mainstream/all/cf/winner_heart.jpgfalse
                          • Avira URL Cloud: phishing
                          unknown
                          https://2041.awlivedose.live/media/mainstream/all/cf/style7.cssfalse
                          • Avira URL Cloud: phishing
                          unknown
                          https://2041.awlivedose.live/media/mainstream/all/cf/google_play_card.jpgfalse
                          • Avira URL Cloud: phishing
                          unknown
                          https://2041.awlivedose.live/media/mainstream/all/cf/winner_1.jpgfalse
                          • Avira URL Cloud: phishing
                          unknown
                          https://2041.awlivedose.live/media/mainstream/all/cf/amazon_1000_summerwater.pngfalse
                          • Avira URL Cloud: phishing
                          unknown
                          https://2041.awlivedose.live/media/mainstream/all/cf/winner_initial_m.jpgfalse
                          • Avira URL Cloud: phishing
                          unknown
                          https://2041.awlivedose.live/media/mainstream/all/cf/winner_initial_r.jpgfalse
                          • Avira URL Cloud: phishing
                          unknown
                          https://2041.awlivedose.live/media/mainstream/all/cf/4.jsfalse
                          • Avira URL Cloud: phishing
                          unknown
                          https://2041.awlivedose.live/media/mainstream/all/cf/winner_2.jpgfalse
                          • Avira URL Cloud: phishing
                          unknown
                          https://2041.awlivedose.live/media/mainstream/u.jsfalse
                          • Avira URL Cloud: phishing
                          unknown
                          https://2041.awlivedose.live/media/mainstream/all/mb/3.jsfalse
                          • Avira URL Cloud: phishing
                          unknown
                          https://2041.awlivedose.live/media/mainstream/all/cf/0xES5Sl_v6oyT7dAKuoni4gp9Q8gbYrhqGlRav_IXfk.woff2false
                          • Avira URL Cloud: phishing
                          unknown
                          https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardfalse
                            high
                            https://2041.awlivedose.live/media/mainstream/all/mb/chrome58x58.pngfalse
                            • Avira URL Cloud: phishing
                            unknown
                            https://2041.awlivedose.live/media/mainstream/all/cf/box.pngfalse
                            • Avira URL Cloud: phishing
                            unknown
                            https://2041.awlivedose.live/media/mainstream/all/cf/2.jsfalse
                            • Avira URL Cloud: phishing
                            unknown
                            https://checking-browser.com/?url=https%3A%2F%2Fmygiftaward.life%2F%3Fu%3D6w3kaew%26o%3Duvdg6dv%26cid%3Duomgcwv9%26t%3Dsweepstakesbbgfalse
                            • Avira URL Cloud: phishing
                            unknown
                            https://2041.awlivedose.live/media/mainstream/all/cf/winner_cat.jpgfalse
                            • Avira URL Cloud: phishing
                            unknown
                            https://jsontdsexit2.com/ExtService.svc/getextparamsfalse
                            • Avira URL Cloud: safe
                            unknown
                            https://2041.awlivedose.live/media/mainstream/all/cf/winner_4.jpgfalse
                            • Avira URL Cloud: phishing
                            unknown
                            https://2041.awlivedose.live/media/mainstream/all/cf/winner_cat2.jpgfalse
                            • Avira URL Cloud: phishing
                            unknown
                            https://2041.awlivedose.live/media/mainstream/alert.mp3false
                            • Avira URL Cloud: phishing
                            unknown
                            https://2041.awlivedose.live/media/mainstream/flag-icon/flags/4x3/us.svgfalse
                            • Avira URL Cloud: phishing
                            unknown
                            https://2041.awlivedose.live/media/mainstream/all/cf/1.jsfalse
                            • Avira URL Cloud: phishing
                            unknown
                            https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1false
                              high
                              https://2041.awlivedose.live/media/mainstream/all/cf/winner_3.jpgfalse
                              • Avira URL Cloud: phishing
                              unknown
                              https://mygiftaward.life/?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakesfalse
                                unknown
                                https://mygiftaward.life/favicon.icofalse
                                • Avira URL Cloud: phishing
                                unknown
                                https://2041.awlivedose.live/media/mainstream/all/cf/winner_initial_s.jpgfalse
                                • Avira URL Cloud: phishing
                                unknown
                                https://2041.awlivedose.live/media/mainstream/flag-icon/css/flag-icon.cssfalse
                                • Avira URL Cloud: phishing
                                unknown
                                NameSourceMaliciousAntivirus DetectionReputation
                                http://fontawesome.iochromecache_77.2.drfalse
                                  high
                                  https://github.com/twbs/bootstrap/blob/main/LICENSE)chromecache_112.2.dr, chromecache_129.2.drfalse
                                    high
                                    https://checking-browser.com?url=chromecache_80.2.drfalse
                                    • Avira URL Cloud: phishing
                                    unknown
                                    https://getbootstrap.com/)chromecache_112.2.dr, chromecache_129.2.drfalse
                                      high
                                      http://fontawesome.io/licensechromecache_77.2.drfalse
                                        high
                                        https://github.com/twbs/bootstrap/graphs/contributors)chromecache_129.2.drfalse
                                          high
                                          • No. of IPs < 25%
                                          • 25% < No. of IPs < 50%
                                          • 50% < No. of IPs < 75%
                                          • 75% < No. of IPs
                                          IPDomainCountryFlagASNASN NameMalicious
                                          185.155.184.32
                                          mygiftaward.lifeSwitzerland
                                          44160INTERNETONEInternetServicesProviderITfalse
                                          185.155.186.25
                                          2041.awlivedose.liveSwitzerland
                                          6898INTERNETONE_CHfalse
                                          185.155.184.55
                                          unknownSwitzerland
                                          44160INTERNETONEInternetServicesProviderITfalse
                                          74.125.136.106
                                          www.google.comUnited States
                                          15169GOOGLEUSfalse
                                          136.243.216.235
                                          jsontdsexit2.comGermany
                                          24940HETZNER-ASDEfalse
                                          172.253.124.139
                                          clients.l.google.comUnited States
                                          15169GOOGLEUSfalse
                                          104.21.6.39
                                          checking-browser.comUnited States
                                          13335CLOUDFLARENETUSfalse
                                          239.255.255.250
                                          unknownReserved
                                          unknownunknownfalse
                                          108.177.122.84
                                          accounts.google.comUnited States
                                          15169GOOGLEUSfalse
                                          104.21.56.41
                                          cdnstat.netUnited States
                                          13335CLOUDFLARENETUSfalse
                                          IP
                                          192.168.2.4
                                          192.168.2.5
                                          Joe Sandbox version:38.0.0 Ammolite
                                          Analysis ID:1377823
                                          Start date and time:2024-01-20 00:40:16 +01:00
                                          Joe Sandbox product:CloudBasic
                                          Overall analysis duration:0h 3m 20s
                                          Hypervisor based Inspection enabled:false
                                          Report type:full
                                          Cookbook file name:browseurl.jbs
                                          Sample URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/
                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                          Number of analysed new started processes analysed:9
                                          Number of new started drivers analysed:0
                                          Number of existing processes analysed:0
                                          Number of existing drivers analysed:0
                                          Number of injected processes analysed:0
                                          Technologies:
                                          • HCA enabled
                                          • EGA enabled
                                          • AMSI enabled
                                          Analysis Mode:default
                                          Analysis stop reason:Timeout
                                          Detection:MAL
                                          Classification:mal64.phis.win@21/88@20/12
                                          EGA Information:Failed
                                          HCA Information:
                                          • Successful, ratio: 100%
                                          • Number of executed functions: 0
                                          • Number of non-executed functions: 0
                                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                          • Excluded IPs from analysis (whitelisted): 108.177.122.94, 34.104.35.123, 20.60.62.1, 74.125.138.95, 64.233.176.94, 13.85.23.86, 72.21.81.240, 192.229.211.108, 13.95.31.18, 52.165.164.15, 173.194.219.94
                                          • HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                          • Not all processes where analyzed, report is missing behavior information
                                          • VT rate limit hit for: https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/
                                          No simulations
                                          No context
                                          No context
                                          No context
                                          No context
                                          No context
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:ASCII text, with very long lines (3533), with no line terminators
                                          Category:downloaded
                                          Size (bytes):3533
                                          Entropy (8bit):5.183663053282523
                                          Encrypted:false
                                          SSDEEP:48:7PeyWaXCT+FkuZbwkrXv868p9DTXgTN/CEGMKZJ81RCtV7:7PHPS6FkuphrkP/XgTN/CKKZS1RU7
                                          MD5:116C9460F5E882A7FCF4E837F7EFC72A
                                          SHA1:13A88E74735D05985E5D07E8CBFF716329F5D81C
                                          SHA-256:651141C8290087AF54C66793AA063EE5697661FB914925F56BD09390A2895CE4
                                          SHA-512:D5662E0448831AFE87EED4DF65145CAED94FF5D2AF2372999FEAB11266E62589754FF9D9345B25A2B5CAD4B73C09FBEE58FAF283BA92B353A228FFF758032EF4
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/cf/4.js
                                          Preview:var canvas1,ctx,W,H;if(screen.width>=988)var mp=150;else mp=75;var deactivationTimerHandler,reactivationTimerHandler,animationHandler,particles=[],angle=0,tiltAngle=0,confettiActive=!0,animationComplete=!0,particleColors={colorOptions:["DodgerBlue","OliveDrab","Gold","pink","SlateBlue","lightblue","Violet","PaleGreen","SteelBlue","SandyBrown","Chocolate","Crimson"],colorIndex:0,colorIncrementer:0,colorThreshold:10,getColor:function(){return this.colorIncrementer>=10&&(this.colorIncrementer=0,this.colorIndex++,this.colorIndex>=this.colorOptions.length&&(this.colorIndex=0)),this.colorIncrementer++,this.colorOptions[this.colorIndex]}};function confettiParticle(t){this.x=Math.random()*W,this.y=Math.random()*H-H,this.r=RandomFromTo(10,30),this.d=Math.random()*mp+10,this.color=t,this.tilt=Math.floor(10*Math.random())-10,this.tiltAngleIncremental=.07*Math.random()+.05,this.tiltAngle=0,this.draw=function(){return ctx.beginPath(),ctx.lineWidth=this.r/2,ctx.strokeStyle=this.color,ctx.moveTo(this
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 1903 x 1020, 8-bit/color RGB, non-interlaced
                                          Category:downloaded
                                          Size (bytes):549442
                                          Entropy (8bit):7.994805157826083
                                          Encrypted:true
                                          SSDEEP:12288:IjQ8p0xvN9qc86dWDRfhVlu9vuInKyZH6Wjvp4qZaqAG58/:Ijfp0p/8dRE9K+bp4q0KW
                                          MD5:F3E18C4DA95B83AB519A72F2876019F2
                                          SHA1:209F613FED2D2202E134E00081AD3C32EC5E6A25
                                          SHA-256:466835EF2D6F0F0BFDDAFA405154702E36A5588F69684DD3B6642F9013EB778B
                                          SHA-512:169598F9793AA478FD14E5BE8785BA583EE9D0AF6C31E64BF8C2EDD05F9F5F6D2510669C38600E90448645CA12D4EC729E7953AC6DB99BF1E3C2AE98231E234B
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/7a-bg.png
                                          Preview:.PNG........IHDR...o..........b.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............pHYs..........6.u....zTXtRaw profile type 8bim..X...]..*....E...@0.~...k.r...so....1B.ikK.\........%.X$H.yHH...{...5.{O,.l.._....7}.p......6,O..=..].w...MA=....b.n..[...G...p[4...{.;.zL..y}....i......E1..S{^.Q...:..K.........]....7...s.t..y.O..N...#z.{.....c7.........7..............}..[`.G..%H...g....M3<.P.......}Sox....n.e.e..x.~..W.....D.].KQ.!o.V..y.j9.. ..U.u...$.?\.......)g.?...v..q...y..5./.......9.......G./......WT.="..L.zzO...'..D@.:>...H\.2$..ZOA.{...Q..Dm&[..;n.|..V.._T...K...........p....]8..a..|3......v.L.K.'..._.c.V...C.-....l.........^.e..\.{.....I...aQ...M..d......o."..l@.M='W..6,..z....?.~V..<0..].<.....l!..S^q[',..' ...L..G....O._....B'e.By..tq?..K....C....r..rg.U.w%.t.)y].X........P..~.Y.^.\i.Q.h..)..L.I.L.h.x.I..[.X....a......[.c..b`\q|T..>.1.C.g...tl.c.....Y.......o.....:.I.=......]p)..y..k.l...W...PP.1.+R..
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:HTML document, ASCII text, with CRLF line terminators
                                          Category:downloaded
                                          Size (bytes):4833
                                          Entropy (8bit):5.158443589425066
                                          Encrypted:false
                                          SSDEEP:96:Pc12FDl12Fyl12LNl12AaNl12+Ll12Vl12uNoW12FDoW12FDoW12FDoW12FDoW1x:PqWDXWyXCNXENXNLX6X/No4WDo4WDo4T
                                          MD5:2C0A1CDC913B2220B50FEADD4DC17B8B
                                          SHA1:3D8D5B8FA5F5D98EA83AC093151684350993CCDB
                                          SHA-256:EB531C2DACEFD17914B680E454B8DCEC083EB1A74CE1E8E91872B8E35ABCB522
                                          SHA-512:03CB7359C7F7C0B8FEC0993B2BF247B65A62C13962F60767363F47DC108713EBA72B31F4E3E2C45230442B8E9E7C760A3B4472D509119869BBA789FA04D351C9
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/al.js
                                          Preview:$('.al__js').html(`..<table class="table table-bordered">...<thead>....<tr>.....<th>......<div class="form-check mar_lef"></div>.....</th>.....<th>Name</th>.....<th>Type</th>.....<th>Object type</th>.....<th>Location</th>....</tr>...</thead>...<tbody id="table_scroll">....<tr>.....<td>......<div class="form-check mar_lef">.......<input class="form-check-input" type="checkbox" value id="defaultCheck1" checked />.......<label class="form-check-label" for="defaultCheck1"></label>......</div>.....</td>.....<td>Trojan.DNSCharge.AC...</td>.....<td>Malware</td>.....<td>Registry Value</td>.....<td>HKLM\SYSTEM\CURRENTCONTROLS...</td>....</tr>....<tr>.....<td>......<div class="form-check mar_lef">.......<input class="form-check-input" type="checkbox" value id="defaultCheck1" checked />.......<label class="form-check-label" for="defaultCheck1"></label>......</div>.....</td>.....<td>Trojan.Dropper.Autoit...</td>.....<td>Malware</td>.....<td>File</td>.....<td>HKLM\SYSTEM\CURRENTCONTROLS...</td>....
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 48x48, components 3
                                          Category:downloaded
                                          Size (bytes):950
                                          Entropy (8bit):7.1236995695974485
                                          Encrypted:false
                                          SSDEEP:24:VaPXXQRzclo0AVD3DYsie56Gwz6tZYShJ9:VawkmDMe64P9
                                          MD5:62A261739E9A386D39D542903D5AB050
                                          SHA1:6CC87F77A580CE13068A1324B397070DB3817511
                                          SHA-256:669C7DE8CC4685BB673F13DB0B8DE84FD8142005C4DB680CBE35FAD7B852C631
                                          SHA-512:7FA5F5C69CF0BE9FB9B2F02813BBD27457379C9C25A31C26EC2754A68E740CEF97F64A380090C4D6690899AF0CC4C9870DCF0C82246A706A7AF6EDD350919805
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/cf/winner_initial_m.jpg
                                          Preview:......JFIF.....H.H.....C....................................................................C.......................................................................0.0..........................................0..........................a..1Q.!u."67Aq...B..................................(........................13.!..AB..#24r............?.....#..0..a...7.Y.M...h..`gh.....3D...X.5D.N..........Y6...qZ2..sC..~tJ.Z...).D..!.D:....(.d.]"4$$..&.....97..;$.%..D..6...m.T.=..2$.D......j..17-.%|.Ch...t..z...1>...Dz.3...;.}~;..Zmy"]o....-R."e.[..s<...Y.?.s..]....:._..k.........c.x./...72ok.!.G.H..JGZ..L.j.E.`..."....A.x}y:.?.=.q.....8/.Q......fF[.FT..3..d.........%h..u.!..)ff....a.......v..I.;........].^.I;.R...oVH.O..J../..9....ur.!...IeL=.)...m*.....Az.)i..{._7..Q..N.}]....VT..2...$..\ ..7r..w...D.(...0t.....e.....I.s .k.....D.i..."mK.b:.h..=..+...'...Zh.A...X.u. .U9.l..:..:P...e.#......M..'.=...(e.9..C...o$e.Ha@.........?..
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 48x48, components 3
                                          Category:downloaded
                                          Size (bytes):1388
                                          Entropy (8bit):7.326760553790512
                                          Encrypted:false
                                          SSDEEP:24:ETjsIhaG5qXfuMDtkkTsPNgNF0SVtldH7ufO1OpmKVXpohBfoyPC+uQYKWhMNdjW:As3XO/a7z9z1Op5iftK+w6NdjW
                                          MD5:0AC513EE31A4AA2855EF74476D76C95A
                                          SHA1:58EFB99A8D8FE861BEC685091D8D065C24A971D9
                                          SHA-256:CD6FC5A817D3E74F516B53FCD9BA5C691CE7B036FFED9947579EDF4C76C12B98
                                          SHA-512:E4C4F7C3D30FADC3AF62A01F81D93CC546AB2FB7157CCEC1B59B3830CDC6FD6383F05DECE25FEAC199579FFE26ED7E59D0B69B3C64E9D5D4CFEFC14276A4E24B
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/cf/winner_cat2.jpg
                                          Preview:......JFIF.............C....................................................................C.......................................................................0.0..................................................................................[..".V.=...'.`.......0Z.;.Y.T......X.....t.....3O#....[..H.n..K'.4n}Vm.?iPf....RU]3N+...<......1............................!1Qaq..."A...#3BCR.........?..jV....%[..-:..=JBN{..3.._.B......,...r.W......N@.hF....g......-.$.. ...Wm>..F......XYm.\.<.*..).#\..&.)M.y...2G...R.O.R}....K....w....1c.....T.?..6|....\.......k.*..I...Ip......P;..c.'....po`7&.\..?.+..B.n.+...1..9.vg..r.'...~..S.....Guo...F3.N.....3..~c.[.,.........V..J.5.}..}.......W...l*.+qhu:..pL*t.F..3...B.p' ...W5^.q....Z[7.2..:c....nRV.8.}..j3_L.T.bS.a.............T..E..3...<...].=....k.$.....e8...\u....)....?...~.f5N}.gh8..k.|cb.&J@..}.<V..b...up......Y.......,..v.=.{.m1.."...o.h.G.5.].?P.Qk.Ha..r.F....k.....l.S.4.hB..0:..Y[)Z?c.j.d[w.V.\1R.hV....X>.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:ASCII text, with CRLF line terminators
                                          Category:downloaded
                                          Size (bytes):1328
                                          Entropy (8bit):5.003382718421605
                                          Encrypted:false
                                          SSDEEP:24:Nf6vuQMc7yMsxtaWHogQNoioxon/oHwb/krQZH+vaFHzZVBgcZVBg9aFXn:NfUMcOMSQWIgQ6LugHwbcmH1Hlrgmrgi
                                          MD5:90CEA6B4B06240E3781AE47DE33B2994
                                          SHA1:33E12CAE311CAE86F6F97BE983EDB024C17F19CC
                                          SHA-256:5D1ACA03C773D4A281104152E34180114DFC1A52921AB186595FDF260155157A
                                          SHA-512:7427D4A47E5913DD0EA95590CF4F45A2FB4E6D23ECDFFD5D2EF0A76A4EEA1E965298D71AA714A4FCB8DBCB48A4030DB6387FB75A2AD6691548F68DE64F2D8DAC
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/main.js
                                          Preview:$(document).ready(function () {...var t = document.createElement('audio');...t.setAttribute('src', 'alertmicrosoft.mp3'),....t.addEventListener(.....'ended',.....function () {......this.play();.....},.....!1,....),....$('.map').click(function () {.....t.play();....}),....$('.black').click(function () {.....t.play();....}),....$('#footer').click(function () {.....t.play();....}),....$('#poptxt').click(function () {.....t.play();....});..}),...$('#footer').....fadeIn('slow').....css({ top: 752, position: 'absolute' }).....animate({ top: 685 }, 800, function () {}),...$(document).ready(function () {....$('.arow-div').delay(1e3).fadeIn(500);...}),...$(document).ready(function () {....$('#txts1').click(function () {.....$('#poptxt').fadeOut('fast');....});...}),...$(document).ready(function () {....$('.alert_popup').click(function () {.....$('.alert_popup').hide('fast');....});...}),...$(document).ready(function () {....$('#footer').click(function () {.....$('#poptxt').fadeOut('fast'), $('#
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:ASCII text, with very long lines (25177), with no line terminators
                                          Category:downloaded
                                          Size (bytes):25177
                                          Entropy (8bit):5.691985354278146
                                          Encrypted:false
                                          SSDEEP:768:c0TJ2pfnQYVqMmQYcDxUxBdRfq2hx1wmxOWg4yLxjq9ExjaR7nN9hADwnSqCZui8:cFnQYVqMmQYcExtxOWgvLxjq9ExjaR7/
                                          MD5:E44AA4CA20702394C8CA04144C3E9E74
                                          SHA1:B3734A4CDE021BB14D2D296C0AE5DFA8112376F6
                                          SHA-256:E075018E9A06D85A147B1F0D79E8E777DA51019B4F306076F8FBBA751D42D566
                                          SHA-512:4BA266FE60E9C67578EAF68FCDB9375A6C1A741D2C1B134FB7C766CC2F11B8E1F2A0349C3810D35B2E52B1F80BF8709B189138F0EBD7A6054BF1594249F4C8B3
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/u.js
                                          Preview:var _0x207a1e=_0x436c;(function(_0x350f6c,_0x515dfe){var _0x517161=_0x436c,_0x31635a=_0x350f6c();while(!![]){try{var _0x7d6b46=parseInt(_0x517161(0x1d1,'cw1N'))/0x1+parseInt(_0x517161(0xdd,'BCQ*'))/0x2*(-parseInt(_0x517161(0x13b,'RmWl'))/0x3)+-parseInt(_0x517161(0x19b,'X%oN'))/0x4*(-parseInt(_0x517161(0x16c,'(Mot'))/0x5)+-parseInt(_0x517161(0xb1,'rib2'))/0x6+-parseInt(_0x517161(0x11c,'ifKh'))/0x7+parseInt(_0x517161(0xe7,'tu!o'))/0x8+parseInt(_0x517161(0x1bf,']PPs'))/0x9;if(_0x7d6b46===_0x515dfe)break;else _0x31635a['push'](_0x31635a['shift']());}catch(_0x36ee2e){_0x31635a['push'](_0x31635a['shift']());}}}(_0x13e1,0xdb032),!function(_0x2333d5,_0x364665){'use strict';var _0x202cee=_0x436c;function _0x5f573b(){var _0x30eac7=_0x436c;if(!_0x272655){_0x272655=!0x0;for(var _0x187937=0x0;_0x187937<_0x3b454c[_0x30eac7(0xd8,'A(l4')];_0x187937++)_0x3b454c[_0x187937]['fn'][_0x30eac7(0x14d,'tu!o')](window,_0x3b454c[_0x187937][_0x30eac7(0x100,'9FrD')]);_0x3b454c=[];}}function _0x158ad8(){var _0x9d82
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
                                          Category:downloaded
                                          Size (bytes):48236
                                          Entropy (8bit):7.994912604882335
                                          Encrypted:true
                                          SSDEEP:768:uj6JxavgLx5rjTH3CdZ3y11o4uMb2IVEhiB6z6GAAHJApICtBgso6HaOjTXHRWK:ujoa4LxZPCdm3B2IVEhiB62apApISxos
                                          MD5:015C126A3520C9A8F6A27979D0266E96
                                          SHA1:2ACF956561D44434A6D84204670CF849D3215D5F
                                          SHA-256:3C4D6A1421C7DDB7E404521FE8C4CD5BE5AF446D7689CD880BE26612EAAD3CFA
                                          SHA-512:02A20F2788BB1C3B2C7D3142C664CDEC306B6BA5366E57E33C008EDB3EB78638B98DC03CDF932A9DC440DED7827956F99117E7A3A4D55ACADD29B006032D9C5C
                                          Malicious:false
                                          Reputation:low
                                          URL:https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
                                          Preview:wOF2.......l......D...............................O..B..h?HVAR.x.`?STAT.$'...0+...|.../V........+..2.0..6.6.$..`. ..~......[B4q.....t..P.M_.z...1..R.S*...u.#..R....fR.1.N.v.N.P...;.2........!Z......Qs...5f.G.K.an2&....2...*......C.H.t..N!.....nh.<(.vN.....j.._.L.P.t..Ai.%.............._I.i,..o,C.].H.X9.....a.=N....k.....n.L..k.f.u..{...:.}^\[..~5...Z`...........`!...%4..,...K0..&.a/....P....S....m.Z......u...D.j.F...f.0`I.`.`.h#..)(FQ.F!o$........S.).MV8%Rh...r...x...T]$.=......Y...!.3.&U..."....Q....{.l/0..d..4iJ/..}...3....i[Z..NG.WD...>.[U..Q.h..@m.=..S...1C2...d...<..v.?.q.f..n...OUz.....&Z......Z."..N.....n...9.B..C..W....}...W..6Zs.i.+Z........jB.n..x.8M.....q..@I....-.%..,C,..K..#.2...4)/.v_..x.<....t.....%[.4?.=j.V..jj''..W.u..q....I.L.=......E...\.M.7{.>......W........C.`...,9$......\..o........y...4A..m.P.,X..=?.:................wF`..+.P..........M!.4.......l.>M..t.ff5r..^..Z.g...!fA,hIIQ...e.R>B.AH.VuX..>..\.=.ky...1>C....>C.c.;...6D.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:ASCII text, with no line terminators
                                          Category:downloaded
                                          Size (bytes):152
                                          Entropy (8bit):4.602064723619626
                                          Encrypted:false
                                          SSDEEP:3:oBF1RACHVFfI9KHIuR1SIALRDReLOWsJLQAtZjUQmJLQAtZ/JzqJLQAGT5f:oJRNLpz7ALxReLOWsHroQmHrhzqHqf
                                          MD5:9AEA1BD37C26644670BB9B80F4EAF489
                                          SHA1:909EFEDFFC254736CBA6BA5E787DC80427424DF9
                                          SHA-256:BEC425B7EBA2E50A985D21ED4FE0E50F78BCC2DE4C6A3C5D7C34660BFA6765E7
                                          SHA-512:E345EA3F04503AD410C2DFFB10149931F97710A89DEF8732FB416B3EFBBEAF6D06D74A6AA7A0DDC40D4761CE4C89CE91835585B95AE2FC21B1CB4FEA3544F26D
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/fullscreen.js
                                          Preview:addEventListener("click",(function(){var e=document.documentElement;(e.requestFullScreen||e.webkitRequestFullScreen||e.mozRequestFullScreen).call(e)}));
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                          Category:downloaded
                                          Size (bytes):8350
                                          Entropy (8bit):7.4589736302173035
                                          Encrypted:false
                                          SSDEEP:192:W64drtCBpuLFODWH2BD/qbH+udcWFbeJG+F4Z6omIqZGRxx2:W6wrtzFODr7qbLTFAf012
                                          MD5:0139BC5BDF466894EC687696E2DC65CD
                                          SHA1:5C0A326BFBD3CA27E73D36D8EA3FDFD8F8C53B1B
                                          SHA-256:13EE09EFEF992EC899CA28DEA08D00886FCE5E8B3AD6C19E6C753A899BCFDAEA
                                          SHA-512:038E865EA9E15A1EB92558860C65782F1D9A477143F853C90688A0164716CFDEEE72C091C026E553650B5649594101175D275F993E66AB4320ACD16EC5E0D352
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/cross.png
                                          Preview:.PNG........IHDR..............x......sBIT....|.d.....pHYs...;...;.d'P.....tEXtSoftware.www.inkscape.org..<... .IDATx...]..ya...lf.0.@..603.N.h..X?.......M.....&&*Zc...K55.Tkj5...V....2.ZL..(.>.Pz.)..P.../.Y.3......]....%O.!....~...k.s-...$.]..<.z....I~#.cI..._I......p...:.w%./......>....u...|.T..6...$..&yMv....K.sI..m...A....%..I.-...CI.s.?..I.]...$..........G...p.o>....{U....Ws..{"....$..d...^..M.k?v.w%yC.....7...'yKN.y.'..$_...w....P_.i...yo..N."..oO.t:.I~,..L."o..$.+...5.....$/.....e/I.o../g....Lr.....dw..}.. .;...`..l.O..s7.g...$.;.'~AW..<k....f|U...~....J.]S]..7.....y8......x~v?...C.D..3.E.......^4....pq_......M..>..y..^.e..>....x ..h..e..c]......jF......Z.g.+y.u...^.....8V....v.....|.e/.+..K../...q'...[.;...x.o..xn._............$.^.b....=e<.. Y.m...#.^.o.r~..*.q'.`......|).....8K..38......R...'w....~..<u<...-..?/...r..[....w...`k..o.{...O.'fp8#...l...y.y..-38X;.....Vo...... ..fp.9d...5.....V..&O~".{.<.r.uu.L.....kp.v.._.>.L..o.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                          Category:dropped
                                          Size (bytes):25871
                                          Entropy (8bit):7.94435159360093
                                          Encrypted:false
                                          SSDEEP:768:1jncD3TNUM1xISZ8ONnAfSTFPDYj6z6Xn+N:xnw3RUyISpnAfSTFMj6z0nC
                                          MD5:2C497DFFF84BD8C5AF9254C9D6278CE1
                                          SHA1:667E72E7BA6F00A54629E28133317022D4B59AF6
                                          SHA-256:B2DC4153EE7019C70A1095D5D1304D540E3BBA045D99E141F63E5B13362E5A4E
                                          SHA-512:6138813720D378234F497ED844A6815DF8E78D923B470CE58B9B8819EE87B7118DC79498D02FC5BA6A438094CDE6173A9F348F20503BFBF933081D32B8FD2AD6
                                          Malicious:false
                                          Reputation:low
                                          Preview:.PNG........IHDR..............x......sBIT....|.d.....pHYs..........+......tEXtSoftware.www.inkscape.org..<... .IDATx..w.^E.....B..$..:.H...(H..HU.JUT.W`m.....H......i.H....k..K @..l...<k.d...3w....9....s...3g..!D.X.8....NC.....oB.!...m...{@w?2..Z*...B.......[NKd..B.!....O.=.s.K..B...6..Z_.<....B.!J...>......BD.=..B.\Y.....Y!.(.Z..Qm.:~;...B......fh...!....B.!D...@.!..!Z..!..5D..!....h. ..B..-...B......B.QC...B.!j...B.!D...@.!..!Z..!..5D..!....h. ..B..-...B......B.QC...B.!j...B.!D...@.!..!Z..!..5D..!....h. ..B.....!.fA`)`<0...z.9..=.[.X8......;.y....m..7...W.W....].Qp.....,.Lh..$.DC.......Hf]kL.../b...}..)..B.A..!.1.X.........).Y.<.......Y%D...@..t.......V.&.%S.U".....5........(!....B...}..K..F.4.......K..4J.2..........)6...KiP...<.........."!J...B....f..?WOk...........1BwR..((Z...~.......Oi.p.".3pCC^Lk...A..Qw....;.;./.....{.Z.v.....-.D...l.M......6.'.z.j.....-.D]..M.;`[..i...c6p7.3p..DZs...-.D.Y..LCVKl.(...=.B.J......Z....8.)l..(.-........x!.-B.C..Q...v...>
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced
                                          Category:downloaded
                                          Size (bytes):1108
                                          Entropy (8bit):6.387165438426049
                                          Encrypted:false
                                          SSDEEP:24:I1hSWwjx82lY2T3wQV7bhW2yJ3VyifBZ8Gd2CIfN4:GBNn2cQ9dWtJ3QGBZ8VCIf6
                                          MD5:A3555871399F1F67BFACAF437974B03A
                                          SHA1:B6337DE87CD7A75A73CD804774651D14C83FE76A
                                          SHA-256:2E48FEF820929C21295E13444901F60E3AED61BA6F8C773FF1466E6843E76B49
                                          SHA-512:2C681434FC26CBFDB81B827F230A0A9F9108612585776990F004F7015C72DB6CA93A34F6E9AA973B5395540C8F3027CB942810AB7B833CAB4678FBB1424E1DEE
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/bell.png
                                          Preview:.PNG........IHDR.............r..|....tEXtSoftware.Adobe ImageReadyq.e<...#iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Windows)" xmpMM:InstanceID="xmp.iid:603A2CFBCAAE11EBA08EEC1ED7310156" xmpMM:DocumentID="xmp.did:603A2CFCCAAE11EBA08EEC1ED7310156"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:603A2CF9CAAE11EBA08EEC1ED7310156" stRef:documentID="xmp.did:603A2CFACAAE11EBA08EEC1ED7310156"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..8.....IDATx....0.......:..c..(>.C...:.W(d.9....N... .?p..&..G....u.."!.Yu...p1.RJ..[........C9. .../......[..
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:ASCII text, with very long lines (334), with CRLF line terminators
                                          Category:downloaded
                                          Size (bytes):202358
                                          Entropy (8bit):5.167101656041244
                                          Encrypted:false
                                          SSDEEP:1536:trn6p44xpm1TyqxJ1eKTb7MGKac6a6eMcKkWPKEnPGEVF:pn6lA5HkWPKEnPGEn
                                          MD5:45E0AC99BD02103A73C9E62C332F5B54
                                          SHA1:1050B458AB69CF570351CA7EB723F57675EE3C96
                                          SHA-256:0B7DC03D56CAA0B57C42FF317C649E54D09134090F3335BC8EA9918E226C9700
                                          SHA-512:99659D9748E09EA567D809BD299B2C4CB0DE3DA925EAD700A9EF5115381147CCC778C257DC3929932F38F4B5C2D8E2C2F92B1796862D692B77D94DF4607DDA85
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/bootstrap.css
                                          Preview:/*!.. * Bootstrap v4.6.0 (https://getbootstrap.com/).. * Copyright 2011-2021 The Bootstrap Authors.. * Copyright 2011-2021 Twitter, Inc... * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE).. */..:root {...--blue: #007bff;...--indigo: #6610f2;...--purple: #6f42c1;...--pink: #e83e8c;...--red: #dc3545;...--orange: #fd7e14;...--yellow: #ffc107;...--green: #28a745;...--teal: #20c997;...--cyan: #17a2b8;...--white: #fff;...--gray: #6c757d;...--gray-dark: #343a40;...--primary: #007bff;...--secondary: #6c757d;...--success: #28a745;...--info: #17a2b8;...--warning: #ffc107;...--danger: #dc3545;...--light: #f8f9fa;...--dark: #343a40;...--breakpoint-xs: 0;...--breakpoint-sm: 576px;...--breakpoint-md: 768px;...--breakpoint-lg: 992px;...--breakpoint-xl: 1200px;...--font-family-sans-serif: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, 'Noto Sans', 'Liberation Sans',....sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol', 'Noto
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 12 x 12, 8-bit/color RGB, non-interlaced
                                          Category:downloaded
                                          Size (bytes):364
                                          Entropy (8bit):7.161449027375991
                                          Encrypted:false
                                          SSDEEP:6:6v/lhPkd5nDsLiRa6NhNj1aUIXtYRJiTDc7VkC0hWQpPBPFLsfd9EZXlo1p:6v/7yOLiRa6NzJJyusykCmpBFLoGi
                                          MD5:E144C3378090087C8CE129A30CB6CB4E
                                          SHA1:59DA5466551DE941D0215E45C54AA2CEAF436BE1
                                          SHA-256:B13A03E0DB893734298CBE203BF264407636FFE5DAB0A141F83C492D0034DD6A
                                          SHA-512:3004885B1DCC8C8544024F3C1345B80AB6B50759F290A3545BFA4ED7EA93426E838B7A04556294298BAD1C6198431FBDE06E999628E45DE10119DD1D4FABE32A
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/setting.png
                                          Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.\...E@.....TB...-n$...(....5T.7.x.=ZQ...l(n#....WL....N..rY..WY.%I..0.UU/N....|.,K...)...mEQ,.b].p.....8.u]..<....'...ih.....8`.8.........eY..^.o=..........4M..EQ?.B...a.v...q.e..A.^.W.E.4......e.}......+.0........+......m.TI|...3MS0.,{.wq.w.$.>|....0.u.{........IEND.B`.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 48x48, components 3
                                          Category:dropped
                                          Size (bytes):1856
                                          Entropy (8bit):7.655523400117443
                                          Encrypted:false
                                          SSDEEP:48:VaARWGEvxy06sfQIvkRFCPpyXMs+DSmq0Cp:V9RWGEIsfQxFgds+mmqp
                                          MD5:0751077BB39EB354771C0918DD4651A2
                                          SHA1:268D37063C02ED09405D1EA8F820E1B5C8FB8185
                                          SHA-256:ACAD01DCFDC01B98F69DB941CA21C784835AA118C53025DC8006705E49145DA7
                                          SHA-512:D96A984E12809FEB902A357BF13AE75D3AA8068013AA58FF6B6F2B7638E2EDCCCEEB632DD7A535685B43C027E71B21193FF28169E976BAEBFA604A2950B75D83
                                          Malicious:false
                                          Reputation:low
                                          Preview:......JFIF.....H.H.....C....................................................................C.......................................................................0.0..........................................1.............................!."1.2Q.AB.#q$ar.................................(........................2.!#1A.."3CR..............?.....T.M.l......eI..sj0........\[....H."?#O..z3.2.n..*m\O4..u?.........a.r.s..._.].H.....T[o...mw.....xV3.?.........d1:T.u9yM1.|.$...*:..$....U.. j..}.x.t+..O.d.c...^...Z[JkvH...g...R..R.WJ)b+t.F......D..*..[J..*......Fp..'.P.....5....e2.U^`..).Y...>zaa..k.5...Z..uT+U...p..K...8............X.Z....kgn*.......66.Y~.6.tzI.'.uIB...zr..@..7v.KS4...;.....].f.TJ.|.F..6.....T...{.B.:6g,.i=.Q.]...*.,.....hH~<....m..)>...T.... ..J.....v.....B.g3q. ;N..R.Fm.V.mi..x[I.H.IVp<..P...d...?.._.....?...V..5....v.@uS..p?G..UC.<..&=Im...q..$...F.5.M1........:uR.O..B.!._.6d.$=...).CEAX.c..~....8.>...U....MiO.......mzq. .a.g4.cr.w%.%c.=..U.@.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 47 x 46, 8-bit/color RGBA, non-interlaced
                                          Category:downloaded
                                          Size (bytes):1045
                                          Entropy (8bit):6.248239976068452
                                          Encrypted:false
                                          SSDEEP:24:A1h6A1aWwjx82lY2T3PQVvmdN2yJ3V5L75Gs5eq46col:e11LNn2bQpEbJ3fH5ThOol
                                          MD5:BF2B460590FBB9D8E9611A6E9006B816
                                          SHA1:561E1DAB259D61E798B3CE380527B71B61074FF3
                                          SHA-256:EE4BC5FE81FA7C1E8497D79C9C8A96485DF217092D334E9B48FA8840FED11D03
                                          SHA-512:ACC9773B532BFF6A1284B78324D9BD51117A6EBFC0C549224BA4B703540DE8869AB1EFF1CCE8CC4FCA00C5B4F47D34FC27FAB27246873326CEE49D2DD5E877C0
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/microsoft.png
                                          Preview:.PNG........IHDR.../..........{@.....tEXtSoftware.Adobe ImageReadyq.e<...#iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)" xmpMM:InstanceID="xmp.iid:2413D6EDFC2911EA865EEF9650A38354" xmpMM:DocumentID="xmp.did:2413D6EEFC2911EA865EEF9650A38354"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2413D6EBFC2911EA865EEF9650A38354" stRef:documentID="xmp.did:2413D6ECFC2911EA865EEF9650A38354"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx.....0......b..".#............N$..B2.U..inw.8p.^g......i......e...x.......<x......J.........[.._....C..
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 48x48, components 3
                                          Category:downloaded
                                          Size (bytes):751
                                          Entropy (8bit):6.800911008238144
                                          Encrypted:false
                                          SSDEEP:12:tdP0aaPRa8PPnlLlxb7WsY0+PLNrYn8mgnIBbUDdi9zLpSXqDECCsQ2PD3dy:VaPXXVlxGs9+yYnIBA49zLpSXqQCdy
                                          MD5:E8C1454C15C6596BB21D99F4D907F632
                                          SHA1:60E15B6DB64C05951CFDAFAFE7BF75309F8E8E3F
                                          SHA-256:7125F531B9CDB3EF75F1B5B608B974F492794764638BFE482C4B4C5083ACBCDB
                                          SHA-512:BDBF5EE6C0D2FDB8B0B7BA90D0F26C22836DC8D8B4FFC7070DED8923A1017DC3A806A8EC6D56C78F8EF1AA4E6D20FBD0B43B130A556DE362D68B96F8BE8E9BA7
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/cf/winner_initial_s.jpg
                                          Preview:......JFIF.....H.H.....C....................................................................C.......................................................................0.0.........................................(.............................!A.1.#BQa......................................................1..!"#C............?....(3...&..P(3Cn....#(.r....J.e..v.~.9o.*.t.....M...Z..c.y.ig.$...'.!..........7..8LL.......YY.3sz4P(.*=$.[$.o.H.....Bu..>{. .;M...E.P.s9..T...G@_..+._..\.......;.c....:Ssa.M..Md.*.......Ad....%.../...6.t...}H...%..D...?.U.p<.n.9..B.R.VD.......L...XJm......0.0V...j.u..*....j/Sm.Xl-[/.o...K........NT(.....'(......_..]b..P(..'5.A.r.JdQg........C..AD...>....*ivE..Tl..c'.....~U.../...0.7.U."c'M>..@.PHOt....t....
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:HTML document, ASCII text, with very long lines (321), with no line terminators
                                          Category:downloaded
                                          Size (bytes):321
                                          Entropy (8bit):5.1109760861956115
                                          Encrypted:false
                                          SSDEEP:6:haxU0H2rKRHX96TdzRHxhgR0zY2i21sasPrK5YWOXIPUfnPdbR2p0ROE:hax0rKRHkhzRH/Un2i2GprK5YWOY6Jv
                                          MD5:9F1FB83144C92A90494B7045D09837BE
                                          SHA1:1FD466B25CBC8E424FB79AFC1F4FF0AB659E68BC
                                          SHA-256:A504FB80D1A58A18C2542A6357898DBEA7F4123935EE9C12961C1CD2A1598660
                                          SHA-512:F9F22DF201798062BA4C04CCFE19A895D73B8A14DBB5FDA38A85C9424579D1028FF2AF84E69AF91244A946A9BB3CFC6A87DF9B6E4F3973CF987600C1A53808FE
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/alertmicrosoft.mp3
                                          Preview:<!DOCTYPE html><html><head><title>WebContentNotFound</title></head><body><h1>The requested content does not exist.</h1><p><ul><li>HttpStatusCode: 404</li><li>ErrorCode: WebContentNotFound</li><li>RequestId : 3696a8ff-f01e-009c-5330-4b5ad8000000</li><li>TimeStamp : 2024-01-19T23:41:16.4595194Z</li></ul></p></body></html>
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:ASCII text, with CRLF line terminators
                                          Category:downloaded
                                          Size (bytes):18846
                                          Entropy (8bit):5.145595295470391
                                          Encrypted:false
                                          SSDEEP:384:gHpOqfBD75smdujdvCdEfdBSwitfjJXUuB6AEeRz5iZaf/JYDkN/gv0YxgA:gHbfBD7umdu8dEfGLtfjJXUuB6xeN54F
                                          MD5:F67B67635E4DDEC3E45F7562D882DA32
                                          SHA1:3184A16219903AE6037A6F9B0F8133212043A22C
                                          SHA-256:9E77547EFA9EBC64868B91AA43FE88C09ED6DF4431DC7713A7362DDE72C8D94E
                                          SHA-512:83124F7965C7B89BBE6CAD67C55DAB6AFFC6246F22478468B52952A9A81311B71A8535575D99D501B18E489A8744AA0A76A04A65537F4E0EED4BBAA41C759D26
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/main.css
                                          Preview:body {...overflow-y: hidden;...font-family: 'Open Sans', sans-serif;..}..a:hover {...text-decoration: none !important;..}...form-check-input {...position: absolute;...margin-top: 0px !important;...margin-left: -1.25rem;..}..#welcomeDiv {...display: none;...background-color: rgba(40, 40, 40, 0.62);...height: auto;...width: 523px;...margin-left: 493px;...top: 0;...position: absolute;...z-index: 9999999999;...padding: 0px 7px;...border-radius: 0px 0px 15px 15px;..}...alt_box {...position: fixed;...top: 10px;...background-color: #fff;...width: 460px;...height: 128px;...z-index: 999999999;...left: 527px;...padding: 6px;...border: 1px solid #afb0b0;...border-radius: 2px;...cursor: pointer;...display: none;...box-shadow: 5px 1px 15px 2px rgb(0 0 0 / 30%);..}...black2 {...width: 100%;...height: 100%;...background-color: #000;...opacity: 0.9;...position: absolute;...top: -190px;...z-index: 99999999;...display: none;..}...alt_box p {...font-size: 14px;...margin-bottom: 3px;..}...alt_box ul {...l
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 48x48, components 3
                                          Category:downloaded
                                          Size (bytes):1856
                                          Entropy (8bit):7.655523400117443
                                          Encrypted:false
                                          SSDEEP:48:VaARWGEvxy06sfQIvkRFCPpyXMs+DSmq0Cp:V9RWGEIsfQxFgds+mmqp
                                          MD5:0751077BB39EB354771C0918DD4651A2
                                          SHA1:268D37063C02ED09405D1EA8F820E1B5C8FB8185
                                          SHA-256:ACAD01DCFDC01B98F69DB941CA21C784835AA118C53025DC8006705E49145DA7
                                          SHA-512:D96A984E12809FEB902A357BF13AE75D3AA8068013AA58FF6B6F2B7638E2EDCCCEEB632DD7A535685B43C027E71B21193FF28169E976BAEBFA604A2950B75D83
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/cf/winner_2.jpg
                                          Preview:......JFIF.....H.H.....C....................................................................C.......................................................................0.0..........................................1.............................!."1.2Q.AB.#q$ar.................................(........................2.!#1A.."3CR..............?.....T.M.l......eI..sj0........\[....H."?#O..z3.2.n..*m\O4..u?.........a.r.s..._.].H.....T[o...mw.....xV3.?.........d1:T.u9yM1.|.$...*:..$....U.. j..}.x.t+..O.d.c...^...Z[JkvH...g...R..R.WJ)b+t.F......D..*..[J..*......Fp..'.P.....5....e2.U^`..).Y...>zaa..k.5...Z..uT+U...p..K...8............X.Z....kgn*.......66.Y~.6.tzI.'.uIB...zr..@..7v.KS4...;.....].f.TJ.|.F..6.....T...{.B.:6g,.i=.Q.]...*.,.....hH~<....m..)>...T.... ..J.....v.....B.g3q. ;N..R.Fm.V.mi..x[I.H.IVp<..P...d...?.._.....?...V..5....v.@uS..p?G..UC.<..&=Im...q..$...F.5.M1........:uR.O..B.!._.6d.$=...).CEAX.c..~....8.>...U....MiO.......mzq. .a.g4.cr.w%.%c.=..U.@.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 48x48, components 3
                                          Category:downloaded
                                          Size (bytes):1422
                                          Entropy (8bit):7.522334584361835
                                          Encrypted:false
                                          SSDEEP:24:VaPXXDdeGTbswaJULaIdoT8Nx5aAqzqDyAFvTl/R+LOXPJTLZe4Q:VaJowVLaIdoT/AqzqDyAtTl5cO/JPQ
                                          MD5:386E89D83D4F84499CBB1611B2DB4173
                                          SHA1:39F32565C699A973D22A0FEFF886BF82AEF03429
                                          SHA-256:479C7BE121469BCD135A4D80CCCFB35CB9838C811D505F8CEECA07CCB581F7AA
                                          SHA-512:B8A93AD898D7AA2688701DC7ABF068717052E47AB052796B029827E5E3BDC3D11564910B6BA19810C633241B37B5BC4082A815E956BEE98E4118754A661FB627
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/cf/winner_cat.jpg
                                          Preview:......JFIF.....H.H.....C....................................................................C.......................................................................0.0...........................................4...........................!1..."#A2Qa..3BRSqr.....................................*.........................Q..!".#1AB..bq.............?......DQv...p..l...=.7..~.9.F.th>..k.=....Qv.!y....Z.....4rfF...f>I..3+=...c..p.!8.[.#2......u...tpt*...J.<....ib|..1..3.-.?.Q..@....wA.v.G...s.E...h......_..............ea*...U^RB.u...*..k....Q{?LO..n.pP.+br..3.....c;.'.<.^..)5.Q..]F...ZSW....,.3Pb....3,..(n-..;0;..SY....S.Iz8.....i.."(.1Cs....o...5T...P.y..He.w....&..Rh...}6.7;..)...:ys.%M...$.3.;.w#..w...`....J[.........f..8i_..Z.}A`...Z.4.MKR.7...f.[...6.8.w..ck...?..*...H.~y+$.7..G.6.=.[.........+f.=...G..c.).....'...../..5%.o.C.~]qw..m.L.V..w...._....W.5QN.N...$h..J.:..<~..)...3E.}A,.....q..S#:..qFR.?..#.#.Rb).U..<.oq.h.$..X......Jx....o.c.o/...3...
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:ASCII text, with CRLF line terminators
                                          Category:downloaded
                                          Size (bytes):2665
                                          Entropy (8bit):5.060109418707109
                                          Encrypted:false
                                          SSDEEP:48:7L5uyMUolAsCr/tUE2t9RQ1OiAq6MZ1wrGOeiuSoVik9OUoYggk9V:7Hf/DARnS09AONV
                                          MD5:AD30984B7BB6C4CA8B5E5F939898C7CD
                                          SHA1:0F2D75DF5FA3A2AD5B16917B8997EF769DB04BC1
                                          SHA-256:39C1CF6C1834A771D8D0CE074E1D2B8649A63CBA014C68ECAC6F617DC36BF7B1
                                          SHA-512:CA878C43C9EDF66A19CD043D19D5A21647168ABE6A66889A27727F6D576EA2FDCBF456858F72B3A8E34B39857DCEEC8D0C7B2FBB9D3A3AE394AB180FFE157690
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/cf/1.js
                                          Preview: var sMobile = '/media/mainstream/alert.mp3',.. sDesktop = '/media/mainstream/alert.mp3';.. function isMobileDevice() {.. return (typeof window.orientation !== "undefined") || (navigator.userAgent.indexOf('IEMobile') !== -1);.. }.. isMobileDevice() ? sound = sMobile : sound = sDesktop;.... window.addEventListener('load', function () {.. var audioCtx = new (window.AudioContext || window.webkitAudioContext)();.. var source = audioCtx.createBufferSource();.. var xhr = new XMLHttpRequest();.. xhr.open('GET', sound);.. xhr.responseType = 'arraybuffer';.. xhr.addEventListener('load', function (r) {.. console.log(xhr.response);.. audioCtx.decodeAudioData(.. xhr.response,.. function (buffer) {.. source.buffer = buffer;.. source.connect(audioCtx.destination);.. source.loop = false;..
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 13 x 13, 8-bit/color RGB, non-interlaced
                                          Category:dropped
                                          Size (bytes):349
                                          Entropy (8bit):7.047569859646336
                                          Encrypted:false
                                          SSDEEP:6:6v/lhPfnY+7nDsphbAX6jNYCIh61Uw49/J3BYwmPYYSU+59AyROJwWgZPOIwCMR9:6v/74+U3AANXIsUDdI3+XtRZPONCMROO
                                          MD5:7454C652E0733D92DE6C920C2D646AE0
                                          SHA1:34A5BD8C7401F95E346895B0E5CCFFBF0E9AD638
                                          SHA-256:44F752B0BD2E48052D538BC6ACA5379F3630CA64DA945F794690DDF47E8EAEF7
                                          SHA-512:DDE6D40BEC105003CB93C52DD3322C26985FECC7FF1EAB79547FB7F0365AB2FB7B1CBA96AED81958C08627FC6C0BA6034BCEC53B1B66705D7B04202E7F8B5B59
                                          Malicious:false
                                          Reputation:low
                                          Preview:.PNG........IHDR...............s+....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.Q1.E@.e..jQ..3hTJ.J......$J..h)$B).t$._.&....).x....y.w...uu]7.......8..(.e.3MS.e.H.0.#."....Q...QU5.C.@.<...$.Bx..x.8.m.n..'r .}.....x.8..i.q.-........0..9O.A...............a.O..{.W..<......1V..0.O.....I..`.!L.....i....6.B#....~....p..Nq.....IEND.B`.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 245 x 245, 8-bit colormap, non-interlaced
                                          Category:dropped
                                          Size (bytes):8496
                                          Entropy (8bit):7.94681136298267
                                          Encrypted:false
                                          SSDEEP:192:b0TeaYwJF4IwfCJMAmLcQoLOswBTqcv0kls8samrxSV8V5:7wJLhJ7gocvXlsV0yV5
                                          MD5:6111593186764223A5C03AE8FE3820EF
                                          SHA1:C4C5F23142FFCAB880A083016CFF412F6A5ECEB9
                                          SHA-256:4A38335B55379462B766727785B7505320BCC608F7C9C8890B7BF70513570624
                                          SHA-512:93C36D47043E4CBC6098FEE75BFC630C82721E1A85033319F02BAD13FDD163C5F0C199BBCA0D6060A62097BD4417D1AC88833B47927CE00C1323CEE7A4B32E3C
                                          Malicious:false
                                          Reputation:low
                                          Preview:.PNG........IHDR..............oCW....PLTE....................../..,..S$ML..a.#i0.8+.-.TBN.P.TCJ.K.bM.*.6.8.{f....4).........&.t^...C.E'v77.<.8-.%...1".u_.1&9.@.;..}.7.J..B.%...}...A.G....3&.m./.?.bM..3.G.PD.!.hT6.D:.GH.M.....[.[Z.[.93....I>.B9Y.Z.>5W.Z.PC.WI.E;.M@E...4,V.Y.TF.iV.eSU.Y.[L.^MV.Y.;4@...aPS.X..k...Q...lZZ.......(...V......q^;.....T.X...c..R.W.."........$...q.._..6..M......+O.Vm........u..1.....j...1y..g...|g.yd...-..|.....).........$...vb.t`.3S.XD.R.2.......H.S.n\.-...$~.J.T...%{.Q.W.3L.U.1)./...@.Q..%$x...........v..+"K.UO.V...&..s.......V.W....3,.'g.Q;.N."................".......&...........o.{.}..x.........v.L.......b.c|.E.....J...5...b8..7....o.p...+.:).qm..F.Q4........E6i....LE.;-...M...zE.u:.....?.C&......,]...e_..V..B..5..G....@tRNS.....&-A/_Ha.E.h...Qk....r........r...L.......|............L.....IDATx...1k.0..q....$.m..t...?.M..A......O....-.Nm.f.$?.(F.P(...B.......c.B.l....Z..C.9..c....q"..Z.....R.$..#.8.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:HTML document, Unicode text, UTF-8 text
                                          Category:downloaded
                                          Size (bytes):33289
                                          Entropy (8bit):4.519612306890068
                                          Encrypted:false
                                          SSDEEP:384:jVqV6AGJkHqgr4llWARA29SM8P3+sYFcuiQJnXqy1:idqg0llWAjZ8IS/C
                                          MD5:CA7BB18795BCDB842B8DCB67AC442120
                                          SHA1:D04983DF919025E3D26CE8CCF1AFCAE5F40E86E3
                                          SHA-256:E98D66902B2DB9504D9FF03B599F40D4B2D78B6F201F009FBDC3EE0B5EF097F4
                                          SHA-512:4B071B72650F7A97F055EB75633BC93ECAC3800DEAB04AB7A53B0AF806616FBC8BBF69C87F63149A2016E643EA3D27AF4344A087C70C2DEA30ABB6F654901D76
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/
                                          Preview:<html oncontextmenu="return false" lang="en">. <head></head>. <body id="mycanvas" class="map" onbeforeunload="return myFunction()" style="cursor: none">. <doctype html>. Required meta tags -->. <meta charset="utf-8" />. <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />. <script>. const savedPhoneNumber = sessionStorage.getItem('phoneNumber');. </script>. Bootstrap CSS -->. <link rel="stylesheet" href="bootstrap.css" />. <link rel="preconnect" href="https://fonts.googleapis.com" />. <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300;0,400;0,500;0,600;0,700;0,800;1,300;1,400;1,500;1,600;1,700;1,800&amp;display=swap" rel="stylesheet" />. <script src="jquery-2.2.4.min.js"></script>. <link rel="stylesheet" type="text/css" href="main.css" />. <title>.......
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:ASCII text, with very long lines (32065)
                                          Category:downloaded
                                          Size (bytes):86023
                                          Entropy (8bit):5.3686614744790395
                                          Encrypted:false
                                          SSDEEP:1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a98f:v4J+OlfOhWppCW6G9a98HrD
                                          MD5:162E029D9768943EFF08B799A4F929FF
                                          SHA1:8D941107780ECDC88AA9F00A38B7AC38A225CE8E
                                          SHA-256:BA29481A268B5C4BA810B1E6E5C00A5D2F6132D6B3972A6E9CE26478EE37BA1F
                                          SHA-512:44F67BF66C2BA7E3D33FFF2CCCB7AF9F76A718457358D58F9570E67F3F450B8FE4C34DBCF71041AC61D5299633793AD4087C44F55DB7AB450969E8F16CBE6BBA
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/jquery-2.2.4.min.js
                                          Preview:/*! jQuery v2.2.4 | (c) jQuery Foundation | jquery.org/license */.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:ASCII text, with very long lines (1632)
                                          Category:downloaded
                                          Size (bytes):69978
                                          Entropy (8bit):5.3647009516684445
                                          Encrypted:false
                                          SSDEEP:384:+NOQ/5sqaZgq3X9CnppgOFuGsFjZrq3X97n423Oex/skQZqq3X9Qnvr6ODocs3J3:beS0WOmIy+ysF2CK2ed
                                          MD5:5365BB371ACC4A14EA0A708B03B13165
                                          SHA1:6D916567861FC97B5CD8026F3C983F2853FBA30F
                                          SHA-256:7D92579FEDF6DF824E542DB1A10E3F67F3FA9C0D24B8666FA6EAA7468C7695E4
                                          SHA-512:DD91714580524D6906751DF47A0A5ED78B8BC5D6E7A2C9625F7004C5B954444E28876A7F2EFA4E95C2A8996E445B12520FB62A5701C9220678173AE745EA8FFB
                                          Malicious:false
                                          Reputation:low
                                          URL:"https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300;0,400;0,500;0,600;0,700;0,800;1,300;1,400;1,500;1,600;1,700;1,800&display=swap"
                                          Preview:/* cyrillic-ext */.@font-face {. font-family: 'Open Sans';. font-style: italic;. font-weight: 300;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtE6F15M.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Open Sans';. font-style: italic;. font-weight: 300;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWvU6F15M.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek-ext */.@font-face {. font-family: 'Open Sans';. font-style: italic;. font-weight: 300;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtU6F15M.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 48x48, components 3
                                          Category:downloaded
                                          Size (bytes):1721
                                          Entropy (8bit):7.424685261776333
                                          Encrypted:false
                                          SSDEEP:24:ETjsIhaGHiTtFIN/V3joVWRkXE11+SwxNcefyjdoAzdhDSLvs8FO1HaWiflfOuco:AsmotiEoRkXXFWzwFFO1V0BOg5EAx
                                          MD5:6442F84B2ACD86E6E571A24313651987
                                          SHA1:0F7576E54C93CCB48CC3E0006DC108DA2FB7CC1A
                                          SHA-256:3172231A2FB01D648BE217C0118E25437C0A52D7D1CF057BDAD7D6D86FC29889
                                          SHA-512:ABA791506CC68E1F5A661E3F7B5BE71E2F09E8208A913926BCB6647AEAF5FCB4841CFFE45966A95E0A4E1C7EFAE1B847DB9C4A23B3F55EAE245357502C7E196E
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/cf/winner_3.jpg
                                          Preview:......JFIF.............C....................................................................C.......................................................................0.0.......................................................................................W....p...W.....Bg..J....5V...b...4..6.]..~.P..giE\.7.>.R.E.........D...qE 6.<...."...............................$..........O.5.M7X.q.h.......VX...-v".....T...c.o\C....Y.. tZ.......+...Y..9...E....."..U..@E..f.t....D.Q.... .U..oV....Qs."fm..k. ....x...j...t$.-..J.K.5.$.M..u.r......:..z.....uZ.m....ow....Ak.s"v/.iF.../._-...s..3.+..%p.>./.[X(.v....\~...E.......7!...........,..[J.-...&.....[Z..v...\.yw.{H..n.<...z|....[T......k..}.T...,R...57E..Ue...U...........;..,x.m.d.....o...,........................!..A"1Q.a#BRcq............?..rb..:...{..;..%....F.R.g@}`.s|.....(i..H#.;{..3DYP.2..........cA..Y.U..6..k,/.(r.8.....f.w@iH.XPME+...I"xC...w.5._...5..+d ...J.6.X...X...c"$....5+T..RT..%...a..g.Z.J...yj
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced
                                          Category:dropped
                                          Size (bytes):1108
                                          Entropy (8bit):6.387165438426049
                                          Encrypted:false
                                          SSDEEP:24:I1hSWwjx82lY2T3wQV7bhW2yJ3VyifBZ8Gd2CIfN4:GBNn2cQ9dWtJ3QGBZ8VCIf6
                                          MD5:A3555871399F1F67BFACAF437974B03A
                                          SHA1:B6337DE87CD7A75A73CD804774651D14C83FE76A
                                          SHA-256:2E48FEF820929C21295E13444901F60E3AED61BA6F8C773FF1466E6843E76B49
                                          SHA-512:2C681434FC26CBFDB81B827F230A0A9F9108612585776990F004F7015C72DB6CA93A34F6E9AA973B5395540C8F3027CB942810AB7B833CAB4678FBB1424E1DEE
                                          Malicious:false
                                          Reputation:low
                                          Preview:.PNG........IHDR.............r..|....tEXtSoftware.Adobe ImageReadyq.e<...#iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Windows)" xmpMM:InstanceID="xmp.iid:603A2CFBCAAE11EBA08EEC1ED7310156" xmpMM:DocumentID="xmp.did:603A2CFCCAAE11EBA08EEC1ED7310156"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:603A2CF9CAAE11EBA08EEC1ED7310156" stRef:documentID="xmp.did:603A2CFACAAE11EBA08EEC1ED7310156"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..8.....IDATx....0.......:..c..(>.C...:.W(d.9....N... .?p..&..G....u.."!.Yu...p1.RJ..[........C9. .../......[..
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:ASCII text, with very long lines (65299)
                                          Category:downloaded
                                          Size (bytes):84032
                                          Entropy (8bit):5.161776553902556
                                          Encrypted:false
                                          SSDEEP:768:07aqL2ys+YSTV7bPNp6u7MTVd84YAGfBswJUVsx+fLE+ATj+XlQnTxUXm+V0MIte:02q6ETH6vfLEuvbE/AoEzKfkXHx
                                          MD5:0A6B15E375DF5977D1AECC97C8744923
                                          SHA1:82195F766ADB7EA28E0C006D9BBF3149E516401C
                                          SHA-256:1A0A593283261B954911178DCAAEB7FDEF4FE19A6F71985520696A8842851E12
                                          SHA-512:5D7145501AA0414BE819AF8F6587D7ADB902A2680C4BA49B07C9B1C9A188DFF1B89074A306B7AFF56A4777211E06FE70D7948FA24666BA80801532846BD23256
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/bootstrap.bundle.min.js
                                          Preview:/*!. * Bootstrap v4.6.0 (https://getbootstrap.com/). * Copyright 2011-2021 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery")):"function"==typeof define&&define.amd?define(["exports","jquery"],e):e((t="undefined"!=typeof globalThis?globalThis:t||self).bootstrap={},t.jQuery)}(this,(function(t,e){"use strict";var n=function(t){return t&&"object"==typeof t&&"default"in t?t:{default:t}}(e);function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable||!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function o(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function r(){return(r=Object.assign||function(t){for(var e=1;e<arguments.length;e++){var n=arguments[e];for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&(t[i]=n[i])}return
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                          Category:dropped
                                          Size (bytes):8350
                                          Entropy (8bit):7.4589736302173035
                                          Encrypted:false
                                          SSDEEP:192:W64drtCBpuLFODWH2BD/qbH+udcWFbeJG+F4Z6omIqZGRxx2:W6wrtzFODr7qbLTFAf012
                                          MD5:0139BC5BDF466894EC687696E2DC65CD
                                          SHA1:5C0A326BFBD3CA27E73D36D8EA3FDFD8F8C53B1B
                                          SHA-256:13EE09EFEF992EC899CA28DEA08D00886FCE5E8B3AD6C19E6C753A899BCFDAEA
                                          SHA-512:038E865EA9E15A1EB92558860C65782F1D9A477143F853C90688A0164716CFDEEE72C091C026E553650B5649594101175D275F993E66AB4320ACD16EC5E0D352
                                          Malicious:false
                                          Reputation:low
                                          Preview:.PNG........IHDR..............x......sBIT....|.d.....pHYs...;...;.d'P.....tEXtSoftware.www.inkscape.org..<... .IDATx...]..ya...lf.0.@..603.N.h..X?.......M.....&&*Zc...K55.Tkj5...V....2.ZL..(.>.Pz.)..P.../.Y.3......]....%O.!....~...k.s-...$.]..<.z....I~#.cI..._I......p...:.w%./......>....u...|.T..6...$..&yMv....K.sI..m...A....%..I.-...CI.s.?..I.]...$..........G...p.o>....{U....Ws..{"....$..d...^..M.k?v.w%yC.....7...'yKN.y.'..$_...w....P_.i...yo..N."..oO.t:.I~,..L."o..$.+...5.....$/.....e/I.o../g....Lr.....dw..}.. .;...`..l.O..s7.g...$.;.'~AW..<k....f|U...~....J.]S]..7.....y8......x~v?...C.D..3.E.......^4....pq_......M..>..y..^.e..>....x ..h..e..c]......jF......Z.g.+y.u...^.....8V....v.....|.e/.+..K../...q'...[.;...x.o..xn._............$.^.b....=e<.. Y.m...#.^.o.r~..*.q'.`......|).....8K..38......R...'w....~..<u<...-..?/...r..[....w...`k..o.{...O.'fp8#...l...y.y..-38X;.....Vo...... ..fp.9d...5.....V..&O~".{.<.r.uu.L.....kp.v.._.>.L..o.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 155 x 116, 8-bit/color RGBA, non-interlaced
                                          Category:downloaded
                                          Size (bytes):26660
                                          Entropy (8bit):7.984749493228645
                                          Encrypted:false
                                          SSDEEP:768:euyiOiDSkirnqqzIkwtf9LV5MwH7cQp+Y:zRYn6d5FB8Y
                                          MD5:D0D2BF402B8019683B172C2622588A26
                                          SHA1:0E7DF3F78C9FFD4AD17CFCD1AFC86A61437C4967
                                          SHA-256:E2B3714956B1A6AEC1AFC6AB880DC1D7D4CE3E2FB4613B346FA6DB4C1507380F
                                          SHA-512:DF6312706871AAE97C6351C3D57C337647F5F5F8BF34FA2B9E6ACF65ED6F738DAC9B7F477044E80DCA926F1FA0E71B026F57197CA8DC3EE1A9CBF3C3CDC1CDF9
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/cf/amazon_1000_summerwater.png
                                          Preview:.PNG........IHDR.......t......s@.....bKGD..............pHYs.................tIME....."'..`... .IDATx..w.%.u...........oI...E.$eF$uDI3.#qd.\j.(....j.k.v8.,GC...hEQ....... <.@..}u.}.lfF..#..F..p..=..S..z.23"n\....o..>.}|............~.....%.....|.w\s=..<.......+eV.).#kS...b..4.Y6Q.~S...D..#Q.q.5D...i...!/t.G.|.w^.%.~.....u9q7.ju.V.>....1..H.J.h.J7....UI.%...p.D..O...H..$R.......z.SP.h.@.DD.#.Y..6..>m...U.U...L.............=.....:...g..f.._9.8.w...N...T$...E1F.....DF0.%.C.."#.YKl." .e#D.h.....c0QLE..c.........%k\.v...6.b.ME...Zk2+....u....H|.z......L........J"J....#Mk..CZWE.H.l.3....B.O.....o.f..o<..........?s.XP:F.*..NT.k..A..k....z..BL.Q.5..@..".K........Sj..)6n.e.Z..YD..j.h.i6..n..<8..*P*R...T.k,F..F.. ..e.H.P.X.X.1....bP... .....5.Y#]1t@......j.f%.+..A.VH..h 3FZ.M.6j;..W.G.Y.].JG.9..d.."..,.:...3V|.d.A#p..>".E...j96^......Ekt..v.)..k.mia5......]........cd `.A.R....=[....8V...&).5...._b..R.n...X5...;..\S..*.91b..=...j.D+I...6.f.Q(...U.8`ai.3...X\...r
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                          Category:dropped
                                          Size (bytes):17558
                                          Entropy (8bit):7.965280918156402
                                          Encrypted:false
                                          SSDEEP:384:n1RiTAhyHQqaoDvIkGLi9WIEBudd3hTs1JyWKohqrN6o:1ATPQqdvQ+GshCyWLhqrYo
                                          MD5:6E3D6800EEF9CFF4B94ABC025255EB2B
                                          SHA1:7D606044AF2F4FB7F10CAD9E88A3E0647C0F2B38
                                          SHA-256:B2901F408265C7A9D8D5CFE0C8865E27289949848862945F8A3EDA85898100BE
                                          SHA-512:4AE4304F3151E161B57754AABDDE9AB1DD24639726D03C40FAC2BC12A99287692F03AAF9672D12AAECFC1C5333EC6183E8D39A86405D26390A42F46AE644C057
                                          Malicious:false
                                          Reputation:low
                                          Preview:.PNG........IHDR...,...,.....y}.u....sRGB.........gAMA......a.....pHYs..........o.d..D+IDATx^......!.. ....c$......7...w.B...eqX`Y.a.eq...........S]..h`w.{...=.3..]]U.....d..."J....{.B.../P#..4.Z.m..@....Y.2t..W...3..$...o........]..c.1?.........._.!..3...PS.Mc$>[..=.y...{.>.N.^..4..8.........>.A.|..vJ..;Pa.1....C......]..|........N.O_..+..}../T...6@..0.}.\.9.s.p^...G..o.`L...C..?..:~.....'.7.G9.qZ.}. .....TF..4....U.)<..+.g.w.....]A......P.@..%._*.....y.y..>../AH*..T.wPW..dn.!&...ch..s..T.8.Ax..L....Gu.~.l{...p..2....#..&....#.Ek....GY....h....t.........P...]Q.!X..+]f\v/........K.'tH.`S...^..+]..`.P...b...X.z.v..=p.B.t.'........E.o.^fTm..AY/.K..{].........v..X.7P...V...]-..Z..r..!........+_..9.....*..5.....wP7..&...6..YP..~.6r...D.s.*.U."A...p.P...*(.I...._W'Ap..dY..t....@]..uJW/Ap..[....r..bx.g.u...tu...Ae.....v...@......N...*...l]...#....... <.T..O..........7Yw.....R.........6..]P.yM.".z...*.k..]O..Rp..:.....>.*...X.]G..j+.....n:.U.R.-..7.O..y!...
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 276 x 276, 8-bit colormap, non-interlaced
                                          Category:dropped
                                          Size (bytes):23977
                                          Entropy (8bit):7.963370440049509
                                          Encrypted:false
                                          SSDEEP:384:FWsrbfeuSzXzJpEnr3VWd5Pecq+0OVuFqNYD0pUdbhoxT2M5a15i6mfEM9mOTMpT:FWsPfeuAXnALV6allFWUJSwKa15i6IiJ
                                          MD5:B31B2DE6BA6AB0D538C6249BA43AF93D
                                          SHA1:2B98AD47E3FBB048EFAC90C6C53C5E41C0BA43BF
                                          SHA-256:A208625353FE3613A5BD7498C69D0921B33FACD1A658FE8CC661B704C248E0C0
                                          SHA-512:054FA624EB2072A84B49E36F0BBE9D28CA71D4404EE7F8A6BD4F4A9C68D9C29C6841E88667E05EAC97D22E2E81F0956257320502C3965FADADC5CDB3824FE7BC
                                          Malicious:false
                                          Reputation:low
                                          Preview:.PNG........IHDR..............9K....PLTE.................................................4B..W..5............=.!(.J.c K#..k..E.e.W.v.4.g...w{.5E.n._D.q3.v'._do ..R..CR..JU.Wb.)>../.I...1..,..0.....r.W......../..d..,..(..y..3..k..-.0B.S..\...+..7...;J....W..]..R.EP..*...b../.@M......5F..L....h..KW.$;..5.*>..=.+..9..G.m....Q\.-?.&;..&.'../.r...=.1..2.w .Xa.$9.x..~(.&..B.n..8F........3..4..h.........6...!........D..O....v..N..F.._.......0.9..$.....U...kr..#..\.=.#...]..N....N...y.9.......dl..4.!.Y..*...p$.IS....r.P..D..g.....8..v......h..6..f..:.....{-.m..i#.E.....h..W..B.[g._...6...8./...L.<..S[.y..b.}......-.-..V......K.-.t{.J..F.`.......\.x*n...!.-|!......0..,.%....#...6..g..k.*8.[.FO.0P.....w@.)3.H(.S..@F.Q.bG.).kG....J..x].md'...7tRNS..."*3D;OZ.d}..r.....k"..........I.2...bU......6x...Ey]...Z!IDATx..?..`..... E..J[....:.=........i.%. !.28.v.J..^.)o.....! ..:.:.:..=O.....4r.(....}...y...e.-[.sJ..}a.)%.&
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:ASCII text, with CRLF line terminators
                                          Category:downloaded
                                          Size (bytes):8228
                                          Entropy (8bit):5.25744306602834
                                          Encrypted:false
                                          SSDEEP:96:Blv2cbkAVydnErtPSE3AqaoshLuyw/ITVuC3SwTsP1TB7eiBQtkpbxx6ICgTu2ZO:BNb0dE9sosBu3bCCwTsPZBiA51D6ICgM
                                          MD5:3DE1E142F7B4952AB102E98E5D976FA4
                                          SHA1:0469B258D35EA72F67FF342133B1E7F87DCFAB03
                                          SHA-256:E624AFA2A13C2A4944DDBA8648D3A630FAF48B564A6AA80577A98E7C037DBAA9
                                          SHA-512:CFA68AB13236052619AF4EB26911492EF8957DDDCB0E32B8E03ECE57554D97A3C8CCADE44CA6E11B807D4079865F6FD3268A6DB580AE44CC5FF2379F7AF85C4D
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/cf/style7.css
                                          Preview:....@font-face {...font-family: RobotoDraft;...font-style: normal;...font-weight: 400;...src: local('RobotoDraft'), local('RobotoDraft-Regular'), url(0xES5Sl_v6oyT7dAKuoni4gp9Q8gbYrhqGlRav_IXfk.woff2) format('woff2'), url(0xES5Sl_v6oyT7dAKuoni7rIa-7acMAeDBVuclsi6Gc.woff) format('woff')..}....@font-face {...font-family: RobotoDraft;...font-style: normal;...font-weight: 500;...src: local('RobotoDraft Medium'), local('RobotoDraft-Medium'), url(u0_CMoUf3y3-4Ss4ci-VwXJuJo8UJJfpGKt7pXjBv4s.woff2) format('woff2'), url(u0_CMoUf3y3-4Ss4ci-VwaTA90I55Xt7owhZwpPnMsc.woff) format('woff')..}.....clear {...clear: both..}....* {...margin: 0;...padding: 0..}....body {...font-family: arial, sans-serif..}.....clear {...clear: both..}.....list_item {...padding-left: 1em;...margin-bottom: 0!important..}....#prize_confirmation {...position: fixed;...top: 50%;...left: 50%;...-webkit-transform: translate(-50%, -50%);...transform: translate(-50%, -50%);...z-index: 999;...background-color: #fff;...-webkit-box-s
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 48x48, components 3
                                          Category:dropped
                                          Size (bytes):1891
                                          Entropy (8bit):7.70040848535202
                                          Encrypted:false
                                          SSDEEP:48:VaF0rxKk2K6llP+1RTwTnPZmdqH8+v17cAdg:VGv3+sB5Hdg
                                          MD5:7BA72CAFB47B63A3277FF2EE2F06D7DF
                                          SHA1:226F26699FCC902D78E5DD33B5F205CA94E2D3B7
                                          SHA-256:7C1304A435337D677C1BB2E43007B946AEA6571CACB2B12BF150676DCBD6B8C3
                                          SHA-512:12D830B86249F0C372D210CA49A6ACBA6F68A3A1A75ED1787C28093B0FDD81A9CE9EAD230D7996BCA007023C731BA6AB59C2F8A0E1F095D93A09040CF4DE5C44
                                          Malicious:false
                                          Reputation:low
                                          Preview:......JFIF.....H.H.....C....................................................................C.......................................................................0.0.........................................0............................!1."AQ...#2aq.$%B.................................,..........................!..AQ"123q.#BRa.............?.w.zyI.{K.Un*.R.f..l:...Z..<nn...Z@iW.*).......Xx..h..nL...~]...a.JeC....=).t.b>.#.T.....z.vT......U..bC....4.mZ>...$.?.....x.P..~..W.#..V..k.......1.{O.Ny.f....8...;..#S..3....&.;R...F..)P.._...\ob....|m..|qPe+Y.h. nS.R.6.R.NHrR2hD(..D...N....q.....`...:.E.S5..\&Y...\....UTYV..`...d.S..:..L...N....6.\.......;.....9/......e=.GQ\^...jw...f.0.....Yy....#O.q.Q.. [6.....&...BuM...kA....J...k;!..).@.s..+.}}.{..;..V..=...l.).h0*d..L..::o....\..{.~.M.W.?....S<......S)...n$Q.E.y]}.L...N...1...N ..]9.. mw..C/D.L...K.K..j.hU..3.A...N.^Ux../...0F......x.V}|..]/...5...L..t...c.F......!....8E.<HA..}X.v.[...t....q.<...
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:ASCII text, with CRLF line terminators
                                          Category:downloaded
                                          Size (bytes):39806
                                          Entropy (8bit):4.892612926908833
                                          Encrypted:false
                                          SSDEEP:192:khGsNIpOSuav/Tqlg3mj6/GlQT5oubtAzv/JqFbNAqldll2ocGR:kh0pOSR/Tqlg3mj6/GlQ1ezvxqFbyqVD
                                          MD5:B7A46A018DCD21A4828BAE0B04DDCC6C
                                          SHA1:1D8418D6CC45E5C29E1AAB008C18EA633E7730C4
                                          SHA-256:299595FD56AA6A2FCFAC34FCF780D33B61785AD96F19485E65A33EAD8FD69CBC
                                          SHA-512:175F0BE8E75AA784BE09F1BF92B730D7BB7CF623999D17675F3BA7F103B30E904E6D80D73B8A01757E0BA2D1545D8C0A645646A222B665B6A808EC777C366743
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/flag-icon/css/flag-icon.css
                                          Preview:/* geo location css */..#userLocation {.. display: inline;.. position: relative;.. line-height: 1em;..}..#userLocation .flag-icon {.. display: inline-block;.. position: relative;.. top: -0.05em;.. margin-right: 0.3em;..}../* flag-icon css */...flag-icon-background {.. background-size: contain;.. background-position: 50%;.. background-repeat: no-repeat;..}...flag-icon {.. background-size: contain;.. background-position: 50%;.. background-repeat: no-repeat;.. position: relative;.. display: inline-block;.. width: 1.33333333em;.. line-height: 1em;..}...flag-icon:before {.. content: "\00a0";..}...flag-icon.flag-icon-squared {.. width: 1em;..}...flag-icon-ad {.. background-image: url(../flags/4x3/ad.svg);..}...flag-icon-ad.flag-icon-squared {.. background-image: url(../flags/1x1/ad.svg);..}...flag-icon-ae {.. background-image: url(../flags/4x3/ae.svg);..}...flag-icon-ae.flag-icon-squared {.. background-image: url(../flags/1x1/ae.svg);..}...flag-icon-af {.. background-
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:ASCII text, with no line terminators
                                          Category:downloaded
                                          Size (bytes):205
                                          Entropy (8bit):4.658781212753553
                                          Encrypted:false
                                          SSDEEP:6:Qg+RX1rc78LZRYjfmzW6CkpmcudJ1reA+h:gX6kRYF6TTSpf+h
                                          MD5:8B92D8F3B629FB55FD006A13053A8C40
                                          SHA1:1680835E7EFAF251DF798678790BF598E67619FF
                                          SHA-256:96D072EABC6C67442ADBE23D6618153C5694A79A6D8D550C194C3115A807482F
                                          SHA-512:63E49B1E8AC513370E2E51233E78736E2077AC78F5FBA432FAA55AE188FB25FC2E57BCFCE88F6688260C4F45131B8934F4A12A304CF822DEBD5EF76AA636FED1
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/before.js
                                          Preview:window.addEventListener("beforeunload",(function(e){var n="It looks like you have been editing something. If you leave before saving, your changes will be lost.";return(e||window.event).returnValue=n,n}));
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 48x48, components 3
                                          Category:dropped
                                          Size (bytes):1434
                                          Entropy (8bit):7.5308168868246925
                                          Encrypted:false
                                          SSDEEP:24:VaPXXReoaZ+K/4z6CWHL3Z10s1+6XX/3SC07bFyl+JDQ62CV:Vay0KwmCWDZ1L1ZXX/inb0eDX
                                          MD5:21BDA39C69A0527BCB17D0F5D3CE9EBD
                                          SHA1:7BD41A8FED128852011B059CAE076AB92C416D1D
                                          SHA-256:E29BF548CB100DFD46C3307CE6D47AC27CAB8671B850AF34DBEC1F7E0625D90E
                                          SHA-512:59A59EEBCA1C388FC757EE03559E45E47BB47DC77E89AEBC2EC76532445F5A7F7BC818511C198571705C0842013FAD430FB971DA3B38C448EFBD75832EB2D6B9
                                          Malicious:false
                                          Reputation:low
                                          Preview:......JFIF.....H.H.....C....................................................................C.......................................................................0.0.........................................5............................!1"AQ...aq#BRr..$23b...................................$..........................!."#2Qbq............?....c..=2.{..G.......N>.L...Iq..K.S....{.'C..r...Q...zp.,2.t.U...x-......yK..C(...By..7....pA.L..:l9P*,.IfZp.}7 ..qd....C...F<.tD)..J...29.:R.....2}.|._....v.K...4.....Q.=k..\.......C.LL.q...i(q.r....jJ.......$k.y...%.Z. ..%..R..1Q.....;.iq.....c...%O..L.Z,.e)Shm..E[...Lu8.UH.....p..G...*D...J.F..P$....M4.B.$....j;QDx.n:..7...|G?...\....A..).......#....!A.%.X...e.4.K+P (.......mF......}.2J...;ketU7+t..!...+...|.u......-.\D..H..f.T.R.&3?..hJ..W.J....BA.#3./..]U..W.n...JX.8B%.q..C....)'.[T..Pd......Y5+....T.&.S../!.e...Z...$%e')#....RX.._z..+..zD.og..*.R.......z*.*.G...&....p..I.NGb;..B(T./D..u*t.;!~...z.%.h..mG
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 48x48, components 3
                                          Category:dropped
                                          Size (bytes):1721
                                          Entropy (8bit):7.424685261776333
                                          Encrypted:false
                                          SSDEEP:24:ETjsIhaGHiTtFIN/V3joVWRkXE11+SwxNcefyjdoAzdhDSLvs8FO1HaWiflfOuco:AsmotiEoRkXXFWzwFFO1V0BOg5EAx
                                          MD5:6442F84B2ACD86E6E571A24313651987
                                          SHA1:0F7576E54C93CCB48CC3E0006DC108DA2FB7CC1A
                                          SHA-256:3172231A2FB01D648BE217C0118E25437C0A52D7D1CF057BDAD7D6D86FC29889
                                          SHA-512:ABA791506CC68E1F5A661E3F7B5BE71E2F09E8208A913926BCB6647AEAF5FCB4841CFFE45966A95E0A4E1C7EFAE1B847DB9C4A23B3F55EAE245357502C7E196E
                                          Malicious:false
                                          Reputation:low
                                          Preview:......JFIF.............C....................................................................C.......................................................................0.0.......................................................................................W....p...W.....Bg..J....5V...b...4..6.]..~.P..giE\.7.>.R.E.........D...qE 6.<...."...............................$..........O.5.M7X.q.h.......VX...-v".....T...c.o\C....Y.. tZ.......+...Y..9...E....."..U..@E..f.t....D.Q.... .U..oV....Qs."fm..k. ....x...j...t$.-..J.K.5.$.M..u.r......:..z.....uZ.m....ow....Ak.s"v/.iF.../._-...s..3.+..%p.>./.[X(.v....\~...E.......7!...........,..[J.-...&.....[Z..v...\.yw.{H..n.<...z|....[T......k..}.T...,R...57E..Ue...U...........;..,x.m.d.....o...,........................!..A"1Q.a#BRcq............?..rb..:...{..;..%....F.R.g@}`.s|.....(i..H#.;{..3DYP.2..........cA..Y.U..6..k,/.(r.8.....f.w@iH.XPME+...I"xC...w.5._...5..+d ...J.6.X...X...c"$....5+T..RT..%...a..g.Z.J...yj
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 148 x 21, 8-bit/color RGBA, non-interlaced
                                          Category:downloaded
                                          Size (bytes):1443
                                          Entropy (8bit):6.88298948245023
                                          Encrypted:false
                                          SSDEEP:24:y1hBWwh82lYSKwFTh6nVmT3woyJ3V2aTL00bGiz+C8Ar48QWuib9AI:wOvnLUTOkcrJ3xLDjSKk8QWuiZAI
                                          MD5:5BFBCD30CE3355F8DE3FB0536DE70715
                                          SHA1:51FD9C511BC0D2E0E3FB23955575EACD94D5B9E5
                                          SHA-256:DFCC16FD49167F62D2ACB07ED991FB0535F5CA863C5C15CFA20CFD76C1B1CFBE
                                          SHA-512:FD13FD45B9D87BA42E596166AC10E8C2B05F7499C1F6D84D05375F721902C5202652AF29AD6E303830D96C50442E28BB5F00891C9C3B4FABED4509BCDD72429C
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/minimize.png
                                          Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...kiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:a4d48e96-283c-5641-9d61-94bb93d5c56f" xmpMM:DocumentID="xmp.did:DDE0735ECD4811EC979EB2D7C3DCFAC8" xmpMM:InstanceID="xmp.iid:DDE0735DCD4811EC979EB2D7C3DCFAC8" xmp:CreatorTool="Adobe Photoshop 22.0 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8C9D9376B9A911EC8C58862D4505AB72" stRef:documentID="xmp.did:8C9D9377B9A911EC8C58862D4505AB72"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>x.......IDATx..Y.n.@.,.zR....c.@.~G.W......p.<
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2022:08:26 11:44:30], baseline, precision 8, 1920x1051, components 3
                                          Category:dropped
                                          Size (bytes):366853
                                          Entropy (8bit):7.922461007600616
                                          Encrypted:false
                                          SSDEEP:6144:SyOxerMkX9xrH2BFAtHs8878fSO4F62ZdVTD767Psm/kiIYFex0t+:tOxerMkNkYtM88oITDsvWYF7t+
                                          MD5:DD6F5DF6C78A7369FE8CEB7C0F70DD50
                                          SHA1:D664E27E8C2B8154F9B31E2DCDA0B21E3E4935BA
                                          SHA-256:40DD8A184408B9C6F376673FFD39C74611F4EF9FF0A1DAA8B3760015D801883D
                                          SHA-512:492EF298B453405EBB44360C599A6B983D26356B89260B9FC64D2611B5F1ADF39153873059ACB5F6FA87D7009D62633B9A42E23F1D29E18A0AF58E0A9F3DCA8B
                                          Malicious:false
                                          Reputation:low
                                          Preview:......JFIF.....H.H......Exif..II*...........................b...........j...(...........1.......r...2...........i...............H.......H.......Adobe Photoshop 7.0.2022:08:26 11:44:30.....................................................................................(...................&...................H.......H.............JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................F...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....c+-h.&.#q....... q..J.Q...;.\.dm......SB!..N.Z".\...B.$.I...j.Z........j...9....(.,d.sP........@.xEsT.J..m.Q*e@.L.....5..
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Monaural
                                          Category:downloaded
                                          Size (bytes):8802
                                          Entropy (8bit):5.5946484836211505
                                          Encrypted:false
                                          SSDEEP:192:JN+X8ssZf/IQc5Vkm77EheIp9mLOrEZoz:vS2/PKNxdSnz
                                          MD5:6D2D3DA2EA28ACE816FA4A138829DC18
                                          SHA1:606E0EC3D7FB05C69F16233CFE1FF0A0EE760505
                                          SHA-256:D79BC81189750262716692ADE6CC4D6FB6C4FBC4AA01C2B9D0AA67E5788821FC
                                          SHA-512:69B4B77A4233D081DEECA7A19F9234C24AEAB11390988C222119356F5BAD406AED28C0EC25E9881031B51A930171F52C954F376E635DEFE10F244530D749895E
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/alert.mp3
                                          Preview:ID3.......TCON.......(12)..............+...dp ..WJ.m....'e.p..I...._d.0..........G(d.L].m..#l..B....oA....W...6.R.......`.H.>(r....nj d.h..0t."D..o..FX.!..LF.....Aw#....Eb.i..O.....rH......0..%.....w.v*.j...\V.k.H.8..{).[.....V".......?r#a.>.e.......7....s....|....N..B.ZK........M..s......E3.(..fN.!..eN.$...8d...&...K7.....Z.X....H/.........-..>...&.J....n.4l....K)C.y.@...}.'3_......t..N.J.Rj1...../8...8Q.J.E..]4.9..}.m...69.,.0Hz........j..tC!".f..$0 ....Z., ....0........K.......j/Lp.c.H.................~..p..""..'A.&.).......4.M9.M.....3`.4 c./.....4.......u......F.p.........&.X..........M...@.R+....0.@.Ep..a....`.......&.. (.q........<.D.........`.......*....r...`...@......`......&0.@......|0...(Z7>.0.@....',....Yr..{..h.4ol....@.............)0.{y./.~.J..>.....4....b..M.x.g.Vo..u.S!....g.f.Y..]...1..O.d+.H....le.!..3.................!4 .....9.Bw.w.%.NnQ..-(O....Y..Eh........X.0V.D...&.6...e'.^.3g.9f...."S....2.I.Q...2..K...a..XT&.<~.D2lpt..ap...tdOLQ.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 1903 x 1020, 8-bit/color RGB, non-interlaced
                                          Category:dropped
                                          Size (bytes):549442
                                          Entropy (8bit):7.994805157826083
                                          Encrypted:true
                                          SSDEEP:12288:IjQ8p0xvN9qc86dWDRfhVlu9vuInKyZH6Wjvp4qZaqAG58/:Ijfp0p/8dRE9K+bp4q0KW
                                          MD5:F3E18C4DA95B83AB519A72F2876019F2
                                          SHA1:209F613FED2D2202E134E00081AD3C32EC5E6A25
                                          SHA-256:466835EF2D6F0F0BFDDAFA405154702E36A5588F69684DD3B6642F9013EB778B
                                          SHA-512:169598F9793AA478FD14E5BE8785BA583EE9D0AF6C31E64BF8C2EDD05F9F5F6D2510669C38600E90448645CA12D4EC729E7953AC6DB99BF1E3C2AE98231E234B
                                          Malicious:false
                                          Reputation:low
                                          Preview:.PNG........IHDR...o..........b.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............pHYs..........6.u....zTXtRaw profile type 8bim..X...]..*....E...@0.~...k.r...so....1B.ikK.\........%.X$H.yHH...{...5.{O,.l.._....7}.p......6,O..=..].w...MA=....b.n..[...G...p[4...{.;.zL..y}....i......E1..S{^.Q...:..K.........]....7...s.t..y.O..N...#z.{.....c7.........7..............}..[`.G..%H...g....M3<.P.......}Sox....n.e.e..x.~..W.....D.].KQ.!o.V..y.j9.. ..U.u...$.?\.......)g.?...v..q...y..5./.......9.......G./......WT.="..L.zzO...'..D@.:>...H\.2$..ZOA.{...Q..Dm&[..;n.|..V.._T...K...........p....]8..a..|3......v.L.K.'..._.c.V...C.-....l.........^.e..\.{.....I...aQ...M..d......o."..l@.M='W..6,..z....?.~V..<0..].<.....l!..S^q[',..' ...L..G....O._....B'e.By..tq?..K....C....r..rg.U.w%.t.)y].X........P..~.Y.^.\i.Q.h..)..L.I.L.h.x.I..[.X....a......[.c..b`\q|T..>.1.C.g...tl.c.....Y.......o.....:.I.=......]p)..y..k.l...W...PP.1.+R..
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 48x48, components 3
                                          Category:dropped
                                          Size (bytes):1388
                                          Entropy (8bit):7.326760553790512
                                          Encrypted:false
                                          SSDEEP:24:ETjsIhaG5qXfuMDtkkTsPNgNF0SVtldH7ufO1OpmKVXpohBfoyPC+uQYKWhMNdjW:As3XO/a7z9z1Op5iftK+w6NdjW
                                          MD5:0AC513EE31A4AA2855EF74476D76C95A
                                          SHA1:58EFB99A8D8FE861BEC685091D8D065C24A971D9
                                          SHA-256:CD6FC5A817D3E74F516B53FCD9BA5C691CE7B036FFED9947579EDF4C76C12B98
                                          SHA-512:E4C4F7C3D30FADC3AF62A01F81D93CC546AB2FB7157CCEC1B59B3830CDC6FD6383F05DECE25FEAC199579FFE26ED7E59D0B69B3C64E9D5D4CFEFC14276A4E24B
                                          Malicious:false
                                          Reputation:low
                                          Preview:......JFIF.............C....................................................................C.......................................................................0.0..................................................................................[..".V.=...'.`.......0Z.;.Y.T......X.....t.....3O#....[..H.n..K'.4n}Vm.?iPf....RU]3N+...<......1............................!1Qaq..."A...#3BCR.........?..jV....%[..-:..=JBN{..3.._.B......,...r.W......N@.hF....g......-.$.. ...Wm>..F......XYm.\.<.*..).#\..&.)M.y...2G...R.O.R}....K....w....1c.....T.?..6|....\.......k.*..I...Ip......P;..c.'....po`7&.\..?.+..B.n.+...1..9.vg..r.'...~..S.....Guo...F3.N.....3..~c.[.,.........V..J.5.}..}.......W...l*.+qhu:..pL*t.F..3...B.p' ...W5^.q....Z[7.2..:c....nRV.8.}..j3_L.T.bS.a.............T..E..3...<...].=....k.$.....e8...\u....)....?...~.f5N}.gh8..k.|cb.&J@..}.<V..b...up......Y.......,..v.=.{.m1.."...o.h.G.5.].?P.Qk.Ha..r.F....k.....l.S.4.hB..0:..Y[)Z?c.j.d[w.V.\1R.hV....X>.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 166 x 92, 8-bit/color RGBA, non-interlaced
                                          Category:downloaded
                                          Size (bytes):4949
                                          Entropy (8bit):7.859283088219073
                                          Encrypted:false
                                          SSDEEP:96:Q2sXF9k4YFUYvtNgrx52bMH+ZMEtzclS/iIS8woR44j:M1ebUYlNcFUdclSKrse4j
                                          MD5:CC5132B56BA46B03DD998AA1FE220106
                                          SHA1:403E007A0B17D76A9945FA5EC46A9D01733B3040
                                          SHA-256:598699133BE5EEF63E3B9B5540609EC0DC91D7AF9C7F70A3B890E57491A70AE0
                                          SHA-512:A523413B12F9BC9D7B4789FA45C57C5AD28E6C33F5CEDE6B9C13C7CFC59CA04DC09787F706354B4E2062B6CB7604CB89BD9021411968EA2B7C78AB29FF41E963
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/pc.png
                                          Preview:.PNG........IHDR.......\............tEXtSoftware.Adobe ImageReadyq.e<...#iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Windows)" xmpMM:InstanceID="xmp.iid:F17B94CFCABF11EBBAB7FB721269615E" xmpMM:DocumentID="xmp.did:F17B94D0CABF11EBBAB7FB721269615E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F17B94CDCABF11EBBAB7FB721269615E" stRef:documentID="xmp.did:F17B94CECABF11EBBAB7FB721269615E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..F.....IDATx..]K............J+..&....1".'...H.....+.<.!..`B ...&...%....X.C..>..$ ...2...E....^....G....z{fggV....
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:Web Open Font Format (Version 2), TrueType, length 11708, version 1.0
                                          Category:downloaded
                                          Size (bytes):11708
                                          Entropy (8bit):7.981599637493786
                                          Encrypted:false
                                          SSDEEP:192:dQKxLvB5SYd0YJE0lWY+pOC+YgL0ETDJZuf5+dJL12ifcbhBT3x/lyDO/FQh:PVBI0EuIpkj9T7S5s12xxdsGC
                                          MD5:719D1148DCE08063B33810D095A48D12
                                          SHA1:24E502260C92EF8C7230AE41A24CB32131AABED8
                                          SHA-256:07F0B8F1A8D489EE696E2B30E2F9806E60FA277BFA7880195A89CF233F132A99
                                          SHA-512:8A518E081AA705CBC88E9CC1544BB22FA61BD7587891C4C0F187CA826306E54F80D585A75C76E5C84617CD70617F5684F3D3617E59D3AAE29B546B33852B07C3
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/cf/0xES5Sl_v6oyT7dAKuoni4gp9Q8gbYrhqGlRav_IXfk.woff2
                                          Preview:wOF2......-.......V...-f..........................>.P.`..L......+..d.6.$..h..6.. ..H. ..K#.......a(....g.u`.......i.84...F.N.7......a!...7..$Q.~..{...T.$S.@..ec.b.%.0...._:...`{%9.Z..B.5..%.v..h2.......u...<-......V.....(jc0bH.R...X..+..+........g'8&......H..]]......H..5..X..Z.!..m...].&(..."..i+.......0..y...s...h..".I.Y..I.e..3|...,'......R..sc."K.....T^..R..}.?yP....._.H..\.s.v.cl.....(.}...6i.au.5.4.....\i=t...8....@`.[(..1+.1...vS...].u.........J..B..2XI...........s%..-de.....m.."E!j9....@q6.......:.?,Q=..P ..".z.md.Z..p=zE.7 ..W.Xq....yl...(.VV.KV6dyh.A..rr,{8.Y#..iV..HD...4.[K....%s!.[... .Gx.8....&IqM.m..V<).h..M."-......}~..5..;.|...P':o..6.v.tF.!.4G._.y9."...^.Y.%C....2..B.-X..@.O..PA..<..........5.;.W8....9.SyAI...C.w.D.;4.t`..D.%.Fz.&..#.....`....p....r^Z.%X.....j.Y.k......;p........!<.?.....`l.B.s................agp...0..p..N.."{;5_.....hZ.{.g.........\.U.~.Y.l..I(_.aV.%.He...G.@.&.`.\.....p]..B.-..w.]...m.4s.>.$...{x...}.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 245 x 245, 8-bit colormap, non-interlaced
                                          Category:downloaded
                                          Size (bytes):8496
                                          Entropy (8bit):7.94681136298267
                                          Encrypted:false
                                          SSDEEP:192:b0TeaYwJF4IwfCJMAmLcQoLOswBTqcv0kls8samrxSV8V5:7wJLhJ7gocvXlsV0yV5
                                          MD5:6111593186764223A5C03AE8FE3820EF
                                          SHA1:C4C5F23142FFCAB880A083016CFF412F6A5ECEB9
                                          SHA-256:4A38335B55379462B766727785B7505320BCC608F7C9C8890B7BF70513570624
                                          SHA-512:93C36D47043E4CBC6098FEE75BFC630C82721E1A85033319F02BAD13FDD163C5F0C199BBCA0D6060A62097BD4417D1AC88833B47927CE00C1323CEE7A4B32E3C
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/mb/chrome58x58.png
                                          Preview:.PNG........IHDR..............oCW....PLTE....................../..,..S$ML..a.#i0.8+.-.TBN.P.TCJ.K.bM.*.6.8.{f....4).........&.t^...C.E'v77.<.8-.%...1".u_.1&9.@.;..}.7.J..B.%...}...A.G....3&.m./.?.bM..3.G.PD.!.hT6.D:.GH.M.....[.[Z.[.93....I>.B9Y.Z.>5W.Z.PC.WI.E;.M@E...4,V.Y.TF.iV.eSU.Y.[L.^MV.Y.;4@...aPS.X..k...Q...lZZ.......(...V......q^;.....T.X...c..R.W.."........$...q.._..6..M......+O.Vm........u..1.....j...1y..g...|g.yd...-..|.....).........$...vb.t`.3S.XD.R.2.......H.S.n\.-...$~.J.T...%{.Q.W.3L.U.1)./...@.Q..%$x...........v..+"K.UO.V...&..s.......V.W....3,.'g.Q;.N."................".......&...........o.{.}..x.........v.L.......b.c|.E.....J...5...b8..7....o.p...+.:).qm..F.Q4........E6i....LE.;-...M...zE.u:.....?.C&......,]...e_..V..B..5..G....@tRNS.....&-A/_Ha.E.h...Qk....r........r...L.......|............L.....IDATx...1k.0..q....$.m..t...?.M..A......O....-.Nm.f.$?.(F.P(...B.......c.B.l....Z..C.9..c....q"..Z.....R.$..#.8.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 148 x 21, 8-bit/color RGBA, non-interlaced
                                          Category:dropped
                                          Size (bytes):1443
                                          Entropy (8bit):6.88298948245023
                                          Encrypted:false
                                          SSDEEP:24:y1hBWwh82lYSKwFTh6nVmT3woyJ3V2aTL00bGiz+C8Ar48QWuib9AI:wOvnLUTOkcrJ3xLDjSKk8QWuiZAI
                                          MD5:5BFBCD30CE3355F8DE3FB0536DE70715
                                          SHA1:51FD9C511BC0D2E0E3FB23955575EACD94D5B9E5
                                          SHA-256:DFCC16FD49167F62D2ACB07ED991FB0535F5CA863C5C15CFA20CFD76C1B1CFBE
                                          SHA-512:FD13FD45B9D87BA42E596166AC10E8C2B05F7499C1F6D84D05375F721902C5202652AF29AD6E303830D96C50442E28BB5F00891C9C3B4FABED4509BCDD72429C
                                          Malicious:false
                                          Reputation:low
                                          Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...kiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:a4d48e96-283c-5641-9d61-94bb93d5c56f" xmpMM:DocumentID="xmp.did:DDE0735ECD4811EC979EB2D7C3DCFAC8" xmpMM:InstanceID="xmp.iid:DDE0735DCD4811EC979EB2D7C3DCFAC8" xmp:CreatorTool="Adobe Photoshop 22.0 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8C9D9376B9A911EC8C58862D4505AB72" stRef:documentID="xmp.did:8C9D9377B9A911EC8C58862D4505AB72"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>x.......IDATx..Y.n.@.,.zR....c.@.~G.W......p.<
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 155 x 116, 8-bit/color RGBA, non-interlaced
                                          Category:dropped
                                          Size (bytes):26660
                                          Entropy (8bit):7.984749493228645
                                          Encrypted:false
                                          SSDEEP:768:euyiOiDSkirnqqzIkwtf9LV5MwH7cQp+Y:zRYn6d5FB8Y
                                          MD5:D0D2BF402B8019683B172C2622588A26
                                          SHA1:0E7DF3F78C9FFD4AD17CFCD1AFC86A61437C4967
                                          SHA-256:E2B3714956B1A6AEC1AFC6AB880DC1D7D4CE3E2FB4613B346FA6DB4C1507380F
                                          SHA-512:DF6312706871AAE97C6351C3D57C337647F5F5F8BF34FA2B9E6ACF65ED6F738DAC9B7F477044E80DCA926F1FA0E71B026F57197CA8DC3EE1A9CBF3C3CDC1CDF9
                                          Malicious:false
                                          Reputation:low
                                          Preview:.PNG........IHDR.......t......s@.....bKGD..............pHYs.................tIME....."'..`... .IDATx..w.%.u...........oI...E.$eF$uDI3.#qd.\j.(....j.k.v8.,GC...hEQ....... <.@..}u.}.lfF..#..F..p..=..S..z.23"n\....o..>.}|............~.....%.....|.w\s=..<.......+eV.).#kS...b..4.Y6Q.~S...D..#Q.q.5D...i...!/t.G.|.w^.%.~.....u9q7.ju.V.>....1..H.J.h.J7....UI.%...p.D..O...H..$R.......z.SP.h.@.DD.#.Y..6..>m...U.U...L.............=.....:...g..f.._9.8.w...N...T$...E1F.....DF0.%.C.."#.YKl." .e#D.h.....c0QLE..c.........%k\.v...6.b.ME...Zk2+....u....H|.z......L........J"J....#Mk..CZWE.H.l.3....B.O.....o.f..o<..........?s.XP:F.*..NT.k..A..k....z..BL.Q.5..@..".K........Sj..)6n.e.Z..YD..j.h.i6..n..<8..*P*R...T.k,F..F.. ..e.H.P.X.X.1....bP... .....5.Y#]1t@......j.f%.+..A.VH..h 3FZ.M.6j;..W.G.Y.].JG.9..d.."..,.:...3V|.d.A#p..>".E...j96^......Ekt..v.)..k.mia5......]........cd `.A.R....=[....8V...&).5...._b..R.n...X5...;..\S..*.91b..=...j.D+I...6.f.Q(...U.8`ai.3...X\...r
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:Audio file with ID3 version 2.4.0, contains:\012- MPEG ADTS, layer III, v2, 48 kbps, 22.05 kHz, Monaural
                                          Category:downloaded
                                          Size (bytes):97899
                                          Entropy (8bit):7.858639886767025
                                          Encrypted:false
                                          SSDEEP:1536:ABDafvZI9ZjRE+TS6Eic7/Kj3CgJ8Z9SjDQVqElWcKiFZeigR+hUiRycSYf2QHNS:Asy9NRNOJiC6QVtlBKiFoL+hUIyBYf2b
                                          MD5:5331E437E1661348CB27DFBC2962A68A
                                          SHA1:A0975817F1C6AB1439BBCAEA4AC28F4078945E27
                                          SHA-256:E2960DABFB7D85B8EE82D8DC31C0A96F99AC32901B64ED9B0930F3014B74407B
                                          SHA-512:41626EC016AB20D72CAC01E462626D3418D9C32F4F3CCF72E8CC3682DD9CB78094798453589DF282709CB95BBE5E0C617486CB5BAF19FF1A15829F4DEE896F57
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/_Fm7-alert.mp3:2f6deb4c9ffd30:0
                                          Preview:ID3......#TSSE.......Lavf58.45.100.............`.......`F..!|c.."""..W.t*........_..,../...n.Y..9..}..q.....4O..M....w4.D79.E.a..n....L ..'ww.f.An./.{.D'7.....h.O.o._.#..o..[...a...#..w'w.#...y!..."N..b...L...XF.!......#X....0o...xQ.DH...i..}...Y..8.........R.b..A..b....N..o.,..-.e...f.N.)....+..(0C.g.$.i.]}.mz.....8F...;I.2.......v..-.5..C......b.9&..,UL@.|'.qZ$+#.%....@.x....{.$._..O..w...-..<.\..New..h."...XP:#......N[.TU.X...O.....D..... i..I.$.J..~...Q....2.QN5...m;2].S....R.x@...Ai>.....b.0,D.e.....@..9!k_..:..x..a4D.A.}nO. ..MT...48.Nc....<....0b.........V..q~..X.E%...2....5.\.."......N...`.....M5...\4A.GB......w04#..Ai.....Z..#...Q....`..#...5.P..D..._.".Zb.;..!.......<6..q. ...y.....k....{.....r...w.r.....b..Q.K=.......S.R..E..=...j..y"*.kJ........}YYT~P..E...H.......+.K"5u.~..f.`..b..".>.T`7&..`....V 3..}.!6$.?+...h..;r...%.9k..|.).....9.BC:T.......ld..$.:....=k.#.n..L.i...2...I .....Y.qPU........N...n8.0.........b8..lA.. '....b.."......Ea
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 166 x 92, 8-bit/color RGBA, non-interlaced
                                          Category:dropped
                                          Size (bytes):4949
                                          Entropy (8bit):7.859283088219073
                                          Encrypted:false
                                          SSDEEP:96:Q2sXF9k4YFUYvtNgrx52bMH+ZMEtzclS/iIS8woR44j:M1ebUYlNcFUdclSKrse4j
                                          MD5:CC5132B56BA46B03DD998AA1FE220106
                                          SHA1:403E007A0B17D76A9945FA5EC46A9D01733B3040
                                          SHA-256:598699133BE5EEF63E3B9B5540609EC0DC91D7AF9C7F70A3B890E57491A70AE0
                                          SHA-512:A523413B12F9BC9D7B4789FA45C57C5AD28E6C33F5CEDE6B9C13C7CFC59CA04DC09787F706354B4E2062B6CB7604CB89BD9021411968EA2B7C78AB29FF41E963
                                          Malicious:false
                                          Reputation:low
                                          Preview:.PNG........IHDR.......\............tEXtSoftware.Adobe ImageReadyq.e<...#iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Windows)" xmpMM:InstanceID="xmp.iid:F17B94CFCABF11EBBAB7FB721269615E" xmpMM:DocumentID="xmp.did:F17B94D0CABF11EBBAB7FB721269615E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F17B94CDCABF11EBBAB7FB721269615E" stRef:documentID="xmp.did:F17B94CECABF11EBBAB7FB721269615E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..F.....IDATx..]K............J+..&....1".'...H.....+.<.!..`B ...&...%....X.C..>..$ ...2...E....^....G....z{fggV....
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 48x48, components 3
                                          Category:dropped
                                          Size (bytes):807
                                          Entropy (8bit):6.886934945049654
                                          Encrypted:false
                                          SSDEEP:24:VaPXXREztxL0g4zXM7EsGFp/kNSIdh+OA6:VapEsgVQzcNBdhI6
                                          MD5:3C777668DAFEEB70CCC712B2772D7BC5
                                          SHA1:C896B95B8DE6A5773F805862B7EDA76AFDCEE5BF
                                          SHA-256:7FBBAED15A8BEAF623F6EAAB8C739875E3F90DD929E09A03BCDB2327E486C438
                                          SHA-512:BA9676D91E51B9001F2FDA8E90597799103C1E2CF0EC9F5601A015D8764AC49D5F79AB61A1664592833D6353F701602791FEA0EBCB1ACE0E1FF44A54A634B8E0
                                          Malicious:false
                                          Reputation:low
                                          Preview:......JFIF.....H.H.....C....................................................................C.......................................................................0.0..........................................)............................!.1A."Qa.#B................................#.........................!1.a3AqQ............?.......H........%G'..hn.^V...o,+lZK.f4...K"R..3-....z...2.#...\..u.r.b..rQ...........*..c.6..P...d.a...y..X...".j.F.[i_.C.+3.F.......R.Irn'Wi.#.+./..#..j.B....."DL<....[Q..Y.qgy..7..R......6.?..u./%.u..-...3.).~.....e*.........v..1..}*...k*...b.*[u3_..T..lk.Zym......q.f.B....?...,(.......V..>.Qe...cWS.oL..O%..._z..*.?..m..-5*>.7g?..y.".......6..3...x..-nml..3....Iu..4{rC.Z.-.........i..K=../..u..DkH5WV.n...K.7-....KjI8....[...YA..M....B.l.2$.`..$Y.a .. ....
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                          Category:downloaded
                                          Size (bytes):17558
                                          Entropy (8bit):7.965280918156402
                                          Encrypted:false
                                          SSDEEP:384:n1RiTAhyHQqaoDvIkGLi9WIEBudd3hTs1JyWKohqrN6o:1ATPQqdvQ+GshCyWLhqrYo
                                          MD5:6E3D6800EEF9CFF4B94ABC025255EB2B
                                          SHA1:7D606044AF2F4FB7F10CAD9E88A3E0647C0F2B38
                                          SHA-256:B2901F408265C7A9D8D5CFE0C8865E27289949848862945F8A3EDA85898100BE
                                          SHA-512:4AE4304F3151E161B57754AABDDE9AB1DD24639726D03C40FAC2BC12A99287692F03AAF9672D12AAECFC1C5333EC6183E8D39A86405D26390A42F46AE644C057
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/new-img.png
                                          Preview:.PNG........IHDR...,...,.....y}.u....sRGB.........gAMA......a.....pHYs..........o.d..D+IDATx^......!.. ....c$......7...w.B...eqX`Y.a.eq...........S]..h`w.{...=.3..]]U.....d..."J....{.B.../P#..4.Z.m..@....Y.2t..W...3..$...o........]..c.1?.........._.!..3...PS.Mc$>[..=.y...{.>.N.^..4..8.........>.A.|..vJ..;Pa.1....C......]..|........N.O_..+..}../T...6@..0.}.\.9.s.p^...G..o.`L...C..?..:~.....'.7.G9.qZ.}. .....TF..4....U.)<..+.g.w.....]A......P.@..%._*.....y.y..>../AH*..T.wPW..dn.!&...ch..s..T.8.Ax..L....Gu.~.l{...p..2....#..&....#.Ek....GY....h....t.........P...]Q.!X..+]f\v/........K.'tH.`S...^..+]..`.P...b...X.z.v..=p.B.t.'........E.o.^fTm..AY/.K..{].........v..X.7P...V...]-..Z..r..!........+_..9.....*..5.....wP7..&...6..YP..~.6r...D.s.*.U."A...p.P...*(.I...._W'Ap..dY..t....@]..uJW/Ap..[....r..bx.g.u...tu...Ae.....v...@......N...*...l]...#....... <.T..O..........7Yw.....R.........6..]P.yM.".z...*.k..]O..Rp..:.....>.*...X.]G..j+.....n:.U.R.-..7.O..y!...
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JSON data
                                          Category:downloaded
                                          Size (bytes):607
                                          Entropy (8bit):5.275077743571625
                                          Encrypted:false
                                          SSDEEP:12:YGGHrpH1c0aNmi7W4ZL3JRexJHpJHr+JH6JHWPQ1JH7u5KiYNnOSF5Mh4aC45Imd:YhFHwNhC4ZLJ6JJJL+JaJ2PuJSciYNj4
                                          MD5:4DD0A0FB418ACC732AD2AF6AC559E54E
                                          SHA1:4675C9815A4E4809867F968B81EA71BCFF1B92B7
                                          SHA-256:17F9D08A903F8221B7F3DAB6A14F79E287EEA15A9D49607E86FFFD92DF868421
                                          SHA-512:70066B3FEC3A25D6252547215F545A86954D7A082D04AED4A6C27ED21C7F2B19FC45C3C32205E4078AE0F4E098B486960DC2C9FA6D0300D163FFEE3ED1DEB7B7
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jsontdsexit2.com/ExtService.svc/getextparams
                                          Preview:{"cc":"US","cnames":{"de":"USA","en":"United States","es":"Estados Unidos","fr":".tats Unis","ja":"....","pt-BR":"EUA","ru":"...","zh-CN":".."},"city":{"de":"Atlanta","en":"Atlanta","es":"Atlanta","fr":"Atlanta","ja":".....","pt-BR":"Atlanta","ru":".......","zh-CN":"...."},"subdiv":[{"de":"","en":"Georgia","es":"Georgia","fr":"G.orgie","ja":"......","pt-BR":"Ge.rgia","ru":"........","zh-CN":"..."}],"pc":"30301","ip":"81.181.57.74","brand":"","model":"Windows Desktop","browser":"Chrome","isp":"Datacamp","lat":33.7485,"long":-84.3871}
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:ASCII text, with CRLF line terminators
                                          Category:downloaded
                                          Size (bytes):401
                                          Entropy (8bit):5.014229347640163
                                          Encrypted:false
                                          SSDEEP:6:AUltcWCRYFRL1CRtsGLERs44dEjJYFgl5DWJ5FGBnL9CEp44AC/Eg0y1AC/Tn:AecWSYFzStszIEaFgleFWBClC/mC/Tn
                                          MD5:EB5C07F70686DBBF452F40FEDD08875A
                                          SHA1:A5787A38E4A0C58B46F8086E3233A81AD5477D2A
                                          SHA-256:48CCFBB3C9A51A3A08BA6484CFABD2DF88CFDFDF8C5DF6217507A3BFC7EE6749
                                          SHA-512:20965FC4D1C74FE8034A63A4E651F5B0A1DE401DD607DCAB5E6DB73D7ACA88D4A26F6C7DDA0199A3A546717F777BB46294370168017313F0D7D8131ADB998A72
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/light.js
                                          Preview:function addEvent(t, n, e) {...t.addEventListener ? t.addEventListener(n, e, !1) : t.attachEvent && t.attachEvent('on' + n, e);..}..addEvent(document, 'mouseout', function (t) {...null == t.toElement && null == t.relatedTarget && $('.lightbox').slideDown();..}),...$('a.close').click(function () {....$('.lightbox').slideUp();...}),...$('body').click(function () {....$('.lightbox').slideUp();...});..
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Monaural
                                          Category:dropped
                                          Size (bytes):8802
                                          Entropy (8bit):5.5946484836211505
                                          Encrypted:false
                                          SSDEEP:192:JN+X8ssZf/IQc5Vkm77EheIp9mLOrEZoz:vS2/PKNxdSnz
                                          MD5:6D2D3DA2EA28ACE816FA4A138829DC18
                                          SHA1:606E0EC3D7FB05C69F16233CFE1FF0A0EE760505
                                          SHA-256:D79BC81189750262716692ADE6CC4D6FB6C4FBC4AA01C2B9D0AA67E5788821FC
                                          SHA-512:69B4B77A4233D081DEECA7A19F9234C24AEAB11390988C222119356F5BAD406AED28C0EC25E9881031B51A930171F52C954F376E635DEFE10F244530D749895E
                                          Malicious:false
                                          Reputation:low
                                          Preview:ID3.......TCON.......(12)..............+...dp ..WJ.m....'e.p..I...._d.0..........G(d.L].m..#l..B....oA....W...6.R.......`.H.>(r....nj d.h..0t."D..o..FX.!..LF.....Aw#....Eb.i..O.....rH......0..%.....w.v*.j...\V.k.H.8..{).[.....V".......?r#a.>.e.......7....s....|....N..B.ZK........M..s......E3.(..fN.!..eN.$...8d...&...K7.....Z.X....H/.........-..>...&.J....n.4l....K)C.y.@...}.'3_......t..N.J.Rj1...../8...8Q.J.E..]4.9..}.m...69.,.0Hz........j..tC!".f..$0 ....Z., ....0........K.......j/Lp.c.H.................~..p..""..'A.&.).......4.M9.M.....3`.4 c./.....4.......u......F.p.........&.X..........M...@.R+....0.@.Ep..a....`.......&.. (.q........<.D.........`.......*....r...`...@......`......&0.@......|0...(Z7>.0.@....',....Yr..{..h.4ol....@.............)0.{y./.~.J..>.....4....b..M.x.g.Vo..u.S!....g.f.Y..]...1..O.d+.H....le.!..3.................!4 .....9.Bw.w.%.NnQ..-(O....Y..Eh........X.0V.D...&.6...e'.^.3g.9f...."S....2.I.Q...2..K...a..XT&.<~.D2lpt..ap...tdOLQ.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 48x48, components 3
                                          Category:dropped
                                          Size (bytes):751
                                          Entropy (8bit):6.800911008238144
                                          Encrypted:false
                                          SSDEEP:12:tdP0aaPRa8PPnlLlxb7WsY0+PLNrYn8mgnIBbUDdi9zLpSXqDECCsQ2PD3dy:VaPXXVlxGs9+yYnIBA49zLpSXqQCdy
                                          MD5:E8C1454C15C6596BB21D99F4D907F632
                                          SHA1:60E15B6DB64C05951CFDAFAFE7BF75309F8E8E3F
                                          SHA-256:7125F531B9CDB3EF75F1B5B608B974F492794764638BFE482C4B4C5083ACBCDB
                                          SHA-512:BDBF5EE6C0D2FDB8B0B7BA90D0F26C22836DC8D8B4FFC7070DED8923A1017DC3A806A8EC6D56C78F8EF1AA4E6D20FBD0B43B130A556DE362D68B96F8BE8E9BA7
                                          Malicious:false
                                          Reputation:low
                                          Preview:......JFIF.....H.H.....C....................................................................C.......................................................................0.0.........................................(.............................!A.1.#BQa......................................................1..!"#C............?....(3...&..P(3Cn....#(.r....J.e..v.~.9o.*.t.....M...Z..c.y.ig.$...'.!..........7..8LL.......YY.3sz4P(.*=$.[$.o.H.....Bu..>{. .;M...E.P.s9..T...G@_..+._..\.......;.c....:Ssa.M..Md.*.......Ad....%.../...6.t...}H...%..D...?.U.p<.n.9..B.R.VD.......L...XJm......0.0V...j.u..*....j/Sm.Xl-[/.o...K........NT(.....'(......_..]b..P(..'5.A.r.JdQg........C..AD...>....*ivE..Tl..c'.....~U.../...0.7.U."c'M>..@.PHOt....t....
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 13 x 13, 8-bit/color RGB, non-interlaced
                                          Category:downloaded
                                          Size (bytes):349
                                          Entropy (8bit):7.047569859646336
                                          Encrypted:false
                                          SSDEEP:6:6v/lhPfnY+7nDsphbAX6jNYCIh61Uw49/J3BYwmPYYSU+59AyROJwWgZPOIwCMR9:6v/74+U3AANXIsUDdI3+XtRZPONCMROO
                                          MD5:7454C652E0733D92DE6C920C2D646AE0
                                          SHA1:34A5BD8C7401F95E346895B0E5CCFFBF0E9AD638
                                          SHA-256:44F752B0BD2E48052D538BC6ACA5379F3630CA64DA945F794690DDF47E8EAEF7
                                          SHA-512:DDE6D40BEC105003CB93C52DD3322C26985FECC7FF1EAB79547FB7F0365AB2FB7B1CBA96AED81958C08627FC6C0BA6034BCEC53B1B66705D7B04202E7F8B5B59
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/que.png
                                          Preview:.PNG........IHDR...............s+....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.Q1.E@.e..jQ..3hTJ.J......$J..h)$B).t$._.&....).x....y.w...uu]7.......8..(.e.3MS.e.H.0.#."....Q...QU5.C.@.<...$.Bx..x.8.m.n..'r .}.....x.8..i.q.-........0..9O.A...............a.O..{.W..<......1V..0.O.....I..`.!L.....i....6.B#....~....p..Nq.....IEND.B`.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:HTML document, ASCII text
                                          Category:downloaded
                                          Size (bytes):465
                                          Entropy (8bit):5.350870647956229
                                          Encrypted:false
                                          SSDEEP:12:hYHK6Qclfj9uJ22voEJIiJmFB7x4qRDG/J0Dx8ulBQb:hYqsEv4iJOkqDhFlg
                                          MD5:A745A50F3448958C51DADDF3CF2741BF
                                          SHA1:34C73B300F7FD45226231E6205B3EBC7BE0D170D
                                          SHA-256:C35A618349C8C5F596AB2EFB481ED163F218D85E459BD510E7837FA89D84F227
                                          SHA-512:FDCCD591CE04BC53887616F3ED22FEA9763915A7D740AB33D0FB725D83C4601D2E94F44A19B5194CF3C20BE2F6BC9B859147851147366158CF7A880DB9C3955E
                                          Malicious:false
                                          Reputation:low
                                          URL:https://checking-browser.com/?url=https%3A%2F%2Fmygiftaward.life%2F%3Fu%3D6w3kaew%26o%3Duvdg6dv%26cid%3Duomgcwv9%26t%3Dsweepstakesbbg
                                          Preview:<!DOCTYPE html>.<html>..<head>...<title></title>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">..</head>. .<script>...var searchParams = new URLSearchParams(window.location.search);...var url = decodeURIComponent(searchParams.get('url').replace(/bbg.{0,}/, ''));...if (url) {....window.location.href = url.replace('firstwincase', '');....//.replace(/bbg.+[^&]+/, '').replace(/\?bbg[^&]+&?/,'?');...}. </script>..<body>.....</body>.</html>
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2022:08:26 11:44:30], baseline, precision 8, 1920x1051, components 3
                                          Category:downloaded
                                          Size (bytes):366853
                                          Entropy (8bit):7.922461007600616
                                          Encrypted:false
                                          SSDEEP:6144:SyOxerMkX9xrH2BFAtHs8878fSO4F62ZdVTD767Psm/kiIYFex0t+:tOxerMkNkYtM88oITDsvWYF7t+
                                          MD5:DD6F5DF6C78A7369FE8CEB7C0F70DD50
                                          SHA1:D664E27E8C2B8154F9B31E2DCDA0B21E3E4935BA
                                          SHA-256:40DD8A184408B9C6F376673FFD39C74611F4EF9FF0A1DAA8B3760015D801883D
                                          SHA-512:492EF298B453405EBB44360C599A6B983D26356B89260B9FC64D2611B5F1ADF39153873059ACB5F6FA87D7009D62633B9A42E23F1D29E18A0AF58E0A9F3DCA8B
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/bg2.jpeg
                                          Preview:......JFIF.....H.H......Exif..II*...........................b...........j...(...........1.......r...2...........i...............H.......H.......Adobe Photoshop 7.0.2022:08:26 11:44:30.....................................................................................(...................&...................H.......H.............JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................F...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....c+-h.&.#q....... q..J.Q...;.\.dm......SB!..N.Z".\...B.$.I...j.Z........j...9....(.,d.sP........@.xEsT.J..m.Q*e@.L.....5..
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:SVG Scalable Vector Graphics image
                                          Category:downloaded
                                          Size (bytes):6215
                                          Entropy (8bit):4.1844959720420025
                                          Encrypted:false
                                          SSDEEP:24:t4obKtc4KM7e9KKKKK+5aKKKK+oG/tEBkmAqkmEkevNknkm6nkjA+voLiFXVhxVM:624vhy
                                          MD5:2B327BDA75CCB4C9C3CD7EA61C4FED82
                                          SHA1:4C3D575D257B08BC7C12B5C1A6F7E6B76A0E1AC9
                                          SHA-256:7DB44305E217E7A44845B47FE090B5F077A1CECF820899C7A6977B26549CDC08
                                          SHA-512:8514024D4FB05C81F8C81768EC3B47E7026E04CED02B6EA3AFA0E22B49611E8FAFE334CAF9A2FCB628E028C257349A224CAD16468CD29263346FCD5828895B97
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/flag-icon/flags/4x3/us.svg
                                          Preview:<svg xmlns="http://www.w3.org/2000/svg" height="480" width="640" viewBox="0 0 640 480">.. <g fill-rule="evenodd" transform="scale(.9375)">.. <g stroke-width="1pt">.. <path d="M0 0h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0z" fill="#bd3d44"/>.. <path d="M0 39.385h972.81V78.77H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0z" fill="#fff"/>.. </g>.. <path fill="#192f5d" d="M0 0h389.12v275.69H0z"/>.. <g fill="#fff">.. <path d="M32.427 11.8l3.54 10.896h11.458l-9.27 6.735 3.541 10.896-9.27-6.734-9.268 6.734 3.54-10.896-9.269-6.735h11.457zm64.853 0l3.541 10.896h11.458l-9.27 6.735 3.541 10.896-9.27-6.734-9.268 6.734 3.54-10.896-9.269-6.735H93.74zm64.856 0l3.54 10.896h11.458l-9.27 6.735 3.541 10.896-9.269-6.734-9.269 6.734 3.54-10.896-9.269-6.735h11.458zm64.852 0l3.54
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:SVG Scalable Vector Graphics image
                                          Category:dropped
                                          Size (bytes):6215
                                          Entropy (8bit):4.1844959720420025
                                          Encrypted:false
                                          SSDEEP:24:t4obKtc4KM7e9KKKKK+5aKKKK+oG/tEBkmAqkmEkevNknkm6nkjA+voLiFXVhxVM:624vhy
                                          MD5:2B327BDA75CCB4C9C3CD7EA61C4FED82
                                          SHA1:4C3D575D257B08BC7C12B5C1A6F7E6B76A0E1AC9
                                          SHA-256:7DB44305E217E7A44845B47FE090B5F077A1CECF820899C7A6977B26549CDC08
                                          SHA-512:8514024D4FB05C81F8C81768EC3B47E7026E04CED02B6EA3AFA0E22B49611E8FAFE334CAF9A2FCB628E028C257349A224CAD16468CD29263346FCD5828895B97
                                          Malicious:false
                                          Reputation:low
                                          Preview:<svg xmlns="http://www.w3.org/2000/svg" height="480" width="640" viewBox="0 0 640 480">.. <g fill-rule="evenodd" transform="scale(.9375)">.. <g stroke-width="1pt">.. <path d="M0 0h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0z" fill="#bd3d44"/>.. <path d="M0 39.385h972.81V78.77H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0z" fill="#fff"/>.. </g>.. <path fill="#192f5d" d="M0 0h389.12v275.69H0z"/>.. <g fill="#fff">.. <path d="M32.427 11.8l3.54 10.896h11.458l-9.27 6.735 3.541 10.896-9.27-6.734-9.268 6.734 3.54-10.896-9.269-6.735h11.457zm64.853 0l3.541 10.896h11.458l-9.27 6.735 3.541 10.896-9.27-6.734-9.268 6.734 3.54-10.896-9.269-6.735H93.74zm64.856 0l3.54 10.896h11.458l-9.27 6.735 3.541 10.896-9.269-6.734-9.269 6.734 3.54-10.896-9.269-6.735h11.458zm64.852 0l3.54
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 85x119, components 3
                                          Category:downloaded
                                          Size (bytes):4130
                                          Entropy (8bit):7.8501946403645695
                                          Encrypted:false
                                          SSDEEP:48:Rx1IqXlrGjObxvtVwZOssPZqMlbP2pa6mvjQQE1Nv59s5CNoMqkRo1Av1nXym+nu:PaI6jsxvsOsWREa6QQD1p593/MANOs7
                                          MD5:3776A9F0C3B19E203951D23C2D577F31
                                          SHA1:779D1935ED4017EF580288246B5259FAD9F17B84
                                          SHA-256:F9B405EE4B9F6B58E46BAFB40463FB08A4EE39C945389D2FCD7E3F8F15959C14
                                          SHA-512:E4434FE4028EEA9F9C7D59FF73219A0D46FC6ADC32981DE161A620F168D6F57554D68F111F60DD8398E25E9FA054E0FFB437733196AECEDFC2699D9529E2368F
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/cf/google_play_card.jpg
                                          Preview:......JFIF.............C....................................................................C.......................................................................w.U.........................................................................................$.7.<.-.....f,L........s.LMY.......p%.Ve...3....8,.KED.c.!.#jy....h....d.....8o...p%.2N].2...o_M.....[.....p%.20.....u.....GY......n..........m.>..).9v..}e#.{...`9j......KDdhsr.i.V......K...>..:#c...g.w.Z##R....u...*....'...\..7.Aw.Z##Y....^r.|.......w.Z#'V.....`......55.hv.Js....1f.r)..........%.........................8...... ...............v.G..)^..J..JW.2R.Rno6...Jd.zS%(^B......j...q.1.u.$...[..Qc...u.Kb..@..0...0.)2.i9.....'..[..mM.f..$..}n....da...X.pM.f...m.)..p.....}.-.M....U.<i..1.........S.f[........3.fc6..Y.$?.+...]..W('|.(.RH5.U.a.1...G.D2._.....W,.......U...[......e#..3jnc6....wS..'......!} ...9...3jnc6...z....a$CHD.8..A..........k.......~....h..U.tH0A .(%.......w$]>../...S3..U.......
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 47 x 46, 8-bit/color RGBA, non-interlaced
                                          Category:dropped
                                          Size (bytes):1045
                                          Entropy (8bit):6.248239976068452
                                          Encrypted:false
                                          SSDEEP:24:A1h6A1aWwjx82lY2T3PQVvmdN2yJ3V5L75Gs5eq46col:e11LNn2bQpEbJ3fH5ThOol
                                          MD5:BF2B460590FBB9D8E9611A6E9006B816
                                          SHA1:561E1DAB259D61E798B3CE380527B71B61074FF3
                                          SHA-256:EE4BC5FE81FA7C1E8497D79C9C8A96485DF217092D334E9B48FA8840FED11D03
                                          SHA-512:ACC9773B532BFF6A1284B78324D9BD51117A6EBFC0C549224BA4B703540DE8869AB1EFF1CCE8CC4FCA00C5B4F47D34FC27FAB27246873326CEE49D2DD5E877C0
                                          Malicious:false
                                          Reputation:low
                                          Preview:.PNG........IHDR.../..........{@.....tEXtSoftware.Adobe ImageReadyq.e<...#iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)" xmpMM:InstanceID="xmp.iid:2413D6EDFC2911EA865EEF9650A38354" xmpMM:DocumentID="xmp.did:2413D6EEFC2911EA865EEF9650A38354"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2413D6EBFC2911EA865EEF9650A38354" stRef:documentID="xmp.did:2413D6ECFC2911EA865EEF9650A38354"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx.....0......b..".#............N$..B2.U..inw.8p.^g......i......e...x.......<x......J.........[.._....C..
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:ASCII text, with very long lines (27303)
                                          Category:downloaded
                                          Size (bytes):27466
                                          Entropy (8bit):4.752060795123139
                                          Encrypted:false
                                          SSDEEP:384:Qi5yWeTUKW+KlkJ5de2UYmydfwYUas8l8yQ/8c:Dlr+Klk3YlKfwYUf8l8yQ/T
                                          MD5:4FBD15CB6047AF93373F4F895639C8BF
                                          SHA1:12D6861075DE8E293265FF6FF03B1F3ADCB44C76
                                          SHA-256:DDD92F10AD162C7449EFF0ACAF40598C05B1111739587EDB75E5326B6697C5D5
                                          SHA-512:F8BE32CBA15170319B5C9F663C6F0C4FFDD4083CF047D80F7B214D302B489ECA25FBEE66DDB9366D758A7598EFC9B9A886B02C9F751AE71F207CB9DB1356243A
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/font-awesome.min.css
                                          Preview:/*!. * Font Awesome 4.5.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.5.0');src:url('../fonts/fontawesome-webfont.eot?#iefix&v=4.5.0') format('embedded-opentype'),url('../fonts/fontawesome-webfont.woff2?v=4.5.0') format('woff2'),url('../fonts/fontawesome-webfont.woff?v=4.5.0') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.5.0') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.5.0#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal normal normal 14px/1 FontAwesome;font-size:inherit;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.33333333em;line-height:.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:HTML document, ASCII text, with very long lines (21447), with CRLF line terminators
                                          Category:downloaded
                                          Size (bytes):38190
                                          Entropy (8bit):5.787648496284126
                                          Encrypted:false
                                          SSDEEP:384:SIiJQHm8slQvPH2LkHRoYR4RUMs9I3ZNhe7/0LP/9aCt2Kt3UuiOaPXuOOMD9wBU:S1JQHEYR49z3ZNhC1/xQoP+W
                                          MD5:9140C2B00F864FB436FF665A8B5D5476
                                          SHA1:A8077E547C96386F449717BA64E908978AD4DF49
                                          SHA-256:D91F53B3FCD3C9CAD1D72756A0DBD12A66449B561AC8565AD9C730E6DD989209
                                          SHA-512:DED5D6C837E7021FF9EE2D58441232183724A1251E8BA8769BE876A37A9BE515699E585BBC5B0C939A712A80A925EC368129A4AC34009910B81F49F128DF0C77
                                          Malicious:false
                                          Reputation:low
                                          URL:https://mygiftaward.life/?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes
                                          Preview:<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">..<head><script>function requestLink(){return {sessionId:['sid','t1~x0hgjdzxqkzaumrwysnznltv'],p1:['','https://awlivedose.live/ubxplwqi/'],jsFpCryptoKey:['','iw8r23clxymqvla7']};}</script>...<title></title>...<meta name="viewport" content="width=320,initial-scale=1"/>.....<style type="text/css">..*{margin:0;padding:0}body{display:flex;flex-direction:column;font:300 100%/1.5 Helvetica Neue,sans-serif;background:#3b5999;color:#fff;min-height:100vh}p{font:110%/1.5 Baskerville,Palatino Linotype,Palatino,Georgia,sans-serif}header{display:flex;align-self:start;width:100%;box-sizing:border-box;padding:.5em;background:#000}header h1{font-size:110%;font-weight:100;text-transform:uppercase;letter-spacing:.06em}header h1 strong{color:#ff1493}header p{flex:1;text-align:right;font-style:italic}body>section{display:none;width:-webkit-max-content;wi
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 48x48, components 3
                                          Category:downloaded
                                          Size (bytes):1428
                                          Entropy (8bit):7.457625103814737
                                          Encrypted:false
                                          SSDEEP:24:jQpuD9XhUbTdJhmqYNjWPUlZE/ayRhdUXA2EdzdpBasB+jnnkkk:RxRQJJEqYYRRTvzrBLB+jnnkx
                                          MD5:D1D2CE3B77A4B6F4347C3AE674142664
                                          SHA1:4325221D22933C878E75F8F84634B42D97C71C05
                                          SHA-256:27E548EAE9447F8D928B3778EB4D14E7C6BE1582F8C53C040E771F5F5E72CED7
                                          SHA-512:51E4111EE8377EBCA5845A67FC919CD12A8B682FD6A86571BA746021A1BA7DB03975D2B3FFCB25DFC6F11CC652DD3DF2E38CC3A0CD8C6A7F7FA32B0EF4E5E4C6
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/cf/winner_heart.jpg
                                          Preview:......JFIF.............C....................................................................C.......................................................................0.0..................................................................................j..E..x.=<.m'a.......@wh0.1#6.4..1W.[.)....fQ.4....X......2R<....|<#.......drMh$............\I.*.b...5.............................!"12Qq.3Aab....#CDR..........?..Uw.jR\-[>8L.'g]Z.4...aU.K......O....kV..-.\VA$.V.f...,}.r.>..c.}@...8mR\..S.....(>WNY...E'...Bz.. .QX...l..F..6.%&.4`.oL.xd.p1..P`q.P'e.?....uw..6.]_...j....a..8I...V..,Py>.....U.n]..5.wY.4...>I<O....99.u..zk~..5..v.G,{.`A.M....IO.S...r.8.CR&N.E`2...#.G....l[.T.V.j.Y..x...C.......vJk}..j..J|D.%.+..0.T.......}..*..."(%........(..W...Z.oW,o...e.......R;.B.u.L.....v....#....X....O...f.$.....y..P..rr4}........D..2I,.y.4.$Y......`@.....t......k.....3I.R2.qq.7$...*uWOM....u.Y.H`.B...... .<.=..<5.7.M.sPEn..h.40...............e..V.QUyS#...$gM.:.q..1S..">k.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:ASCII text, with very long lines (515), with no line terminators
                                          Category:downloaded
                                          Size (bytes):515
                                          Entropy (8bit):5.335198527496933
                                          Encrypted:false
                                          SSDEEP:12:jgUkdhXymRltEGgMPIdBttg1mrCJKOQiiTSdIGyn9AKsqzKN:cUkbymRlHvIxtg1mhOQiC9Vn9NsqE
                                          MD5:F7FA3C2113CD3F6C99F9978158F533F3
                                          SHA1:46B016607A827B2356E353B48C407126D8ED83E6
                                          SHA-256:CAC7EBD3280EF61007A91A1B762A4DDDCFE9DAF15611BC53501C7B5191D6E983
                                          SHA-512:CACF518148BBD2F0733E0E3F1E241498C53D02FF9BA463CFA8A653BB796B14EB75A53647DB76658D11BFE1C31876DAD764BEE46F5A5C0E2ECB4CCB033C1FA1C6
                                          Malicious:false
                                          Reputation:low
                                          URL:https://cdnstat.net/get/script.js?referrer=https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/
                                          Preview:try{setTimeout((()=>{window.Ya=window.Ya||{},Ya._metrika=Ya._metrika||{},Ya._metrika.oo=!0,/googletagmanager/i.test(document.documentElement.innerHTML)&&(window._gaUserPrefs={ioo:function(){return!0}});var e="https://checking-browser.com?url="+encodeURIComponent("https://mygiftaward.life/?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes")+"bbg";window.location.href=e}),100)}catch(e){};document.querySelectorAll("script").forEach(e=>{new RegExp(atob("Y2Ruc3RhdC5uZXQ=")).test(e.src)&&document.body.removeChild(e)});
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 48x48, components 3
                                          Category:dropped
                                          Size (bytes):950
                                          Entropy (8bit):7.1236995695974485
                                          Encrypted:false
                                          SSDEEP:24:VaPXXQRzclo0AVD3DYsie56Gwz6tZYShJ9:VawkmDMe64P9
                                          MD5:62A261739E9A386D39D542903D5AB050
                                          SHA1:6CC87F77A580CE13068A1324B397070DB3817511
                                          SHA-256:669C7DE8CC4685BB673F13DB0B8DE84FD8142005C4DB680CBE35FAD7B852C631
                                          SHA-512:7FA5F5C69CF0BE9FB9B2F02813BBD27457379C9C25A31C26EC2754A68E740CEF97F64A380090C4D6690899AF0CC4C9870DCF0C82246A706A7AF6EDD350919805
                                          Malicious:false
                                          Reputation:low
                                          Preview:......JFIF.....H.H.....C....................................................................C.......................................................................0.0..........................................0..........................a..1Q.!u."67Aq...B..................................(........................13.!..AB..#24r............?.....#..0..a...7.Y.M...h..`gh.....3D...X.5D.N..........Y6...qZ2..sC..~tJ.Z...).D..!.D:....(.d.]"4$$..&.....97..;$.%..D..6...m.T.=..2$.D......j..17-.%|.Ch...t..z...1>...Dz.3...;.}~;..Zmy"]o....-R."e.[..s<...Y.?.s..]....:._..k.........c.x./...72ok.!.G.H..JGZ..L.j.E.`..."....A.x}y:.?.=.q.....8/.Q......fF[.FT..3..d.........%h..u.!..)ff....a.......v..I.;........].^.I;.R...oVH.O..J../..9....ur.!...IeL=.)...m*.....Az.)i..{._7..Q..N.}]....VT..2...$..\ ..7r..w...D.(...0t.....e.....I.s .k.....D.i..."mK.b:.h..=..+...'...Zh.A...X.u. .U9.l..:..:P...e.#......M..'.=...(e.9..C...o$e.Ha@.........?..
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:ASCII text, with CRLF line terminators
                                          Category:downloaded
                                          Size (bytes):1287
                                          Entropy (8bit):4.854204387637648
                                          Encrypted:false
                                          SSDEEP:24:Fffl0FcRYNkTgyfjNBSaTsTBTpFZAOQPKgOL+/ulJv+hTiVuqIAlEYEwB3wK97zd:F3GFcRYNkTgyfjDSaY93ZAOQPpOL+/uL
                                          MD5:30A227187F27DE3552C0037EEA9D7FA1
                                          SHA1:DB241B12874844D162B13B54C6C8ED11B2BC9FEB
                                          SHA-256:041E2DD0599A264CF3185E23F702527E255C05D52939655206715C09212AEC92
                                          SHA-512:8343D0BC2DF13731181D65EB8C06C4831CE3275B45279E1ECB44BB7131AED091A366908FE8D03536CB1298FB878C8865406484DB52132CB20FA3A83A6BC25B50
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/cf/2.js
                                          Preview:...var winner_date1 = new Date();.....winner_date1.setDate(winner_date1.getDate()-28);.....var winner_date2 = new Date();.....winner_date2.setDate(winner_date2.getDate()-55);.....var winner_date3 = new Date();.....winner_date3.setDate(winner_date3.getDate()-89);.....var winner_date4 = new Date();.....winner_date4.setDate(winner_date4.getDate()-113);.....var winner_date5 = new Date();.....winner_date5.setDate(winner_date5.getDate()-148);.....var winner_date6 = new Date();.....winner_date6.setDate(winner_date6.getDate()-177);.....var winner_date7 = new Date();.....winner_date7.setDate(winner_date7.getDate()-206);.....var winner_date8 = new Date();.....winner_date8.setDate(winner_date8.getDate()-246);.....var winner_date9 = new Date();.....winner_date9.setDate(winner_date9.getDate()-273);.....var winner_date10 = new Date();.....winner_date10.setDate(winner_date10.getDate()-299);.....function formatDate(date) {..... var monthNames = [..... "January", "February", "March",..... "April
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
                                          Category:dropped
                                          Size (bytes):3834
                                          Entropy (8bit):7.661511605576764
                                          Encrypted:false
                                          SSDEEP:96:UgQ99q3GTte0IZF+gPYLRGssABY1sdaS+9:Qs680IjnPIz8Z9
                                          MD5:77A2FFC5545F87551D74781201DE9B3B
                                          SHA1:C9C3798AFD2AE95AA3BBA3C428335D49C8255B06
                                          SHA-256:316E6A6737BD296AB30ACA2EF7FA36F119D15786A2432D01E31FDC130272F15C
                                          SHA-512:CD1A966E47A63AF86E7AC34D58051EF6EA6E0BB5B8ABE14981BD088462667B5A69974B394E960C61F8ED559FB33A2C638D90C004EE13FA985A3F11455213FC2E
                                          Malicious:false
                                          Reputation:low
                                          Preview:.PNG........IHDR.............R.l.....tEXtSoftware.Adobe ImageReadyq.e<...siTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:c42f55b0-556c-f647-9b5f-ce457f4ebdde" xmpMM:DocumentID="xmp.did:CC2FE32CB28311EB83B6BD6A3591FD42" xmpMM:InstanceID="xmp.iid:CC2FE32BB28311EB83B6BD6A3591FD42" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:c42f55b0-556c-f647-9b5f-ce457f4ebdde" stRef:documentID="xmp.did:c42f55b0-556c-f647-9b5f-ce457f4ebdde"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>k.1.....IDATx..{.]E....H.. .A....%`..
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 48x48, components 3
                                          Category:dropped
                                          Size (bytes):1422
                                          Entropy (8bit):7.522334584361835
                                          Encrypted:false
                                          SSDEEP:24:VaPXXDdeGTbswaJULaIdoT8Nx5aAqzqDyAFvTl/R+LOXPJTLZe4Q:VaJowVLaIdoT/AqzqDyAtTl5cO/JPQ
                                          MD5:386E89D83D4F84499CBB1611B2DB4173
                                          SHA1:39F32565C699A973D22A0FEFF886BF82AEF03429
                                          SHA-256:479C7BE121469BCD135A4D80CCCFB35CB9838C811D505F8CEECA07CCB581F7AA
                                          SHA-512:B8A93AD898D7AA2688701DC7ABF068717052E47AB052796B029827E5E3BDC3D11564910B6BA19810C633241B37B5BC4082A815E956BEE98E4118754A661FB627
                                          Malicious:false
                                          Reputation:low
                                          Preview:......JFIF.....H.H.....C....................................................................C.......................................................................0.0...........................................4...........................!1..."#A2Qa..3BRSqr.....................................*.........................Q..!".#1AB..bq.............?......DQv...p..l...=.7..~.9.F.th>..k.=....Qv.!y....Z.....4rfF...f>I..3+=...c..p.!8.[.#2......u...tpt*...J.<....ib|..1..3.-.?.Q..@....wA.v.G...s.E...h......_..............ea*...U^RB.u...*..k....Q{?LO..n.pP.+br..3.....c;.'.<.^..)5.Q..]F...ZSW....,.3Pb....3,..(n-..;0;..SY....S.Iz8.....i.."(.1Cs....o...5T...P.y..He.w....&..Rh...}6.7;..)...:ys.%M...$.3.;.w#..w...`....J[.........f..8i_..Z.}A`...Z.4.MKR.7...f.[...6.8.w..ck...?..*...H.~y+$.7..G.6.=.[.........+f.=...G..c.).....'...../..5%.o.C.~]qw..m.L.V..w...._....W.5QN.N...$h..J.:..<~..)...3E.}A,.....q..S#:..qFR.?..#.#.Rb).U..<.oq.h.$..X......Jx....o.c.o/...3...
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 48x48, components 3
                                          Category:dropped
                                          Size (bytes):1428
                                          Entropy (8bit):7.457625103814737
                                          Encrypted:false
                                          SSDEEP:24:jQpuD9XhUbTdJhmqYNjWPUlZE/ayRhdUXA2EdzdpBasB+jnnkkk:RxRQJJEqYYRRTvzrBLB+jnnkx
                                          MD5:D1D2CE3B77A4B6F4347C3AE674142664
                                          SHA1:4325221D22933C878E75F8F84634B42D97C71C05
                                          SHA-256:27E548EAE9447F8D928B3778EB4D14E7C6BE1582F8C53C040E771F5F5E72CED7
                                          SHA-512:51E4111EE8377EBCA5845A67FC919CD12A8B682FD6A86571BA746021A1BA7DB03975D2B3FFCB25DFC6F11CC652DD3DF2E38CC3A0CD8C6A7F7FA32B0EF4E5E4C6
                                          Malicious:false
                                          Reputation:low
                                          Preview:......JFIF.............C....................................................................C.......................................................................0.0..................................................................................j..E..x.=<.m'a.......@wh0.1#6.4..1W.[.)....fQ.4....X......2R<....|<#.......drMh$............\I.*.b...5.............................!"12Qq.3Aab....#CDR..........?..Uw.jR\-[>8L.'g]Z.4...aU.K......O....kV..-.\VA$.V.f...,}.r.>..c.}@...8mR\..S.....(>WNY...E'...Bz.. .QX...l..F..6.%&.4`.oL.xd.p1..P`q.P'e.?....uw..6.]_...j....a..8I...V..,Py>.....U.n]..5.wY.4...>I<O....99.u..zk~..5..v.G,{.`A.M....IO.S...r.8.CR&N.E`2...#.G....l[.T.V.j.Y..x...C.......vJk}..j..J|D.%.+..0.T.......}..*..."(%........(..W...Z.oW,o...e.......R;.B.u.L.....v....#....X....O...f.$.....y..P..rr4}........D..2I,.y.4.$Y......`@.....t......k.....3I.R2.qq.7$...*uWOM....u.Y.H`.B...... .<.=..<5.7.M.sPEn..h.40...............e..V.QUyS#...$gM.:.q..1S..">k.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 48x48, components 3
                                          Category:downloaded
                                          Size (bytes):1434
                                          Entropy (8bit):7.5308168868246925
                                          Encrypted:false
                                          SSDEEP:24:VaPXXReoaZ+K/4z6CWHL3Z10s1+6XX/3SC07bFyl+JDQ62CV:Vay0KwmCWDZ1L1ZXX/inb0eDX
                                          MD5:21BDA39C69A0527BCB17D0F5D3CE9EBD
                                          SHA1:7BD41A8FED128852011B059CAE076AB92C416D1D
                                          SHA-256:E29BF548CB100DFD46C3307CE6D47AC27CAB8671B850AF34DBEC1F7E0625D90E
                                          SHA-512:59A59EEBCA1C388FC757EE03559E45E47BB47DC77E89AEBC2EC76532445F5A7F7BC818511C198571705C0842013FAD430FB971DA3B38C448EFBD75832EB2D6B9
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/cf/winner_1.jpg
                                          Preview:......JFIF.....H.H.....C....................................................................C.......................................................................0.0.........................................5............................!1"AQ...aq#BRr..$23b...................................$..........................!."#2Qbq............?....c..=2.{..G.......N>.L...Iq..K.S....{.'C..r...Q...zp.,2.t.U...x-......yK..C(...By..7....pA.L..:l9P*,.IfZp.}7 ..qd....C...F<.tD)..J...29.:R.....2}.|._....v.K...4.....Q.=k..\.......C.LL.q...i(q.r....jJ.......$k.y...%.Z. ..%..R..1Q.....;.iq.....c...%O..L.Z,.e)Shm..E[...Lu8.UH.....p..G...*D...J.F..P$....M4.B.$....j;QDx.n:..7...|G?...\....A..).......#....!A.%.X...e.4.K+P (.......mF......}.2J...;ketU7+t..!...+...|.u......-.\D..H..f.T.R.&3?..hJ..W.J....BA.#3./..]U..W.n...JX.8B%.q..C....)'.[T..Pd......Y5+....T.&.S../!.e...Z...$%e')#....RX.._z..+..zD.og..*.R.......z*.*.G...&....p..I.NGb;..B(T./D..u*t.;!~...z.%.h..mG
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:ASCII text, with very long lines (15078), with no line terminators
                                          Category:downloaded
                                          Size (bytes):15078
                                          Entropy (8bit):5.7423511461481995
                                          Encrypted:false
                                          SSDEEP:192:6kVpRdb27XcyrcCxWiugjM/bWMMSVr+W+Fus2K0JbeFqIoEEh+D+1FjUCb2ht0S+:6cVilrLpAYyCWDK0FeFoEEMy1FjU1j4
                                          MD5:2CBD91425B89204F7429837A1B5F9EF1
                                          SHA1:256E6F5FD75519BCAFC1DF1E3923AA510058C534
                                          SHA-256:9FA1826A0CE98788FAD2BD2BEE0AB9982F773E39D8C8D5A7994DA64F78B3BEDF
                                          SHA-512:C69C20AE4503DAA0500AD342174C127B8771BB845D10074040C82331E5B9FF6C75125CAB823E7159CB8C2155EC95FCCF6883087A71289989C45765416B7EE940
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/mb/3.js
                                          Preview:var _0x3d08e1=_0xcca8;function _0xcca8(_0x57ca9f,_0xe24696){var _0x1beeec=_0x1bee();return _0xcca8=function(_0xcca830,_0x48624b){_0xcca830=_0xcca830-0x1d7;var _0x1a9c4d=_0x1beeec[_0xcca830];if(_0xcca8['LGJDeT']===undefined){var _0x51e32e=function(_0x205cb5){var _0x2214a9='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';var _0x1164fb='',_0x414417='';for(var _0x796e7a=0x0,_0x126c8b,_0x5c6d5c,_0x121c58=0x0;_0x5c6d5c=_0x205cb5['charAt'](_0x121c58++);~_0x5c6d5c&&(_0x126c8b=_0x796e7a%0x4?_0x126c8b*0x40+_0x5c6d5c:_0x5c6d5c,_0x796e7a++%0x4)?_0x1164fb+=String['fromCharCode'](0xff&_0x126c8b>>(-0x2*_0x796e7a&0x6)):0x0){_0x5c6d5c=_0x2214a9['indexOf'](_0x5c6d5c);}for(var _0xb40cb7=0x0,_0x127b29=_0x1164fb['length'];_0xb40cb7<_0x127b29;_0xb40cb7++){_0x414417+='%'+('00'+_0x1164fb['charCodeAt'](_0xb40cb7)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x414417);};var _0xc53a69=function(_0x3a0e5a,_0x42b9e1){var _0x28f169=[],_0x305d8e=0x0,_0x47d8bf,_0x15715e='';_0x3a0e5a
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                          Category:downloaded
                                          Size (bytes):25871
                                          Entropy (8bit):7.94435159360093
                                          Encrypted:false
                                          SSDEEP:768:1jncD3TNUM1xISZ8ONnAfSTFPDYj6z6Xn+N:xnw3RUyISpnAfSTFMj6z0nC
                                          MD5:2C497DFFF84BD8C5AF9254C9D6278CE1
                                          SHA1:667E72E7BA6F00A54629E28133317022D4B59AF6
                                          SHA-256:B2DC4153EE7019C70A1095D5D1304D540E3BBA045D99E141F63E5B13362E5A4E
                                          SHA-512:6138813720D378234F497ED844A6815DF8E78D923B470CE58B9B8819EE87B7118DC79498D02FC5BA6A438094CDE6173A9F348F20503BFBF933081D32B8FD2AD6
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/virus-scan.png
                                          Preview:.PNG........IHDR..............x......sBIT....|.d.....pHYs..........+......tEXtSoftware.www.inkscape.org..<... .IDATx..w.^E.....B..$..:.H...(H..HU.JUT.W`m.....H......i.H....k..K @..l...<k.d...3w....9....s...3g..!D.X.8....NC.....oB.!...m...{@w?2..Z*...B.......[NKd..B.!....O.=.s.K..B...6..Z_.<....B.!J...>......BD.=..B.\Y.....Y!.(.Z..Qm.:~;...B......fh...!....B.!D...@.!..!Z..!..5D..!....h. ..B..-...B......B.QC...B.!j...B.!D...@.!..!Z..!..5D..!....h. ..B..-...B......B.QC...B.!j...B.!D...@.!..!Z..!..5D..!....h. ..B.....!.fA`)`<0...z.9..=.[.X8......;.y....m..7...W.W....].Qp.....,.Lh..$.DC.......Hf]kL.../b...}..)..B.A..!.1.X.........).Y.<.......Y%D...@..t.......V.&.%S.U".....5........(!....B...}..K..F.4.......K..4J.2..........)6...KiP...<.........."!J...B....f..?WOk...........1BwR..((Z...~.......Oi.p.".3pCC^Lk...A..Qw....;.;./.....{.Z.v.....-.D...l.M......6.'.z.j.....-.D]..M.;`[..i...c6p7.3p..DZs...-.D.Y..LCVKl.(...=.B.J......Z....8.)l..(.-........x!.-B.C..Q...v...>
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JSON data
                                          Category:dropped
                                          Size (bytes):607
                                          Entropy (8bit):5.275077743571625
                                          Encrypted:false
                                          SSDEEP:12:YGGHrpH1c0aNmi7W4ZL3JRexJHpJHr+JH6JHWPQ1JH7u5KiYNnOSF5Mh4aC45Imd:YhFHwNhC4ZLJ6JJJL+JaJ2PuJSciYNj4
                                          MD5:4DD0A0FB418ACC732AD2AF6AC559E54E
                                          SHA1:4675C9815A4E4809867F968B81EA71BCFF1B92B7
                                          SHA-256:17F9D08A903F8221B7F3DAB6A14F79E287EEA15A9D49607E86FFFD92DF868421
                                          SHA-512:70066B3FEC3A25D6252547215F545A86954D7A082D04AED4A6C27ED21C7F2B19FC45C3C32205E4078AE0F4E098B486960DC2C9FA6D0300D163FFEE3ED1DEB7B7
                                          Malicious:false
                                          Reputation:low
                                          Preview:{"cc":"US","cnames":{"de":"USA","en":"United States","es":"Estados Unidos","fr":".tats Unis","ja":"....","pt-BR":"EUA","ru":"...","zh-CN":".."},"city":{"de":"Atlanta","en":"Atlanta","es":"Atlanta","fr":"Atlanta","ja":".....","pt-BR":"Atlanta","ru":".......","zh-CN":"...."},"subdiv":[{"de":"","en":"Georgia","es":"Georgia","fr":"G.orgie","ja":"......","pt-BR":"Ge.rgia","ru":"........","zh-CN":"..."}],"pc":"30301","ip":"81.181.57.74","brand":"","model":"Windows Desktop","browser":"Chrome","isp":"Datacamp","lat":33.7485,"long":-84.3871}
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 12 x 12, 8-bit/color RGB, non-interlaced
                                          Category:dropped
                                          Size (bytes):364
                                          Entropy (8bit):7.161449027375991
                                          Encrypted:false
                                          SSDEEP:6:6v/lhPkd5nDsLiRa6NhNj1aUIXtYRJiTDc7VkC0hWQpPBPFLsfd9EZXlo1p:6v/7yOLiRa6NzJJyusykCmpBFLoGi
                                          MD5:E144C3378090087C8CE129A30CB6CB4E
                                          SHA1:59DA5466551DE941D0215E45C54AA2CEAF436BE1
                                          SHA-256:B13A03E0DB893734298CBE203BF264407636FFE5DAB0A141F83C492D0034DD6A
                                          SHA-512:3004885B1DCC8C8544024F3C1345B80AB6B50759F290A3545BFA4ED7EA93426E838B7A04556294298BAD1C6198431FBDE06E999628E45DE10119DD1D4FABE32A
                                          Malicious:false
                                          Reputation:low
                                          Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.\...E@.....TB...-n$...(....5T.7.x.=ZQ...l(n#....WL....N..rY..WY.%I..0.UU/N....|.,K...)...mEQ,.b].p.....8.u]..<....'...ih.....8`.8.........eY..^.o=..........4M..EQ?.B...a.v...q.e..A.^.W.E.4......e.}......+.0........+......m.TI|...3MS0.,{.wq.w.$.>|....0.u.{........IEND.B`.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1476), with CRLF line terminators
                                          Category:downloaded
                                          Size (bytes):13213
                                          Entropy (8bit):5.271714525375846
                                          Encrypted:false
                                          SSDEEP:384:pNKbX+OMqGk/kFkv3fsGbLMWnPdAEFiLYVo:pbAiZ
                                          MD5:9A019628A97A1E2D946C8B7E3CFBA132
                                          SHA1:BFB6E46DD9B072B470779A89D8034ACA476A64C3
                                          SHA-256:0EF64B15E16E46929DE9A87837E084A8F291A33DA08E1B61F62C2EAEB4706985
                                          SHA-512:8CDD92ABA589128D608DEB52B826A16A8EFD89DA0542546C54143CB1D8D21348980C491A0A58DF765DC2AB4FDCAA9580D7C07061D897FF924A4096BA6C034304
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Preview:<html><head><script>function requestLink(){return {sessionId:['sid','t1~x0hgjdzxqkzaumrwysnznltv']};}var geoInfo={"cc":"US","cnames":{"de":"USA","en":"United States","es":"Estados Unidos","fr":".tats Unis","ja":"....","pt-BR":"EUA","ru":"...","zh-CN":".."},"city":{"de":"Atlanta","en":"Atlanta","es":"Atlanta","fr":"Atlanta","ja":".....","pt-BR":"Atlanta","ru":".......","zh-CN":"...."},"subdiv":{"de":"","en":"Georgia","es":"Georgia","fr":"G.orgie","ja":"......","pt-BR":"Ge.rgia","ru":"........","zh-CN":"..."},"pc":"30301","lat":33.7485,"long":-84.3871};var ip='81.181.57.74';var devInfo='Datacamp';</script>...<title>Prize</title>...<meta charset="utf-8">...<link rel="stylesheet" type="text/css" href="/media/mainstream/all/cf/style7.css">...<meta name="viewport" content="width=device-width, initial-scale=1.0">...<script src="/media/mainstream/all/cf/1.js"></script>...<script src="/media/mainstream/u.js"></script>...<link
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 276 x 276, 8-bit colormap, non-interlaced
                                          Category:downloaded
                                          Size (bytes):23977
                                          Entropy (8bit):7.963370440049509
                                          Encrypted:false
                                          SSDEEP:384:FWsrbfeuSzXzJpEnr3VWd5Pecq+0OVuFqNYD0pUdbhoxT2M5a15i6mfEM9mOTMpT:FWsPfeuAXnALV6allFWUJSwKa15i6IiJ
                                          MD5:B31B2DE6BA6AB0D538C6249BA43AF93D
                                          SHA1:2B98AD47E3FBB048EFAC90C6C53C5E41C0BA43BF
                                          SHA-256:A208625353FE3613A5BD7498C69D0921B33FACD1A658FE8CC661B704C248E0C0
                                          SHA-512:054FA624EB2072A84B49E36F0BBE9D28CA71D4404EE7F8A6BD4F4A9C68D9C29C6841E88667E05EAC97D22E2E81F0956257320502C3965FADADC5CDB3824FE7BC
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/cf/box.png
                                          Preview:.PNG........IHDR..............9K....PLTE.................................................4B..W..5............=.!(.J.c K#..k..E.e.W.v.4.g...w{.5E.n._D.q3.v'._do ..R..CR..JU.Wb.)>../.I...1..,..0.....r.W......../..d..,..(..y..3..k..-.0B.S..\...+..7...;J....W..]..R.EP..*...b../.@M......5F..L....h..KW.$;..5.*>..=.+..9..G.m....Q\.-?.&;..&.'../.r...=.1..2.w .Xa.$9.x..~(.&..B.n..8F........3..4..h.........6...!........D..O....v..N..F.._.......0.9..$.....U...kr..#..\.=.#...]..N....N...y.9.......dl..4.!.Y..*...p$.IS....r.P..D..g.....8..v......h..6..f..:.....{-.m..i#.E.....h..W..B.[g._...6...8./...L.<..S[.y..b.}......-.-..V......K.-.t{.J..F.`.......\.x*n...!.-|!......0..,.%....#...6..g..k.*8.[.FO.0P.....w@.)3.H(.S..@F.Q.bG.).kG....J..x].md'...7tRNS..."*3D;OZ.d}..r.....k"..........I.2...bU......6x...Ey]...Z!IDATx..?..`..... E..J[....:.=........i.%. !.28.v.J..^.)o.....! ..:.:.:..=O.....4r.(....}...y...e.-[.sJ..}a.)%.&
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 48x48, components 3
                                          Category:downloaded
                                          Size (bytes):807
                                          Entropy (8bit):6.886934945049654
                                          Encrypted:false
                                          SSDEEP:24:VaPXXREztxL0g4zXM7EsGFp/kNSIdh+OA6:VapEsgVQzcNBdhI6
                                          MD5:3C777668DAFEEB70CCC712B2772D7BC5
                                          SHA1:C896B95B8DE6A5773F805862B7EDA76AFDCEE5BF
                                          SHA-256:7FBBAED15A8BEAF623F6EAAB8C739875E3F90DD929E09A03BCDB2327E486C438
                                          SHA-512:BA9676D91E51B9001F2FDA8E90597799103C1E2CF0EC9F5601A015D8764AC49D5F79AB61A1664592833D6353F701602791FEA0EBCB1ACE0E1FF44A54A634B8E0
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/cf/winner_initial_r.jpg
                                          Preview:......JFIF.....H.H.....C....................................................................C.......................................................................0.0..........................................)............................!.1A."Qa.#B................................#.........................!1.a3AqQ............?.......H........%G'..hn.^V...o,+lZK.f4...K"R..3-....z...2.#...\..u.r.b..rQ...........*..c.6..P...d.a...y..X...".j.F.[i_.C.+3.F.......R.Irn'Wi.#.+./..#..j.B....."DL<....[Q..Y.qgy..7..R......6.?..u./%.u..-...3.).~.....e*.........v..1..}*...k*...b.*[u3_..T..lk.Zym......q.f.B....?...,(.......V..>.Qe...cWS.oL..O%..._z..*.?..m..-5*>.7g?..y.".......6..3...x..-nml..3....Iu..4{rC.Z.-.........i..K=../..u..DkH5WV.n...K.7-....KjI8....[...YA..M....B.l.2$.`..$Y.a .. ....
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 48x48, components 3
                                          Category:downloaded
                                          Size (bytes):1891
                                          Entropy (8bit):7.70040848535202
                                          Encrypted:false
                                          SSDEEP:48:VaF0rxKk2K6llP+1RTwTnPZmdqH8+v17cAdg:VGv3+sB5Hdg
                                          MD5:7BA72CAFB47B63A3277FF2EE2F06D7DF
                                          SHA1:226F26699FCC902D78E5DD33B5F205CA94E2D3B7
                                          SHA-256:7C1304A435337D677C1BB2E43007B946AEA6571CACB2B12BF150676DCBD6B8C3
                                          SHA-512:12D830B86249F0C372D210CA49A6ACBA6F68A3A1A75ED1787C28093B0FDD81A9CE9EAD230D7996BCA007023C731BA6AB59C2F8A0E1F095D93A09040CF4DE5C44
                                          Malicious:false
                                          Reputation:low
                                          URL:https://2041.awlivedose.live/media/mainstream/all/cf/winner_4.jpg
                                          Preview:......JFIF.....H.H.....C....................................................................C.......................................................................0.0.........................................0............................!1."AQ...#2aq.$%B.................................,..........................!..AQ"123q.#BRa.............?.w.zyI.{K.Un*.R.f..l:...Z..<nn...Z@iW.*).......Xx..h..nL...~]...a.JeC....=).t.b>.#.T.....z.vT......U..bC....4.mZ>...$.?.....x.P..~..W.#..V..k.......1.{O.Ny.f....8...;..#S..3....&.;R...F..)P.._...\ob....|m..|qPe+Y.h. nS.R.6.R.NHrR2hD(..D...N....q.....`...:.E.S5..\&Y...\....UTYV..`...d.S..:..L...N....6.\.......;.....9/......e=.GQ\^...jw...f.0.....Yy....#O.q.Q.. [6.....&...BuM...kA....J...k;!..).@.s..+.}}.{..;..V..=...l.).h0*d..L..::o....\..{.~.M.W.?....S<......S)...n$Q.E.y]}.L...N...1...N ..]9.. mw..C/D.L...K.K..j.hU..3.A...N.^Ux../...0F......x.V}|..]/...5...L..t...c.F......!....8E.<HA..}X.v.[...t....q.<...
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:ASCII text, with very long lines (32058)
                                          Category:downloaded
                                          Size (bytes):86659
                                          Entropy (8bit):5.36781915816204
                                          Encrypted:false
                                          SSDEEP:1536:YNhEyjjTikEJO4edXXe9J578go6MWX2xkj8e4c4j2ll2AckaXEP6n15HZ+FhFcQ7:uxc2yjx4j2uX/kcQDU8Cu9
                                          MD5:C9F5AEECA3AD37BF2AA006139B935F0A
                                          SHA1:1055018C28AB41087EF9CCEFE411606893DABEA2
                                          SHA-256:87083882CC6015984EB0411A99D3981817F5DC5C90BA24F0940420C5548D82DE
                                          SHA-512:DCFF2B5C2B8625D3593A7531FF4DDCD633939CC9F7ACFEB79C18A9E6038FDAA99487960075502F159D44F902D965B0B5AED32B41BFA66A1DC07D85B5D5152B58
                                          Malicious:false
                                          Reputation:low
                                          URL:https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
                                          Preview:/*! jQuery v3.2.1 | (c) JS Foundation and other contributors | jquery.org/license */.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b||d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.2.1",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 85x119, components 3
                                          Category:dropped
                                          Size (bytes):4130
                                          Entropy (8bit):7.8501946403645695
                                          Encrypted:false
                                          SSDEEP:48:Rx1IqXlrGjObxvtVwZOssPZqMlbP2pa6mvjQQE1Nv59s5CNoMqkRo1Av1nXym+nu:PaI6jsxvsOsWREa6QQD1p593/MANOs7
                                          MD5:3776A9F0C3B19E203951D23C2D577F31
                                          SHA1:779D1935ED4017EF580288246B5259FAD9F17B84
                                          SHA-256:F9B405EE4B9F6B58E46BAFB40463FB08A4EE39C945389D2FCD7E3F8F15959C14
                                          SHA-512:E4434FE4028EEA9F9C7D59FF73219A0D46FC6ADC32981DE161A620F168D6F57554D68F111F60DD8398E25E9FA054E0FFB437733196AECEDFC2699D9529E2368F
                                          Malicious:false
                                          Reputation:low
                                          Preview:......JFIF.............C....................................................................C.......................................................................w.U.........................................................................................$.7.<.-.....f,L........s.LMY.......p%.Ve...3....8,.KED.c.!.#jy....h....d.....8o...p%.2N].2...o_M.....[.....p%.20.....u.....GY......n..........m.>..).9v..}e#.{...`9j......KDdhsr.i.V......K...>..:#c...g.w.Z##R....u...*....'...\..7.Aw.Z##Y....^r.|.......w.Z#'V.....`......55.hv.Js....1f.r)..........%.........................8...... ...............v.G..)^..J..JW.2R.Rno6...Jd.zS%(^B......j...q.1.u.$...[..Qc...u.Kb..@..0...0.)2.i9.....'..[..mM.f..$..}n....da...X.pM.f...m.)..p.....}.-.M....U.<i..1.........S.f[........3.fc6..Y.$?.+...]..W('|.(.RH5.U.a.1...G.D2._.....W,.......U...[......e#..3jnc6....wS..'......!} ...9...3jnc6...z....a$CHD.8..A..........k.......~....h..U.tH0A .(%.......w$]>../...S3..U.......
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:HTML document, ASCII text, with very long lines (10920), with no line terminators
                                          Category:downloaded
                                          Size (bytes):10920
                                          Entropy (8bit):5.256617725651326
                                          Encrypted:false
                                          SSDEEP:192:Vev8Wbmq69OCKK6BsPLb6PfblemMmVfVoDZ66Dq95:U8SurKKc6Lb6PT0mnVfSDZ6Lb
                                          MD5:C0D599AE0569A5407B71B72EE1D79A29
                                          SHA1:7BA9CAA0DAA9AF56AD27E99A48C2C2288D44506C
                                          SHA-256:8FE45BB754321FC5F0DFF361D29FBCAC129EB3C1D208AFF25BD8D087D6537F42
                                          SHA-512:09D681DFC52CAE591538FD58623A429F3C5256A59F0DC293F9AB5C9875635CF5DBB587B49CD4EA2FFFF55AC44FA9658FF2DAC8116F844EC43F2E2D584ADE84E0
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/modernizr.min.js
                                          Preview:window.Modernizr=function(e,t,n){function r(e){h.cssText=e}function o(e,t){return typeof e===t}function a(e,t){return!!~(""+e).indexOf(t)}function i(e,t){for(var r in e){var o=e[r];if(!a(o,"-")&&h[o]!==n)return"pfx"!=t||o}return!1}function c(e,t,r){for(var a in e){var i=t[e[a]];if(i!==n)return!1===r?e[a]:o(i,"function")?i.bind(r||t):i}return!1}function s(e,t,n){var r=e.charAt(0).toUpperCase()+e.slice(1),a=(e+" "+x.join(r+" ")+r).split(" ");return o(t,"string")||o(t,"undefined")?i(a,t):c(a=(e+" "+w.join(r+" ")+r).split(" "),t,n)}var u,l,d={},f=t.documentElement,m="modernizr",p=t.createElement(m),h=p.style,g=t.createElement("input"),v=":)",y={}.toString,b=" -webkit- -moz- -o- -ms- ".split(" "),E="Webkit Moz O ms",x=E.split(" "),w=E.toLowerCase().split(" "),S="http://www.w3.org/2000/svg",C={},k={},T={},N=[],M=N.slice,P=function(e,n,r,o){var a,i,c,s,u=t.createElement("div"),l=t.body,d=l||t.createElement("body");if(parseInt(r,10))for(;r--;)(c=t.createElement("div")).id=o?o[r]:m+(r+1),u.appe
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:assembler source, ASCII text, with CRLF line terminators
                                          Category:downloaded
                                          Size (bytes):8618
                                          Entropy (8bit):5.206113790847079
                                          Encrypted:false
                                          SSDEEP:192:B5FIiHvWYN9Eshe2ZlYJjxzkmQQlweV+B0UvUkq7hCNPLVa28/OwB46VRVNBw3Nn:B5FImWYNCsheElYJjxzkmYe4Bz+7hCNl
                                          MD5:8F643FD5582FA3C12F874DFD5778B92E
                                          SHA1:A3ECB6D5A72B9C83E2EE0DECCD6DD57694B4E5F1
                                          SHA-256:68CE158EC295CE170575CCE4601FD70553FC2CFA6AC51C8492E6909BA4305F85
                                          SHA-512:01E25751754AB633E6123D5EED7227DA12FBB65AF8B464B71314D128212A8E789088E104AB3354D0AC87E2890DA75D97DF735CD21B0FE1BAAF27BACC4005308E
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/chat2.css
                                          Preview:#wrapper {.../* width: 600px;.. margin: 50px auto;*/..}...bounce {...-webkit-border-radius: 50%;...-moz-border-radius: 50%;...-ms-border-radius: 50%;...border-radius: 50%;...animation: bounce 2s infinite;...-webkit-animation: bounce 2s infinite;...-moz-animation: bounce 2s infinite;...-o-animation: bounce 2s infinite;..}....@-webkit-keyframes bounce {...0%,...20%,...50%,...80%,...100% {....-webkit-transform: translateY(0);...}...40% {....-webkit-transform: translateY(-30px);...}...60% {....-webkit-transform: translateY(-15px);...}..}....@-moz-keyframes bounce {...0%,...20%,...50%,...80%,...100% {....-moz-transform: translateY(0);...}...40% {....-moz-transform: translateY(-30px);...}...60% {....-moz-transform: translateY(-15px);...}..}....@-o-keyframes bounce {...0%,...20%,...50%,...80%,...100% {....-o-transform: translateY(0);...}...40% {....-o-transform: translateY(-30px);...}...60% {....-o-transform: translateY(-15px);...}..}..@keyframes bounce {...0%,...20%,...50%,...80%,...100% {.
                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          File Type:PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
                                          Category:downloaded
                                          Size (bytes):3834
                                          Entropy (8bit):7.661511605576764
                                          Encrypted:false
                                          SSDEEP:96:UgQ99q3GTte0IZF+gPYLRGssABY1sdaS+9:Qs680IjnPIz8Z9
                                          MD5:77A2FFC5545F87551D74781201DE9B3B
                                          SHA1:C9C3798AFD2AE95AA3BBA3C428335D49C8255B06
                                          SHA-256:316E6A6737BD296AB30ACA2EF7FA36F119D15786A2432D01E31FDC130272F15C
                                          SHA-512:CD1A966E47A63AF86E7AC34D58051EF6EA6E0BB5B8ABE14981BD088462667B5A69974B394E960C61F8ED559FB33A2C638D90C004EE13FA985A3F11455213FC2E
                                          Malicious:false
                                          Reputation:low
                                          URL:https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/def.png
                                          Preview:.PNG........IHDR.............R.l.....tEXtSoftware.Adobe ImageReadyq.e<...siTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:c42f55b0-556c-f647-9b5f-ce457f4ebdde" xmpMM:DocumentID="xmp.did:CC2FE32CB28311EB83B6BD6A3591FD42" xmpMM:InstanceID="xmp.iid:CC2FE32BB28311EB83B6BD6A3591FD42" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:c42f55b0-556c-f647-9b5f-ce457f4ebdde" stRef:documentID="xmp.did:c42f55b0-556c-f647-9b5f-ce457f4ebdde"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>k.1.....IDATx..{.]E....H.. .A....%`..
                                          No static file info
                                          TimestampSource PortDest PortSource IPDest IP
                                          Jan 20, 2024 00:41:01.321897984 CET49675443192.168.2.4173.222.162.32
                                          Jan 20, 2024 00:41:10.931041956 CET49675443192.168.2.4173.222.162.32
                                          Jan 20, 2024 00:41:11.240300894 CET49729443192.168.2.4108.177.122.84
                                          Jan 20, 2024 00:41:11.240345955 CET44349729108.177.122.84192.168.2.4
                                          Jan 20, 2024 00:41:11.240405083 CET49729443192.168.2.4108.177.122.84
                                          Jan 20, 2024 00:41:11.241044044 CET49730443192.168.2.4172.253.124.139
                                          Jan 20, 2024 00:41:11.241127968 CET44349730172.253.124.139192.168.2.4
                                          Jan 20, 2024 00:41:11.241190910 CET49730443192.168.2.4172.253.124.139
                                          Jan 20, 2024 00:41:11.244267941 CET49730443192.168.2.4172.253.124.139
                                          Jan 20, 2024 00:41:11.244303942 CET44349730172.253.124.139192.168.2.4
                                          Jan 20, 2024 00:41:11.244405031 CET49729443192.168.2.4108.177.122.84
                                          Jan 20, 2024 00:41:11.244429111 CET44349729108.177.122.84192.168.2.4
                                          Jan 20, 2024 00:41:11.509094954 CET44349730172.253.124.139192.168.2.4
                                          Jan 20, 2024 00:41:11.509430885 CET49730443192.168.2.4172.253.124.139
                                          Jan 20, 2024 00:41:11.509450912 CET44349730172.253.124.139192.168.2.4
                                          Jan 20, 2024 00:41:11.509998083 CET44349730172.253.124.139192.168.2.4
                                          Jan 20, 2024 00:41:11.510061979 CET49730443192.168.2.4172.253.124.139
                                          Jan 20, 2024 00:41:11.511445999 CET44349730172.253.124.139192.168.2.4
                                          Jan 20, 2024 00:41:11.511504889 CET49730443192.168.2.4172.253.124.139
                                          Jan 20, 2024 00:41:11.511826992 CET44349729108.177.122.84192.168.2.4
                                          Jan 20, 2024 00:41:11.513969898 CET49729443192.168.2.4108.177.122.84
                                          Jan 20, 2024 00:41:11.513999939 CET44349729108.177.122.84192.168.2.4
                                          Jan 20, 2024 00:41:11.514596939 CET49730443192.168.2.4172.253.124.139
                                          Jan 20, 2024 00:41:11.514880896 CET44349730172.253.124.139192.168.2.4
                                          Jan 20, 2024 00:41:11.515770912 CET49730443192.168.2.4172.253.124.139
                                          Jan 20, 2024 00:41:11.515796900 CET44349730172.253.124.139192.168.2.4
                                          Jan 20, 2024 00:41:11.515825033 CET44349729108.177.122.84192.168.2.4
                                          Jan 20, 2024 00:41:11.515892029 CET49729443192.168.2.4108.177.122.84
                                          Jan 20, 2024 00:41:11.516949892 CET49729443192.168.2.4108.177.122.84
                                          Jan 20, 2024 00:41:11.517031908 CET44349729108.177.122.84192.168.2.4
                                          Jan 20, 2024 00:41:11.517148018 CET49729443192.168.2.4108.177.122.84
                                          Jan 20, 2024 00:41:11.517158031 CET44349729108.177.122.84192.168.2.4
                                          Jan 20, 2024 00:41:11.570188999 CET49730443192.168.2.4172.253.124.139
                                          Jan 20, 2024 00:41:11.632836103 CET49729443192.168.2.4108.177.122.84
                                          Jan 20, 2024 00:41:11.717705965 CET44349730172.253.124.139192.168.2.4
                                          Jan 20, 2024 00:41:11.718103886 CET44349730172.253.124.139192.168.2.4
                                          Jan 20, 2024 00:41:11.718200922 CET49730443192.168.2.4172.253.124.139
                                          Jan 20, 2024 00:41:11.718739033 CET49730443192.168.2.4172.253.124.139
                                          Jan 20, 2024 00:41:11.718779087 CET44349730172.253.124.139192.168.2.4
                                          Jan 20, 2024 00:41:11.723292112 CET44349729108.177.122.84192.168.2.4
                                          Jan 20, 2024 00:41:11.723673105 CET44349729108.177.122.84192.168.2.4
                                          Jan 20, 2024 00:41:11.723747015 CET49729443192.168.2.4108.177.122.84
                                          Jan 20, 2024 00:41:11.724319935 CET49729443192.168.2.4108.177.122.84
                                          Jan 20, 2024 00:41:11.724350929 CET44349729108.177.122.84192.168.2.4
                                          Jan 20, 2024 00:41:15.655194998 CET49760443192.168.2.4104.21.56.41
                                          Jan 20, 2024 00:41:15.655272007 CET44349760104.21.56.41192.168.2.4
                                          Jan 20, 2024 00:41:15.655555010 CET49760443192.168.2.4104.21.56.41
                                          Jan 20, 2024 00:41:15.656786919 CET49760443192.168.2.4104.21.56.41
                                          Jan 20, 2024 00:41:15.656821966 CET44349760104.21.56.41192.168.2.4
                                          Jan 20, 2024 00:41:15.863571882 CET49770443192.168.2.474.125.136.106
                                          Jan 20, 2024 00:41:15.863645077 CET4434977074.125.136.106192.168.2.4
                                          Jan 20, 2024 00:41:15.863750935 CET49770443192.168.2.474.125.136.106
                                          Jan 20, 2024 00:41:15.865093946 CET49770443192.168.2.474.125.136.106
                                          Jan 20, 2024 00:41:15.865122080 CET4434977074.125.136.106192.168.2.4
                                          Jan 20, 2024 00:41:15.913944006 CET44349760104.21.56.41192.168.2.4
                                          Jan 20, 2024 00:41:15.915446997 CET49760443192.168.2.4104.21.56.41
                                          Jan 20, 2024 00:41:15.915476084 CET44349760104.21.56.41192.168.2.4
                                          Jan 20, 2024 00:41:15.917087078 CET44349760104.21.56.41192.168.2.4
                                          Jan 20, 2024 00:41:15.917187929 CET49760443192.168.2.4104.21.56.41
                                          Jan 20, 2024 00:41:15.918837070 CET49760443192.168.2.4104.21.56.41
                                          Jan 20, 2024 00:41:15.918917894 CET44349760104.21.56.41192.168.2.4
                                          Jan 20, 2024 00:41:15.919472933 CET49760443192.168.2.4104.21.56.41
                                          Jan 20, 2024 00:41:15.919482946 CET44349760104.21.56.41192.168.2.4
                                          Jan 20, 2024 00:41:15.967389107 CET49760443192.168.2.4104.21.56.41
                                          Jan 20, 2024 00:41:16.120079041 CET4434977074.125.136.106192.168.2.4
                                          Jan 20, 2024 00:41:16.125334024 CET49770443192.168.2.474.125.136.106
                                          Jan 20, 2024 00:41:16.125354052 CET4434977074.125.136.106192.168.2.4
                                          Jan 20, 2024 00:41:16.128289938 CET4434977074.125.136.106192.168.2.4
                                          Jan 20, 2024 00:41:16.128351927 CET49770443192.168.2.474.125.136.106
                                          Jan 20, 2024 00:41:16.131225109 CET49770443192.168.2.474.125.136.106
                                          Jan 20, 2024 00:41:16.131429911 CET4434977074.125.136.106192.168.2.4
                                          Jan 20, 2024 00:41:16.179184914 CET49770443192.168.2.474.125.136.106
                                          Jan 20, 2024 00:41:16.179204941 CET4434977074.125.136.106192.168.2.4
                                          Jan 20, 2024 00:41:16.225586891 CET49770443192.168.2.474.125.136.106
                                          Jan 20, 2024 00:41:16.398241997 CET44349760104.21.56.41192.168.2.4
                                          Jan 20, 2024 00:41:16.398492098 CET44349760104.21.56.41192.168.2.4
                                          Jan 20, 2024 00:41:16.398560047 CET49760443192.168.2.4104.21.56.41
                                          Jan 20, 2024 00:41:16.452307940 CET49760443192.168.2.4104.21.56.41
                                          Jan 20, 2024 00:41:16.452364922 CET44349760104.21.56.41192.168.2.4
                                          Jan 20, 2024 00:41:16.889024019 CET49774443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:16.889085054 CET44349774104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:16.889183998 CET49774443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:16.889503002 CET49774443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:16.889532089 CET44349774104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:17.028256893 CET49775443192.168.2.4184.31.62.93
                                          Jan 20, 2024 00:41:17.028295040 CET44349775184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:17.028510094 CET49775443192.168.2.4184.31.62.93
                                          Jan 20, 2024 00:41:17.030953884 CET49775443192.168.2.4184.31.62.93
                                          Jan 20, 2024 00:41:17.031028032 CET44349775184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:17.153650045 CET44349774104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:17.153978109 CET49774443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:17.153995991 CET44349774104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:17.155597925 CET44349774104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:17.155684948 CET49774443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:17.256130934 CET44349775184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:17.256212950 CET49775443192.168.2.4184.31.62.93
                                          Jan 20, 2024 00:41:17.260452032 CET49775443192.168.2.4184.31.62.93
                                          Jan 20, 2024 00:41:17.260483027 CET44349775184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:17.260890961 CET44349775184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:17.305249929 CET49776443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:17.305279970 CET44349776104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:17.305347919 CET49776443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:17.308279991 CET49775443192.168.2.4184.31.62.93
                                          Jan 20, 2024 00:41:17.314342022 CET49776443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:17.314352036 CET44349776104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:17.315964937 CET49774443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:17.316310883 CET44349774104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:17.317790985 CET49774443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:17.317811966 CET44349774104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:17.371648073 CET49774443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:17.561513901 CET44349776104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:17.612047911 CET49776443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:17.614064932 CET49776443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:17.614072084 CET44349776104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:17.615514040 CET44349776104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:17.615576982 CET49776443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:17.621516943 CET49776443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:17.621660948 CET44349776104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:17.676047087 CET49776443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:17.676054955 CET44349776104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:17.724039078 CET49776443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:17.849658012 CET44349774104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:17.849968910 CET44349774104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:17.850660086 CET49774443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:17.884345055 CET49774443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:17.884358883 CET44349774104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:17.888605118 CET49775443192.168.2.4184.31.62.93
                                          Jan 20, 2024 00:41:17.929965019 CET44349775184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:17.992347002 CET44349775184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:17.992482901 CET44349775184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:17.992558002 CET49775443192.168.2.4184.31.62.93
                                          Jan 20, 2024 00:41:18.014229059 CET49775443192.168.2.4184.31.62.93
                                          Jan 20, 2024 00:41:18.014246941 CET44349775184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:18.014267921 CET49775443192.168.2.4184.31.62.93
                                          Jan 20, 2024 00:41:18.014276028 CET44349775184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:18.051115990 CET49785443192.168.2.4184.31.62.93
                                          Jan 20, 2024 00:41:18.051137924 CET44349785184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:18.051204920 CET49785443192.168.2.4184.31.62.93
                                          Jan 20, 2024 00:41:18.051598072 CET49785443192.168.2.4184.31.62.93
                                          Jan 20, 2024 00:41:18.051613092 CET44349785184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:18.121184111 CET49786443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:18.121222973 CET44349786185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:18.121284008 CET49786443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:18.122534990 CET49786443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:18.122551918 CET44349786185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:18.145162106 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:18.145225048 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:18.145309925 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:18.145673990 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:18.145704031 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:18.273471117 CET44349785184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:18.273577929 CET49785443192.168.2.4184.31.62.93
                                          Jan 20, 2024 00:41:18.299316883 CET49785443192.168.2.4184.31.62.93
                                          Jan 20, 2024 00:41:18.299338102 CET44349785184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:18.300230026 CET44349785184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:18.302529097 CET49785443192.168.2.4184.31.62.93
                                          Jan 20, 2024 00:41:18.345931053 CET44349785184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:18.473169088 CET44349785184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:18.473314047 CET44349785184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:18.473428965 CET49785443192.168.2.4184.31.62.93
                                          Jan 20, 2024 00:41:18.476171970 CET49785443192.168.2.4184.31.62.93
                                          Jan 20, 2024 00:41:18.476171970 CET49785443192.168.2.4184.31.62.93
                                          Jan 20, 2024 00:41:18.476202011 CET44349785184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:18.476227999 CET44349785184.31.62.93192.168.2.4
                                          Jan 20, 2024 00:41:18.761090040 CET44349786185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:18.772048950 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:18.778619051 CET49786443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:18.778650045 CET44349786185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:18.778896093 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:18.778934956 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:18.780327082 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:18.780426979 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:18.782577038 CET44349786185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:18.782670975 CET49786443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.200150967 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.200288057 CET49786443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.200339079 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.200449944 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.200467110 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.200598955 CET44349786185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.247883081 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.405935049 CET44349786185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.406028032 CET49786443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.575320959 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.575351954 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.575401068 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.575429916 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.575436115 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.575449944 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.575467110 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.575494051 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.575495005 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.575506926 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.575544119 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.575546980 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.575558901 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.575597048 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.782757998 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.782944918 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.782998085 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.783030033 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.783051014 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.783054113 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.783091068 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.783104897 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.783147097 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.783200979 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.783207893 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.783250093 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.783255100 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.783302069 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.783307076 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.783360958 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.783365965 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.783407927 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.783427954 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.783477068 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.783519983 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.783572912 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.783612013 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.783663988 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.783704042 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.783754110 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.783799887 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.783854008 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:19.783866882 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.783951998 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:19.787128925 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:20.288578987 CET49787443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:20.288645029 CET44349787185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:20.816421986 CET49786443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:20.857952118 CET44349786185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:20.882117987 CET49788443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:20.882198095 CET44349788185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:20.882272005 CET49788443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:20.882946968 CET49789443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:20.883008957 CET44349789185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:20.883065939 CET49789443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:20.884665012 CET49788443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:20.884694099 CET44349788185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:20.885849953 CET49789443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:20.885871887 CET44349789185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:21.026094913 CET44349786185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:21.026194096 CET44349786185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:21.026247978 CET49786443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:21.041985989 CET49786443192.168.2.4185.155.184.32
                                          Jan 20, 2024 00:41:21.042030096 CET44349786185.155.184.32192.168.2.4
                                          Jan 20, 2024 00:41:21.551063061 CET44349788185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:21.552001953 CET44349789185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:21.604499102 CET49789443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:21.620517015 CET49788443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.297516108 CET49789443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.297566891 CET44349789185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.297739983 CET49788443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.297817945 CET44349788185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.299226046 CET44349789185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.299246073 CET44349789185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.299288988 CET49789443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.300770998 CET49789443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.300858974 CET44349789185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.300970078 CET49789443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.300987005 CET44349789185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.301575899 CET44349788185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.301635981 CET44349788185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.301656008 CET49788443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.302647114 CET49788443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.302849054 CET44349788185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.402894974 CET49789443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.429922104 CET49788443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.429949999 CET44349788185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.517205954 CET44349789185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.517262936 CET44349789185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.517318010 CET49789443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.517338037 CET44349789185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.517383099 CET49789443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.517398119 CET44349789185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.517441988 CET44349789185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.517493963 CET49789443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.517502069 CET44349789185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.517541885 CET49789443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.546741962 CET49790443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.546783924 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.546854973 CET49790443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.547404051 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.547508001 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.547580957 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.548265934 CET49792443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.548285007 CET44349792185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.548352003 CET49792443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.548839092 CET49788443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.549458027 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.549475908 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.549535990 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.550107956 CET49790443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.550127983 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.550467014 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.550504923 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.551307917 CET49792443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.551331997 CET44349792185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.551898956 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.551909924 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.589946032 CET44349788185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.724827051 CET44349789185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.724860907 CET44349789185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.724899054 CET49789443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.725120068 CET44349789185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.725171089 CET49789443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.727421045 CET49789443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.727447987 CET44349789185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.727818966 CET49794443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.727845907 CET44349794185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.727909088 CET49794443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.728754997 CET49794443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.728773117 CET44349794185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.815800905 CET44349788185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.815870047 CET44349788185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.815948009 CET49788443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.815978050 CET44349788185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.816004038 CET44349788185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.816031933 CET44349788185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.816046000 CET49788443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.816046000 CET49788443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.816288948 CET44349788185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:22.816348076 CET49788443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.819753885 CET49788443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:22.819783926 CET44349788185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.013365984 CET44349792185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.013744116 CET49792443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.013804913 CET44349792185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.016294956 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.016546965 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.016565084 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.017059088 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.017432928 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.017524004 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.017591000 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.017848969 CET44349792185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.017923117 CET49792443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.018332005 CET49792443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.018438101 CET49792443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.018449068 CET44349792185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.018645048 CET44349792185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.019639969 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.019809008 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.019824982 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.021284103 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.021336079 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.021986961 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.022094965 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.022114038 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.023991108 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.024404049 CET49790443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.024415970 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.025546074 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.026012897 CET49790443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.026134014 CET49790443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.026140928 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.026195049 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.061907053 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.065926075 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.105698109 CET49792443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.105756998 CET44349792185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.105799913 CET49790443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.148786068 CET44349794185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.149260044 CET49794443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.149277925 CET44349794185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.150734901 CET44349794185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.150814056 CET49794443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.151333094 CET49794443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.151469946 CET49794443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.151474953 CET44349794185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.151582956 CET44349794185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.229656935 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.229677916 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.229707956 CET49794443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.229718924 CET44349794185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.308224916 CET49792443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.427820921 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.427862883 CET49794443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.474271059 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.474301100 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.474390030 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.474452019 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.474509954 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.474669933 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.474730968 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.476946115 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.477005005 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.477073908 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.477089882 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.477129936 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.477190018 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.477200031 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.521703959 CET44349792185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.521770954 CET44349792185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.521835089 CET49792443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.521853924 CET44349792185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.521995068 CET44349792185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.522165060 CET49792443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.523782015 CET49792443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.523823023 CET44349792185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.532780886 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.532807112 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.532849073 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.532862902 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.532881975 CET49790443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.532896996 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.532922029 CET49790443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.595017910 CET49790443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.608378887 CET44349794185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.608475924 CET44349794185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.608530045 CET49794443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.608547926 CET44349794185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.608586073 CET44349794185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.608638048 CET49794443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.608644962 CET44349794185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.627896070 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.681917906 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.681993961 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.682008982 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.682087898 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.682116985 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.682137012 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.682137012 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.682158947 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.682178974 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.682183027 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.682224989 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.682238102 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.682256937 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.682306051 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.682306051 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.682323933 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.682365894 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.682365894 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.682383060 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.682394981 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.682431936 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.683115005 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.683130026 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.683177948 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.683180094 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.683197021 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.683232069 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.683249950 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.683250904 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.683264971 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.683300018 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.686976910 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.687026978 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.687041044 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.687089920 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.687333107 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.687412977 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.687988043 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.689295053 CET49793443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.689315081 CET44349793185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.740781069 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.740796089 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.740850925 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.740854025 CET49790443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.740900040 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.740907907 CET49790443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.740911961 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.740942955 CET49790443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.740945101 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.740983009 CET49790443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.741898060 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.741951942 CET49790443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.741961956 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.742001057 CET49790443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.742311954 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.742362022 CET49790443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.742368937 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.742386103 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.742428064 CET49790443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.749319077 CET49794443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.749597073 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.807761908 CET49790443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.807784081 CET44349790185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.809758902 CET49795443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.809839010 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.809947968 CET49795443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.810148954 CET49796443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.810228109 CET44349796185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.810317039 CET49796443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.810786009 CET49797443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.810822964 CET44349797185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.810869932 CET49797443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.812546015 CET49795443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.812582016 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.813256025 CET49796443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.813288927 CET44349796185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.813610077 CET49797443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.813626051 CET44349797185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.814114094 CET49798443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.814152002 CET44349798185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.814891100 CET49798443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.815287113 CET49798443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.815301895 CET44349798185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.815376043 CET44349794185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.815437078 CET49794443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.815438986 CET44349794185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.815592051 CET44349794185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.815639019 CET49794443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.815649033 CET44349794185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.815732956 CET44349794185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.815783024 CET49794443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.816133022 CET49794443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.816139936 CET44349794185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.818279028 CET49799443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.818296909 CET44349799185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.818351030 CET49799443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.818597078 CET49799443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.818609953 CET44349799185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.889955997 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.889975071 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.890054941 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.890074968 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.890151978 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.890579939 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.890625000 CET44349791185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.890654087 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.890686989 CET49791443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.896433115 CET49800443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.896508932 CET44349800185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:23.896620989 CET49800443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.897047997 CET49800443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:23.897177935 CET44349800185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.047188044 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:24.047241926 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:24.047341108 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:24.047632933 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:24.047652006 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:24.277062893 CET44349798185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.277458906 CET49798443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.277477026 CET44349798185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.278940916 CET44349798185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.279074907 CET49798443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.279515028 CET49798443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.279597044 CET44349798185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.279711008 CET49798443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.279719114 CET44349798185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.286370039 CET44349796185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.286621094 CET49796443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.286681890 CET44349796185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.287838936 CET44349796185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.288502932 CET49796443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.288666964 CET49796443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.288681030 CET44349796185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.333251953 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.333682060 CET49795443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.333713055 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.333904028 CET44349796185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.334492922 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.334868908 CET49795443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.335084915 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.335122108 CET44349797185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.335159063 CET49795443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.335500956 CET49797443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.335517883 CET44349797185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.337969065 CET44349797185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.338056087 CET49797443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.338701963 CET44349799185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.339169979 CET44349800185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.340378046 CET49797443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.340470076 CET44349797185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.340578079 CET49799443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.340607882 CET44349799185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.340955973 CET49797443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.340974092 CET44349797185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.340985060 CET49800443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.341047049 CET44349800185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.342057943 CET44349799185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.342118025 CET49799443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.342614889 CET44349800185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.342681885 CET49800443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.351309061 CET49800443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.351425886 CET44349800185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.353224993 CET49799443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.353306055 CET44349799185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.353729963 CET49800443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.353746891 CET44349800185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.353785038 CET49799443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.353792906 CET44349799185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.381907940 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.416224957 CET49799443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.416229963 CET49796443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.489917040 CET44349798185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.489974976 CET49798443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.492665052 CET49795443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.492671967 CET49797443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.492687941 CET49800443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.683557987 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:24.683821917 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:24.683840990 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:24.685275078 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:24.685340881 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:24.685653925 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:24.685731888 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:24.685777903 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:24.729904890 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:24.737628937 CET44349798185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.737662077 CET44349798185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.737709045 CET49798443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.737723112 CET44349798185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.737776041 CET49798443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.737787962 CET44349798185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.737833977 CET49798443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.737840891 CET44349798185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.737875938 CET44349798185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.737921953 CET49798443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.739447117 CET49798443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.739459991 CET44349798185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.739897966 CET49804443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.739979029 CET44349804185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.740053892 CET49804443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.740683079 CET49804443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.740716934 CET44349804185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.742149115 CET44349796185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.742199898 CET44349796185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.742311954 CET49796443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.742328882 CET44349796185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.742352009 CET44349796185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.742384911 CET49796443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.742419004 CET44349796185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.742454052 CET49796443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.743861914 CET44349796185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.743916035 CET49796443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.745364904 CET49796443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.745393038 CET44349796185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.747646093 CET49805443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.747689009 CET44349805185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.747798920 CET49805443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.748092890 CET49805443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.748111010 CET44349805185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.751323938 CET49806443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:24.751352072 CET44349806185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:24.751414061 CET49806443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:24.751593113 CET49806443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:24.751607895 CET44349806185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:24.752526045 CET44349797185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.752558947 CET44349797185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.752613068 CET49797443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.752626896 CET44349797185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.752665997 CET49797443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.752685070 CET44349797185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.752723932 CET49797443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.754610062 CET49797443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.754625082 CET44349797185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.755001068 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.755012989 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.755065918 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.755069971 CET49795443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.755078077 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.755093098 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.755121946 CET49795443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.755136967 CET49795443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.756694078 CET49807443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.756769896 CET44349807185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.756849051 CET49807443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.757505894 CET49807443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.757540941 CET44349807185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.762756109 CET49808443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:24.762789011 CET44349808185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:24.762855053 CET49808443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:24.763083935 CET49808443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:24.763101101 CET44349808185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:24.774708986 CET44349800185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.774808884 CET44349800185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.774914026 CET49800443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.776451111 CET49800443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.776506901 CET44349800185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.779294968 CET49809443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.779370070 CET44349809185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.779505968 CET49809443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.780148029 CET49809443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.780221939 CET44349809185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.797972918 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:24.797986984 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:24.801750898 CET44349799185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.801810980 CET44349799185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.801883936 CET49799443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.801919937 CET44349799185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.801996946 CET44349799185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.802030087 CET49799443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.802066088 CET49799443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.802850008 CET49799443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.802861929 CET44349799185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.805913925 CET49810443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.805932999 CET44349810185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.806271076 CET49810443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.806802988 CET49810443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.806816101 CET44349810185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.894853115 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:24.894913912 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:24.894932032 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:24.894947052 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:24.894989967 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:24.895000935 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:24.895014048 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:24.935298920 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:24.963145971 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.963162899 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.963238001 CET49795443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.963562012 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.963572979 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.963615894 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.963615894 CET49795443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.963629961 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.963664055 CET49795443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.964014053 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.964062929 CET49795443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.964068890 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.964118004 CET49795443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.964126110 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.964158058 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:24.964250088 CET49795443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:24.968898058 CET49811443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:24.968978882 CET44349811136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:24.969306946 CET49811443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:24.969750881 CET49811443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:24.969824076 CET44349811136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:25.101968050 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.101983070 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.102040052 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.102041960 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.102086067 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.102093935 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.102099895 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.102133036 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.102150917 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.102186918 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.102227926 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.102237940 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.102251053 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.102276087 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.102283955 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.102322102 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.102332115 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.102375984 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.113468885 CET49795443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.113493919 CET44349795185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.113873959 CET49812443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.113922119 CET44349812185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.113984108 CET49812443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.114384890 CET49802443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.114401102 CET44349802185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.115516901 CET49812443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.115534067 CET44349812185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.144418001 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.144498110 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.144589901 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.145035028 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.145070076 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.159483910 CET44349804185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.159776926 CET49804443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.159821987 CET44349804185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.160325050 CET44349804185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.160653114 CET49804443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.160744905 CET44349804185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.160867929 CET49804443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.201905012 CET44349804185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.210346937 CET44349807185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.210568905 CET49807443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.210628033 CET44349807185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.212790966 CET44349807185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.213042021 CET49807443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.216674089 CET49807443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.216804981 CET49807443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.216833115 CET44349807185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.216860056 CET44349807185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.232637882 CET44349805185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.232985020 CET44349806185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.235979080 CET49805443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.236006021 CET44349805185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.236135006 CET49806443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.236155033 CET44349806185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.236814976 CET44349806185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.237153053 CET49806443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.237205982 CET44349805185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.237433910 CET44349806185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.237647057 CET49805443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.237803936 CET49806443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.237828970 CET44349805185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.238006115 CET49805443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.244458914 CET44349808185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.247750998 CET49808443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.247766018 CET44349808185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.249625921 CET44349808185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.249689102 CET49808443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.250078917 CET49808443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.250200987 CET49808443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.250299931 CET44349808185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.253693104 CET44349810185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.253984928 CET49810443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.254019022 CET44349810185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.254465103 CET44349809185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.254748106 CET49809443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.254807949 CET44349809185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.255475044 CET44349810185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.255534887 CET49810443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.255821943 CET49810443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.255897045 CET44349810185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.255942106 CET49810443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.256362915 CET44349809185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.256534100 CET49809443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.256848097 CET49809443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.256849051 CET49809443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.256937981 CET44349809185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.257019043 CET44349809185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.281939983 CET44349806185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.285903931 CET44349805185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.294665098 CET49808443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.294675112 CET44349808185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.301904917 CET44349810185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.309864998 CET49810443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.309899092 CET44349810185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.309983015 CET49809443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.310039997 CET44349809185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.325289011 CET49807443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.325345039 CET44349807185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.347234011 CET49808443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.359002113 CET49810443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.359143019 CET49809443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.429116011 CET49807443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.536614895 CET44349812185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.536938906 CET49812443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.536958933 CET44349812185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.540538073 CET44349812185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.540631056 CET49812443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.545448065 CET49812443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.545739889 CET49812443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.545752048 CET44349812185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.568758965 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.569032907 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.569094896 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.569593906 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.569962978 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.570051908 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.570082903 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.585956097 CET44349812185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.586971045 CET49812443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.586986065 CET44349812185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.612644911 CET44349811136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:25.613051891 CET49811443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:25.613110065 CET44349811136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:25.614774942 CET44349811136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:25.614862919 CET49811443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:25.615914106 CET49811443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:25.616012096 CET44349811136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:25.616064072 CET49811443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:25.617902994 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.619064093 CET44349804185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.619096041 CET44349804185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.619174004 CET44349804185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.619220018 CET49804443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.619285107 CET49804443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.622912884 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.628684998 CET44349806185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.628731012 CET44349806185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.628802061 CET49806443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.628843069 CET44349806185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.628871918 CET44349806185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.628922939 CET49806443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.628943920 CET44349806185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.628969908 CET49806443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.629101992 CET44349806185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.629223108 CET49806443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.632194042 CET49804443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.632236004 CET44349804185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.632661104 CET49815443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.632710934 CET44349815185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.632765055 CET49815443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.633863926 CET49815443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.633881092 CET44349815185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.634370089 CET44349807185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.634491920 CET49812443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.634641886 CET44349807185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.634756088 CET49807443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.637192011 CET44349805185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.637254000 CET44349805185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.637373924 CET44349805185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.637428999 CET49805443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.644295931 CET49806443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.644344091 CET44349806185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.645328999 CET49805443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.645343065 CET44349805185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.645792961 CET49816443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.645817041 CET44349816185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.645873070 CET49816443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.646589041 CET49807443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.646619081 CET44349807185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.647087097 CET49816443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.647103071 CET44349816185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.657932997 CET49817443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.657989025 CET44349817185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.658071041 CET49817443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.658245087 CET49817443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.658276081 CET44349817185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.661901951 CET44349811136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:25.672202110 CET49818443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.672252893 CET44349818185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.672327995 CET49818443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.672502995 CET49818443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.672530890 CET44349818185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.674163103 CET49819443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.674231052 CET44349819185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.674493074 CET49819443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.675893068 CET49819443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.675930977 CET44349819185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.677367926 CET49820443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.677401066 CET44349820185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.677464008 CET49820443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.677953005 CET49820443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.677980900 CET44349820185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.707459927 CET44349809185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.707639933 CET44349809185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.707731009 CET49809443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.720746040 CET49809443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.720789909 CET44349809185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.723926067 CET49822443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.723963976 CET44349822185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.724030018 CET49822443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.724121094 CET44349808185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.724185944 CET44349808185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.724219084 CET49811443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:25.724232912 CET44349811136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:25.724246979 CET49808443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.724268913 CET44349808185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.724303961 CET44349808185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.724353075 CET49808443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.724581003 CET49822443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.724601030 CET44349822185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.726169109 CET49808443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.726186991 CET44349808185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.739099979 CET49823443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.739156008 CET44349823185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.739229918 CET49823443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.739550114 CET44349810185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.739628077 CET44349810185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.739717960 CET49810443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.739773989 CET44349810185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.739808083 CET44349810185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.739821911 CET49823443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.739852905 CET44349823185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.739876032 CET49810443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.742145061 CET49810443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.742172003 CET44349810185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.757217884 CET49824443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.757260084 CET44349824185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.757335901 CET49824443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.757522106 CET49824443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:25.757529020 CET44349824185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:25.823658943 CET44349811136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:25.823741913 CET49811443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:25.829292059 CET49811443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:25.829354048 CET44349811136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:25.843830109 CET49825443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.843857050 CET44349825185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.843919992 CET49825443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.844105959 CET49825443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.844130039 CET44349825185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.955727100 CET49827443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:25.955809116 CET44349827136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:25.955971003 CET49827443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:25.956185102 CET49827443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:25.956219912 CET44349827136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:25.994225979 CET44349812185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.994285107 CET44349812185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.994359016 CET49812443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:25.994386911 CET44349812185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.994431973 CET44349812185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:25.994601011 CET49812443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.036576986 CET49812443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.036608934 CET44349812185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.052916050 CET44349815185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.053256035 CET49815443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.053281069 CET44349815185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.053594112 CET44349815185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.054039955 CET49815443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.054100037 CET44349815185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.054425001 CET49815443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.071393967 CET44349816185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.074563026 CET49816443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.074584961 CET44349816185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.075222969 CET44349817185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.075759888 CET49817443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.075803041 CET44349817185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.075855970 CET44349816185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.076277018 CET49816443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.076471090 CET44349816185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.076745033 CET49816443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.077419996 CET44349817185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.077502012 CET49817443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.077970028 CET49817443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.078054905 CET44349817185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.078156948 CET49817443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.078166962 CET44349817185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.097942114 CET44349815185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.098057985 CET4434977074.125.136.106192.168.2.4
                                          Jan 20, 2024 00:41:26.098212957 CET4434977074.125.136.106192.168.2.4
                                          Jan 20, 2024 00:41:26.098274946 CET49770443192.168.2.474.125.136.106
                                          Jan 20, 2024 00:41:26.099972010 CET44349818185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.100300074 CET49818443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.100358963 CET44349818185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.101489067 CET44349818185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.103527069 CET49818443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.103708029 CET44349818185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.103715897 CET49818443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.109560966 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.109612942 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.109726906 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.109788895 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.109849930 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.109877110 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.120265961 CET49817443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.121911049 CET44349816185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.141180038 CET44349820185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.141377926 CET44349819185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.141396999 CET49820443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.141416073 CET44349820185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.141664028 CET49819443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.141724110 CET44349819185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.142221928 CET44349819185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.142535925 CET49819443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.142630100 CET44349819185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.142647982 CET49819443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.142899036 CET44349820185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.142961025 CET49820443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.143273115 CET49820443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.143354893 CET44349820185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.143419027 CET49820443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.143426895 CET44349820185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.145210028 CET44349822185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.145400047 CET49822443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.145421028 CET44349822185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.146934986 CET44349822185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.147006035 CET49822443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.147310972 CET49822443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.147399902 CET44349822185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.147417068 CET49822443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.149523020 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.149928093 CET44349818185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.157120943 CET44349823185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.157346010 CET49823443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.157362938 CET44349823185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.158807039 CET44349823185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.158871889 CET49823443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.159172058 CET49823443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.159257889 CET44349823185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.159276962 CET49823443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.180279970 CET44349824185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.185499907 CET49824443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.185528994 CET44349824185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.189069986 CET44349824185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.189141989 CET49824443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.189423084 CET49824443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.189532042 CET49824443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.189594984 CET44349824185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.189919949 CET44349819185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.189935923 CET44349822185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.195849895 CET49819443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.205944061 CET44349823185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.227077961 CET49818443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.227104902 CET49820443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.227118015 CET49823443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.227138996 CET49822443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.227152109 CET44349823185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.227169037 CET44349822185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.267600060 CET44349825185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.267842054 CET49825443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.267863035 CET44349825185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.271615982 CET44349825185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.271706104 CET49825443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.272416115 CET49825443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.272567987 CET49825443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.272572041 CET44349825185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.272593975 CET44349825185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.318070889 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.318104029 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.318133116 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.318222046 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.318267107 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.318279982 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.318320990 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.318325043 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.318351984 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.318370104 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.318451881 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.318495035 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.318500042 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.318536043 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.318552017 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.318717957 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.318767071 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.318895102 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.318909883 CET44349813185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.318937063 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.318950891 CET49813443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.319448948 CET49828443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.319497108 CET44349828185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.319583893 CET49828443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.326819897 CET49828443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.326838970 CET44349828185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.332463026 CET49770443192.168.2.474.125.136.106
                                          Jan 20, 2024 00:41:26.332487106 CET4434977074.125.136.106192.168.2.4
                                          Jan 20, 2024 00:41:26.378303051 CET44349827136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:26.397919893 CET44349824185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.400928020 CET49824443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.407851934 CET49827443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:26.407893896 CET44349827136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:26.411539078 CET44349827136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:26.411636114 CET49827443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:26.418621063 CET49823443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.418627977 CET49822443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.418863058 CET49825443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.418876886 CET44349825185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.423958063 CET49827443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:26.424145937 CET44349827136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:26.424165964 CET49827443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:26.465938091 CET44349827136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:26.467412949 CET49827443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:26.467469931 CET44349827136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:26.513572931 CET49827443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:26.518263102 CET44349815185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.518280983 CET44349815185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.518332005 CET44349815185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.518346071 CET49815443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.518389940 CET44349815185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.518404961 CET44349815185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.518408060 CET49815443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.518450975 CET49815443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.529664993 CET49825443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.534493923 CET49815443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.534512997 CET44349815185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.536150932 CET44349817185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.536186934 CET44349817185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.536277056 CET44349817185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.536356926 CET49817443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.536425114 CET49817443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.538992882 CET49817443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.539031029 CET44349817185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.554069042 CET44349818185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.554124117 CET44349818185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.554244995 CET49818443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.554302931 CET44349818185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.554336071 CET44349818185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.554389954 CET49818443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.564204931 CET49818443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.564235926 CET44349818185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.580312014 CET44349816185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.580511093 CET44349816185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.580566883 CET49816443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.584307909 CET49816443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.584327936 CET44349816185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.588319063 CET44349819185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.588382959 CET44349819185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.588515043 CET44349819185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.588581085 CET49819443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.588581085 CET49819443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.594221115 CET49819443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.594264984 CET44349819185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.608860970 CET44349822185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.608891010 CET44349822185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.608941078 CET49822443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.608963013 CET44349822185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.609065056 CET44349822185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.609137058 CET49822443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.610162020 CET49822443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.610179901 CET44349822185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.614223957 CET44349823185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.614306927 CET44349823185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.614362001 CET49823443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.615036964 CET49823443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.615067959 CET44349823185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.637295961 CET44349824185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.637370110 CET44349824185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.637445927 CET49824443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.637463093 CET44349824185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.637489080 CET44349824185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.637538910 CET49824443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.640477896 CET49824443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.640489101 CET44349824185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.644634962 CET49830443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.644716978 CET44349830185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.644809008 CET49830443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.645092964 CET49830443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.645128012 CET44349830185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.648402929 CET49831443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.648437023 CET44349831185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.648487091 CET49831443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.648808956 CET49831443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.648827076 CET44349831185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.659543037 CET49832443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.659634113 CET44349832185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.659712076 CET49832443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.660022020 CET49832443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.660056114 CET44349832185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.663490057 CET49833443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.663530111 CET44349833185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.663708925 CET49833443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.663883924 CET49833443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.663901091 CET44349833185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.672684908 CET44349820185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.672754049 CET44349820185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.672858000 CET49820443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.673602104 CET49820443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.673616886 CET44349820185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.729604006 CET44349825185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.729785919 CET44349825185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.729857922 CET49825443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.739392042 CET49825443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.739434958 CET44349825185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.748922110 CET44349828185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.749324083 CET49828443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.749347925 CET44349828185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.750478983 CET44349828185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.750813007 CET49828443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.750987053 CET44349828185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.751202106 CET49828443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.776449919 CET49834443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.776527882 CET44349834185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.776618004 CET49834443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.776809931 CET49834443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:26.776839018 CET44349834185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.797941923 CET44349828185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:26.832150936 CET44349827136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:26.832333088 CET44349827136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:26.832520962 CET49827443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:26.833100080 CET49827443192.168.2.4136.243.216.235
                                          Jan 20, 2024 00:41:26.833137989 CET44349827136.243.216.235192.168.2.4
                                          Jan 20, 2024 00:41:26.872035980 CET49835443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.872078896 CET44349835185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:26.872143030 CET49835443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.872611046 CET49835443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:26.872629881 CET44349835185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:27.073708057 CET44349830185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.077418089 CET44349831185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.080806017 CET49831443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.080831051 CET44349831185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.080869913 CET44349832185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.080981970 CET49830443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.081043005 CET44349830185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.081146002 CET49832443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.081176043 CET44349832185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.081357956 CET44349831185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.082057953 CET49831443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.082144022 CET44349831185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.082645893 CET49831443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.082783937 CET44349832185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.082848072 CET49832443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.083170891 CET44349830185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.084361076 CET44349833185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.092298985 CET49832443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.092420101 CET44349832185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.092582941 CET49833443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.092643976 CET44349833185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.094238997 CET44349833185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.094332933 CET49833443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.102273941 CET49830443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.102648020 CET44349830185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.125961065 CET44349831185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.127790928 CET49831443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.199748993 CET44349834185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.201988935 CET44349828185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.202059984 CET44349828185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.202202082 CET44349828185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.202258110 CET49828443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.232768059 CET49832443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.232784986 CET44349832185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.232789993 CET49830443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.241117954 CET49833443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.241318941 CET44349833185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.241394043 CET49832443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.242130995 CET49834443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.242172956 CET44349834185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.243550062 CET44349834185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.265645981 CET49830443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.265927076 CET49833443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.265968084 CET44349833185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.285908937 CET44349832185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.295140982 CET44349835185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:27.296555996 CET49834443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.305932999 CET44349830185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.311670065 CET49833443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.348625898 CET49835443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:27.349946976 CET49834443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.350254059 CET44349834185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.350754976 CET49835443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:27.350769997 CET44349835185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:27.351278067 CET49834443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.352332115 CET44349835185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:27.393930912 CET44349834185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.399720907 CET49835443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:27.521231890 CET49835443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:27.521567106 CET44349835185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:27.521838903 CET49835443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:27.530380011 CET44349830185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.530582905 CET44349830185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.530771017 CET49830443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.542421103 CET44349832185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.542484045 CET44349833185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.542493105 CET44349832185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.542507887 CET44349833185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.542640924 CET44349833185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.542675972 CET49832443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.542701960 CET49833443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.542701960 CET49833443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.542726040 CET44349832185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.542756081 CET44349832185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.543256998 CET49832443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.561949968 CET44349835185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:27.618002892 CET44349831185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.618053913 CET44349831185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.618122101 CET49831443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.618144989 CET44349831185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.618174076 CET44349831185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.618187904 CET49831443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.618196964 CET44349831185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.618257046 CET49831443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.618326902 CET44349831185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.618489027 CET49831443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.737369061 CET44349834185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.737555981 CET44349834185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:27.737651110 CET49834443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:27.799830914 CET44349835185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:27.799880981 CET44349835185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:27.799945116 CET49835443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:27.799993038 CET44349835185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:27.800028086 CET44349835185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:27.800039053 CET49835443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:27.800059080 CET44349835185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:27.800082922 CET49835443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:27.800304890 CET44349835185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:27.800364971 CET49835443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:28.020709991 CET49828443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:28.020746946 CET44349828185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:28.131252050 CET49830443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:28.131316900 CET44349830185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:28.131638050 CET49833443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:28.131700993 CET44349833185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:28.132009029 CET49832443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:28.132051945 CET44349832185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:28.132328033 CET49834443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:28.132386923 CET44349834185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:28.138803005 CET49831443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:28.138825893 CET44349831185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:28.139316082 CET49835443192.168.2.4185.155.186.25
                                          Jan 20, 2024 00:41:28.139339924 CET44349835185.155.186.25192.168.2.4
                                          Jan 20, 2024 00:41:28.442279100 CET804972369.164.42.0192.168.2.4
                                          Jan 20, 2024 00:41:28.442421913 CET4972380192.168.2.469.164.42.0
                                          Jan 20, 2024 00:41:28.442459106 CET4972380192.168.2.469.164.42.0
                                          Jan 20, 2024 00:41:28.545427084 CET804972369.164.42.0192.168.2.4
                                          Jan 20, 2024 00:41:32.208364010 CET49839443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:32.208405018 CET44349839185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:32.208482981 CET49839443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:32.290128946 CET49839443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:32.290163040 CET44349839185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:32.553636074 CET44349776104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:32.553819895 CET44349776104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:32.553874969 CET49776443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:32.712415934 CET44349839185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:32.720390081 CET49839443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:32.720429897 CET44349839185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:32.721556902 CET44349839185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:32.722136974 CET49839443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:32.722311020 CET44349839185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:32.722574949 CET49839443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:32.765957117 CET44349839185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:33.165438890 CET44349839185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:33.165503979 CET44349839185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:33.165576935 CET49839443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:33.165604115 CET44349839185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:33.165621042 CET44349839185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:33.165674925 CET49839443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:33.165683031 CET44349839185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:33.165865898 CET44349839185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:33.166060925 CET49839443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:33.167113066 CET49839443192.168.2.4185.155.184.55
                                          Jan 20, 2024 00:41:33.167126894 CET44349839185.155.184.55192.168.2.4
                                          Jan 20, 2024 00:41:33.193830967 CET49776443192.168.2.4104.21.6.39
                                          Jan 20, 2024 00:41:33.193859100 CET44349776104.21.6.39192.168.2.4
                                          Jan 20, 2024 00:41:43.092992067 CET804972469.164.42.0192.168.2.4
                                          Jan 20, 2024 00:41:43.093116999 CET4972480192.168.2.469.164.42.0
                                          Jan 20, 2024 00:41:43.118279934 CET4972480192.168.2.469.164.42.0
                                          Jan 20, 2024 00:41:43.221030951 CET804972469.164.42.0192.168.2.4
                                          Jan 20, 2024 00:42:15.970715046 CET49842443192.168.2.474.125.136.106
                                          Jan 20, 2024 00:42:15.970762014 CET4434984274.125.136.106192.168.2.4
                                          Jan 20, 2024 00:42:15.970828056 CET49842443192.168.2.474.125.136.106
                                          Jan 20, 2024 00:42:15.971152067 CET49842443192.168.2.474.125.136.106
                                          Jan 20, 2024 00:42:15.971167088 CET4434984274.125.136.106192.168.2.4
                                          Jan 20, 2024 00:42:16.184897900 CET4434984274.125.136.106192.168.2.4
                                          Jan 20, 2024 00:42:16.203422070 CET49842443192.168.2.474.125.136.106
                                          Jan 20, 2024 00:42:16.203442097 CET4434984274.125.136.106192.168.2.4
                                          Jan 20, 2024 00:42:16.203912020 CET4434984274.125.136.106192.168.2.4
                                          Jan 20, 2024 00:42:16.204704046 CET49842443192.168.2.474.125.136.106
                                          Jan 20, 2024 00:42:16.204787016 CET4434984274.125.136.106192.168.2.4
                                          Jan 20, 2024 00:42:16.248631954 CET49842443192.168.2.474.125.136.106
                                          Jan 20, 2024 00:42:26.252105951 CET4434984274.125.136.106192.168.2.4
                                          Jan 20, 2024 00:42:26.252269983 CET4434984274.125.136.106192.168.2.4
                                          Jan 20, 2024 00:42:26.252418995 CET49842443192.168.2.474.125.136.106
                                          Jan 20, 2024 00:42:29.085314989 CET49842443192.168.2.474.125.136.106
                                          Jan 20, 2024 00:42:29.085341930 CET4434984274.125.136.106192.168.2.4
                                          TimestampSource PortDest PortSource IPDest IP
                                          Jan 20, 2024 00:41:11.086924076 CET5058653192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:11.087563992 CET6067053192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:11.088479996 CET6435053192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:11.088823080 CET6274753192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:11.143897057 CET53606321.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:11.205941916 CET53505861.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:11.206181049 CET53606701.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:11.207169056 CET53643501.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:11.207849026 CET53627471.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:11.887458086 CET53562991.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:13.545778036 CET53583691.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:13.548182011 CET53560651.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:15.530159950 CET6301853192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:15.530498981 CET5611153192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:15.650621891 CET53630181.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:15.651492119 CET53561111.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:15.728341103 CET4964153192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:15.729113102 CET4990553192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:15.846652985 CET53496411.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:15.847855091 CET53499051.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:16.754894018 CET5610553192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:16.768052101 CET6124153192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:16.876300097 CET53561051.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:16.888501883 CET53612411.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:17.974083900 CET5043353192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:17.974299908 CET5430353192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:18.094068050 CET53543031.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:18.119895935 CET53504331.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:20.661636114 CET5868453192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:20.662066936 CET6242053192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:20.843553066 CET53624201.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:20.850148916 CET53586841.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:23.827192068 CET6286153192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:23.827616930 CET5724053192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:23.930675983 CET53577091.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:24.015125036 CET53572401.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:24.016253948 CET53628611.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:24.846700907 CET5711953192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:24.847178936 CET6541453192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:24.966140985 CET53571191.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:24.966392994 CET53654141.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:25.832813978 CET5851253192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:25.833173037 CET6284653192.168.2.41.1.1.1
                                          Jan 20, 2024 00:41:25.952626944 CET53628461.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:25.954739094 CET53585121.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:28.898468018 CET53635951.1.1.1192.168.2.4
                                          Jan 20, 2024 00:41:30.824994087 CET138138192.168.2.4192.168.2.255
                                          Jan 20, 2024 00:41:48.251945019 CET53623711.1.1.1192.168.2.4
                                          Jan 20, 2024 00:42:11.139288902 CET53622041.1.1.1192.168.2.4
                                          Jan 20, 2024 00:42:12.112642050 CET53532661.1.1.1192.168.2.4
                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                          Jan 20, 2024 00:41:11.086924076 CET192.168.2.41.1.1.10xc424Standard query (0)clients2.google.comA (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:11.087563992 CET192.168.2.41.1.1.10x1b19Standard query (0)clients2.google.com65IN (0x0001)false
                                          Jan 20, 2024 00:41:11.088479996 CET192.168.2.41.1.1.10xb84Standard query (0)accounts.google.comA (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:11.088823080 CET192.168.2.41.1.1.10x9440Standard query (0)accounts.google.com65IN (0x0001)false
                                          Jan 20, 2024 00:41:15.530159950 CET192.168.2.41.1.1.10x1668Standard query (0)cdnstat.netA (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:15.530498981 CET192.168.2.41.1.1.10xe836Standard query (0)cdnstat.net65IN (0x0001)false
                                          Jan 20, 2024 00:41:15.728341103 CET192.168.2.41.1.1.10x61daStandard query (0)www.google.comA (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:15.729113102 CET192.168.2.41.1.1.10xf178Standard query (0)www.google.com65IN (0x0001)false
                                          Jan 20, 2024 00:41:16.754894018 CET192.168.2.41.1.1.10xe556Standard query (0)checking-browser.comA (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:16.768052101 CET192.168.2.41.1.1.10xa84fStandard query (0)checking-browser.com65IN (0x0001)false
                                          Jan 20, 2024 00:41:17.974083900 CET192.168.2.41.1.1.10xba08Standard query (0)mygiftaward.lifeA (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:17.974299908 CET192.168.2.41.1.1.10xb18cStandard query (0)mygiftaward.life65IN (0x0001)false
                                          Jan 20, 2024 00:41:20.661636114 CET192.168.2.41.1.1.10x1dd8Standard query (0)2041.awlivedose.liveA (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:20.662066936 CET192.168.2.41.1.1.10xf43fStandard query (0)2041.awlivedose.live65IN (0x0001)false
                                          Jan 20, 2024 00:41:23.827192068 CET192.168.2.41.1.1.10xb468Standard query (0)2041.awlivedose.liveA (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:23.827616930 CET192.168.2.41.1.1.10x83beStandard query (0)2041.awlivedose.live65IN (0x0001)false
                                          Jan 20, 2024 00:41:24.846700907 CET192.168.2.41.1.1.10x4a2fStandard query (0)jsontdsexit2.comA (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:24.847178936 CET192.168.2.41.1.1.10x636aStandard query (0)jsontdsexit2.com65IN (0x0001)false
                                          Jan 20, 2024 00:41:25.832813978 CET192.168.2.41.1.1.10x56e3Standard query (0)jsontdsexit2.comA (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:25.833173037 CET192.168.2.41.1.1.10xbfebStandard query (0)jsontdsexit2.com65IN (0x0001)false
                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                          Jan 20, 2024 00:41:11.205941916 CET1.1.1.1192.168.2.40xc424No error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)false
                                          Jan 20, 2024 00:41:11.205941916 CET1.1.1.1192.168.2.40xc424No error (0)clients.l.google.com172.253.124.139A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:11.205941916 CET1.1.1.1192.168.2.40xc424No error (0)clients.l.google.com172.253.124.138A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:11.205941916 CET1.1.1.1192.168.2.40xc424No error (0)clients.l.google.com172.253.124.100A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:11.205941916 CET1.1.1.1192.168.2.40xc424No error (0)clients.l.google.com172.253.124.113A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:11.205941916 CET1.1.1.1192.168.2.40xc424No error (0)clients.l.google.com172.253.124.102A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:11.205941916 CET1.1.1.1192.168.2.40xc424No error (0)clients.l.google.com172.253.124.101A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:11.206181049 CET1.1.1.1192.168.2.40x1b19No error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)false
                                          Jan 20, 2024 00:41:11.207169056 CET1.1.1.1192.168.2.40xb84No error (0)accounts.google.com108.177.122.84A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:15.650621891 CET1.1.1.1192.168.2.40x1668No error (0)cdnstat.net104.21.56.41A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:15.650621891 CET1.1.1.1192.168.2.40x1668No error (0)cdnstat.net172.67.176.240A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:15.651492119 CET1.1.1.1192.168.2.40xe836No error (0)cdnstat.net65IN (0x0001)false
                                          Jan 20, 2024 00:41:15.846652985 CET1.1.1.1192.168.2.40x61daNo error (0)www.google.com74.125.136.106A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:15.846652985 CET1.1.1.1192.168.2.40x61daNo error (0)www.google.com74.125.136.147A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:15.846652985 CET1.1.1.1192.168.2.40x61daNo error (0)www.google.com74.125.136.99A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:15.846652985 CET1.1.1.1192.168.2.40x61daNo error (0)www.google.com74.125.136.104A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:15.846652985 CET1.1.1.1192.168.2.40x61daNo error (0)www.google.com74.125.136.103A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:15.846652985 CET1.1.1.1192.168.2.40x61daNo error (0)www.google.com74.125.136.105A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:15.847855091 CET1.1.1.1192.168.2.40xf178No error (0)www.google.com65IN (0x0001)false
                                          Jan 20, 2024 00:41:16.876300097 CET1.1.1.1192.168.2.40xe556No error (0)checking-browser.com104.21.6.39A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:16.876300097 CET1.1.1.1192.168.2.40xe556No error (0)checking-browser.com172.67.154.206A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:16.888501883 CET1.1.1.1192.168.2.40xa84fNo error (0)checking-browser.com65IN (0x0001)false
                                          Jan 20, 2024 00:41:18.119895935 CET1.1.1.1192.168.2.40xba08No error (0)mygiftaward.life185.155.184.32A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:20.850148916 CET1.1.1.1192.168.2.40x1dd8No error (0)2041.awlivedose.live185.155.186.25A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:20.850148916 CET1.1.1.1192.168.2.40x1dd8No error (0)2041.awlivedose.live185.155.184.55A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:24.016253948 CET1.1.1.1192.168.2.40xb468No error (0)2041.awlivedose.live185.155.184.55A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:24.016253948 CET1.1.1.1192.168.2.40xb468No error (0)2041.awlivedose.live185.155.186.25A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:24.966140985 CET1.1.1.1192.168.2.40x4a2fNo error (0)jsontdsexit2.com136.243.216.235A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:25.954739094 CET1.1.1.1192.168.2.40x56e3No error (0)jsontdsexit2.com136.243.216.235A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:26.404000044 CET1.1.1.1192.168.2.40x7965No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                          Jan 20, 2024 00:41:26.404000044 CET1.1.1.1192.168.2.40x7965No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:41:39.440632105 CET1.1.1.1192.168.2.40x3e4aNo error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                          Jan 20, 2024 00:41:39.440632105 CET1.1.1.1192.168.2.40x3e4aNo error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:42:04.356698036 CET1.1.1.1192.168.2.40x9885No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                          Jan 20, 2024 00:42:04.356698036 CET1.1.1.1192.168.2.40x9885No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                                          Jan 20, 2024 00:42:26.107670069 CET1.1.1.1192.168.2.40x7eabNo error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                          Jan 20, 2024 00:42:26.107670069 CET1.1.1.1192.168.2.40x7eabNo error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                                          • clients2.google.com
                                          • accounts.google.com
                                          • https:
                                            • cdnstat.net
                                            • checking-browser.com
                                            • mygiftaward.life
                                            • 2041.awlivedose.live
                                            • jsontdsexit2.com
                                          • fs.microsoft.com
                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          0192.168.2.449730172.253.124.1394436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:11 UTC752OUTGET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1
                                          Host: clients2.google.com
                                          Connection: keep-alive
                                          X-Goog-Update-Interactivity: fg
                                          X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda
                                          X-Goog-Update-Updater: chromecrx-117.0.5938.132
                                          Sec-Fetch-Site: none
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: empty
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:11 UTC732INHTTP/1.1 200 OK
                                          Content-Security-Policy: script-src 'report-sample' 'nonce-FAak-JYfXwC-XkZ5qNPfhw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
                                          Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                          Pragma: no-cache
                                          Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                          Date: Fri, 19 Jan 2024 23:41:11 GMT
                                          Content-Type: text/xml; charset=UTF-8
                                          X-Daynum: 6227
                                          X-Daystart: 56471
                                          X-Content-Type-Options: nosniff
                                          X-Frame-Options: SAMEORIGIN
                                          X-XSS-Protection: 1; mode=block
                                          Server: GSE
                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                          Accept-Ranges: none
                                          Vary: Accept-Encoding
                                          Connection: close
                                          Transfer-Encoding: chunked
                                          2024-01-19 23:41:11 UTC520INData Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 32 32 37 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 35 36 34 37 31 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22
                                          Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6227" elapsed_seconds="56471"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
                                          2024-01-19 23:41:11 UTC200INData Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a
                                          Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
                                          2024-01-19 23:41:11 UTC5INData Raw: 30 0d 0a 0d 0a
                                          Data Ascii: 0


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          1192.168.2.449729108.177.122.844436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:11 UTC680OUTPOST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1
                                          Host: accounts.google.com
                                          Connection: keep-alive
                                          Content-Length: 1
                                          Origin: https://www.google.com
                                          Content-Type: application/x-www-form-urlencoded
                                          Sec-Fetch-Site: none
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: empty
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
                                          2024-01-19 23:41:11 UTC1OUTData Raw: 20
                                          Data Ascii:
                                          2024-01-19 23:41:11 UTC1799INHTTP/1.1 200 OK
                                          Content-Type: application/json; charset=utf-8
                                          Access-Control-Allow-Origin: https://www.google.com
                                          Access-Control-Allow-Credentials: true
                                          X-Content-Type-Options: nosniff
                                          Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                          Pragma: no-cache
                                          Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                          Date: Fri, 19 Jan 2024 23:41:11 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                          Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport
                                          Content-Security-Policy: script-src 'report-sample' 'nonce-zx4Rtn4Atn4xQvpSZ5T64Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self'
                                          Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist
                                          Cross-Origin-Opener-Policy: same-origin
                                          Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
                                          reporting-endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjMtDikmLw1JBiOHxtB5Meyy0mIyCe2_2UaSEQH4x7znQUiHf4eLA4pc9gDQBiIR6O6RPXrGUTOHBw-QEmALL-F04"
                                          Server: ESF
                                          X-XSS-Protection: 0
                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                          Accept-Ranges: none
                                          Vary: Accept-Encoding
                                          Connection: close
                                          Transfer-Encoding: chunked
                                          2024-01-19 23:41:11 UTC23INData Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a
                                          Data Ascii: 11["gaia.l.a.r",[]]
                                          2024-01-19 23:41:11 UTC5INData Raw: 30 0d 0a 0d 0a
                                          Data Ascii: 0


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          2192.168.2.449760104.21.56.414436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:15 UTC623OUTGET /get/script.js?referrer=https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/ HTTP/1.1
                                          Host: cdnstat.net
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: */*
                                          Sec-Fetch-Site: cross-site
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: script
                                          Referer: https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:16 UTC820INHTTP/1.1 200 OK
                                          Date: Fri, 19 Jan 2024 23:41:16 GMT
                                          Content-Type: text/html; charset=utf-8
                                          Transfer-Encoding: chunked
                                          Connection: close
                                          X-Powered-By: PHP/8.2.1
                                          Access-Control-Allow-Origin: https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net
                                          Access-Control-Allow-Methods: GET, POST
                                          Access-Control-Allow-Headers: X-Requested-With,content-type
                                          Access-Control-Allow-Credentials: true
                                          CF-Cache-Status: DYNAMIC
                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eDnZy5I8gzYeGp35W81JmOfUs4dbnt5EF%2BCwQpsc3kv6IeGT1u6AW6jgRwQgTcqk2Zo5lJt3Be01qiLp1WcVu1rzCgEekS5xAzbPBVgJd2uQtNIObeKqqOP39bBVag%3D%3D"}],"group":"cf-nel","max_age":604800}
                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                          Server: cloudflare
                                          CF-RAY: 8482ed6fb9156750-ATL
                                          alt-svc: h3=":443"; ma=86400
                                          2024-01-19 23:41:16 UTC522INData Raw: 32 30 33 0d 0a 74 72 79 7b 73 65 74 54 69 6d 65 6f 75 74 28 28 28 29 3d 3e 7b 77 69 6e 64 6f 77 2e 59 61 3d 77 69 6e 64 6f 77 2e 59 61 7c 7c 7b 7d 2c 59 61 2e 5f 6d 65 74 72 69 6b 61 3d 59 61 2e 5f 6d 65 74 72 69 6b 61 7c 7c 7b 7d 2c 59 61 2e 5f 6d 65 74 72 69 6b 61 2e 6f 6f 3d 21 30 2c 2f 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2f 69 2e 74 65 73 74 28 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 69 6e 6e 65 72 48 54 4d 4c 29 26 26 28 77 69 6e 64 6f 77 2e 5f 67 61 55 73 65 72 50 72 65 66 73 3d 7b 69 6f 6f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 30 7d 7d 29 3b 76 61 72 20 65 3d 22 68 74 74 70 73 3a 2f 2f 63 68 65 63 6b 69 6e 67 2d 62 72 6f 77 73 65 72 2e 63 6f 6d 3f 75 72 6c 3d 22 2b 65 6e 63 6f 64 65
                                          Data Ascii: 203try{setTimeout((()=>{window.Ya=window.Ya||{},Ya._metrika=Ya._metrika||{},Ya._metrika.oo=!0,/googletagmanager/i.test(document.documentElement.innerHTML)&&(window._gaUserPrefs={ioo:function(){return!0}});var e="https://checking-browser.com?url="+encode
                                          2024-01-19 23:41:16 UTC5INData Raw: 30 0d 0a 0d 0a
                                          Data Ascii: 0


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          3192.168.2.449774104.21.6.394436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:17 UTC819OUTGET /?url=https%3A%2F%2Fmygiftaward.life%2F%3Fu%3D6w3kaew%26o%3Duvdg6dv%26cid%3Duomgcwv9%26t%3Dsweepstakesbbg HTTP/1.1
                                          Host: checking-browser.com
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          sec-ch-ua-platform: "Windows"
                                          Upgrade-Insecure-Requests: 1
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                          Sec-Fetch-Site: cross-site
                                          Sec-Fetch-Mode: navigate
                                          Sec-Fetch-Dest: document
                                          Referer: https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:17 UTC654INHTTP/1.1 200 OK
                                          Date: Fri, 19 Jan 2024 23:41:17 GMT
                                          Content-Type: text/html; charset=utf-8
                                          Transfer-Encoding: chunked
                                          Connection: close
                                          Last-Modified: Sat, 06 Jan 2024 07:57:46 GMT
                                          Accept-Ranges: bytes
                                          CF-Cache-Status: DYNAMIC
                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qGkSkdWzQNFHEnuW4eQBeBPMKi9COnzgBfaLJeutD1GKEgSJAs3KIiWOLGfvI6p74b4CZjEdNMYEhH1Wz%2F6I%2FpBFWdfNOWHTDkSD8cYdvoO%2F4mSK8HYoWhrZhqtsxtjydXUOsZ%2FYvg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                          Server: cloudflare
                                          CF-RAY: 8482ed779b3c4575-ATL
                                          alt-svc: h3=":443"; ma=86400
                                          2024-01-19 23:41:17 UTC472INData Raw: 31 64 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 3c 2f 68 65 61 64 3e 0a 20 20 09 3c 73 63 72 69 70 74 3e 0a 09 09 76 61 72 20 73 65 61 72 63 68 50 61 72 61 6d 73 20 3d 20 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 29 3b 0a 09 09 76 61 72 20 75 72 6c 20 3d 20 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 73 65 61 72 63 68 50 61 72 61 6d 73 2e
                                          Data Ascii: 1d1<!DOCTYPE html><html><head><title></title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head> <script>var searchParams = new URLSearchParams(window.location.search);var url = decodeURIComponent(searchParams.
                                          2024-01-19 23:41:17 UTC5INData Raw: 30 0d 0a 0d 0a
                                          Data Ascii: 0


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          4192.168.2.449775184.31.62.93443
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:17 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
                                          Connection: Keep-Alive
                                          Accept: */*
                                          Accept-Encoding: identity
                                          User-Agent: Microsoft BITS/7.8
                                          Host: fs.microsoft.com
                                          2024-01-19 23:41:17 UTC532INHTTP/1.1 200 OK
                                          Content-Type: application/octet-stream
                                          Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                          ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                          X-Ms-ApiVersion: Distribute 1.2
                                          X-Ms-Region: prod-eus-z1
                                          Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                          X-MSEdge-Ref: Ref A: 124ACC55E2B647A7955FEB1A9F40BE53 Ref B: ASHEDGE1417 Ref C: 2024-01-19T03:20:37Z
                                          Cache-Control: public, max-age=185972
                                          Date: Fri, 19 Jan 2024 23:41:17 GMT
                                          Connection: close
                                          X-CID: 2


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          5192.168.2.449785184.31.62.93443
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:18 UTC239OUTGET /fs/windows/config.json HTTP/1.1
                                          Connection: Keep-Alive
                                          Accept: */*
                                          Accept-Encoding: identity
                                          If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
                                          Range: bytes=0-2147483646
                                          User-Agent: Microsoft BITS/7.8
                                          Host: fs.microsoft.com
                                          2024-01-19 23:41:18 UTC662INHTTP/1.1 200 OK
                                          Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                          ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                          Content-Type: application/octet-stream
                                          ApiVersion: Distribute 1.1
                                          Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                          X-CID: 7
                                          X-CCC: US
                                          X-Azure-Ref-OriginShield: Ref A: 77D3A374A575439792C03F9D3B3E5A6A Ref B: CH1AA2040903034 Ref C: 2023-07-19T16:59:25Z
                                          X-MSEdge-Ref: Ref A: 268FB40D90624D4B909B4269BE9DB868 Ref B: CHI30EDGE0106 Ref C: 2023-07-19T17:02:00Z
                                          Cache-Control: public, max-age=131209
                                          Date: Fri, 19 Jan 2024 23:41:18 GMT
                                          Content-Length: 55
                                          Connection: close
                                          X-CID: 2
                                          2024-01-19 23:41:18 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
                                          Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          6192.168.2.449787185.155.184.324436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:19 UTC732OUTGET /?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes HTTP/1.1
                                          Host: mygiftaward.life
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          sec-ch-ua-platform: "Windows"
                                          Upgrade-Insecure-Requests: 1
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                          Sec-Fetch-Site: cross-site
                                          Sec-Fetch-Mode: navigate
                                          Sec-Fetch-Dest: document
                                          Referer: https://checking-browser.com/
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:19 UTC396INHTTP/1.1 200 OK
                                          Server: nginx
                                          Date: Fri, 19 Jan 2024 23:41:19 GMT
                                          Content-Type: text/html
                                          Content-Length: 38190
                                          Connection: close
                                          cache-control: private
                                          set-cookie: sid=t1~x0hgjdzxqkzaumrwysnznltv; path=/
                                          set-cookie: sid=t1~x0hgjdzxqkzaumrwysnznltv; path=/
                                          set-cookie: p1=https://awlivedose.live/ubxplwqi/; path=/
                                          set-cookie: s1=iw8r23clxymqvla7; path=/
                                          Cache-Control: no-transform
                                          2024-01-19 23:41:19 UTC2544INData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 72 65 71 75 65 73 74 4c 69 6e 6b 28 29 7b 72 65 74 75 72 6e 20 7b 73 65 73 73 69 6f 6e 49 64 3a 5b 27 73 69 64 27 2c 27 74 31 7e 78 30 68 67 6a 64 7a 78 71 6b 7a 61 75 6d 72 77 79 73 6e 7a 6e 6c 74 76 27 5d 2c 70 31 3a 5b 27 27
                                          Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><script>function requestLink(){return {sessionId:['sid','t1~x0hgjdzxqkzaumrwysnznltv'],p1:[''
                                          2024-01-19 23:41:19 UTC2896INData Raw: 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 30 25 7d 2e 61 6c 6c 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 63 6f 6c 6f 72 3a 23 33 62 35 39 39 39 7d 0d 0a 2e 63 6c 69 63 6b 20 7b 20 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 20 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 20 7d 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 0d 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 72 65 64 69 72 65 63 74 69 6e 67 22 3e 3c 64 69 76 20 69 64 3d 27 72 31 27 3e 3c 2f 64 69 76 3e 0d 0a 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 72 65 64 69 72 65 63 74 69 6e 67 22 3e 0d 0a 09 3c 68 31 3e 4c 6f
                                          Data Ascii: ff;font-size:120%}.all:hover{background:#fff;text-decoration:none;border-color:transparent;color:#3b5999}.click { color: white; display:none; }</style></head><body class="redirecting"><div id='r1'></div><section class="redirecting"><h1>Lo
                                          2024-01-19 23:41:19 UTC1448INData Raw: 6f 66 20 74 26 26 28 74 3d 61 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 66 2e 63 65 69 6c 28 73 29 3a 66 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 61 3d 66 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 63 3b 68
                                          Data Ascii: of t&&(t=a.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4*o),c=(s=t?f.ceil(s):f.max((0|s)-this._minBufferSize,0))*o,a=f.min(4*c,n);if(c){for(var h=0;h<c;h
                                          2024-01-19 23:41:19 UTC1448INData Raw: 3d 74 5b 65 2b 31 32 5d 2c 42 3d 74 5b 65 2b 31 33 5d 2c 6d 3d 74 5b 65 2b 31 34 5d 2c 6b 3d 74 5b 65 2b 31 35 5d 2c 53 3d 6f 5b 30 5d 2c 78 3d 6f 5b 31 5d 2c 43 3d 6f 5b 32 5d 2c 7a 3d 6f 5b 33 5d 3b 78 3d 62 28 78 3d 62 28 78 3d 62 28 78 3d 62 28 78 3d 45 28 78 3d 45 28 78 3d 45 28 78 3d 45 28 78 3d 44 28 78 3d 44 28 78 3d 44 28 78 3d 44 28 78 3d 4d 28 78 3d 4d 28 78 3d 4d 28 78 3d 4d 28 78 2c 43 3d 4d 28 43 2c 7a 3d 4d 28 7a 2c 53 3d 4d 28 53 2c 78 2c 43 2c 7a 2c 73 2c 37 2c 77 5b 30 5d 29 2c 78 2c 43 2c 63 2c 31 32 2c 77 5b 31 5d 29 2c 53 2c 78 2c 61 2c 31 37 2c 77 5b 32 5d 29 2c 7a 2c 53 2c 68 2c 32 32 2c 77 5b 33 5d 29 2c 43 3d 4d 28 43 2c 7a 3d 4d 28 7a 2c 53 3d 4d 28 53 2c 78 2c 43 2c 7a 2c 66 2c 37 2c 77 5b 34 5d 29 2c 78 2c 43 2c 75 2c 31 32 2c
                                          Data Ascii: =t[e+12],B=t[e+13],m=t[e+14],k=t[e+15],S=o[0],x=o[1],C=o[2],z=o[3];x=b(x=b(x=b(x=b(x=E(x=E(x=E(x=E(x=D(x=D(x=D(x=D(x=M(x=M(x=M(x=M(x,C=M(C,z=M(z,S=M(S,x,C,z,s,7,w[0]),x,C,c,12,w[1]),S,x,a,17,w[2]),z,S,h,22,w[3]),C=M(C,z=M(z,S=M(S,x,C,z,f,7,w[4]),x,C,u,12,
                                          2024-01-19 23:41:19 UTC2896INData Raw: 5b 30 5d 3d 6f 5b 30 5d 2b 53 7c 30 2c 6f 5b 31 5d 3d 6f 5b 31 5d 2b 78 7c 30 2c 6f 5b 32 5d 3d 6f 5b 32 5d 2b 43 7c 30 2c 6f 5b 33 5d 3d 6f 5b 33 5d 2b 7a 7c 30 7d 2c 5f 64 6f 46 69 6e 61 6c 69 7a 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 5f 64 61 74 61 2c 65 3d 74 2e 77 6f 72 64 73 2c 72 3d 38 2a 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2c 69 3d 38 2a 74 2e 73 69 67 42 79 74 65 73 3b 65 5b 69 3e 3e 3e 35 5d 7c 3d 31 32 38 3c 3c 32 34 2d 69 25 33 32 3b 76 61 72 20 6e 3d 66 2e 66 6c 6f 6f 72 28 72 2f 34 32 39 34 39 36 37 32 39 36 29 2c 6f 3d 72 3b 65 5b 31 35 2b 28 36 34 2b 69 3e 3e 3e 39 3c 3c 34 29 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c
                                          Data Ascii: [0]=o[0]+S|0,o[1]=o[1]+x|0,o[2]=o[2]+C|0,o[3]=o[3]+z|0},_doFinalize:function(){var t=this._data,e=t.words,r=8*this._nDataBytes,i=8*t.sigBytes;e[i>>>5]|=128<<24-i%32;var n=f.floor(r/4294967296),o=r;e[15+(64+i>>>9<<4)]=16711935&(n<<8|n>>>24)|4278255360&(n<<
                                          2024-01-19 23:41:19 UTC1448INData Raw: 29 7d 2c 6b 65 79 53 69 7a 65 3a 34 2c 69 76 53 69 7a 65 3a 34 2c 5f 45 4e 43 5f 58 46 4f 52 4d 5f 4d 4f 44 45 3a 31 2c 5f 44 45 43 5f 58 46 4f 52 4d 5f 4d 4f 44 45 3a 32 2c 5f 63 72 65 61 74 65 48 65 6c 70 65 72 3a 66 75 6e 63 74 69 6f 6e 28 69 29 7b 72 65 74 75 72 6e 7b 65 6e 63 72 79 70 74 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 72 65 74 75 72 6e 20 68 28 65 29 2e 65 6e 63 72 79 70 74 28 69 2c 74 2c 65 2c 72 29 7d 2c 64 65 63 72 79 70 74 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 72 65 74 75 72 6e 20 68 28 65 29 2e 64 65 63 72 79 70 74 28 69 2c 74 2c 65 2c 72 29 7d 7d 7d 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 68 28 74 29 7b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 3f 6d 3a 67 7d 65 2e 53 74 72 65 61 6d 43
                                          Data Ascii: )},keySize:4,ivSize:4,_ENC_XFORM_MODE:1,_DEC_XFORM_MODE:2,_createHelper:function(i){return{encrypt:function(t,e,r){return h(e).encrypt(i,t,e,r)},decrypt:function(t,e,r){return h(e).decrypt(i,t,e,r)}}}});function h(t){return"string"==typeof t?m:g}e.StreamC
                                          2024-01-19 23:41:19 UTC1448INData Raw: 72 2c 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 3d 31 29 2c 74 68 69 73 2e 5f 6d 6f 64 65 26 26 74 68 69 73 2e 5f 6d 6f 64 65 2e 5f 5f 63 72 65 61 74 6f 72 3d 3d 74 3f 74 68 69 73 2e 5f 6d 6f 64 65 2e 69 6e 69 74 28 74 68 69 73 2c 72 26 26 72 2e 77 6f 72 64 73 29 3a 28 74 68 69 73 2e 5f 6d 6f 64 65 3d 74 2e 63 61 6c 6c 28 69 2c 74 68 69 73 2c 72 26 26 72 2e 77 6f 72 64 73 29 2c 74 68 69 73 2e 5f 6d 6f 64 65 2e 5f 5f 63 72 65 61 74 6f 72 3d 74 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 74 68 69 73 2e 5f 6d 6f 64 65 2e 70 72 6f 63 65 73 73 42 6c 6f 63 6b 28 74 2c 65 29 7d 2c 5f 64 6f 46 69 6e 61 6c 69 7a 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 2c 65 3d 74 68 69 73 2e 63 66
                                          Data Ascii: r,this._minBufferSize=1),this._mode&&this._mode.__creator==t?this._mode.init(this,r&&r.words):(this._mode=t.call(i,this,r&&r.words),this._mode.__creator=t)},_doProcessBlock:function(t,e){this._mode.processBlock(t,e)},_doFinalize:function(){var t,e=this.cf
                                          2024-01-19 23:41:19 UTC2896INData Raw: 29 2e 63 6f 6d 70 75 74 65 28 74 2c 69 29 2c 6f 3d 61 2e 63 72 65 61 74 65 28 6e 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 65 29 2c 34 2a 72 29 3b 72 65 74 75 72 6e 20 6e 2e 73 69 67 42 79 74 65 73 3d 34 2a 65 2c 5f 2e 63 72 65 61 74 65 28 7b 6b 65 79 3a 6e 2c 69 76 3a 6f 2c 73 61 6c 74 3a 69 7d 29 7d 7d 2c 6d 3d 65 2e 50 61 73 73 77 6f 72 64 42 61 73 65 64 43 69 70 68 65 72 3d 67 2e 65 78 74 65 6e 64 28 7b 63 66 67 3a 67 2e 63 66 67 2e 65 78 74 65 6e 64 28 7b 6b 64 66 3a 42 7d 29 2c 65 6e 63 72 79 70 74 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 2c 69 29 7b 76 61 72 20 6e 3d 28 69 3d 74 68 69 73 2e 63 66 67 2e 65 78 74 65 6e 64 28 69 29 29 2e 6b 64 66 2e 65 78 65 63 75 74 65 28 72 2c 74 2e 6b 65 79 53 69 7a 65 2c 74 2e 69 76 53 69 7a 65 29 3b 69 2e 69 76
                                          Data Ascii: ).compute(t,i),o=a.create(n.words.slice(e),4*r);return n.sigBytes=4*e,_.create({key:n,iv:o,salt:i})}},m=e.PasswordBasedCipher=g.extend({cfg:g.cfg.extend({kdf:B}),encrypt:function(t,e,r,i){var n=(i=this.cfg.extend(i)).kdf.execute(r,t.keySize,t.ivSize);i.iv
                                          2024-01-19 23:41:19 UTC1448INData Raw: 3e 3e 28 2d 30 78 32 2a 71 26 30 78 36 29 29 3a 30 78 30 29 7b 73 3d 6e 5b 27 69 6e 64 65 78 4f 66 27 5d 28 73 29 3b 7d 66 6f 72 28 76 61 72 20 75 3d 30 78 30 2c 76 3d 6f 5b 27 6c 65 6e 67 74 68 27 5d 3b 75 3c 76 3b 75 2b 2b 29 7b 70 2b 3d 27 25 27 2b 28 27 30 30 27 2b 6f 5b 27 63 68 61 72 43 6f 64 65 41 74 27 5d 28 75 29 5b 27 74 6f 53 74 72 69 6e 67 27 5d 28 30 78 31 30 29 29 5b 27 73 6c 69 63 65 27 5d 28 2d 30 78 32 29 3b 7d 72 65 74 75 72 6e 20 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 70 29 3b 7d 3b 62 5b 27 75 47 41 46 6c 73 27 5d 3d 69 2c 63 3d 61 72 67 75 6d 65 6e 74 73 2c 62 5b 27 43 57 47 79 6b 71 27 5d 3d 21 21 5b 5d 3b 7d 76 61 72 20 6a 3d 65 5b 30 78 30 5d 2c 6b 3d 66 2b 6a 2c 6c 3d 63 5b 6b 5d 3b 72 65 74 75 72 6e 21 6c 3f 28
                                          Data Ascii: >>(-0x2*q&0x6)):0x0){s=n['indexOf'](s);}for(var u=0x0,v=o['length'];u<v;u++){p+='%'+('00'+o['charCodeAt'](u)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(p);};b['uGAFls']=i,c=arguments,b['CWGykq']=!![];}var j=e[0x0],k=f+j,l=c[k];return!l?(
                                          2024-01-19 23:41:19 UTC1448INData Raw: 72 73 65 28 63 2c 64 29 7b 76 61 72 20 4a 3d 62 3b 69 66 28 74 79 70 65 6f 66 20 67 65 74 42 61 63 6b 65 6e 64 50 61 72 61 6d 73 3d 3d 3d 4a 28 30 78 31 63 35 29 29 7b 63 6f 6e 73 6f 6c 65 5b 4a 28 30 78 31 64 38 29 5d 28 4a 28 30 78 32 31 37 29 29 3b 76 61 72 20 65 3d 67 65 74 42 61 63 6b 65 6e 64 50 61 72 61 6d 73 28 29 3b 72 65 74 75 72 6e 20 65 5b 64 5d 26 26 65 5b 64 5d 5b 30 78 31 5d 3f 65 5b 64 5d 5b 30 78 31 5d 3a 75 6e 64 65 66 69 6e 65 64 3b 7d 65 6c 73 65 7b 69 66 28 67 65 74 43 6f 6f 6b 69 65 28 63 29 29 72 65 74 75 72 6e 20 63 6f 6e 73 6f 6c 65 5b 4a 28 30 78 31 64 38 29 5d 28 4a 28 30 78 31 61 37 29 29 2c 67 65 74 43 6f 6f 6b 69 65 28 63 29 3b 7d 7d 66 75 6e 63 74 69 6f 6e 20 72 53 74 72 69 6e 67 28 63 29 7b 76 61 72 20 4b 3d 62 2c 64 3d 27
                                          Data Ascii: rse(c,d){var J=b;if(typeof getBackendParams===J(0x1c5)){console[J(0x1d8)](J(0x217));var e=getBackendParams();return e[d]&&e[d][0x1]?e[d][0x1]:undefined;}else{if(getCookie(c))return console[J(0x1d8)](J(0x1a7)),getCookie(c);}}function rString(c){var K=b,d='


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          7192.168.2.449786185.155.184.324436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:20 UTC735OUTGET /favicon.ico HTTP/1.1
                                          Host: mygiftaward.life
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: image
                                          Referer: https://mygiftaward.life/?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          Cookie: sid=t1~x0hgjdzxqkzaumrwysnznltv; p1=https://awlivedose.live/ubxplwqi/; s1=iw8r23clxymqvla7
                                          2024-01-19 23:41:21 UTC127INHTTP/1.1 204 No Content
                                          Server: nginx
                                          Date: Fri, 19 Jan 2024 23:41:20 GMT
                                          Connection: close
                                          Cache-Control: no-transform


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          8192.168.2.449789185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:22 UTC826OUTGET /ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          sec-ch-ua-platform: "Windows"
                                          Upgrade-Insecure-Requests: 1
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                          Sec-Fetch-Site: cross-site
                                          Sec-Fetch-Mode: navigate
                                          Sec-Fetch-Dest: document
                                          Referer: https://mygiftaward.life/
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:22 UTC166INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:22 GMT
                                          Content-Type: text/html
                                          Content-Length: 13213
                                          Connection: close
                                          cache-control: private
                                          2024-01-19 23:41:22 UTC3930INData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 72 65 71 75 65 73 74 4c 69 6e 6b 28 29 7b 72 65 74 75 72 6e 20 7b 73 65 73 73 69 6f 6e 49 64 3a 5b 27 73 69 64 27 2c 27 74 31 7e 78 30 68 67 6a 64 7a 78 71 6b 7a 61 75 6d 72 77 79 73 6e 7a 6e 6c 74 76 27 5d 7d 3b 7d 76 61 72 20 67 65 6f 49 6e 66 6f 3d 7b 22 63 63 22 3a 22 55 53 22 2c 22 63 6e 61 6d 65 73 22 3a 7b 22 64 65 22 3a 22 55 53 41 22 2c 22 65 6e 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 65 73 22 3a 22 45 73 74 61 64 6f 73 20 55 6e 69 64 6f 73 22 2c 22 66 72 22 3a 22 c3 89 74 61 74 73 20 55 6e 69 73 22 2c 22 6a 61 22 3a 22 e3 82 a2 e3 83 a1 e3 83 aa e3 82 ab 22 2c 22 70 74 2d 42 52 22 3a 22 45 55 41 22 2c 22 72 75 22 3a 22 d0 a1 d0 a8 d0 90 22 2c
                                          Data Ascii: <html><head><script>function requestLink(){return {sessionId:['sid','t1~x0hgjdzxqkzaumrwysnznltv']};}var geoInfo={"cc":"US","cnames":{"de":"USA","en":"United States","es":"Estados Unidos","fr":"tats Unis","ja":"","pt-BR":"EUA","ru":"",
                                          2024-01-19 23:41:22 UTC19INData Raw: 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 3c 2f 64 69 76 3e
                                          Data Ascii: </div></div>
                                          2024-01-19 23:41:22 UTC4096INData Raw: 0d 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 69 7a 65 20 74 77 6f 22 3e 0d 0a 09 09 09 09 09 09 3c 69 6d 67 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 6d 61 69 6e 73 74 72 65 61 6d 2f 61 6c 6c 2f 63 66 2f 62 6f 78 2e 70 6e 67 22 20 61 6c 74 3d 22 50 72 65 69 73 22 20 63 6c 61 73 73 3d 22 70 72 69 7a 65 5f 69 6d 61 67 65 22 3e 0d 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 61 6c 5f 70 72 69 7a 65 22 3e 0d 0a 09 09 09 09 09 09 09 3c 69 6d 67 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 6d 61 69 6e 73 74 72 65 61 6d 2f 61 6c 6c 2f 63 66 2f 67 6f 6f 67 6c 65 5f 70 6c 61 79 5f 63 61 72 64 2e 6a 70 67 22 20 63 6c 61 73 73 3d 22 72 65 61 6c 5f 70 72 69 7a 65 5f 69 6d 61 67 65 22 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09
                                          Data Ascii: <div class="prize two"><img src="/media/mainstream/all/cf/box.png" alt="Preis" class="prize_image"><div class="real_prize"><img src="/media/mainstream/all/cf/google_play_card.jpg" class="real_prize_image"></div>
                                          2024-01-19 23:41:22 UTC4096INData Raw: 22 68 61 6c 6c 5f 6f 66 5f 66 61 6d 65 5f 77 69 6e 6e 65 72 5f 70 72 69 7a 65 22 3e 3c 73 70 61 6e 3e 50 72 69 7a 65 3a 20 3c 2f 73 70 61 6e 3e 24 32 35 30 20 41 6d 61 7a 6f 6e 20 47 69 66 74 20 43 61 72 64 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 61 6c 6c 5f 6f 66 5f 66 61 6d 65 5f 77 69 6e 6e 65 72 22 3e 0d 0a 09 09 09 09 09 3c 69 6d 67 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 6d 61 69 6e 73 74 72 65 61 6d 2f 61 6c 6c 2f 63 66 2f 77 69 6e 6e 65 72 5f 63 61 74 2e 6a 70 67 22 20 63 6c 61 73 73 3d 22 68 61 6c 6c 5f 6f 66 5f 66 61 6d 65 5f 77 69 6e 6e 65 72 5f 69 6d 61 67 65 22 3e 0d 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 61 6c 6c 5f
                                          Data Ascii: "hall_of_fame_winner_prize"><span>Prize: </span>$250 Amazon Gift Card</div></div></div><div class="hall_of_fame_winner"><img src="/media/mainstream/all/cf/winner_cat.jpg" class="hall_of_fame_winner_image"><div class="hall_
                                          2024-01-19 23:41:22 UTC1072INData Raw: 2c 20 24 28 22 2e 70 72 69 7a 65 5f 69 6d 61 67 65 22 29 2e 66 61 64 65 54 6f 28 32 65 33 2c 20 30 2c 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 7d 29 2c 20 24 28 22 2e 72 65 61 6c 5f 70 72 69 7a 65 22 29 2e 66 61 64 65 49 6e 28 32 65 33 2c 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 73 65 74 49 6e 74 65 72 76 61 6c 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 20 3d 20 22 68 69 64 64 65 6e 22 2c 20 24 28 22 23 62 6c 61 63 6b 5f 6f 76 65 72 6c 61 79 2c 20 23 70 72 69 7a 65 5f 63 6f 6e 66 69 72 6d 61 74 69 6f 6e 22 29 2e 73 68 6f 77 28 29 0d 0a 20 20 20 20 20 20 20 20 7d 2c 20 32 65 33 29 0d 0a 20
                                          Data Ascii: , $(".prize_image").fadeTo(2e3, 0, function() {}), $(".real_prize").fadeIn(2e3, function() { window.setInterval(function() { document.body.style.overflow = "hidden", $("#black_overlay, #prize_confirmation").show() }, 2e3)


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          9192.168.2.449788185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:22 UTC714OUTGET /media/mainstream/all/cf/style7.css HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: text/css,*/*;q=0.1
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: style
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:22 UTC781INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:22 GMT
                                          Content-Type: text/css
                                          Content-Length: 8228
                                          Connection: close
                                          Content-Security-Policy: block-all-mixed-content
                                          ETag: "3de1e142f7b4952ab102e98e5d976fa4"
                                          Last-Modified: Mon, 20 Feb 2023 09:33:03 GMT
                                          No-Gzip-Compression: true
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Request-Id: 17ABE419A58F8A5D
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1676805107#266178647/gid:0/gname:root/mode:33188/mtime:1665052659#469977000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-10-06T10:37:39.469977Z
                                          Expires: Sat, 18 Jan 2025 23:41:22 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:22 UTC3315INData Raw: 0d 0a 0d 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 52 6f 62 6f 74 6f 44 72 61 66 74 3b 0d 0a 09 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0d 0a 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0d 0a 09 73 72 63 3a 20 6c 6f 63 61 6c 28 27 52 6f 62 6f 74 6f 44 72 61 66 74 27 29 2c 20 6c 6f 63 61 6c 28 27 52 6f 62 6f 74 6f 44 72 61 66 74 2d 52 65 67 75 6c 61 72 27 29 2c 20 75 72 6c 28 30 78 45 53 35 53 6c 5f 76 36 6f 79 54 37 64 41 4b 75 6f 6e 69 34 67 70 39 51 38 67 62 59 72 68 71 47 6c 52 61 76 5f 49 58 66 6b 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 2c 20 75 72 6c 28 30 78 45 53 35 53 6c 5f 76 36 6f 79 54 37 64 41 4b 75 6f 6e 69 37 72 49 61 2d 37 61 63 4d 41 65 44
                                          Data Ascii: @font-face {font-family: RobotoDraft;font-style: normal;font-weight: 400;src: local('RobotoDraft'), local('RobotoDraft-Regular'), url(0xES5Sl_v6oyT7dAKuoni4gp9Q8gbYrhqGlRav_IXfk.woff2) format('woff2'), url(0xES5Sl_v6oyT7dAKuoni7rIa-7acMAeD
                                          2024-01-19 23:41:22 UTC4096INData Raw: 6c 65 66 74 3b 0d 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 34 30 70 78 3b 0d 0a 09 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 3b 0d 0a 09 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 0d 0a 7d 0d 0a 0d 0a 2e 70 72 69 7a 65 3a 66 69 72 73 74 2d 6f 66 2d 74 79 70 65 20 7b 0d 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 30 0d 0a 7d 0d 0a 0d 0a 2e 70 72 69 7a 65 5f 69 6d 61 67 65 20 7b 0d 0a 09 77 69 64 74 68 3a 20 31 37 35 70 78 3b 0d 0a 09 68 65 69 67 68 74 3a 20 31 37 35 70 78 3b 0d 0a 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 31 30 70 78 0d 0a 7d 0d 0a 0d 0a 2e 70 72 69 7a 65 5f 62 75 74 74 6f 6e 20 7b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 30 30 63 38 35 33 3b 0d 0a 09 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 32 70 78 3b
                                          Data Ascii: left;margin-left: 40px;cursor: pointer;position: relative}.prize:first-of-type {margin-left: 0}.prize_image {width: 175px;height: 175px;margin-bottom: 10px}.prize_button {background: #00c853;border-radius: 2px;
                                          2024-01-19 23:41:22 UTC817INData Raw: 0d 0a 0d 0a 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 31 31 39 39 70 78 29 20 7b 0d 0a 09 62 6f 64 79 2e 73 74 79 6c 65 33 20 2e 70 72 69 7a 65 5f 62 75 74 74 6f 6e 2e 61 62 6f 72 74 2c 0d 0a 09 62 6f 64 79 2e 73 74 79 6c 65 33 20 2e 70 72 69 7a 65 5f 62 75 74 74 6f 6e 2e 63 6f 6e 66 69 72 6d 2c 0d 0a 09 62 6f 64 79 2e 73 74 79 6c 65 33 20 2e 70 72 69 7a 65 5f 62 75 74 74 6f 6e 2e 66 69 6e 69 73 68 2c 0d 0a 09 62 6f 64 79 2e 73 74 79 6c 65 33 20 2e 70 72 69 7a 65 5f 62 75 74 74 6f 6e 2e 73 75 62 6d 69 74 5f 63 65 72 74 69 66 69 63 61 74 65 20 7b 0d 0a 09 09 77 69 64 74 68 3a 20 31 30 30 25 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 09 7d 0d 0a 7d 0d 0a 0d 0a 62
                                          Data Ascii: @media (max-width: 1199px) {body.style3 .prize_button.abort,body.style3 .prize_button.confirm,body.style3 .prize_button.finish,body.style3 .prize_button.submit_certificate {width: 100% !important;box-sizing: border-box;}}b


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          10192.168.2.449791185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:23 UTC724OUTGET /media/mainstream/flag-icon/css/flag-icon.css HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: text/css,*/*;q=0.1
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: style
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:23 UTC786INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:23 GMT
                                          Content-Type: text/css
                                          Content-Length: 39806
                                          Connection: close
                                          ETag: "b7a46a018dcd21a4828bae0b04ddcc6c"
                                          Last-Modified: Wed, 20 Sep 2023 15:24:06 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE419CE088D2B
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1693134508#288021464/gid:0/gname:root/mode:33279/mtime:1655387459#318598233/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-06-16T13:50:59.318598233Z
                                          Expires: Sat, 18 Jan 2025 23:41:23 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:23 UTC3310INData Raw: 2f 2a 20 67 65 6f 20 6c 6f 63 61 74 69 6f 6e 20 63 73 73 20 2a 2f 0d 0a 23 75 73 65 72 4c 6f 63 61 74 69 6f 6e 20 7b 0d 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 3b 0d 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 65 6d 3b 0d 0a 7d 0d 0a 23 75 73 65 72 4c 6f 63 61 74 69 6f 6e 20 2e 66 6c 61 67 2d 69 63 6f 6e 20 7b 0d 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0d 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 20 20 74 6f 70 3a 20 2d 30 2e 30 35 65 6d 3b 0d 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 30 2e 33 65 6d 3b 0d 0a 7d 0d 0a 2f 2a 20 66 6c 61 67 2d 69 63 6f 6e 20 63 73 73 20 2a 2f 0d 0a 2e 66 6c 61 67
                                          Data Ascii: /* geo location css */#userLocation { display: inline; position: relative; line-height: 1em;}#userLocation .flag-icon { display: inline-block; position: relative; top: -0.05em; margin-right: 0.3em;}/* flag-icon css */.flag
                                          2024-01-19 23:41:23 UTC4096INData Raw: 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 62 62 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 62 62 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 62 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 62 64 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 62 64 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 62 64 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d
                                          Data Ascii: );}.flag-icon-bb.flag-icon-squared { background-image: url(../flags/1x1/bb.svg);}.flag-icon-bd { background-image: url(../flags/4x3/bd.svg);}.flag-icon-bd.flag-icon-squared { background-image: url(../flags/1x1/bd.svg);}.flag-icon-
                                          2024-01-19 23:41:23 UTC4096INData Raw: 33 2f 63 6b 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 63 6b 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 63 6b 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 63 6c 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 63 6c 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 63 6c 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 63 6c 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c
                                          Data Ascii: 3/ck.svg);}.flag-icon-ck.flag-icon-squared { background-image: url(../flags/1x1/ck.svg);}.flag-icon-cl { background-image: url(../flags/4x3/cl.svg);}.flag-icon-cl.flag-icon-squared { background-image: url(../flags/1x1/cl.svg);}.fl
                                          2024-01-19 23:41:23 UTC4096INData Raw: 66 6c 61 67 73 2f 34 78 33 2f 66 6b 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 66 6b 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 66 6b 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 66 6d 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 66 6d 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 66 6d 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 66 6d 2e 73 76 67 29 3b
                                          Data Ascii: flags/4x3/fk.svg);}.flag-icon-fk.flag-icon-squared { background-image: url(../flags/1x1/fk.svg);}.flag-icon-fm { background-image: url(../flags/4x3/fm.svg);}.flag-icon-fm.flag-icon-squared { background-image: url(../flags/1x1/fm.svg);
                                          2024-01-19 23:41:23 UTC4096INData Raw: 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 68 72 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 68 72 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 68 72 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 68 74 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 68 74 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 68 74 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f
                                          Data Ascii: url(../flags/4x3/hr.svg);}.flag-icon-hr.flag-icon-squared { background-image: url(../flags/1x1/hr.svg);}.flag-icon-ht { background-image: url(../flags/4x3/ht.svg);}.flag-icon-ht.flag-icon-squared { background-image: url(../flags/1x1/
                                          2024-01-19 23:41:23 UTC4096INData Raw: 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 6b 7a 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 6b 7a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 6b 7a 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 6c 61 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 6c 61 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 6c 61 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c
                                          Data Ascii: d-image: url(../flags/4x3/kz.svg);}.flag-icon-kz.flag-icon-squared { background-image: url(../flags/1x1/kz.svg);}.flag-icon-la { background-image: url(../flags/4x3/la.svg);}.flag-icon-la.flag-icon-squared { background-image: url(../fl
                                          2024-01-19 23:41:23 UTC4096INData Raw: 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 6d 73 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 6d 73 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 6d 73 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 6d 74 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 6d 74 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 6d 74 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75
                                          Data Ascii: ackground-image: url(../flags/4x3/ms.svg);}.flag-icon-ms.flag-icon-squared { background-image: url(../flags/1x1/ms.svg);}.flag-icon-mt { background-image: url(../flags/4x3/mt.svg);}.flag-icon-mt.flag-icon-squared { background-image: u
                                          2024-01-19 23:41:23 UTC4096INData Raw: 6c 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 70 6c 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 70 6c 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 70 6c 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 70 6d 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 70 6d 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 70 6d 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d
                                          Data Ascii: l { background-image: url(../flags/4x3/pl.svg);}.flag-icon-pl.flag-icon-squared { background-image: url(../flags/1x1/pl.svg);}.flag-icon-pm { background-image: url(../flags/4x3/pm.svg);}.flag-icon-pm.flag-icon-squared { background-
                                          2024-01-19 23:41:23 UTC4096INData Raw: 67 2d 69 63 6f 6e 2d 73 6f 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 73 6f 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 6f 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 73 6f 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 72 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 73 72 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 72 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63
                                          Data Ascii: g-icon-so { background-image: url(../flags/4x3/so.svg);}.flag-icon-so.flag-icon-squared { background-image: url(../flags/1x1/so.svg);}.flag-icon-sr { background-image: url(../flags/4x3/sr.svg);}.flag-icon-sr.flag-icon-squared { bac
                                          2024-01-19 23:41:23 UTC3728INData Raw: 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 75 73 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 75 73 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 75 73 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 75 73 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 75 79 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 75 79 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 75 79 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20
                                          Data Ascii: }.flag-icon-us { background-image: url(../flags/4x3/us.svg);}.flag-icon-us.flag-icon-squared { background-image: url(../flags/1x1/us.svg);}.flag-icon-uy { background-image: url(../flags/4x3/uy.svg);}.flag-icon-uy.flag-icon-squared


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          11192.168.2.449792185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:23 UTC694OUTGET /media/mainstream/all/cf/1.js HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: */*
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: script
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:23 UTC795INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:23 GMT
                                          Content-Type: application/javascript
                                          Content-Length: 2665
                                          Connection: close
                                          Content-Security-Policy: block-all-mixed-content
                                          ETag: "ad30984b7bb6c4ca8b5e5f939898c7cd"
                                          Last-Modified: Mon, 20 Feb 2023 09:33:03 GMT
                                          No-Gzip-Compression: true
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Request-Id: 17ABE419CFF47A34
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1676843277#791577239/gid:0/gname:root/mode:33279/mtime:1652249417#434782000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:17.434782Z
                                          Expires: Sat, 18 Jan 2025 23:41:23 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:23 UTC2665INData Raw: 20 20 20 20 76 61 72 20 73 4d 6f 62 69 6c 65 20 3d 20 27 2f 6d 65 64 69 61 2f 6d 61 69 6e 73 74 72 65 61 6d 2f 61 6c 65 72 74 2e 6d 70 33 27 2c 0d 0a 20 20 20 20 20 20 20 20 73 44 65 73 6b 74 6f 70 20 3d 20 27 2f 6d 65 64 69 61 2f 6d 61 69 6e 73 74 72 65 61 6d 2f 61 6c 65 72 74 2e 6d 70 33 27 3b 0d 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 69 73 4d 6f 62 69 6c 65 44 65 76 69 63 65 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 28 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 6f 72 69 65 6e 74 61 74 69 6f 6e 20 21 3d 3d 20 22 75 6e 64 65 66 69 6e 65 64 22 29 20 7c 7c 20 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 69 6e 64 65 78 4f 66 28 27 49 45 4d 6f 62 69 6c 65 27 29 20 21 3d 3d 20 2d 31 29 3b 0d 0a 20 20 20 20 7d 0d 0a 20
                                          Data Ascii: var sMobile = '/media/mainstream/alert.mp3', sDesktop = '/media/mainstream/alert.mp3'; function isMobileDevice() { return (typeof window.orientation !== "undefined") || (navigator.userAgent.indexOf('IEMobile') !== -1); }


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          12192.168.2.449793185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:23 UTC687OUTGET /media/mainstream/u.js HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: */*
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: script
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:23 UTC789INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:23 GMT
                                          Content-Type: text/javascript
                                          Content-Length: 25177
                                          Connection: close
                                          ETag: "e44aa4ca20702394c8ca04144c3e9e74"
                                          Last-Modified: Tue, 21 Nov 2023 12:30:30 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE419CDE54ED0
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1695324544#29542012/gid:0/gname:root/mode:33188/mtime:1657924117#384361000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-07-15T22:28:37.384361Z
                                          Expires: Sat, 18 Jan 2025 23:41:23 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:23 UTC3307INData Raw: 76 61 72 20 5f 30 78 32 30 37 61 31 65 3d 5f 30 78 34 33 36 63 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 33 35 30 66 36 63 2c 5f 30 78 35 31 35 64 66 65 29 7b 76 61 72 20 5f 30 78 35 31 37 31 36 31 3d 5f 30 78 34 33 36 63 2c 5f 30 78 33 31 36 33 35 61 3d 5f 30 78 33 35 30 66 36 63 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 76 61 72 20 5f 30 78 37 64 36 62 34 36 3d 70 61 72 73 65 49 6e 74 28 5f 30 78 35 31 37 31 36 31 28 30 78 31 64 31 2c 27 63 77 31 4e 27 29 29 2f 30 78 31 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 35 31 37 31 36 31 28 30 78 64 64 2c 27 42 43 51 2a 27 29 29 2f 30 78 32 2a 28 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 35 31 37 31 36 31 28 30 78 31 33 62 2c 27 52 6d 57 6c 27 29 29 2f 30 78 33 29 2b 2d 70 61 72 73 65 49 6e 74 28 5f 30
                                          Data Ascii: var _0x207a1e=_0x436c;(function(_0x350f6c,_0x515dfe){var _0x517161=_0x436c,_0x31635a=_0x350f6c();while(!![]){try{var _0x7d6b46=parseInt(_0x517161(0x1d1,'cw1N'))/0x1+parseInt(_0x517161(0xdd,'BCQ*'))/0x2*(-parseInt(_0x517161(0x13b,'RmWl'))/0x3)+-parseInt(_0
                                          2024-01-19 23:41:23 UTC4096INData Raw: 74 75 21 6f 27 29 5d 3d 3d 3d 5f 30 78 32 62 61 66 34 33 28 30 78 31 61 34 2c 27 69 66 4b 68 27 29 26 26 28 5f 30 78 31 61 35 35 36 33 5b 5f 30 78 33 63 30 38 34 35 5d 5b 5f 30 78 32 62 61 66 34 33 28 30 78 62 64 2c 27 68 64 26 78 27 29 5d 3d 5f 30 78 32 62 61 66 34 33 28 30 78 62 30 2c 27 4c 6e 57 5a 27 29 2b 5f 30 78 31 31 39 38 35 66 5b 5f 30 78 32 62 61 66 34 33 28 30 78 31 32 33 2c 27 72 69 62 32 27 29 5d 5b 30 78 30 5d 2b 27 3d 27 2b 5f 30 78 31 31 39 38 35 66 5b 5f 30 78 32 62 61 66 34 33 28 30 78 31 32 36 2c 27 43 72 78 45 27 29 5d 5b 30 78 31 5d 29 3b 7d 7d 65 6c 73 65 7b 69 66 28 21 67 65 74 43 6f 6f 6b 69 65 28 5f 30 78 32 62 61 66 34 33 28 30 78 62 66 2c 27 59 30 70 26 27 29 29 26 26 74 79 70 65 6f 66 20 72 65 71 75 65 73 74 4c 69 6e 6b 3d 3d
                                          Data Ascii: tu!o')]===_0x2baf43(0x1a4,'ifKh')&&(_0x1a5563[_0x3c0845][_0x2baf43(0xbd,'hd&x')]=_0x2baf43(0xb0,'LnWZ')+_0x11985f[_0x2baf43(0x123,'rib2')][0x0]+'='+_0x11985f[_0x2baf43(0x126,'CrxE')][0x1]);}}else{if(!getCookie(_0x2baf43(0xbf,'Y0p&'))&&typeof requestLink==
                                          2024-01-19 23:41:23 UTC4096INData Raw: 78 45 27 29 5d 28 27 3d 27 29 2c 5f 30 78 35 39 36 61 36 34 3d 5f 30 78 32 66 64 31 66 30 5b 5f 30 78 35 39 33 30 30 66 28 30 78 31 38 37 2c 27 73 56 76 42 27 29 5d 28 30 78 31 29 5b 5f 30 78 35 39 33 30 30 66 28 30 78 31 36 38 2c 27 54 64 6a 30 27 29 5d 28 27 3d 27 29 3b 27 5c 78 32 32 27 3d 3d 3d 5f 30 78 35 39 36 61 36 34 5b 5f 30 78 35 39 33 30 30 66 28 30 78 64 33 2c 27 43 55 53 48 27 29 5d 28 30 78 30 29 26 26 28 5f 30 78 35 39 36 61 36 34 3d 5f 30 78 35 39 36 61 36 34 5b 5f 30 78 35 39 33 30 30 66 28 30 78 64 30 2c 27 35 5a 28 52 27 29 5d 28 30 78 31 2c 2d 30 78 31 29 29 3b 74 72 79 7b 76 61 72 20 5f 30 78 32 39 30 39 38 35 3d 5f 30 78 32 66 64 31 66 30 5b 30 78 30 5d 5b 5f 30 78 35 39 33 30 30 66 28 30 78 31 34 63 2c 27 73 38 5b 28 27 29 5d 28 5f
                                          Data Ascii: xE')]('='),_0x596a64=_0x2fd1f0[_0x59300f(0x187,'sVvB')](0x1)[_0x59300f(0x168,'Tdj0')]('=');'\x22'===_0x596a64[_0x59300f(0xd3,'CUSH')](0x0)&&(_0x596a64=_0x596a64[_0x59300f(0xd0,'5Z(R')](0x1,-0x1));try{var _0x290985=_0x2fd1f0[0x0][_0x59300f(0x14c,'s8[(')](_
                                          2024-01-19 23:41:23 UTC4096INData Raw: 5b 5f 30 78 35 36 63 61 66 36 5d 5b 5f 30 78 34 38 65 36 61 31 28 30 78 31 63 34 2c 27 7a 26 74 34 27 29 5d 21 3d 5f 30 78 34 38 65 36 61 31 28 30 78 31 35 65 2c 27 74 75 21 6f 27 29 26 26 28 5f 30 78 35 35 61 62 66 62 5b 5f 30 78 35 36 63 61 66 36 5d 5b 5f 30 78 34 38 65 36 61 31 28 30 78 31 36 35 2c 27 62 6b 24 6f 27 29 5d 3d 5f 30 78 34 39 33 34 38 34 29 3b 7d 76 61 72 20 64 69 73 61 62 6c 65 6c 69 6e 6b 73 66 75 6e 63 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 30 78 33 36 34 34 63 65 3d 5f 30 78 32 30 37 61 31 65 2c 5f 30 78 31 33 62 65 63 37 3d 64 6f 63 75 6d 65 6e 74 5b 5f 30 78 33 36 34 34 63 65 28 30 78 31 33 39 2c 27 21 30 56 50 27 29 5d 28 27 41 27 29 3b 66 6f 72 28 76 61 72 20 5f 30 78 33 34 38 61 30 30 3d 30 78 30 3b 5f 30 78 33 34 38
                                          Data Ascii: [_0x56caf6][_0x48e6a1(0x1c4,'z&t4')]!=_0x48e6a1(0x15e,'tu!o')&&(_0x55abfb[_0x56caf6][_0x48e6a1(0x165,'bk$o')]=_0x493484);}var disablelinksfunc=function(){var _0x3644ce=_0x207a1e,_0x13bec7=document[_0x3644ce(0x139,'!0VP')]('A');for(var _0x348a00=0x0;_0x348
                                          2024-01-19 23:41:23 UTC4096INData Raw: 30 78 34 34 33 35 65 33 28 30 78 64 36 2c 27 48 6c 40 23 27 29 5d 28 2f 5b 5c 5b 5d 2f 2c 27 5c 78 35 63 5b 27 29 5b 5f 30 78 34 34 33 35 65 33 28 30 78 31 61 36 2c 27 5d 5b 77 34 27 29 5d 28 2f 5b 5c 5d 5d 2f 2c 27 5c 78 35 63 5d 27 29 3b 76 61 72 20 5f 30 78 32 36 38 37 38 62 3d 6e 65 77 20 52 65 67 45 78 70 28 5f 30 78 34 34 33 35 65 33 28 30 78 31 34 66 2c 27 7a 26 74 34 27 29 2b 5f 30 78 31 38 35 38 35 31 2b 5f 30 78 34 34 33 35 65 33 28 30 78 31 34 61 2c 27 39 46 72 44 27 29 29 2c 5f 30 78 31 64 39 30 38 34 3d 5f 30 78 32 36 38 37 38 62 5b 5f 30 78 34 34 33 35 65 33 28 30 78 31 35 62 2c 27 68 64 26 78 27 29 5d 28 6c 6f 63 61 74 69 6f 6e 5b 5f 30 78 34 34 33 35 65 33 28 30 78 31 61 38 2c 27 21 30 56 50 27 29 5d 29 3b 72 65 74 75 72 6e 20 5f 30 78 31
                                          Data Ascii: 0x4435e3(0xd6,'Hl@#')](/[\[]/,'\x5c[')[_0x4435e3(0x1a6,'][w4')](/[\]]/,'\x5c]');var _0x26878b=new RegExp(_0x4435e3(0x14f,'z&t4')+_0x185851+_0x4435e3(0x14a,'9FrD')),_0x1d9084=_0x26878b[_0x4435e3(0x15b,'hd&x')](location[_0x4435e3(0x1a8,'!0VP')]);return _0x1
                                          2024-01-19 23:41:23 UTC4096INData Raw: 69 63 54 54 43 38 6f 53 75 75 38 27 2c 27 64 57 37 64 50 61 27 2c 27 57 50 6c 63 53 38 6f 7a 78 61 27 2c 27 57 35 42 64 4f 53 6f 65 6f 47 4b 32 62 71 27 2c 27 64 53 6f 66 69 53 6b 56 57 37 44 4d 27 2c 27 67 58 52 64 50 43 6f 7a 71 43 6f 5a 42 47 27 2c 27 57 35 74 64 51 43 6f 70 66 62 79 32 77 53 6f 6b 46 53 6f 70 57 52 5a 64 4f 67 58 59 57 34 68 63 49 57 27 2c 27 57 50 42 64 4e 6d 6b 47 57 36 54 77 27 2c 27 57 34 57 69 73 43 6b 49 27 2c 27 66 38 6f 70 70 64 6e 54 45 43 6f 58 27 2c 27 57 36 5a 63 48 43 6f 68 68 38 6f 4f 57 37 42 63 53 43 6f 37 57 35 57 31 57 34 69 45 27 2c 27 57 34 70 64 4e 53 6f 45 65 53 6f 46 45 57 27 2c 27 6d 53 6f 76 70 74 54 57 44 43 6f 54 44 47 27 2c 27 57 51 56 63 4e 6d 6b 6f 67 6d 6b 4f 57 35 65 52 27 2c 27 57 34 33 63 53 6d 6b 79
                                          Data Ascii: icTTC8oSuu8','dW7dPa','WPlcS8ozxa','W5BdOSoeoGK2bq','dSofiSkVW7DM','gXRdPCozqCoZBG','W5tdQCopfby2wSokFSopWRZdOgXYW4hcIW','WPBdNmkGW6Tw','W4WisCkI','f8oppdnTECoX','W6ZcHCohh8oOW7BcSCo7W5W1W4iE','W4pdNSoEeSoFEW','mSovptTWDCoTDG','WQVcNmkogmkOW5eR','W43cSmky
                                          2024-01-19 23:41:23 UTC1390INData Raw: 53 53 6f 71 57 35 4e 64 4f 53 6f 54 43 65 4c 4b 42 71 27 2c 27 57 36 5a 64 4a 64 37 64 50 38 6f 6d 57 34 43 58 43 4d 46 63 50 43 6b 76 57 36 79 27 2c 27 46 6d 6f 63 44 31 53 27 2c 27 57 34 78 64 55 6d 6f 79 6f 71 27 2c 27 57 4f 4b 6d 71 38 6b 55 57 51 30 27 2c 27 72 43 6b 2b 57 35 78 64 56 6d 6b 53 41 43 6f 66 57 52 61 41 42 6d 6f 73 57 52 4a 63 4d 57 6e 4f 6b 66 70 64 4a 43 6b 44 57 4f 4f 27 2c 27 57 51 46 63 4e 43 6b 63 68 38 6b 4f 57 35 44 59 27 2c 27 57 37 4e 64 47 43 6f 73 71 43 6f 57 57 37 4c 58 75 43 6b 48 46 71 38 27 5d 3b 5f 30 78 31 33 65 31 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 30 78 34 66 32 35 38 33 3b 7d 3b 72 65 74 75 72 6e 20 5f 30 78 31 33 65 31 28 29 3b 7d 76 61 72 20 67 65 6f 52 65 66 44 61 74 61 3d 6e 75 6c 6c 3b
                                          Data Ascii: SSoqW5NdOSoTCeLKBq','W6ZdJd7dP8omW4CXCMFcPCkvW6y','FmocD1S','W4xdUmoyoq','WOKmq8kUWQ0','rCk+W5xdVmkSACofWRaABmosWRJcMWnOkfpdJCkDWOO','WQFcNCkch8kOW5DY','W7NdGCosqCoWW7LXuCkHFq8'];_0x13e1=function(){return _0x4f2583;};return _0x13e1();}var geoRefData=null;


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          13192.168.2.449790185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:23 UTC777OUTGET /media/mainstream/all/cf/amazon_1000_summerwater.png HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: image
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:23 UTC782INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:23 GMT
                                          Content-Type: image/png
                                          Content-Length: 26660
                                          Connection: close
                                          Content-Security-Policy: block-all-mixed-content
                                          ETag: "d0d2bf402b8019683b172c2622588a26"
                                          Last-Modified: Mon, 20 Feb 2023 09:33:03 GMT
                                          No-Gzip-Compression: true
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Request-Id: 17ABE419D09BE7E6
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1676843277#791577239/gid:0/gname:root/mode:33279/mtime:1652249418#22785000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:18.022785Z
                                          Expires: Sat, 18 Jan 2025 23:41:23 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:23 UTC3314INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 9b 00 00 00 74 08 06 00 00 00 92 73 40 db 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 07 74 49 4d 45 07 e3 06 0f 17 22 27 90 f6 60 c4 00 00 20 00 49 44 41 54 78 da ec bd 77 94 25 c7 75 e6 f9 bb 11 99 cf 97 af ae f6 1e 0d 6f 49 10 a0 05 45 0a 24 65 46 24 75 44 49 33 c3 23 71 64 97 5c 6a 8e 28 b7 1a 19 ee 6a c7 6b e4 76 38 d2 ae 2c 47 43 91 a3 91 68 45 51 14 9d 04 10 04 09 02 20 3c 1a 40 03 ed 7d 75 97 7d f5 6c 66 46 dc fd 23 f2 b9 ea 46 a3 09 70 cf d9 3d cb ec 53 07 85 7a f9 32 33 22 6e 5c f3 dd ef de 84 6f 1f df 3e be 7d 7c fb f8 f6 f1 ed e3 db c7 ff d3 c7 c7 9e 7e e2 db 93 f0 ed e3 25 1d d1 e5 9c f4 df 9f 7c 92 77 5c
                                          Data Ascii: PNGIHDRts@bKGDpHYstIME"'` IDATxw%uoIE$eF$uDI3#qd\j(jkv8,GChEQ <@}u}lfF#Fp=Sz23"n\o>}|~%|w\
                                          2024-01-19 23:41:23 UTC4096INData Raw: c4 43 cf 1c 66 b5 d5 e6 ce d7 dc c2 f4 d4 04 ce 65 c1 11 47 98 8c 2d 8f ec 3f 24 4f 1d 38 82 13 d8 b2 7d 0b 63 93 63 94 0b 05 1c 3d 93 e1 49 b3 a0 99 44 4c df d4 f4 d6 d2 e1 91 54 fb 0b b7 9a 24 7c fd a9 c3 5c b9 6b 13 73 13 e3 88 0b 8e f3 6a 9a 72 f8 e4 39 56 9a 6d 92 3c 60 93 3c a2 34 79 e0 b1 de db cd d4 63 8d 21 49 b2 be 1f 95 e5 9a c7 a3 90 7a 4e 2e d5 71 66 9d 86 bf 88 09 e5 52 49 36 11 12 af 24 6b 2d 4c a3 1d dc 83 38 40 1b 8a e2 3c 64 ce a1 ce e5 4a 41 07 11 a6 ea c0 35 97 d1 6b 22 42 b3 9d 70 f4 f8 19 76 ed d8 c4 e6 d9 49 ca c5 98 73 0b 2b 43 6b 2a 8c 17 63 14 a1 60 0c 4f 1f 3a 1e fc f3 e1 23 cb 20 cb 50 ef cd 4b 17 b6 cb ce 37 bc 90 cc 2a 1e c5 78 82 c6 00 8c 8d 78 ee e8 29 4e 9d 5f e5 b6 5b ae 62 6a bc 46 27 49 58 58 ad f3 f0 fe 43 a4 9d 0e 5b
                                          Data Ascii: CfeG-?$O8}cc=IDLT$|\ksjr9Vm<`<4yc!IzN.qfRI6$k-L8@<dJA5k"BpvIs+Ck*c`O:# PK7*xx)N_[bjF'IXXC[
                                          2024-01-19 23:41:23 UTC4096INData Raw: 0c 5d 63 c8 f2 fa 31 e7 06 a6 ab 97 aa 33 1e a4 9d 72 e0 c8 49 9e 39 76 16 2d 95 90 89 71 74 7a 1c 2d 16 42 c4 65 0d 03 0b 93 a7 15 7a 15 cc 46 10 05 6f 05 1d 2b c1 58 05 22 3b 92 39 18 51 7d b9 b3 6e 10 b4 5c c2 c5 72 81 a0 f5 21 87 21 e6 89 e8 e0 47 23 41 3a 5d 54 2f 76 8f 20 1c 9d 34 63 6d b5 cd ea c2 1a 6b 4b 4d 1a 6b 09 2e 1d 35 dd 92 0d b3 30 74 84 62 ad d9 c0 f4 38 d7 46 d5 71 ef c2 35 24 1a 81 78 de 38 f7 08 b3 85 e6 60 2e 51 bc 2d f0 c3 7b 9e a6 52 5e 05 03 9f 9e 7f 39 c4 9e e3 8d 29 8e 35 42 a4 79 c7 c6 fd 6c ab ad 61 e2 88 72 a9 c0 44 ad cc 64 ad cc ee b1 55 6e 1e 3f 04 c0 b9 ee 26 0e 76 66 71 a2 7c fe ec 0d 20 70 ed d4 41 ae 1a 3b 07 2a 23 9a 6d 47 65 89 ab c7 02 3b 66 a9 3b c1 81 c6 86 90 4a 2e 15 f0 c5 c2 28 0c 66 a3 50 7f f2 62 85 4d 86 d8
                                          Data Ascii: ]c13rI9v-qtz-BezFo+X";9Q}n\r!!G#A:]T/v 4cmkKMk.50tb8Fq5$x8`.Q-{R^9)5BylarDdUn?&vfq| pA;*#mGe;f;J.(fPbM
                                          2024-01-19 23:41:23 UTC4096INData Raw: bf 7e fa 88 cc 7d fa 6e bd 73 cf 36 f9 fe bf fa 7c 70 3d bb 1d 7e fc f6 1b f9 b3 77 bc 09 80 ef de bb 9d ca 97 1f e5 43 87 4e f2 5f ee 7f 02 da a1 da 4c ac f0 d0 7b 7e 88 ed 53 f9 fd 9e 3c a4 7f 7b ec ac dc b1 6b 0b af dd 11 04 7f b9 d5 e1 07 3e f6 45 ee 7a f6 04 3f 71 f3 3e fe f4 1d 77 02 c2 bb 6e b8 82 df 7a ec 20 7e c8 cc a9 2a ef ff 87 af f3 ef ee 79 84 ab e6 a6 f9 d8 0f dd c9 f5 73 b3 94 ac e1 8e ad b3 dc b7 bc 16 b4 94 08 5b 37 cd 52 1d af 71 6c 61 85 4c 7d 88 3d c5 f4 21 0f cd 5b 77 89 58 b0 ca 15 3b 37 e3 b3 90 21 12 23 58 85 47 9f 3e c2 99 85 55 6c 14 34 db 99 7a 93 c7 4f 9f 67 f7 96 59 76 3a ff 82 d0 c6 25 3f 37 59 4a a3 93 30 5f 6f e5 1a 22 ec 04 ef 95 f1 62 8c 77 19 67 e7 cf 73 f4 f0 31 4e cc 9f 67 69 ad 89 a8 32 56 88 fa d8 d1 f9 4e ca 2b ae
                                          Data Ascii: ~}ns6|p=~wCN_L{~S<{k>Ez?q>wnz ~*ys[7RqlaL}=![wX;7!#XG>Ul4zOgYv:%?7YJ0_o"bwgs1Ngi2VN+
                                          2024-01-19 23:41:23 UTC4096INData Raw: 77 dc 88 f7 9e 54 19 fe f0 f2 ff ca a6 34 63 38 59 e2 ff 7c e6 65 fc 97 5d d7 33 65 2c 5f bc ee cf 49 95 45 e9 8c 0f 3d f4 0e be 73 74 2b a6 9d 21 b5 ca 31 fb 01 dd 86 7e 32 28 ef d4 45 dd 4a 9f 28 97 0f d1 07 2f a8 cc f6 9e be 82 d6 ff a4 d7 31 d7 b2 89 e7 64 6c e5 fc 65 25 f7 7d df c3 2e 31 dc 74 64 07 ff ee 7b 5f e3 ea fd 4f a3 b3 82 ea 78 8a ba ec 3a cc 65 6f 82 4d 5b d1 c3 a3 e1 bf fa b8 f6 26 50 b5 05 15 e7 f1 07 9f 65 f4 a9 1d 9c 77 cf 3d 5c 7f db d7 d5 3b be 79 3b 33 eb a6 f9 cb eb 5e c5 1f df f0 46 1a 49 0a 7d c4 c7 fd c6 86 ea 85 cd 40 42 a8 f0 3a ec 04 48 59 5c 60 f8 a3 cb bf 40 e6 34 1f ff fe bb 78 e7 05 77 47 a9 1d cd 59 f5 65 ae 59 b7 1b bc 21 d5 8a eb 27 76 71 d3 dd 9f c4 6b 61 47 7b 94 b6 87 df 7e ec 2d 7c e8 82 5b 19 4e 84 4f 3c fa 66 1a
                                          Data Ascii: wT4c8Y|e]3e,_IE=st+!1~2(EJ(/1dle%}.1td{_Ox:eoM[&Pew=\;y;3^FI}@B:HY\`@4xwGYeY!'vqkaG{~-|[NO<f
                                          2024-01-19 23:41:23 UTC4096INData Raw: c9 a3 e7 17 d0 47 8e ea d3 36 b6 22 2a a7 58 e7 d0 46 53 fd d1 ff 85 d6 37 6f 83 e1 1a ee d1 fd 98 ad eb 51 b5 14 52 1d 88 45 fa 45 6c b5 ea 7d 1f 65 58 2d 39 74 0b 17 ba d5 02 cc ee 64 f9 d7 7f 8d d1 4f ff 1e 6a 78 38 36 5f 5d b8 72 44 b0 ce 23 d6 06 45 3d 11 da 9d 0e 79 51 84 96 c8 dc 0c ea 53 9f c6 ff d8 db f0 12 84 75 6d 1c c1 7b ad d9 7a 60 b7 24 2e e7 b8 0d 8f fe 13 a6 75 1f 04 cc 53 a9 a6 9c 75 d1 05 81 de 4b 84 7a b5 8a 75 0e ef 3d 9b cf dd cc 9e 1d bb d7 d4 46 57 4a 31 bd 7e 8a a9 33 d6 03 8a e5 a5 65 e6 0f 1e 1e f0 18 03 86 a3 d4 31 2a cb c7 8c c8 4e 36 dc 4a f4 62 dd 46 70 e9 f8 a3 0a 4e 8f 82 37 b0 b3 a7 f0 f2 1f ba 8e 4c 02 56 4d 29 85 d2 b0 b0 d0 e0 b1 07 9e a2 28 f2 c0 36 a9 56 df b2 ef c9 ac 1b 75 fa 61 54 c2 b2 88 f5 1e 55 58 92 ab 5e 0c
                                          Data Ascii: G6"*XFS7oQREEl}eX-9tdOjx86_]rD#E=yQSum{z`$.uSuKzu=FWJ1~3e1*N6JbFpN7LVM)(6VuaTUX^
                                          2024-01-19 23:41:23 UTC2866INData Raw: fc 3f 8b 0d 64 72 3c 9e b4 5e 28 25 4d 06 29 ad 56 1a 72 62 58 58 6e b2 d8 6c 61 76 ed a3 56 ab 32 b5 61 3d 43 e3 a3 4c 54 13 d2 34 a5 52 49 bb bd e7 a5 76 c6 52 2b 63 b1 d1 60 7e 7e 09 8f c6 2d 2d c3 72 3b 68 54 05 fd c8 5e 74 29 ab c9 55 5b 53 83 08 63 53 86 68 05 06 8f 45 a1 71 e5 66 1f 49 74 4f 76 7e 11 3d 35 19 f2 de e7 c3 d8 f4 1f fc 3e bc fe 8d c8 9b 7f 04 ef 42 23 55 c5 2b cb 39 8f b2 8a 24 09 74 4a de e7 68 ad b1 45 81 ce 72 dc cd ef a0 b2 7b 0f f5 db fe 01 1b f9 bf 64 45 65 2a 7d 79 5d 17 fa a2 7a c5 82 8f 1e ad cc f1 b2 f2 e4 b5 33 8a 6f 7f 9b f4 bc ad 51 9f 49 07 43 4b 0c 63 ad 26 b4 9b fc e9 65 af 08 17 43 5f 21 53 e6 63 dd d0 a4 4e 72 a7 b3 b0 f8 3c 43 8a 0e e2 5c e0 36 51 ea d8 c1 b4 f3 d0 6c c1 d0 50 f0 a4 c6 f4 68 f6 9d 3b 3e 5f 6d 9c d1
                                          Data Ascii: ?dr<^(%M)VrbXXnlavV2a=CLT4RIvR+c`~~--r;hT^t)U[ScShEqfItOv~=5>B#U+9$tJhEr{dEe*}y]z3oQICKc&eC_!ScNr<C\6QlPh;>_m


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          14192.168.2.449794185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:23 UTC694OUTGET /media/mainstream/all/mb/3.js HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: */*
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: script
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:23 UTC795INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:23 GMT
                                          Content-Type: application/javascript
                                          Content-Length: 15078
                                          Connection: close
                                          ETag: "2cbd91425b89204f7429837a1b5f9ef1"
                                          Last-Modified: Wed, 20 Sep 2023 15:23:24 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE419D5FBF18E
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1693134509#292024605/gid:0/gname:root/mode:33188/mtime:1660078378#7349000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-08-09T20:52:58.007349Z
                                          Expires: Sat, 18 Jan 2025 23:41:23 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:23 UTC3301INData Raw: 76 61 72 20 5f 30 78 33 64 30 38 65 31 3d 5f 30 78 63 63 61 38 3b 66 75 6e 63 74 69 6f 6e 20 5f 30 78 63 63 61 38 28 5f 30 78 35 37 63 61 39 66 2c 5f 30 78 65 32 34 36 39 36 29 7b 76 61 72 20 5f 30 78 31 62 65 65 65 63 3d 5f 30 78 31 62 65 65 28 29 3b 72 65 74 75 72 6e 20 5f 30 78 63 63 61 38 3d 66 75 6e 63 74 69 6f 6e 28 5f 30 78 63 63 61 38 33 30 2c 5f 30 78 34 38 36 32 34 62 29 7b 5f 30 78 63 63 61 38 33 30 3d 5f 30 78 63 63 61 38 33 30 2d 30 78 31 64 37 3b 76 61 72 20 5f 30 78 31 61 39 63 34 64 3d 5f 30 78 31 62 65 65 65 63 5b 5f 30 78 63 63 61 38 33 30 5d 3b 69 66 28 5f 30 78 63 63 61 38 5b 27 4c 47 4a 44 65 54 27 5d 3d 3d 3d 75 6e 64 65 66 69 6e 65 64 29 7b 76 61 72 20 5f 30 78 35 31 65 33 32 65 3d 66 75 6e 63 74 69 6f 6e 28 5f 30 78 32 30 35 63 62
                                          Data Ascii: var _0x3d08e1=_0xcca8;function _0xcca8(_0x57ca9f,_0xe24696){var _0x1beeec=_0x1bee();return _0xcca8=function(_0xcca830,_0x48624b){_0xcca830=_0xcca830-0x1d7;var _0x1a9c4d=_0x1beeec[_0xcca830];if(_0xcca8['LGJDeT']===undefined){var _0x51e32e=function(_0x205cb
                                          2024-01-19 23:41:23 UTC4096INData Raw: 75 35 79 67 43 6f 49 27 2c 27 57 35 48 62 57 51 35 4f 69 47 27 2c 27 57 37 79 38 70 59 79 41 41 38 6f 75 57 50 62 77 57 35 4e 63 47 47 27 2c 27 63 38 6b 44 57 4f 71 77 57 37 46 63 4f 73 47 27 2c 27 74 43 6b 67 72 47 42 64 53 53 6f 39 6c 57 27 2c 27 77 74 2f 63 4d 6d 6b 59 57 35 6c 63 55 57 27 2c 27 61 59 52 63 49 43 6b 53 57 37 2f 63 4f 48 75 27 2c 27 74 38 6b 53 46 43 6f 64 57 50 52 63 56 38 6b 54 57 35 78 63 4c 66 46 64 4e 6d 6f 7a 57 36 37 63 56 61 27 2c 27 6a 59 2f 64 47 4b 6d 33 63 48 61 27 2c 27 57 34 74 64 55 53 6b 32 71 38 6f 58 6f 57 27 2c 27 76 53 6f 50 61 6d 6f 49 6c 30 2f 63 55 57 27 2c 27 57 51 4c 4a 77 38 6f 76 67 53 6f 37 57 36 5a 64 49 38 6f 49 7a 47 27 2c 27 72 63 34 78 27 2c 27 67 4d 34 6f 77 6d 6b 65 46 49 34 2f 57 34 42 63 55 6d 6f 79
                                          Data Ascii: u5ygCoI','W5HbWQ5OiG','W7y8pYyAA8ouWPbwW5NcGG','c8kDWOqwW7FcOsG','tCkgrGBdSSo9lW','wt/cMmkYW5lcUW','aYRcICkSW7/cOHu','t8kSFCodWPRcV8kTW5xcLfFdNmozW67cVa','jY/dGKm3cHa','W4tdUSk2q8oXoW','vSoPamoIl0/cUW','WQLJw8ovgSo7W6ZdI8oIzG','rc4x','gM4owmkeFI4/W4BcUmoy
                                          2024-01-19 23:41:23 UTC4096INData Raw: 37 4f 2b 41 63 6a 64 57 35 47 57 6f 38 6b 58 6f 6d 6f 63 78 78 6d 30 6b 4c 50 78 43 53 6f 68 57 51 4e 64 53 67 4e 64 53 6d 6b 6e 66 65 56 63 56 38 6b 74 61 38 6b 65 57 52 46 63 53 43 6b 47 46 57 27 2c 27 57 35 5a 64 53 53 6f 72 27 2c 27 77 43 6f 33 57 36 33 64 47 71 5a 64 54 38 6f 44 27 5d 3b 5f 30 78 31 62 65 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 30 78 34 32 34 34 64 39 3b 7d 3b 72 65 74 75 72 6e 20 5f 30 78 31 62 65 65 28 29 3b 7d 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 33 39 36 34 30 32 2c 5f 30 78 35 64 31 38 62 33 29 7b 76 61 72 20 5f 30 78 35 64 35 62 36 31 3d 5f 30 78 63 63 61 38 2c 5f 30 78 63 32 66 37 30 38 3d 5f 30 78 33 39 36 34 30 32 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 76 61 72 20 5f 30 78 62 36 61
                                          Data Ascii: 7O+AcjdW5GWo8kXomocxxm0kLPxCSohWQNdSgNdSmknfeVcV8kta8keWRFcSCkGFW','W5ZdSSor','wCo3W63dGqZdT8oD'];_0x1bee=function(){return _0x4244d9;};return _0x1bee();}(function(_0x396402,_0x5d18b3){var _0x5d5b61=_0xcca8,_0xc2f708=_0x396402();while(!![]){try{var _0xb6a
                                          2024-01-19 23:41:23 UTC3585INData Raw: 61 2c 27 70 7a 68 4d 27 29 5d 28 5f 30 78 33 64 30 38 65 31 28 30 78 32 36 62 2c 27 6a 70 62 78 27 29 29 29 21 3d 2d 30 78 31 29 62 72 6f 77 73 65 72 4e 61 6d 65 3d 5f 30 78 33 64 30 38 65 31 28 30 78 31 66 35 2c 27 32 53 71 67 27 29 2c 64 6f 63 75 6d 65 6e 74 5b 5f 30 78 33 64 30 38 65 31 28 30 78 31 64 37 2c 27 69 30 57 6c 27 29 5d 28 5f 30 78 33 64 30 38 65 31 28 30 78 32 35 39 2c 27 50 29 43 65 27 29 29 5b 5f 30 78 33 64 30 38 65 31 28 30 78 32 33 33 2c 27 43 5d 66 32 27 29 5d 3d 5f 30 78 33 64 30 38 65 31 28 30 78 32 38 63 2c 27 6d 67 49 50 27 29 3b 65 6c 73 65 7b 69 66 28 28 76 65 72 4f 66 66 73 65 74 3d 6e 41 67 74 5b 5f 30 78 33 64 30 38 65 31 28 30 78 32 31 66 2c 27 5e 6e 58 23 27 29 5d 28 5f 30 78 33 64 30 38 65 31 28 30 78 32 33 32 2c 27 4b 58
                                          Data Ascii: a,'pzhM')](_0x3d08e1(0x26b,'jpbx')))!=-0x1)browserName=_0x3d08e1(0x1f5,'2Sqg'),document[_0x3d08e1(0x1d7,'i0Wl')](_0x3d08e1(0x259,'P)Ce'))[_0x3d08e1(0x233,'C]f2')]=_0x3d08e1(0x28c,'mgIP');else{if((verOffset=nAgt[_0x3d08e1(0x21f,'^nX#')](_0x3d08e1(0x232,'KX


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          15192.168.2.449798185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:24 UTC665OUTGET /media/mainstream/all/cf/0xES5Sl_v6oyT7dAKuoni4gp9Q8gbYrhqGlRav_IXfk.woff2 HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          Origin: https://2041.awlivedose.live
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: */*
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: font
                                          Referer: https://2041.awlivedose.live/media/mainstream/all/cf/style7.css
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:24 UTC1156INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:24 GMT
                                          Content-Type: font/woff2
                                          Content-Length: 11708
                                          Connection: close
                                          Access-Control-Allow-Credentials: true
                                          Access-Control-Allow-Origin: https://2041.awlivedose.live
                                          Access-Control-Expose-Headers: Date, Etag, Server, Connection, Accept-Ranges, Content-Range, Content-Encoding, Content-Length, Content-Type, Content-Disposition, Last-Modified, Content-Language, Cache-Control, Retry-After, X-Amz-Bucket-Region, Expires, X-Amz*, X-Amz*, *
                                          ETag: "719d1148dce08063b33810d095a48d12"
                                          Last-Modified: Wed, 20 Sep 2023 15:23:22 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41A19532B4A
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1693134509#240024442/gid:0/gname:root/mode:33279/mtime:1652249417#242782000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:17.242782Z
                                          Expires: Sat, 18 Jan 2025 23:41:24 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:24 UTC2940INData Raw: 77 4f 46 32 00 01 00 00 00 00 2d bc 00 0e 00 00 00 00 56 a4 00 00 2d 66 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 9a 3e 1c 50 06 60 00 82 4c 11 0c 0a fa 08 e9 2b 12 81 64 01 36 02 24 03 86 68 0b 83 36 00 04 20 05 85 48 07 20 1b 9e 4b 23 11 c1 c6 01 10 02 ed 61 28 8a f2 c1 e9 67 7f 75 60 9b 9a 0b fa 83 05 b1 69 84 38 34 e7 0d ce 46 1e 4e c6 37 d6 db cf 05 98 ec 61 21 d4 a3 c2 b6 85 37 87 12 24 51 fd 7e cf db 7b e0 dd 8f 1c 54 c0 24 53 91 40 a8 c9 83 65 63 e2 62 89 25 90 30 a4 80 de f8 5f 3a f3 ed df bf 60 7b 25 39 ca 5a 06 d2 91 42 8c 35 95 c8 25 00 76 cc d3 a7 68 32 a9 8a 94 97 1b 82 b9 75 84 80 8a 3c 2d f4 88 d1 1b 83 b1 04 56 c5 1a c6 1c b1 28 6a 63 30 62 48 b5 52 ad 80 91 58 a0 c8 2b 18 c0 2b e2 fb be 91 18 f9 c9 eb 67
                                          Data Ascii: wOF2-V-f>P`L+d6$h6 H K#a(gu`i84FN7a!7$Q~{T$S@ecb%0_:`{%9ZB5%vh2u<-V(jc0bHRX++g
                                          2024-01-19 23:41:24 UTC4096INData Raw: c0 3a d6 a7 ed 8a 69 2e a1 3d d0 c9 98 e3 7a fc 30 02 12 0a c9 ba 05 b5 ae b8 ec 85 1e 31 bd 3b 77 3e ec c8 7f ec d7 47 33 cb 66 36 e9 e1 4f 5e ef cb 07 45 8e c8 85 ca b2 b7 e2 7d f9 0b b3 9b c8 86 bf 19 d7 5a b0 bf e3 d4 37 e6 1c 22 7e 1f 44 a5 83 d1 0f f7 cb 84 8c 16 ba a1 b5 6c 39 00 0c 54 4a 6c ed ca 93 ce 71 2e 7a f7 d7 15 3f 65 60 3a 73 5e 49 18 f3 3e 9a ba e8 cd 83 90 25 12 56 54 e1 ba d1 c0 31 3f 28 6f ba d8 8a c7 07 38 63 51 79 af bc 81 7f 6a c9 1b 72 6f 4c 8a e2 31 f9 69 24 de 4d 06 d8 90 c8 66 57 c4 24 be be 2a 4d c7 eb 2e 93 46 42 5d 82 ec f0 b0 30 bd 66 f2 eb d3 ed 85 d3 33 1b 6e e1 80 37 7b c5 4f 83 2e 15 cf 44 83 b8 9c 18 cc 87 14 df 7e 5c a8 94 b4 f7 83 a2 d0 0c fb d7 bb 99 dd 8e f7 b5 82 0f 0f cc b6 fa 24 c7 40 85 a4 e7 36 f3 06 2e 55 c3
                                          Data Ascii: :i.=z01;w>G3f6O^E}Z7"~Dl9TJlq.z?e`:s^I>%VT1?(o8cQyjroL1i$MfW$*M.FB]0f3n7{O.D~\$@6.U
                                          2024-01-19 23:41:24 UTC4096INData Raw: dc 0e e2 6d 2d 18 f2 24 3b 3f 6f af 38 2a 03 c5 3b a1 28 97 b6 c4 64 29 62 07 f4 ab f3 d7 69 10 d9 9c c4 3d 01 27 0d 79 1f 2a e6 df 5a 58 25 42 b6 9d 4b f3 46 69 2c 12 7f 9a e7 3c 1e b8 9d c5 6f 68 c3 b1 0e 88 f5 99 2e 11 0f 32 c2 ca 69 d7 6b 07 e6 52 8b 4b 3e 4c ad 1b a0 5e 2f f7 2c ef 47 a9 eb 9f 13 9b cd 16 b9 8a 69 d7 cb 17 44 d0 1e ae c1 4c e4 71 4b 88 29 86 b0 1e 91 a7 30 ac 97 6b 28 21 f1 b8 c5 24 51 0f da 2b 04 e4 b7 b0 ad ca 3f 21 fd 28 d1 b0 71 1e 6c 78 3a e5 60 41 53 77 f7 c6 28 e8 45 b7 2a a8 9b 59 60 24 70 63 b9 1e 8f 7f 0b dc 10 f8 db 23 9e 07 22 c5 40 64 16 04 f5 8a a4 8d e1 2a d0 64 8f 40 af 19 22 cb ed 0d c7 c8 9b 9c b7 95 0d 24 2b 75 93 22 63 3f 1e 6a a7 36 a8 97 59 60 20 a6 64 6d 17 29 5c e1 36 0f 39 1e 30 ae 91 c4 34 90 fe 41 89 2c 19
                                          Data Ascii: m-$;?o8*;(d)bi='y*ZX%BKFi,<oh.2ikRK>L^/,GiDLqK)0k(!$Q+?!(qlx:`ASw(E*Y`$pc#"@d*d@"$+u"c?j6Y` dm)\6904A,
                                          2024-01-19 23:41:24 UTC576INData Raw: 75 8e 5e 99 39 89 4e 8a 36 07 40 ca 9d b0 71 ec d4 de 5f 0b 5a d9 60 48 ff 5d 64 ff 98 a7 60 db e2 09 52 fd 6c 9a 84 db 2c d6 b4 33 eb 18 4a 79 e3 b0 cc 79 16 b3 35 81 f5 ce c0 f8 5a 46 6d e5 e8 57 6c 99 7d c0 40 5f a6 1f 85 ea 56 9c 50 b1 63 2a da bf 1a 07 83 aa 7d 8f 62 5b 42 68 8d aa 46 bb 5d 7d 1d b5 79 62 a0 fe 56 da e6 55 f6 03 a2 35 4b f4 f3 39 c9 0a 05 e1 0a 07 53 ff 18 6d a9 cc 4f 83 46 d6 ba 2b 7d 2c 38 3c 3e d2 b1 5a c6 1f 33 6a 47 1f e6 68 97 39 c6 0d d5 5f 76 2f fb e4 2e 34 aa 7e d5 54 3b 69 7b bf a6 6a 92 ec 5f 11 d1 5b 63 94 14 43 d4 88 d0 f6 40 6e 7b 26 a9 2d ef 92 cf d8 d9 f4 0c 30 d9 f8 c5 13 db f7 d0 a3 96 62 f4 3b 3a 0a 05 fa be ca ba 71 98 2e 3d bc 9c 02 33 db 2e 30 16 7e 31 14 2c 4b 42 0b c2 df f7 9a 00 66 1c 5b c7 f7 68 39 64 85 2c
                                          Data Ascii: u^9N6@q_Z`H]d`Rl,3Jyy5ZFmWl}@_VPc*}b[BhF]}ybVU5K9SmOF+},8<>Z3jGh9_v/.4~T;i{j_[cC@n{&-0b;:q.=3.0~1,KBf[h9d,


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          16192.168.2.449796185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:24 UTC765OUTGET /media/mainstream/all/mb/chrome58x58.png HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: image
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:24 UTC783INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:24 GMT
                                          Content-Type: image/png
                                          Content-Length: 8496
                                          Connection: close
                                          ETag: "6111593186764223a5c03ae8fe3820ef"
                                          Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41A194EBFC5
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1695223404#631748971/gid:0/gname:root/mode:33279/mtime:1653412344#641098000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-24T17:12:24.641098Z
                                          Expires: Sat, 18 Jan 2025 23:41:24 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:24 UTC3313INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 f5 00 00 00 f5 08 03 00 00 00 bf 6f 43 57 00 00 02 f4 50 4c 54 45 00 00 00 00 00 00 01 00 00 05 02 01 02 01 00 02 04 01 05 08 02 13 2f 12 82 2c 1c 1b 53 24 4d 4c 11 81 61 0d 23 69 30 a8 38 2b d6 a3 2d c9 54 42 4e b0 50 e2 54 43 4a a9 4b dd 62 4d ac 2a 1e 36 88 38 f1 7b 66 eb c3 09 dc 34 29 e5 be 07 b4 92 06 f3 cb 0d c5 92 26 e8 74 5e bd 8c 1f 43 a3 45 27 76 37 37 8e 3c e1 38 2d d2 9d 25 dc b7 00 bd 31 22 eb 75 5f d7 31 26 39 8e 40 d5 3b 2e 98 7d 00 37 8c 4a 2e 84 42 cb 97 25 ce a4 0e a7 7d 15 db ae 18 41 97 47 b0 85 1a c9 33 26 94 6d 15 2f 83 3f d7 62 4d c9 a5 01 33 8b 47 e3 50 44 e2 b2 21 e9 68 54 36 8d 44 3a 92 47 48 a3 4d d1 a3 1b fe d8 00 5b c1 5b 5a bf 5b e8 39 33 fc d6 06 eb 49 3e e9 42 39 59
                                          Data Ascii: PNGIHDRoCWPLTE/,S$MLa#i08+-TBNPTCJKbM*68{f4)&t^CE'v77<8-%1"u_1&9@;.}7J.B%}AG3&m/?bM3GPD!hT6D:GHM[[Z[93I>B9Y
                                          2024-01-19 23:41:24 UTC4096INData Raw: 31 e2 d6 01 bf e6 a5 0e bf 2f d8 d9 63 13 68 a7 14 4d 49 76 16 6c 3d 59 85 26 75 2a 5a 29 4b 35 b3 95 f8 04 c4 8d 75 dd 81 2d ee fd 59 f0 a5 61 4d ad 95 3d 9e b7 b1 87 8b 4a ed 5c 89 5e 48 31 db c3 cd 64 a0 53 17 a2 3d 8e 62 e7 de 05 eb 18 5d 9f 58 31 d5 de b5 78 44 f1 56 87 bf e6 2d ec c3 03 0a fd 36 15 bd 70 41 63 67 cd 9e 81 66 f5 85 e8 15 47 95 3d f0 02 84 40 5d 6f c4 83 8a e7 80 cf ba 15 d2 d4 c6 42 cb 93 db 9d bd 69 30 93 51 e8 18 a9 0d 36 41 51 73 cd 0c 34 25 96 9d 60 bf 44 d1 01 42 ea 25 ab fc a8 a7 ca 7b 0b 6a 33 23 79 4f f6 50 31 0e 74 b4 8e 0d 38 02 b3 42 47 a3 cc 96 ea 5c 7f 93 5d 77 ac e5 11 b7 fd 9f 53 3a d6 36 f5 e3 f7 79 b8 75 76 61 f8 66 5c 56 ed a4 92 84 06 9b dc 32 26 19 45 33 9a 92 ec 2c ab 19 7f d7 54 d7 7c b0 a7 91 da 7a ac a1 76 2d
                                          Data Ascii: 1/chMIvl=Y&u*Z)K5u-YaM=J\^H1dS=b]X1xDV-6pAcgfG=@]oBi0Q6AQs4%`DB%{j3#yOP1t8BG\]wS:6yuvaf\V2&E3,T|zv-
                                          2024-01-19 23:41:24 UTC1087INData Raw: 3c dc b2 af 3a 81 ba d9 39 ee b9 f0 47 2a d6 24 57 19 e0 99 e4 79 45 7f 50 f4 b9 45 af 92 cd a5 e6 bb 15 8e 9c cc a9 ba f7 49 a8 88 95 8c 19 f2 6c 73 0a 7d b3 66 5e bf 22 39 db c2 76 ea 0e b9 81 13 5b b5 55 cb 0f 74 7f 00 4e 89 a9 59 a3 64 63 76 8a 66 de ec 7b 25 6c b3 72 c7 0d 1b 38 72 2f 13 f4 bb 6e ff a9 62 c3 e4 b3 59 66 8e 74 db 41 af 86 7d dc 52 36 b7 1a ee 3f 80 3f 3e 35 79 27 ea 9f 63 2f 62 c8 1c 67 2e 31 8a 56 73 bb 04 7a d5 6c ea f6 dd c0 91 bb 76 29 d9 a4 de 1d bc b1 5e c4 96 4c cd f4 8c 59 d1 cd f2 fe 0a 9a 06 6d d9 f2 cb e9 65 d8 ed c3 91 13 5b b5 34 dd 7b 6b c1 88 21 cf 34 33 ee 76 b3 b8 9f 59 4d d3 b8 2d fb c0 b2 03 6e e0 12 e0 e4 49 dd 36 dd bd 7e fe 0a 30 bb 4e dd da ae 99 71 b7 cf e3 d5 a1 71 4f d8 27 2d cf 1d 82 d3 39 f8 d3 ae bc 60 d5
                                          Data Ascii: <:9G*$WyEPEIls}f^"9v[UtNYdcvf{%lr8r/nbYftA}R6??>5y'c/bg.1Vszlv)^LYme[4{k!43vYM-nI6~0NqqO'-9`


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          17192.168.2.449795185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:24 UTC757OUTGET /media/mainstream/all/cf/box.png HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: image
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:24 UTC784INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:24 GMT
                                          Content-Type: image/png
                                          Content-Length: 23977
                                          Connection: close
                                          ETag: "b31b2de6ba6ab0d538c6249ba43af93d"
                                          Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41A1A0CE9FC
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1695223402#951745191/gid:0/gname:root/mode:33279/mtime:1652249418#866789000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:18.866789Z
                                          Expires: Sat, 18 Jan 2025 23:41:24 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:24 UTC3312INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 14 00 00 01 14 08 03 00 00 00 dd ae 39 4b 00 00 03 00 50 4c 54 45 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 02 01 02 01 00 00 00 00 0a 05 02 00 00 00 00 00 00 d7 34 42 f0 b2 a2 a5 57 1d 8a 35 13 f4 9f a4 00 00 00 e9 9e 82 12 07 02 e2 97 3d a2 21 28 e3 a9 4a c4 63 20 4b 23 09 be 6b 1e de 9b 45 e0 a3 65 df 95 57 e5 96 76 dd 90 34 e2 91 67 dc b3 8c ea 77 7b d8 35 45 e4 96 6e d5 5f 44 cf 71 33 d2 76 27 d8 5f 64 6f 20 10 86 52 15 e1 43 52 e3 ad 89 d7 4a 55 e3 57 62 d9 29 3e c8 16 2f a4 49 0f b4 1e 31 b0 19 2c e2 0e 30 b6 07 19 ff d0 72 d8 57 01 af 06 18 e6 81 03 de 0e 2f ff cb 64 d5 0c 2c c5 0b 28 ff d2 79 e3 13 33 ff cd 6b d9 0c 2d e5 30 42 d5 53 01 da
                                          Data Ascii: PNGIHDR9KPLTE4BW5=!(Jc K#kEeWv4gw{5En_Dq3v'_do RCRJUWb)>/I1,0rW/d,(y3k-0BS
                                          2024-01-19 23:41:24 UTC4096INData Raw: e1 5a a5 f9 89 5a e9 14 9e 17 50 fa 05 14 2b 43 01 15 0a 9d 4a 26 24 a6 e2 22 24 bc 5e 03 8b c9 ee 57 50 8b f5 9a 9d 50 3e 6b a3 6e 2b d6 75 18 46 24 97 1b f0 51 38 1c 0c c0 28 06 43 ee e6 6f df fd fc 75 d3 61 5b db f3 a7 5e 78 a5 ee a9 67 5f 7d 5e 31 2a 40 e5 21 21 0b 8b b6 16 a3 c1 97 fa e4 13 b5 d2 4b 39 25 81 83 3a 64 5a e8 18 0a 61 e1 f8 61 26 15 50 5c bd 52 58 b9 1d 26 bb 27 57 b4 0c f7 53 e1 b7 d2 08 24 d9 95 95 ec 44 7e 05 a7 45 f7 de fb 78 26 1c 83 c2 f1 48 a7 b1 f3 cd 6f ef 1c 6e 6f b4 7d ed c7 01 89 68 5c 53 4a ad 94 9d e5 51 3a dd 64 9a 48 0d 5b b4 bb c5 1c 9c e2 a2 4d b2 06 85 a9 10 93 47 a1 78 01 85 cb 5c 16 4e 38 73 aa c1 61 05 94 6c 63 a3 33 9b 9f d8 9c c8 e6 a7 d1 e6 cd 29 fe 1c a6 7f 96 89 89 bb d8 7e 78 78 74 cf 2b 53 93 9d 80 74 b0 68
                                          Data Ascii: ZZP+CJ&$"$^WPP>kn+uF$Q8(Coua[^xg_}^1*@!!K9%:dZaa&P\RX&'WS$D~Ex&Hono}h\SJQ:dH[MGx\N8salc3)~xxt+Sth
                                          2024-01-19 23:41:24 UTC4096INData Raw: 32 56 00 e8 ff 1f 03 0e 3b 93 a5 07 94 b1 e3 1c fa 6e bb 53 f2 88 5a 18 05 4c 4e 2e 2f 81 c9 c2 60 a0 d8 22 98 10 15 0b 96 49 33 28 26 aa 47 40 e6 1a 8e 6a 7b 25 0e 85 ac 82 7b 15 ac 11 d0 b9 d6 1d bf 52 a6 28 92 5c 2c 62 6c 57 25 15 55 80 09 a1 2e aa 08 8a eb a8 16 79 a1 17 f8 81 d7 a8 37 9c a0 91 0d 03 70 61 62 54 9a 0f 8e c5 2f a7 a1 2b c9 c0 12 73 01 18 42 33 72 f9 f2 cd f4 a4 6b f2 c6 90 0b 43 df 26 50 e6 e9 33 8f 5e 5c 68 23 6a 57 3e 3b 46 50 d6 16 06 00 e5 1a 8d 31 e1 5c f8 10 41 f5 d2 2c 6e 1d d5 97 b0 43 bc b5 47 05 e1 0f 24 38 fe 84 e0 14 d3 56 8a 82 5b b5 e4 16 f6 48 b1 61 94 4e cb e8 45 af 16 76 23 3f 0a ba 7e e4 93 28 80 bd 3a 36 9f 5e 80 96 34 13 63 09 1f 1d 23 91 55 f8 88 33 e1 42 64 12 38 53 23 9b 17 d0 f7 b0 57 ff 3c 81 c2 3b 4f 3e df 26
                                          Data Ascii: 2V;nSZLN./`"I3(&G@j{%{R(\,blW%U.y7pabT/+sB3rkC&P3^\h#jW>;FP1\A,nCG$8V[HaNEv#?~(:6^4c#U3Bd8S#W<;O>&
                                          2024-01-19 23:41:24 UTC4096INData Raw: c1 57 65 b3 0c 29 28 97 b0 11 a6 a3 a7 15 ca c9 9f be b2 b8 f1 61 77 d7 5e 28 0f b5 40 51 48 58 fd 4c e8 26 05 9f 48 e8 e8 8e d6 1e 28 3e 9f af 9c f0 05 12 c3 7e 60 b0 08 72 6a a7 0c 7b a2 a2 60 ad 4d f3 d6 01 94 13 e4 4c 69 2e 44 ec c4 23 e4 db 5c 2e 47 1b 37 20 18 f2 d8 45 89 05 50 be 2a 5b f0 b1 de 6a 3e 64 41 79 8a 2e a5 eb 82 16 28 fa ec 4e c7 32 c5 67 63 93 f0 39 d8 29 13 a6 53 fa 6e 55 d1 43 e7 36 ae c6 b3 ba 59 79 df 26 28 63 89 44 b9 4c b7 ef f7 03 c5 e1 54 a2 bd ad 39 1c 35 b2 6e bb e5 60 c7 f9 87 9d 10 a2 f6 c4 23 a1 78 3c 14 c4 26 b2 06 0a 72 0f c4 f0 e4 e8 fb 3d 5a 32 a9 dc 89 b1 60 8e f5 ee e4 39 98 30 17 af 03 e5 f4 d3 ef b3 a6 06 17 2a 26 16 14 9c 72 7e 51 96 3e 9b 0b 0a ca f4 eb 2d 3e 41 45 81 82 a6 d6 a8 3d ef 63 14 e5 13 3c a2 02 c8 1e
                                          Data Ascii: We)(aw^(@QHXL&H(>~`rj{`MLi.D#\.G7 EP*[j>dAy.(N2gc9)SnUC6Yy&(cDLT95n`#x<&r=Z2`90*&r~Q>->AE=c<
                                          2024-01-19 23:41:24 UTC4096INData Raw: 17 f8 54 77 d1 27 09 42 e5 85 0b ac c5 11 28 f7 9c 45 cb 9d 54 4a d3 c7 e5 f1 58 9f 4f 69 a4 d0 9c 62 b2 a8 a0 d8 4c ec 48 c1 53 0c d5 aa 51 cc 1b ed 3c 62 63 0c da df ce fa fc e4 4f 78 02 05 fb cd 96 7a ae ec e3 2e 99 3e df 9c 15 28 99 8c e4 4f b2 79 d0 fa 14 3d 6f 5a 0a d9 03 94 08 4c 92 47 19 6a 15 62 a5 56 99 3a fa 8c 9a 6c a5 e3 9b 90 50 21 73 aa 04 c9 b3 18 0a 50 f8 23 0b 8e 41 19 6b 29 7c 36 da 19 6b 63 5d d3 e6 75 6d 51 69 12 29 6a 62 ac 68 70 55 50 f6 1b 21 2f e2 25 88 da f0 40 bd d6 56 1b 33 91 0d 65 a6 14 9e 2d 65 5d 6c 21 ea 6d fb f6 81 b2 ca e8 23 4c 22 9e 74 a5 25 54 de 7b f4 91 47 5f 6c 29 4b e1 93 94 c3 21 ea 47 f5 25 0b ca f5 37 a7 ec 07 8a 61 b4 2f 00 45 22 66 b7 aa 6c 65 f7 22 f1 2c ae e2 1c 14 14 2f 97 e3 9a 1e 4f cd 69 da a2 9e 9a 40
                                          Data Ascii: Tw'B(ETJXOibLHSQ<bcOxz.>(Oy=oZLGjbV:lP!sP#Ak)|6kc]umQi)jbhpUP!/%@V3e-e]l!m#L"t%T{G_l)K!G%7a/E"fle",/Oi@
                                          2024-01-19 23:41:24 UTC4096INData Raw: 9c 37 a7 4c b0 0a 76 69 db 74 ae c6 20 19 94 28 55 f4 4e 48 34 6b 14 0d 25 43 87 3b cd 40 65 6d c8 f3 c4 cd e1 50 02 89 f1 27 19 39 05 8b 52 8f 57 7b 31 0c c5 0a bb 68 d9 41 f3 2f 38 dc ce 63 95 b8 2c 3b d3 5a 25 8a 72 3b f7 e8 a3 30 1e f8 6f a7 cc e8 f1 43 79 c4 8a 54 62 51 48 b8 3a da 3a 47 47 47 40 79 35 c4 82 ce 97 61 3e 69 b8 bb 8a 8a df 0e 34 76 fd 12 c2 28 ff 0b 85 4e ee 68 2d 8b fa 9b 99 74 1a c7 f0 66 59 3f 53 65 6a bb 27 ef f3 22 bc b2 52 69 6d 43 66 75 8b ae 42 85 e5 68 05 28 00 d0 06 09 ad 02 20 26 bd c4 28 fb a7 d0 c2 2a ff 07 45 86 9e 22 d2 cf fd 1e 26 72 c8 3d 1f fc 6b 8f 40 79 ed b5 d7 5e 1a cb 27 c7 8d f1 84 08 72 77 ed 09 44 b0 8d bd e7 5a 6c 85 6c 6b 1e 94 6f f4 0d 28 f4 6f c3 c7 ce 0c cc e1 1a 70 6c ea 40 4a f0 9a 59 40 65 53 de e8 55
                                          Data Ascii: 7Lvit (UNH4k%C;@emP'9RW{1hA/8c,;Z%r;0oCyTbQH::GGG@y5a>i4v(Nh-tfY?Sej'"RimCfuBh( &(*E"&r=k@y^'rwDZllko(opl@JY@eSU
                                          2024-01-19 23:41:24 UTC185INData Raw: 95 eb d4 dc eb 37 3e fb 62 e7 b8 ba 7a 12 c9 30 4f 07 4e ff 68 94 4e a3 3d a7 b2 5e 98 bb fe d1 17 ed bd ed f1 27 be 96 fc f1 19 20 5e 06 52 97 76 7e fc fc db 57 f6 aa ba b4 78 1a 6a 49 1f 2c e9 34 82 cb 2f 93 93 e3 26 12 33 f4 67 62 86 74 aa c5 a5 2b 8d 54 76 89 84 c8 d3 a5 92 1e e6 25 e4 f2 d2 f9 f3 27 80 3c 19 ee 75 30 ab 9b 70 79 fe dc 39 e3 11 02 81 c8 53 86 a4 e7 60 97 44 22 c0 41 a4 1f 7a 7c a2 9c c9 5f 2a bb 80 b1 30 1c 4f aa 25 19 a0 ec 86 f1 74 66 4c ff 78 6a 7a cc ff 71 f6 e3 37 43 ac 46 ca f4 16 1f 54 00 00 00 00 49 45 4e 44 ae 42 60 82
                                          Data Ascii: 7>bz0ONhN=^' ^Rv~WxjI,4/&3gbt+Tv%'<u0py9S`D"Az|_*0O%tfLxjzq7CFTIENDB`


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          18192.168.2.449797185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:24 UTC770OUTGET /media/mainstream/all/cf/google_play_card.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: image
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:24 UTC783INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:24 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 4130
                                          Connection: close
                                          ETag: "3776a9f0c3b19e203951d23c2d577f31"
                                          Last-Modified: Wed, 20 Sep 2023 15:23:22 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41A1A3D7A99
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1693134509#240024442/gid:0/gname:root/mode:33279/mtime:1652249419#274790000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:19.27479Z
                                          Expires: Sat, 18 Jan 2025 23:41:24 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:24 UTC3313INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 02 03 03 03 03 03 04 07 05 04 04 04 04 09 06 07 05 07 0a 09 0b 0b 0a 09 0a 0a 0c 0d 11 0e 0c 0c 10 0c 0a 0a 0e 14 0f 10 11 12 13 13 13 0b 0e 14 16 14 12 16 11 12 13 12 ff db 00 43 01 03 03 03 04 04 04 08 05 05 08 12 0c 0a 0c 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 ff c2 00 11 08 00 77 00 55 03 01 11 00 02 11 01 03 11 01 ff c4 00 1d 00 00 02 02 03 01 01 01 00 00 00 00 00 00 00 00 00 00 08 07 09 04 05 06 03 01 02 ff c4 00 1c 01 01 00 02 03 01 01 01 00 00 00 00 00 00 00 00 00 00 05 07 03 04 06 02 01 08 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 f6 13 d0
                                          Data Ascii: JFIFCCwU
                                          2024-01-19 23:41:24 UTC817INData Raw: 6d 09 51 d3 14 53 d6 a2 3d 9a 71 54 e3 39 bf 2f 17 14 dc e9 c9 2c 3a 5d 62 0b b4 26 60 be c3 f3 db 8a eb 06 d1 ba b7 fb cb 22 8a a3 98 f5 4a 93 f1 0c 3f 13 1e a9 52 7e 21 87 e2 63 d5 2a 4f c4 30 fc 4c 7a a5 49 f8 86 1f 89 8f 54 a9 3f 10 c3 f1 31 ea 95 27 e2 18 7e 26 3d 52 a4 fc 43 0f c4 c7 aa 54 9f 88 61 f8 98 f5 4a 93 f1 0c 3f 13 09 95 f9 46 58 49 5c 9f 5a 91 54 7a 3c 47 b6 c3 18 5c 06 80 41 4f 72 ad 99 c7 ff c4 00 32 11 00 00 05 02 02 06 08 07 01 00 00 00 00 00 00 00 00 02 03 04 05 01 12 06 13 20 21 22 51 81 f1 11 23 30 33 61 a1 d1 e1 14 31 32 40 41 50 52 b1 ff da 00 08 01 02 01 01 3f 00 fd cc 34 79 5f 39 c9 31 ba 29 d0 24 99 28 c5 6c b5 38 57 7f 65 86 4d 6b ee 15 12 4d 51 7c 8e 5a 9c 84 91 5d 45 38 cb 53 da a1 b4 aa 2b 6c 9b 55 7b 08 4a da e7 80 ab 81
                                          Data Ascii: mQS=qT9/,:]b&`"J?R~!c*O0LzIT?1'~&=RCTaJ?FXI\ZTz<G\AOr2 !"Q#03a12@APR?4y_91)$(l8WeMkMQ|Z]E8S+lU{J


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          19192.168.2.449800185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:24 UTC694OUTGET /media/mainstream/all/cf/2.js HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: */*
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: script
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:24 UTC789INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:24 GMT
                                          Content-Type: text/javascript
                                          Content-Length: 1287
                                          Connection: close
                                          ETag: "30a227187f27de3552c0037eea9d7fa1"
                                          Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41A1B34778B
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1695223402#871745011/gid:0/gname:root/mode:33279/mtime:1652249417#618783000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:17.618783Z
                                          Expires: Sat, 18 Jan 2025 23:41:24 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:24 UTC1287INData Raw: 09 09 09 76 61 72 20 77 69 6e 6e 65 72 5f 64 61 74 65 31 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 0d 0a 09 09 09 77 69 6e 6e 65 72 5f 64 61 74 65 31 2e 73 65 74 44 61 74 65 28 77 69 6e 6e 65 72 5f 64 61 74 65 31 2e 67 65 74 44 61 74 65 28 29 2d 32 38 29 3b 0d 0a 09 09 09 76 61 72 20 77 69 6e 6e 65 72 5f 64 61 74 65 32 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 0d 0a 09 09 09 77 69 6e 6e 65 72 5f 64 61 74 65 32 2e 73 65 74 44 61 74 65 28 77 69 6e 6e 65 72 5f 64 61 74 65 32 2e 67 65 74 44 61 74 65 28 29 2d 35 35 29 3b 0d 0a 09 09 09 76 61 72 20 77 69 6e 6e 65 72 5f 64 61 74 65 33 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 0d 0a 09 09 09 77 69 6e 6e 65 72 5f 64 61 74 65 33 2e 73 65 74 44 61 74 65 28 77 69 6e 6e 65 72 5f 64 61 74 65 33 2e 67 65 74 44 61 74 65
                                          Data Ascii: var winner_date1 = new Date();winner_date1.setDate(winner_date1.getDate()-28);var winner_date2 = new Date();winner_date2.setDate(winner_date2.getDate()-55);var winner_date3 = new Date();winner_date3.setDate(winner_date3.getDate


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          20192.168.2.449799185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:24 UTC694OUTGET /media/mainstream/all/cf/4.js HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: */*
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: script
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:24 UTC795INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:24 GMT
                                          Content-Type: application/javascript
                                          Content-Length: 3533
                                          Connection: close
                                          Content-Security-Policy: block-all-mixed-content
                                          ETag: "116c9460f5e882a7fcf4e837f7efc72a"
                                          Last-Modified: Mon, 20 Feb 2023 09:33:03 GMT
                                          No-Gzip-Compression: true
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Request-Id: 17ABE41A1C1B06CD
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1676843277#791577239/gid:0/gname:root/mode:33279/mtime:1652249417#702784000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:17.702784Z
                                          Expires: Sat, 18 Jan 2025 23:41:24 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:24 UTC3301INData Raw: 76 61 72 20 63 61 6e 76 61 73 31 2c 63 74 78 2c 57 2c 48 3b 69 66 28 73 63 72 65 65 6e 2e 77 69 64 74 68 3e 3d 39 38 38 29 76 61 72 20 6d 70 3d 31 35 30 3b 65 6c 73 65 20 6d 70 3d 37 35 3b 76 61 72 20 64 65 61 63 74 69 76 61 74 69 6f 6e 54 69 6d 65 72 48 61 6e 64 6c 65 72 2c 72 65 61 63 74 69 76 61 74 69 6f 6e 54 69 6d 65 72 48 61 6e 64 6c 65 72 2c 61 6e 69 6d 61 74 69 6f 6e 48 61 6e 64 6c 65 72 2c 70 61 72 74 69 63 6c 65 73 3d 5b 5d 2c 61 6e 67 6c 65 3d 30 2c 74 69 6c 74 41 6e 67 6c 65 3d 30 2c 63 6f 6e 66 65 74 74 69 41 63 74 69 76 65 3d 21 30 2c 61 6e 69 6d 61 74 69 6f 6e 43 6f 6d 70 6c 65 74 65 3d 21 30 2c 70 61 72 74 69 63 6c 65 43 6f 6c 6f 72 73 3d 7b 63 6f 6c 6f 72 4f 70 74 69 6f 6e 73 3a 5b 22 44 6f 64 67 65 72 42 6c 75 65 22 2c 22 4f 6c 69 76 65
                                          Data Ascii: var canvas1,ctx,W,H;if(screen.width>=988)var mp=150;else mp=75;var deactivationTimerHandler,reactivationTimerHandler,animationHandler,particles=[],angle=0,tiltAngle=0,confettiActive=!0,animationComplete=!0,particleColors={colorOptions:["DodgerBlue","Olive
                                          2024-01-19 23:41:24 UTC232INData Raw: 6e 64 6f 77 2e 72 65 71 75 65 73 74 41 6e 69 6d 46 72 61 6d 65 3d 77 69 6e 64 6f 77 2e 72 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 7c 7c 77 69 6e 64 6f 77 2e 77 65 62 6b 69 74 52 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 7c 7c 77 69 6e 64 6f 77 2e 6d 6f 7a 52 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 7c 7c 77 69 6e 64 6f 77 2e 6f 52 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 7c 7c 77 69 6e 64 6f 77 2e 6d 73 52 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 73 65 74 54 69 6d 65 6f 75 74 28 74 2c 31 65 33 2f 36 30 29 7d 3b
                                          Data Ascii: ndow.requestAnimFrame=window.requestAnimationFrame||window.webkitRequestAnimationFrame||window.mozRequestAnimationFrame||window.oRequestAnimationFrame||window.msRequestAnimationFrame||function(t){return window.setTimeout(t,1e3/60)};


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          21192.168.2.449802185.155.184.554436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:24 UTC395OUTGET /media/mainstream/all/cf/amazon_1000_summerwater.png HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: */*
                                          Sec-Fetch-Site: none
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: empty
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:24 UTC783INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:24 GMT
                                          Content-Type: image/png
                                          Content-Length: 26660
                                          Connection: close
                                          ETag: "d0d2bf402b8019683b172c2622588a26"
                                          Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41A227032AA
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1695223402#931745146/gid:0/gname:root/mode:33279/mtime:1652249418#22785000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:18.022785Z
                                          Expires: Sat, 18 Jan 2025 23:41:24 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:24 UTC3313INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 9b 00 00 00 74 08 06 00 00 00 92 73 40 db 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 07 74 49 4d 45 07 e3 06 0f 17 22 27 90 f6 60 c4 00 00 20 00 49 44 41 54 78 da ec bd 77 94 25 c7 75 e6 f9 bb 11 99 cf 97 af ae f6 1e 0d 6f 49 10 a0 05 45 0a 24 65 46 24 75 44 49 33 c3 23 71 64 97 5c 6a 8e 28 b7 1a 19 ee 6a c7 6b e4 76 38 d2 ae 2c 47 43 91 a3 91 68 45 51 14 9d 04 10 04 09 02 20 3c 1a 40 03 ed 7d 75 97 7d f5 6c 66 46 dc fd 23 f2 b9 ea 46 a3 09 70 cf d9 3d cb ec 53 07 85 7a f9 32 33 22 6e 5c f3 dd ef de 84 6f 1f df 3e be 7d 7c fb f8 f6 f1 ed e3 db c7 ff d3 c7 c7 9e 7e e2 db 93 f0 ed e3 25 1d d1 e5 9c f4 df 9f 7c 92 77 5c
                                          Data Ascii: PNGIHDRts@bKGDpHYstIME"'` IDATxw%uoIE$eF$uDI3#qd\j(jkv8,GChEQ <@}u}lfF#Fp=Sz23"n\o>}|~%|w\
                                          2024-01-19 23:41:24 UTC4096INData Raw: 4c c4 43 cf 1c 66 b5 d5 e6 ce d7 dc c2 f4 d4 04 ce 65 c1 11 47 98 8c 2d 8f ec 3f 24 4f 1d 38 82 13 d8 b2 7d 0b 63 93 63 94 0b 05 1c 3d 93 e1 49 b3 a0 99 44 4c df d4 f4 d6 d2 e1 91 54 fb 0b b7 9a 24 7c fd a9 c3 5c b9 6b 13 73 13 e3 88 0b 8e f3 6a 9a 72 f8 e4 39 56 9a 6d 92 3c 60 93 3c a2 34 79 e0 b1 de db cd d4 63 8d 21 49 b2 be 1f 95 e5 9a c7 a3 90 7a 4e 2e d5 71 66 9d 86 bf 88 09 e5 52 49 36 11 12 af 24 6b 2d 4c a3 1d dc 83 38 40 1b 8a e2 3c 64 ce a1 ce e5 4a 41 07 11 a6 ea c0 35 97 d1 6b 22 42 b3 9d 70 f4 f8 19 76 ed d8 c4 e6 d9 49 ca c5 98 73 0b 2b 43 6b 2a 8c 17 63 14 a1 60 0c 4f 1f 3a 1e fc f3 e1 23 cb 20 cb 50 ef cd 4b 17 b6 cb ce 37 bc 90 cc 2a 1e c5 78 82 c6 00 8c 8d 78 ee e8 29 4e 9d 5f e5 b6 5b ae 62 6a bc 46 27 49 58 58 ad f3 f0 fe 43 a4 9d 0e
                                          Data Ascii: LCfeG-?$O8}cc=IDLT$|\ksjr9Vm<`<4yc!IzN.qfRI6$k-L8@<dJA5k"BpvIs+Ck*c`O:# PK7*xx)N_[bjF'IXXC
                                          2024-01-19 23:41:25 UTC4096INData Raw: 65 0c 5d 63 c8 f2 fa 31 e7 06 a6 ab 97 aa 33 1e a4 9d 72 e0 c8 49 9e 39 76 16 2d 95 90 89 71 74 7a 1c 2d 16 42 c4 65 0d 03 0b 93 a7 15 7a 15 cc 46 10 05 6f 05 1d 2b c1 58 05 22 3b 92 39 18 51 7d b9 b3 6e 10 b4 5c c2 c5 72 81 a0 f5 21 87 21 e6 89 e8 e0 47 23 41 3a 5d 54 2f 76 8f 20 1c 9d 34 63 6d b5 cd ea c2 1a 6b 4b 4d 1a 6b 09 2e 1d 35 dd 92 0d b3 30 74 84 62 ad d9 c0 f4 38 d7 46 d5 71 ef c2 35 24 1a 81 78 de 38 f7 08 b3 85 e6 60 2e 51 bc 2d f0 c3 7b 9e a6 52 5e 05 03 9f 9e 7f 39 c4 9e e3 8d 29 8e 35 42 a4 79 c7 c6 fd 6c ab ad 61 e2 88 72 a9 c0 44 ad cc 64 ad cc ee b1 55 6e 1e 3f 04 c0 b9 ee 26 0e 76 66 71 a2 7c fe ec 0d 20 70 ed d4 41 ae 1a 3b 07 2a 23 9a 6d 47 65 89 ab c7 02 3b 66 a9 3b c1 81 c6 86 90 4a 2e 15 f0 c5 c2 28 0c 66 a3 50 7f f2 62 85 4d 86
                                          Data Ascii: e]c13rI9v-qtz-BezFo+X";9Q}n\r!!G#A:]T/v 4cmkKMk.50tb8Fq5$x8`.Q-{R^9)5BylarDdUn?&vfq| pA;*#mGe;f;J.(fPbM
                                          2024-01-19 23:41:25 UTC4096INData Raw: 97 bf 7e fa 88 cc 7d fa 6e bd 73 cf 36 f9 fe bf fa 7c 70 3d bb 1d 7e fc f6 1b f9 b3 77 bc 09 80 ef de bb 9d ca 97 1f e5 43 87 4e f2 5f ee 7f 02 da a1 da 4c ac f0 d0 7b 7e 88 ed 53 f9 fd 9e 3c a4 7f 7b ec ac dc b1 6b 0b af dd 11 04 7f b9 d5 e1 07 3e f6 45 ee 7a f6 04 3f 71 f3 3e fe f4 1d 77 02 c2 bb 6e b8 82 df 7a ec 20 7e c8 cc a9 2a ef ff 87 af f3 ef ee 79 84 ab e6 a6 f9 d8 0f dd c9 f5 73 b3 94 ac e1 8e ad b3 dc b7 bc 16 b4 94 08 5b 37 cd 52 1d af 71 6c 61 85 4c 7d 88 3d c5 f4 21 0f cd 5b 77 89 58 b0 ca 15 3b 37 e3 b3 90 21 12 23 58 85 47 9f 3e c2 99 85 55 6c 14 34 db 99 7a 93 c7 4f 9f 67 f7 96 59 76 3a ff 82 d0 c6 25 3f 37 59 4a a3 93 30 5f 6f e5 1a 22 ec 04 ef 95 f1 62 8c 77 19 67 e7 cf 73 f4 f0 31 4e cc 9f 67 69 ad 89 a8 32 56 88 fa d8 d1 f9 4e ca 2b
                                          Data Ascii: ~}ns6|p=~wCN_L{~S<{k>Ez?q>wnz ~*ys[7RqlaL}=![wX;7!#XG>Ul4zOgYv:%?7YJ0_o"bwgs1Ngi2VN+
                                          2024-01-19 23:41:25 UTC4096INData Raw: 77 77 dc 88 f7 9e 54 19 fe f0 f2 ff ca a6 34 63 38 59 e2 ff 7c e6 65 fc 97 5d d7 33 65 2c 5f bc ee cf 49 95 45 e9 8c 0f 3d f4 0e be 73 74 2b a6 9d 21 b5 ca 31 fb 01 dd 86 7e 32 28 ef d4 45 dd 4a 9f 28 97 0f d1 07 2f a8 cc f6 9e be 82 d6 ff a4 d7 31 d7 b2 89 e7 64 6c e5 fc 65 25 f7 7d df c3 2e 31 dc 74 64 07 ff ee 7b 5f e3 ea fd 4f a3 b3 82 ea 78 8a ba ec 3a cc 65 6f 82 4d 5b d1 c3 a3 e1 bf fa b8 f6 26 50 b5 05 15 e7 f1 07 9f 65 f4 a9 1d 9c 77 cf 3d 5c 7f db d7 d5 3b be 79 3b 33 eb a6 f9 cb eb 5e c5 1f df f0 46 1a 49 0a 7d c4 c7 fd c6 86 ea 85 cd 40 42 a8 f0 3a ec 04 48 59 5c 60 f8 a3 cb bf 40 e6 34 1f ff fe bb 78 e7 05 77 47 a9 1d cd 59 f5 65 ae 59 b7 1b bc 21 d5 8a eb 27 76 71 d3 dd 9f c4 6b 61 47 7b 94 b6 87 df 7e ec 2d 7c e8 82 5b 19 4e 84 4f 3c fa 66
                                          Data Ascii: wwT4c8Y|e]3e,_IE=st+!1~2(EJ(/1dle%}.1td{_Ox:eoM[&Pew=\;y;3^FI}@B:HY\`@4xwGYeY!'vqkaG{~-|[NO<f
                                          2024-01-19 23:41:25 UTC4096INData Raw: 2a c9 a3 e7 17 d0 47 8e ea d3 36 b6 22 2a a7 58 e7 d0 46 53 fd d1 ff 85 d6 37 6f 83 e1 1a ee d1 fd 98 ad eb 51 b5 14 52 1d 88 45 fa 45 6c b5 ea 7d 1f 65 58 2d 39 74 0b 17 ba d5 02 cc ee 64 f9 d7 7f 8d d1 4f ff 1e 6a 78 38 36 5f 5d b8 72 44 b0 ce 23 d6 06 45 3d 11 da 9d 0e 79 51 84 96 c8 dc 0c ea 53 9f c6 ff d8 db f0 12 84 75 6d 1c c1 7b ad d9 7a 60 b7 24 2e e7 b8 0d 8f fe 13 a6 75 1f 04 cc 53 a9 a6 9c 75 d1 05 81 de 4b 84 7a b5 8a 75 0e ef 3d 9b cf dd cc 9e 1d bb d7 d4 46 57 4a 31 bd 7e 8a a9 33 d6 03 8a e5 a5 65 e6 0f 1e 1e f0 18 03 86 a3 d4 31 2a cb c7 8c c8 4e 36 dc 4a f4 62 dd 46 70 e9 f8 a3 0a 4e 8f 82 37 b0 b3 a7 f0 f2 1f ba 8e 4c 02 56 4d 29 85 d2 b0 b0 d0 e0 b1 07 9e a2 28 f2 c0 36 a9 56 df b2 ef c9 ac 1b 75 fa 61 54 c2 b2 88 f5 1e 55 58 92 ab 5e
                                          Data Ascii: *G6"*XFS7oQREEl}eX-9tdOjx86_]rD#E=yQSum{z`$.uSuKzu=FWJ1~3e1*N6JbFpN7LVM)(6VuaTUX^
                                          2024-01-19 23:41:25 UTC2867INData Raw: af fc 3f 8b 0d 64 72 3c 9e b4 5e 28 25 4d 06 29 ad 56 1a 72 62 58 58 6e b2 d8 6c 61 76 ed a3 56 ab 32 b5 61 3d 43 e3 a3 4c 54 13 d2 34 a5 52 49 bb bd e7 a5 76 c6 52 2b 63 b1 d1 60 7e 7e 09 8f c6 2d 2d c3 72 3b 68 54 05 fd c8 5e 74 29 ab c9 55 5b 53 83 08 63 53 86 68 05 06 8f 45 a1 71 e5 66 1f 49 74 4f 76 7e 11 3d 35 19 f2 de e7 c3 d8 f4 1f fc 3e bc fe 8d c8 9b 7f 04 ef 42 23 55 c5 2b cb 39 8f b2 8a 24 09 74 4a de e7 68 ad b1 45 81 ce 72 dc cd ef a0 b2 7b 0f f5 db fe 01 1b f9 bf 64 45 65 2a 7d 79 5d 17 fa a2 7a c5 82 8f 1e ad cc f1 b2 f2 e4 b5 33 8a 6f 7f 9b f4 bc ad 51 9f 49 07 43 4b 0c 63 ad 26 b4 9b fc e9 65 af 08 17 43 5f 21 53 e6 63 dd d0 a4 4e 72 a7 b3 b0 f8 3c 43 8a 0e e2 5c e0 36 51 ea d8 c1 b4 f3 d0 6c c1 d0 50 f0 a4 c6 f4 68 f6 9d 3b 3e 5f 6d 9c
                                          Data Ascii: ?dr<^(%M)VrbXXnlavV2a=CLT4RIvR+c`~~--r;hT^t)U[ScShEqfItOv~=5>B#U+9$tJhEr{dEe*}y]z3oQICKc&eC_!ScNr<C\6QlPh;>_m


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          22192.168.2.449804185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:25 UTC762OUTGET /media/mainstream/all/cf/winner_2.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: image
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:25 UTC784INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:25 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 1856
                                          Connection: close
                                          ETag: "0751077bb39eb354771c0918dd4651a2"
                                          Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41A4D96CE51
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1695223403#295745965/gid:0/gname:root/mode:33279/mtime:1652249422#854806000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:22.854806Z
                                          Expires: Sat, 18 Jan 2025 23:41:25 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:25 UTC1856INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 02 02 02 02 02 02 02 02 02 02 02 02 02 02 03 04 03 02 02 03 04 05 04 04 04 04 04 05 06 05 05 05 05 05 05 06 06 07 07 08 07 07 06 09 09 0a 0a 09 09 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff db 00 43 01 03 03 03 05 04 05 09 06 06 09 0d 0b 09 0b 0d 0f 0e 0e 0e 0e 0f 0f 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1b 00 00 02 02 03 01 00 00 00 00 00 00 00 00 00 00 00 09 0a 07 08 03 05 06 04 ff c4 00 31 10 00 01 03 03 03 03 03 03 03 03 05 00 00 00 00 00 01 02 03 04 05 06 11 07 12 13 00 08 21 14 22 31 09 32 51 15 41 42 16 23 71 24 61 72
                                          Data Ascii: JFIFHHCC001!"12QAB#q$ar


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          23192.168.2.449807185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:25 UTC770OUTGET /media/mainstream/all/cf/winner_initial_s.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: image
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:25 UTC783INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:25 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 751
                                          Connection: close
                                          ETag: "e8c1454c15c6596bb21d99f4d907f632"
                                          Last-Modified: Wed, 20 Sep 2023 15:23:23 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41A4EB82F76
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1693134509#244024455/gid:0/gname:root/mode:33279/mtime:1652249423#310808000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:23.310808Z
                                          Expires: Sat, 18 Jan 2025 23:41:25 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:25 UTC751INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 02 02 02 02 02 02 02 02 02 02 02 02 02 02 03 04 03 02 02 03 04 05 04 04 04 04 04 05 06 05 05 05 05 05 05 06 06 07 07 08 07 07 06 09 09 0a 0a 09 09 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff db 00 43 01 03 03 03 05 04 05 09 06 06 09 0d 0b 09 0b 0d 0f 0e 0e 0e 0e 0f 0f 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1a 00 01 00 02 03 01 00 00 00 00 00 00 00 00 00 00 00 00 03 08 01 06 07 09 ff c4 00 28 10 00 00 05 04 01 04 02 02 03 00 00 00 00 00 00 00 01 02 03 04 06 00 05 07 11 12 08 13 21 41 14 31 15 23 42 51 61 ff c4 00 1a 01 01 01 01
                                          Data Ascii: JFIFHHCC00(!A1#BQa


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          24192.168.2.449806185.155.184.554436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:25 UTC383OUTGET /media/mainstream/all/mb/chrome58x58.png HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: */*
                                          Sec-Fetch-Site: none
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: empty
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:25 UTC783INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:25 GMT
                                          Content-Type: image/png
                                          Content-Length: 8496
                                          Connection: close
                                          ETag: "6111593186764223a5c03ae8fe3820ef"
                                          Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41A4E281916
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1695223404#631748971/gid:0/gname:root/mode:33279/mtime:1653412344#641098000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-24T17:12:24.641098Z
                                          Expires: Sat, 18 Jan 2025 23:41:25 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:25 UTC3313INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 f5 00 00 00 f5 08 03 00 00 00 bf 6f 43 57 00 00 02 f4 50 4c 54 45 00 00 00 00 00 00 01 00 00 05 02 01 02 01 00 02 04 01 05 08 02 13 2f 12 82 2c 1c 1b 53 24 4d 4c 11 81 61 0d 23 69 30 a8 38 2b d6 a3 2d c9 54 42 4e b0 50 e2 54 43 4a a9 4b dd 62 4d ac 2a 1e 36 88 38 f1 7b 66 eb c3 09 dc 34 29 e5 be 07 b4 92 06 f3 cb 0d c5 92 26 e8 74 5e bd 8c 1f 43 a3 45 27 76 37 37 8e 3c e1 38 2d d2 9d 25 dc b7 00 bd 31 22 eb 75 5f d7 31 26 39 8e 40 d5 3b 2e 98 7d 00 37 8c 4a 2e 84 42 cb 97 25 ce a4 0e a7 7d 15 db ae 18 41 97 47 b0 85 1a c9 33 26 94 6d 15 2f 83 3f d7 62 4d c9 a5 01 33 8b 47 e3 50 44 e2 b2 21 e9 68 54 36 8d 44 3a 92 47 48 a3 4d d1 a3 1b fe d8 00 5b c1 5b 5a bf 5b e8 39 33 fc d6 06 eb 49 3e e9 42 39 59
                                          Data Ascii: PNGIHDRoCWPLTE/,S$MLa#i08+-TBNPTCJKbM*68{f4)&t^CE'v77<8-%1"u_1&9@;.}7J.B%}AG3&m/?bM3GPD!hT6D:GHM[[Z[93I>B9Y
                                          2024-01-19 23:41:25 UTC4096INData Raw: 31 e2 d6 01 bf e6 a5 0e bf 2f d8 d9 63 13 68 a7 14 4d 49 76 16 6c 3d 59 85 26 75 2a 5a 29 4b 35 b3 95 f8 04 c4 8d 75 dd 81 2d ee fd 59 f0 a5 61 4d ad 95 3d 9e b7 b1 87 8b 4a ed 5c 89 5e 48 31 db c3 cd 64 a0 53 17 a2 3d 8e 62 e7 de 05 eb 18 5d 9f 58 31 d5 de b5 78 44 f1 56 87 bf e6 2d ec c3 03 0a fd 36 15 bd 70 41 63 67 cd 9e 81 66 f5 85 e8 15 47 95 3d f0 02 84 40 5d 6f c4 83 8a e7 80 cf ba 15 d2 d4 c6 42 cb 93 db 9d bd 69 30 93 51 e8 18 a9 0d 36 41 51 73 cd 0c 34 25 96 9d 60 bf 44 d1 01 42 ea 25 ab fc a8 a7 ca 7b 0b 6a 33 23 79 4f f6 50 31 0e 74 b4 8e 0d 38 02 b3 42 47 a3 cc 96 ea 5c 7f 93 5d 77 ac e5 11 b7 fd 9f 53 3a d6 36 f5 e3 f7 79 b8 75 76 61 f8 66 5c 56 ed a4 92 84 06 9b dc 32 26 19 45 33 9a 92 ec 2c ab 19 7f d7 54 d7 7c b0 a7 91 da 7a ac a1 76 2d
                                          Data Ascii: 1/chMIvl=Y&u*Z)K5u-YaM=J\^H1dS=b]X1xDV-6pAcgfG=@]oBi0Q6AQs4%`DB%{j3#yOP1t8BG\]wS:6yuvaf\V2&E3,T|zv-
                                          2024-01-19 23:41:25 UTC1087INData Raw: 3c dc b2 af 3a 81 ba d9 39 ee b9 f0 47 2a d6 24 57 19 e0 99 e4 79 45 7f 50 f4 b9 45 af 92 cd a5 e6 bb 15 8e 9c cc a9 ba f7 49 a8 88 95 8c 19 f2 6c 73 0a 7d b3 66 5e bf 22 39 db c2 76 ea 0e b9 81 13 5b b5 55 cb 0f 74 7f 00 4e 89 a9 59 a3 64 63 76 8a 66 de ec 7b 25 6c b3 72 c7 0d 1b 38 72 2f 13 f4 bb 6e ff a9 62 c3 e4 b3 59 66 8e 74 db 41 af 86 7d dc 52 36 b7 1a ee 3f 80 3f 3e 35 79 27 ea 9f 63 2f 62 c8 1c 67 2e 31 8a 56 73 bb 04 7a d5 6c ea f6 dd c0 91 bb 76 29 d9 a4 de 1d bc b1 5e c4 96 4c cd f4 8c 59 d1 cd f2 fe 0a 9a 06 6d d9 f2 cb e9 65 d8 ed c3 91 13 5b b5 34 dd 7b 6b c1 88 21 cf 34 33 ee 76 b3 b8 9f 59 4d d3 b8 2d fb c0 b2 03 6e e0 12 e0 e4 49 dd 36 dd bd 7e fe 0a 30 bb 4e dd da ae 99 71 b7 cf e3 d5 a1 71 4f d8 27 2d cf 1d 82 d3 39 f8 d3 ae bc 60 d5
                                          Data Ascii: <:9G*$WyEPEIls}f^"9v[UtNYdcvf{%lr8r/nbYftA}R6??>5y'c/bg.1Vszlv)^LYme[4{k!43vYM-nI6~0NqqO'-9`


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          25192.168.2.449805185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:25 UTC764OUTGET /media/mainstream/all/cf/winner_cat.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: image
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:25 UTC783INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:25 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 1422
                                          Connection: close
                                          ETag: "386e89d83d4f84499cbb1611b2db4173"
                                          Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41A4EA2F0A6
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1695223403#303745984/gid:0/gname:root/mode:33279/mtime:1652249423#26807000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:23.026807Z
                                          Expires: Sat, 18 Jan 2025 23:41:25 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:25 UTC1422INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 02 02 02 02 02 02 02 02 02 02 02 02 02 02 03 04 03 02 02 03 04 05 04 04 04 04 04 05 06 05 05 05 05 05 05 06 06 07 07 08 07 07 06 09 09 0a 0a 09 09 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff db 00 43 01 03 03 03 05 04 05 09 06 06 09 0d 0b 09 0b 0d 0f 0e 0e 0e 0e 0f 0f 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 00 03 01 00 00 00 00 00 00 00 00 00 00 06 08 03 05 07 01 02 09 04 ff c4 00 34 10 00 02 02 01 03 03 01 06 04 04 07 00 00 00 00 00 01 02 03 04 05 06 11 12 00 07 21 31 08 13 14 22 23 41 32 51 61 81 15 33 42 52 53
                                          Data Ascii: JFIFHHCC004!1"#A2Qa3BRS


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          26192.168.2.449808185.155.184.554436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:25 UTC388OUTGET /media/mainstream/all/cf/google_play_card.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: */*
                                          Sec-Fetch-Site: none
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: empty
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:25 UTC782INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:25 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 4130
                                          Connection: close
                                          Content-Security-Policy: block-all-mixed-content
                                          ETag: "3776a9f0c3b19e203951d23c2d577f31"
                                          Last-Modified: Mon, 20 Feb 2023 09:33:03 GMT
                                          No-Gzip-Compression: true
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Request-Id: 17ABE41A528A6E7B
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1676843277#791577239/gid:0/gname:root/mode:33279/mtime:1652249419#274790000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:19.27479Z
                                          Expires: Sat, 18 Jan 2025 23:41:25 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:25 UTC3314INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 02 03 03 03 03 03 04 07 05 04 04 04 04 09 06 07 05 07 0a 09 0b 0b 0a 09 0a 0a 0c 0d 11 0e 0c 0c 10 0c 0a 0a 0e 14 0f 10 11 12 13 13 13 0b 0e 14 16 14 12 16 11 12 13 12 ff db 00 43 01 03 03 03 04 04 04 08 05 05 08 12 0c 0a 0c 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 ff c2 00 11 08 00 77 00 55 03 01 11 00 02 11 01 03 11 01 ff c4 00 1d 00 00 02 02 03 01 01 01 00 00 00 00 00 00 00 00 00 00 08 07 09 04 05 06 03 01 02 ff c4 00 1c 01 01 00 02 03 01 01 01 00 00 00 00 00 00 00 00 00 00 05 07 03 04 06 02 01 08 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 f6 13 d0
                                          Data Ascii: JFIFCCwU
                                          2024-01-19 23:41:25 UTC816INData Raw: 09 51 d3 14 53 d6 a2 3d 9a 71 54 e3 39 bf 2f 17 14 dc e9 c9 2c 3a 5d 62 0b b4 26 60 be c3 f3 db 8a eb 06 d1 ba b7 fb cb 22 8a a3 98 f5 4a 93 f1 0c 3f 13 1e a9 52 7e 21 87 e2 63 d5 2a 4f c4 30 fc 4c 7a a5 49 f8 86 1f 89 8f 54 a9 3f 10 c3 f1 31 ea 95 27 e2 18 7e 26 3d 52 a4 fc 43 0f c4 c7 aa 54 9f 88 61 f8 98 f5 4a 93 f1 0c 3f 13 09 95 f9 46 58 49 5c 9f 5a 91 54 7a 3c 47 b6 c3 18 5c 06 80 41 4f 72 ad 99 c7 ff c4 00 32 11 00 00 05 02 02 06 08 07 01 00 00 00 00 00 00 00 00 02 03 04 05 01 12 06 13 20 21 22 51 81 f1 11 23 30 33 61 a1 d1 e1 14 31 32 40 41 50 52 b1 ff da 00 08 01 02 01 01 3f 00 fd cc 34 79 5f 39 c9 31 ba 29 d0 24 99 28 c5 6c b5 38 57 7f 65 86 4d 6b ee 15 12 4d 51 7c 8e 5a 9c 84 91 5d 45 38 cb 53 da a1 b4 aa 2b 6c 9b 55 7b 08 4a da e7 80 ab 81 28
                                          Data Ascii: QS=qT9/,:]b&`"J?R~!c*O0LzIT?1'~&=RCTaJ?FXI\ZTz<G\AOr2 !"Q#03a12@APR?4y_91)$(l8WeMkMQ|Z]E8S+lU{J(


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          27192.168.2.449810185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:25 UTC762OUTGET /media/mainstream/all/cf/winner_1.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: image
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:25 UTC783INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:25 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 1434
                                          Connection: close
                                          Content-Security-Policy: block-all-mixed-content
                                          ETag: "21bda39c69a0527bcb17d0f5d3ce9ebd"
                                          Last-Modified: Mon, 20 Feb 2023 09:33:03 GMT
                                          No-Gzip-Compression: true
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Request-Id: 17ABE41A54153B40
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1676843277#791577239/gid:0/gname:root/mode:33279/mtime:1652249422#798806000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:22.798806Z
                                          Expires: Sat, 18 Jan 2025 23:41:25 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:25 UTC1434INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 02 02 02 02 02 02 02 02 02 02 02 02 02 02 03 04 03 02 02 03 04 05 04 04 04 04 04 05 06 05 05 05 05 05 05 06 06 07 07 08 07 07 06 09 09 0a 0a 09 09 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff db 00 43 01 03 03 03 05 04 05 09 06 06 09 0d 0b 09 0b 0d 0f 0e 0e 0e 0e 0f 0f 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1a 00 00 02 03 01 01 00 00 00 00 00 00 00 00 00 00 00 06 09 05 07 08 0a 04 ff c4 00 35 10 00 01 03 03 02 04 03 05 06 07 00 00 00 00 00 00 01 02 03 04 05 06 11 00 12 07 13 21 31 22 41 51 08 14 15 61 71 23 42 52 72 91 a1 24 32
                                          Data Ascii: JFIFHHCC005!1"AQaq#BRr$2


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          28192.168.2.449809185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:25 UTC770OUTGET /media/mainstream/all/cf/winner_initial_m.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: image
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:25 UTC782INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:25 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 950
                                          Connection: close
                                          Content-Security-Policy: block-all-mixed-content
                                          ETag: "62a261739e9a386d39d542903d5ab050"
                                          Last-Modified: Mon, 20 Feb 2023 09:33:03 GMT
                                          No-Gzip-Compression: true
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Request-Id: 17ABE41A523879A6
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1676843277#791577239/gid:0/gname:root/mode:33279/mtime:1652249423#198808000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:23.198808Z
                                          Expires: Sat, 18 Jan 2025 23:41:25 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:25 UTC950INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 02 02 02 02 02 02 02 02 02 02 02 02 02 02 03 04 03 02 02 03 04 05 04 04 04 04 04 05 06 05 05 05 05 05 05 06 06 07 07 08 07 07 06 09 09 0a 0a 09 09 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff db 00 43 01 03 03 03 05 04 05 09 06 06 09 0d 0b 09 0b 0d 0f 0e 0e 0e 0e 0f 0f 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1b 00 00 02 02 03 01 00 00 00 00 00 00 00 00 00 00 00 00 02 04 07 03 05 06 08 ff c4 00 30 10 00 00 05 03 02 04 03 07 05 00 00 00 00 00 00 00 01 02 03 04 05 00 06 12 11 61 07 13 31 51 08 21 75 14 22 36 37 41 71 b4 15 16 42 b3
                                          Data Ascii: JFIFHHCC000a1Q!u"67AqB


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          29192.168.2.449812185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:25 UTC762OUTGET /media/mainstream/all/cf/winner_3.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: image
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:25 UTC784INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:25 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 1721
                                          Connection: close
                                          ETag: "6442f84b2acd86e6e571a24313651987"
                                          Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41A63E69C05
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1695223403#295745965/gid:0/gname:root/mode:33279/mtime:1652249422#914806000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:22.914806Z
                                          Expires: Sat, 18 Jan 2025 23:41:25 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:25 UTC1721INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 03 02 02 02 02 02 03 02 02 02 03 03 03 03 04 06 04 04 04 04 04 08 06 06 05 06 09 08 0a 0a 09 08 09 09 0a 0c 0f 0c 0a 0b 0e 0b 09 09 0d 11 0d 0e 0f 10 10 11 10 0a 0c 12 13 12 10 13 0f 10 10 10 ff db 00 43 01 03 03 03 04 03 04 08 04 04 08 10 0b 09 0b 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 ff c2 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1a 00 01 00 03 01 01 01 00 00 00 00 00 00 00 00 00 00 07 04 06 08 05 01 02 ff c4 00 1b 01 00 02 03 01 01 01 00 00 00 00 00 00 00 00 00 00 03 04 00 05 06 01 02 07 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 f7 2e a1 cc e2 cf bf
                                          Data Ascii: JFIFCC00.


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          30192.168.2.449813185.155.184.554436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:25 UTC397OUTGET /media/mainstream/all/cf/box.png HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: */*
                                          Sec-Fetch-Site: none
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: empty
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          Cookie: cookie1=true
                                          2024-01-19 23:41:26 UTC783INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:26 GMT
                                          Content-Type: image/png
                                          Content-Length: 23977
                                          Connection: close
                                          Content-Security-Policy: block-all-mixed-content
                                          ETag: "b31b2de6ba6ab0d538c6249ba43af93d"
                                          Last-Modified: Mon, 20 Feb 2023 09:33:03 GMT
                                          No-Gzip-Compression: true
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Request-Id: 17ABE41A6994615A
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1676843277#791577239/gid:0/gname:root/mode:33279/mtime:1652249418#866789000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:18.866789Z
                                          Expires: Sat, 18 Jan 2025 23:41:26 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:26 UTC3313INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 14 00 00 01 14 08 03 00 00 00 dd ae 39 4b 00 00 03 00 50 4c 54 45 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 02 01 02 01 00 00 00 00 0a 05 02 00 00 00 00 00 00 d7 34 42 f0 b2 a2 a5 57 1d 8a 35 13 f4 9f a4 00 00 00 e9 9e 82 12 07 02 e2 97 3d a2 21 28 e3 a9 4a c4 63 20 4b 23 09 be 6b 1e de 9b 45 e0 a3 65 df 95 57 e5 96 76 dd 90 34 e2 91 67 dc b3 8c ea 77 7b d8 35 45 e4 96 6e d5 5f 44 cf 71 33 d2 76 27 d8 5f 64 6f 20 10 86 52 15 e1 43 52 e3 ad 89 d7 4a 55 e3 57 62 d9 29 3e c8 16 2f a4 49 0f b4 1e 31 b0 19 2c e2 0e 30 b6 07 19 ff d0 72 d8 57 01 af 06 18 e6 81 03 de 0e 2f ff cb 64 d5 0c 2c c5 0b 28 ff d2 79 e3 13 33 ff cd 6b d9 0c 2d e5 30 42 d5 53 01 da
                                          Data Ascii: PNGIHDR9KPLTE4BW5=!(Jc K#kEeWv4gw{5En_Dq3v'_do RCRJUWb)>/I1,0rW/d,(y3k-0BS
                                          2024-01-19 23:41:26 UTC4096INData Raw: 5a a5 f9 89 5a e9 14 9e 17 50 fa 05 14 2b 43 01 15 0a 9d 4a 26 24 a6 e2 22 24 bc 5e 03 8b c9 ee 57 50 8b f5 9a 9d 50 3e 6b a3 6e 2b d6 75 18 46 24 97 1b f0 51 38 1c 0c c0 28 06 43 ee e6 6f df fd fc 75 d3 61 5b db f3 a7 5e 78 a5 ee a9 67 5f 7d 5e 31 2a 40 e5 21 21 0b 8b b6 16 a3 c1 97 fa e4 13 b5 d2 4b 39 25 81 83 3a 64 5a e8 18 0a 61 e1 f8 61 26 15 50 5c bd 52 58 b9 1d 26 bb 27 57 b4 0c f7 53 e1 b7 d2 08 24 d9 95 95 ec 44 7e 05 a7 45 f7 de fb 78 26 1c 83 c2 f1 48 a7 b1 f3 cd 6f ef 1c 6e 6f b4 7d ed c7 01 89 68 5c 53 4a ad 94 9d e5 51 3a dd 64 9a 48 0d 5b b4 bb c5 1c 9c e2 a2 4d b2 06 85 a9 10 93 47 a1 78 01 85 cb 5c 16 4e 38 73 aa c1 61 05 94 6c 63 a3 33 9b 9f d8 9c c8 e6 a7 d1 e6 cd 29 fe 1c a6 7f 96 89 89 bb d8 7e 78 78 74 cf 2b 53 93 9d 80 74 b0 68 74
                                          Data Ascii: ZZP+CJ&$"$^WPP>kn+uF$Q8(Coua[^xg_}^1*@!!K9%:dZaa&P\RX&'WS$D~Ex&Hono}h\SJQ:dH[MGx\N8salc3)~xxt+Stht
                                          2024-01-19 23:41:26 UTC4096INData Raw: 56 00 e8 ff 1f 03 0e 3b 93 a5 07 94 b1 e3 1c fa 6e bb 53 f2 88 5a 18 05 4c 4e 2e 2f 81 c9 c2 60 a0 d8 22 98 10 15 0b 96 49 33 28 26 aa 47 40 e6 1a 8e 6a 7b 25 0e 85 ac 82 7b 15 ac 11 d0 b9 d6 1d bf 52 a6 28 92 5c 2c 62 6c 57 25 15 55 80 09 a1 2e aa 08 8a eb a8 16 79 a1 17 f8 81 d7 a8 37 9c a0 91 0d 03 70 61 62 54 9a 0f 8e c5 2f a7 a1 2b c9 c0 12 73 01 18 42 33 72 f9 f2 cd f4 a4 6b f2 c6 90 0b 43 df 26 50 e6 e9 33 8f 5e 5c 68 23 6a 57 3e 3b 46 50 d6 16 06 00 e5 1a 8d 31 e1 5c f8 10 41 f5 d2 2c 6e 1d d5 97 b0 43 bc b5 47 05 e1 0f 24 38 fe 84 e0 14 d3 56 8a 82 5b b5 e4 16 f6 48 b1 61 94 4e cb e8 45 af 16 76 23 3f 0a ba 7e e4 93 28 80 bd 3a 36 9f 5e 80 96 34 13 63 09 1f 1d 23 91 55 f8 88 33 e1 42 64 12 38 53 23 9b 17 d0 f7 b0 57 ff 3c 81 c2 3b 4f 3e df 26 a3
                                          Data Ascii: V;nSZLN./`"I3(&G@j{%{R(\,blW%U.y7pabT/+sB3rkC&P3^\h#jW>;FP1\A,nCG$8V[HaNEv#?~(:6^4c#U3Bd8S#W<;O>&
                                          2024-01-19 23:41:26 UTC4096INData Raw: 57 65 b3 0c 29 28 97 b0 11 a6 a3 a7 15 ca c9 9f be b2 b8 f1 61 77 d7 5e 28 0f b5 40 51 48 58 fd 4c e8 26 05 9f 48 e8 e8 8e d6 1e 28 3e 9f af 9c f0 05 12 c3 7e 60 b0 08 72 6a a7 0c 7b a2 a2 60 ad 4d f3 d6 01 94 13 e4 4c 69 2e 44 ec c4 23 e4 db 5c 2e 47 1b 37 20 18 f2 d8 45 89 05 50 be 2a 5b f0 b1 de 6a 3e 64 41 79 8a 2e a5 eb 82 16 28 fa ec 4e c7 32 c5 67 63 93 f0 39 d8 29 13 a6 53 fa 6e 55 d1 43 e7 36 ae c6 b3 ba 59 79 df 26 28 63 89 44 b9 4c b7 ef f7 03 c5 e1 54 a2 bd ad 39 1c 35 b2 6e bb e5 60 c7 f9 87 9d 10 a2 f6 c4 23 a1 78 3c 14 c4 26 b2 06 0a 72 0f c4 f0 e4 e8 fb 3d 5a 32 a9 dc 89 b1 60 8e f5 ee e4 39 98 30 17 af 03 e5 f4 d3 ef b3 a6 06 17 2a 26 16 14 9c 72 7e 51 96 3e 9b 0b 0a ca f4 eb 2d 3e 41 45 81 82 a6 d6 a8 3d ef 63 14 e5 13 3c a2 02 c8 1e 28
                                          Data Ascii: We)(aw^(@QHXL&H(>~`rj{`MLi.D#\.G7 EP*[j>dAy.(N2gc9)SnUC6Yy&(cDLT95n`#x<&r=Z2`90*&r~Q>->AE=c<(
                                          2024-01-19 23:41:26 UTC4096INData Raw: f8 54 77 d1 27 09 42 e5 85 0b ac c5 11 28 f7 9c 45 cb 9d 54 4a d3 c7 e5 f1 58 9f 4f 69 a4 d0 9c 62 b2 a8 a0 d8 4c ec 48 c1 53 0c d5 aa 51 cc 1b ed 3c 62 63 0c da df ce fa fc e4 4f 78 02 05 fb cd 96 7a ae ec e3 2e 99 3e df 9c 15 28 99 8c e4 4f b2 79 d0 fa 14 3d 6f 5a 0a d9 03 94 08 4c 92 47 19 6a 15 62 a5 56 99 3a fa 8c 9a 6c a5 e3 9b 90 50 21 73 aa 04 c9 b3 18 0a 50 f8 23 0b 8e 41 19 6b 29 7c 36 da 19 6b 63 5d d3 e6 75 6d 51 69 12 29 6a 62 ac 68 70 55 50 f6 1b 21 2f e2 25 88 da f0 40 bd d6 56 1b 33 91 0d 65 a6 14 9e 2d 65 5d 6c 21 ea 6d fb f6 81 b2 ca e8 23 4c 22 9e 74 a5 25 54 de 7b f4 91 47 5f 6c 29 4b e1 93 94 c3 21 ea 47 f5 25 0b ca f5 37 a7 ec 07 8a 61 b4 2f 00 45 22 66 b7 aa 6c 65 f7 22 f1 2c ae e2 1c 14 14 2f 97 e3 9a 1e 4f cd 69 da a2 9e 9a 40 59
                                          Data Ascii: Tw'B(ETJXOibLHSQ<bcOxz.>(Oy=oZLGjbV:lP!sP#Ak)|6kc]umQi)jbhpUP!/%@V3e-e]l!m#L"t%T{G_l)K!G%7a/E"fle",/Oi@Y
                                          2024-01-19 23:41:26 UTC4096INData Raw: 37 a7 4c b0 0a 76 69 db 74 ae c6 20 19 94 28 55 f4 4e 48 34 6b 14 0d 25 43 87 3b cd 40 65 6d c8 f3 c4 cd e1 50 02 89 f1 27 19 39 05 8b 52 8f 57 7b 31 0c c5 0a bb 68 d9 41 f3 2f 38 dc ce 63 95 b8 2c 3b d3 5a 25 8a 72 3b f7 e8 a3 30 1e f8 6f a7 cc e8 f1 43 79 c4 8a 54 62 51 48 b8 3a da 3a 47 47 47 40 79 35 c4 82 ce 97 61 3e 69 b8 bb 8a 8a df 0e 34 76 fd 12 c2 28 ff 0b 85 4e ee 68 2d 8b fa 9b 99 74 1a c7 f0 66 59 3f 53 65 6a bb 27 ef f3 22 bc b2 52 69 6d 43 66 75 8b ae 42 85 e5 68 05 28 00 d0 06 09 ad 02 20 26 bd c4 28 fb a7 d0 c2 2a ff 07 45 86 9e 22 d2 cf fd 1e 26 72 c8 3d 1f fc 6b 8f 40 79 ed b5 d7 5e 1a cb 27 c7 8d f1 84 08 72 77 ed 09 44 b0 8d bd e7 5a 6c 85 6c 6b 1e 94 6f f4 0d 28 f4 6f c3 c7 ce 0c cc e1 1a 70 6c ea 40 4a f0 9a 59 40 65 53 de e8 55 96
                                          Data Ascii: 7Lvit (UNH4k%C;@emP'9RW{1hA/8c,;Z%r;0oCyTbQH::GGG@y5a>i4v(Nh-tfY?Sej'"RimCfuBh( &(*E"&r=k@y^'rwDZllko(opl@JY@eSU
                                          2024-01-19 23:41:26 UTC184INData Raw: eb d4 dc eb 37 3e fb 62 e7 b8 ba 7a 12 c9 30 4f 07 4e ff 68 94 4e a3 3d a7 b2 5e 98 bb fe d1 17 ed bd ed f1 27 be 96 fc f1 19 20 5e 06 52 97 76 7e fc fc db 57 f6 aa ba b4 78 1a 6a 49 1f 2c e9 34 82 cb 2f 93 93 e3 26 12 33 f4 67 62 86 74 aa c5 a5 2b 8d 54 76 89 84 c8 d3 a5 92 1e e6 25 e4 f2 d2 f9 f3 27 80 3c 19 ee 75 30 ab 9b 70 79 fe dc 39 e3 11 02 81 c8 53 86 a4 e7 60 97 44 22 c0 41 a4 1f 7a 7c a2 9c c9 5f 2a bb 80 b1 30 1c 4f aa 25 19 a0 ec 86 f1 74 66 4c ff 78 6a 7a cc ff 71 f6 e3 37 43 ac 46 ca f4 16 1f 54 00 00 00 00 49 45 4e 44 ae 42 60 82
                                          Data Ascii: 7>bz0ONhN=^' ^Rv~WxjI,4/&3gbt+Tv%'<u0py9S`D"Az|_*0O%tfLxjzq7CFTIENDB`


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          31192.168.2.449811136.243.216.2354436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:25 UTC581OUTGET /ExtService.svc/getextparams HTTP/1.1
                                          Host: jsontdsexit2.com
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: */*
                                          Origin: https://2041.awlivedose.live
                                          Sec-Fetch-Site: cross-site
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: empty
                                          Referer: https://2041.awlivedose.live/
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:25 UTC213INHTTP/1.1 200 OK
                                          Server: nginx
                                          Date: Fri, 19 Jan 2024 23:41:25 GMT
                                          Content-Type: application/json; charset=utf-8
                                          Content-Length: 607
                                          Connection: close
                                          Vary: Accept-Encoding
                                          Access-Control-Allow-Origin: *
                                          2024-01-19 23:41:25 UTC607INData Raw: 7b 22 63 63 22 3a 22 55 53 22 2c 22 63 6e 61 6d 65 73 22 3a 7b 22 64 65 22 3a 22 55 53 41 22 2c 22 65 6e 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 65 73 22 3a 22 45 73 74 61 64 6f 73 20 55 6e 69 64 6f 73 22 2c 22 66 72 22 3a 22 c3 89 74 61 74 73 20 55 6e 69 73 22 2c 22 6a 61 22 3a 22 e3 82 a2 e3 83 a1 e3 83 aa e3 82 ab 22 2c 22 70 74 2d 42 52 22 3a 22 45 55 41 22 2c 22 72 75 22 3a 22 d0 a1 d0 a8 d0 90 22 2c 22 7a 68 2d 43 4e 22 3a 22 e7 be 8e e5 9b bd 22 7d 2c 22 63 69 74 79 22 3a 7b 22 64 65 22 3a 22 41 74 6c 61 6e 74 61 22 2c 22 65 6e 22 3a 22 41 74 6c 61 6e 74 61 22 2c 22 65 73 22 3a 22 41 74 6c 61 6e 74 61 22 2c 22 66 72 22 3a 22 41 74 6c 61 6e 74 61 22 2c 22 6a 61 22 3a 22 e3 82 a2 e3 83 88 e3 83 a9 e3 83 b3 e3 82 bf 22 2c 22 70 74 2d
                                          Data Ascii: {"cc":"US","cnames":{"de":"USA","en":"United States","es":"Estados Unidos","fr":"tats Unis","ja":"","pt-BR":"EUA","ru":"","zh-CN":""},"city":{"de":"Atlanta","en":"Atlanta","es":"Atlanta","fr":"Atlanta","ja":"","pt-


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          32192.168.2.449815185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:26 UTC694OUTGET /media/mainstream/flag-icon/flags/4x3/us.svg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: image
                                          Referer: https://2041.awlivedose.live/media/mainstream/flag-icon/css/flag-icon.css
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          Cookie: cookie1=true
                                          2024-01-19 23:41:26 UTC790INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:26 GMT
                                          Content-Type: image/svg+xml
                                          Content-Length: 6215
                                          Connection: close
                                          ETag: "2b327bda75ccb4c9c3cd7ea61c4fed82"
                                          Last-Modified: Wed, 20 Sep 2023 15:24:08 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41A83786A5F
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1693134508#308021526/gid:0/gname:root/mode:33279/mtime:1655387477#446639958/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-06-16T13:51:17.446639958Z
                                          Expires: Sat, 18 Jan 2025 23:41:26 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:26 UTC3306INData Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 68 65 69 67 68 74 3d 22 34 38 30 22 20 77 69 64 74 68 3d 22 36 34 30 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 36 34 30 20 34 38 30 22 3e 0d 0a 20 20 3c 67 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 73 63 61 6c 65 28 2e 39 33 37 35 29 22 3e 0d 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 70 74 22 3e 0d 0a 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 30 20 30 68 39 37 32 2e 38 31 76 33 39 2e 33 38 35 48 30 7a 6d 30 20 37 38 2e 37 37 68 39 37 32 2e 38 31 76 33 39 2e 33 38 35 48 30 7a 6d 30 20 37 38 2e 37 37 68 39 37 32 2e 38 31 76 33 39 2e 33 38 35 48 30 7a
                                          Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" height="480" width="640" viewBox="0 0 640 480"> <g fill-rule="evenodd" transform="scale(.9375)"> <g stroke-width="1pt"> <path d="M0 0h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0z
                                          2024-01-19 23:41:26 UTC2909INData Raw: 31 30 2e 38 39 36 2d 39 2e 32 36 39 2d 36 2e 37 33 34 2d 39 2e 32 36 39 20 36 2e 37 33 34 20 33 2e 35 34 2d 31 30 2e 38 39 36 2d 39 2e 32 36 39 2d 36 2e 37 33 35 68 31 31 2e 34 35 38 7a 6d 36 34 2e 38 35 32 20 30 6c 33 2e 35 34 20 31 30 2e 38 39 36 68 31 31 2e 34 35 37 6c 2d 39 2e 32 36 39 20 36 2e 37 33 35 20 33 2e 35 34 20 31 30 2e 38 39 36 2d 39 2e 32 36 38 2d 36 2e 37 33 34 2d 39 2e 32 37 20 36 2e 37 33 34 20 33 2e 35 34 31 2d 31 30 2e 38 39 36 2d 39 2e 32 37 2d 36 2e 37 33 35 68 31 31 2e 34 35 38 7a 6d 36 34 2e 38 35 35 20 30 6c 33 2e 35 34 20 31 30 2e 38 39 36 68 31 31 2e 34 35 38 6c 2d 39 2e 32 37 20 36 2e 37 33 35 20 33 2e 35 34 31 20 31 30 2e 38 39 36 2d 39 2e 32 37 2d 36 2e 37 33 34 2d 39 2e 32 36 38 20 36 2e 37 33 34 20 33 2e 35 34 2d 31 30 2e
                                          Data Ascii: 10.896-9.269-6.734-9.269 6.734 3.54-10.896-9.269-6.735h11.458zm64.852 0l3.54 10.896h11.457l-9.269 6.735 3.54 10.896-9.268-6.734-9.27 6.734 3.541-10.896-9.27-6.735h11.458zm64.855 0l3.54 10.896h11.458l-9.27 6.735 3.541 10.896-9.27-6.734-9.268 6.734 3.54-10.


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          33192.168.2.449816185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:26 UTC765OUTGET /media/mainstream/all/cf/winner_cat2.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: image
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:26 UTC782INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:26 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 1388
                                          Connection: close
                                          Content-Security-Policy: block-all-mixed-content
                                          ETag: "0ac513ee31a4aa2855ef74476d76c95a"
                                          Last-Modified: Mon, 20 Feb 2023 09:33:03 GMT
                                          No-Gzip-Compression: true
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Request-Id: 17ABE41A860F858D
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1676843277#791577239/gid:0/gname:root/mode:33279/mtime:1652249423#82807000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:23.082807Z
                                          Expires: Sat, 18 Jan 2025 23:41:26 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:26 UTC1388INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 03 02 02 02 02 02 03 02 02 02 03 03 03 03 04 06 04 04 04 04 04 08 06 06 05 06 09 08 0a 0a 09 08 09 09 0a 0c 0f 0c 0a 0b 0e 0b 09 09 0d 11 0d 0e 0f 10 10 11 10 0a 0c 12 13 12 10 13 0f 10 10 10 ff db 00 43 01 03 03 03 04 03 04 08 04 04 08 10 0b 09 0b 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 ff c2 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1b 00 00 02 02 03 01 00 00 00 00 00 00 00 00 00 00 00 07 08 05 06 02 04 09 03 ff c4 00 1b 01 00 03 00 03 01 01 00 00 00 00 00 00 00 00 00 00 02 03 06 00 01 04 05 07 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 5b b8 ba 22 09 56
                                          Data Ascii: JFIFCC00["V


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          34192.168.2.449817185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:26 UTC766OUTGET /media/mainstream/all/cf/winner_heart.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: image
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:26 UTC784INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:26 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 1428
                                          Connection: close
                                          ETag: "d1d2ce3b77a4b6f4347c3ae674142664"
                                          Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41A8442D00F
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1695223403#315746011/gid:0/gname:root/mode:33279/mtime:1652249423#138807000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:23.138807Z
                                          Expires: Sat, 18 Jan 2025 23:41:26 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:26 UTC1428INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 02 03 03 03 03 03 04 07 05 04 04 04 04 09 06 07 05 07 0a 09 0b 0b 0a 09 0a 0a 0c 0d 11 0e 0c 0c 10 0c 0a 0a 0e 14 0f 10 11 12 13 13 13 0b 0e 14 16 14 12 16 11 12 13 12 ff db 00 43 01 03 03 03 04 04 04 08 05 05 08 12 0c 0a 0c 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 ff c2 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1a 00 00 02 03 01 01 00 00 00 00 00 00 00 00 00 00 00 07 09 03 06 08 05 04 ff c4 00 1c 01 00 01 04 03 01 00 00 00 00 00 00 00 00 00 00 00 03 00 02 04 07 01 06 08 05 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 6a 09 08 45 b1 e3
                                          Data Ascii: JFIFCC00jE


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          35192.168.2.449818185.155.184.554436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:26 UTC402OUTGET /media/mainstream/all/cf/winner_2.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: */*
                                          Sec-Fetch-Site: none
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: empty
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          Cookie: cookie1=true
                                          2024-01-19 23:41:26 UTC784INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:26 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 1856
                                          Connection: close
                                          ETag: "0751077bb39eb354771c0918dd4651a2"
                                          Last-Modified: Wed, 20 Sep 2023 15:23:23 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41A859AD53E
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1693134509#244024455/gid:0/gname:root/mode:33279/mtime:1652249422#854806000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:22.854806Z
                                          Expires: Sat, 18 Jan 2025 23:41:26 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:26 UTC1856INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 02 02 02 02 02 02 02 02 02 02 02 02 02 02 03 04 03 02 02 03 04 05 04 04 04 04 04 05 06 05 05 05 05 05 05 06 06 07 07 08 07 07 06 09 09 0a 0a 09 09 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff db 00 43 01 03 03 03 05 04 05 09 06 06 09 0d 0b 09 0b 0d 0f 0e 0e 0e 0e 0f 0f 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1b 00 00 02 02 03 01 00 00 00 00 00 00 00 00 00 00 00 09 0a 07 08 03 05 06 04 ff c4 00 31 10 00 01 03 03 03 03 03 03 03 03 05 00 00 00 00 00 01 02 03 04 05 06 11 07 12 13 00 08 21 14 22 31 09 32 51 15 41 42 16 23 71 24 61 72
                                          Data Ascii: JFIFHHCC001!"12QAB#q$ar


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          36192.168.2.449819185.155.184.554436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:26 UTC404OUTGET /media/mainstream/all/cf/winner_cat.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: */*
                                          Sec-Fetch-Site: none
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: empty
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          Cookie: cookie1=true
                                          2024-01-19 23:41:26 UTC783INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:26 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 1422
                                          Connection: close
                                          ETag: "386e89d83d4f84499cbb1611b2db4173"
                                          Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41A8763D2E2
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1695223403#303745984/gid:0/gname:root/mode:33279/mtime:1652249423#26807000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:23.026807Z
                                          Expires: Sat, 18 Jan 2025 23:41:26 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:26 UTC1422INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 02 02 02 02 02 02 02 02 02 02 02 02 02 02 03 04 03 02 02 03 04 05 04 04 04 04 04 05 06 05 05 05 05 05 05 06 06 07 07 08 07 07 06 09 09 0a 0a 09 09 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff db 00 43 01 03 03 03 05 04 05 09 06 06 09 0d 0b 09 0b 0d 0f 0e 0e 0e 0e 0f 0f 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 00 03 01 00 00 00 00 00 00 00 00 00 00 06 08 03 05 07 01 02 09 04 ff c4 00 34 10 00 02 02 01 03 03 01 06 04 04 07 00 00 00 00 00 01 02 03 04 05 06 11 12 00 07 21 31 08 13 14 22 23 41 32 51 61 81 15 33 42 52 53
                                          Data Ascii: JFIFHHCC004!1"#A2Qa3BRS


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          37192.168.2.449820185.155.184.554436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:26 UTC410OUTGET /media/mainstream/all/cf/winner_initial_s.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: */*
                                          Sec-Fetch-Site: none
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: empty
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          Cookie: cookie1=true
                                          2024-01-19 23:41:26 UTC782INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:26 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 751
                                          Connection: close
                                          Content-Security-Policy: block-all-mixed-content
                                          ETag: "e8c1454c15c6596bb21d99f4d907f632"
                                          Last-Modified: Mon, 20 Feb 2023 09:33:03 GMT
                                          No-Gzip-Compression: true
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Request-Id: 17ABE41A8B14A801
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1676843277#791577239/gid:0/gname:root/mode:33279/mtime:1652249423#310808000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:23.310808Z
                                          Expires: Sat, 18 Jan 2025 23:41:26 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:26 UTC751INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 02 02 02 02 02 02 02 02 02 02 02 02 02 02 03 04 03 02 02 03 04 05 04 04 04 04 04 05 06 05 05 05 05 05 05 06 06 07 07 08 07 07 06 09 09 0a 0a 09 09 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff db 00 43 01 03 03 03 05 04 05 09 06 06 09 0d 0b 09 0b 0d 0f 0e 0e 0e 0e 0f 0f 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1a 00 01 00 02 03 01 00 00 00 00 00 00 00 00 00 00 00 00 03 08 01 06 07 09 ff c4 00 28 10 00 00 05 04 01 04 02 02 03 00 00 00 00 00 00 00 01 02 03 04 06 00 05 07 11 12 08 13 21 41 14 31 15 23 42 51 61 ff c4 00 1a 01 01 01 01
                                          Data Ascii: JFIFHHCC00(!A1#BQa


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          38192.168.2.449822185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:26 UTC784OUTGET /media/mainstream/all/cf/winner_4.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: image
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          Cookie: cookie1=true
                                          2024-01-19 23:41:26 UTC784INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:26 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 1891
                                          Connection: close
                                          ETag: "7ba72cafb47b63a3277ff2ee2f06d7df"
                                          Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41A888DA2A3
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1695223403#299745974/gid:0/gname:root/mode:33279/mtime:1652249422#970807000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:22.970807Z
                                          Expires: Sat, 18 Jan 2025 23:41:26 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:26 UTC1891INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 02 02 02 02 02 02 02 02 02 02 02 02 02 02 03 04 03 02 02 03 04 05 04 04 04 04 04 05 06 05 05 05 05 05 05 06 06 07 07 08 07 07 06 09 09 0a 0a 09 09 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff db 00 43 01 03 03 03 05 04 05 09 06 06 09 0d 0b 09 0b 0d 0f 0e 0e 0e 0e 0f 0f 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1a 00 00 02 03 01 01 00 00 00 00 00 00 00 00 00 00 00 05 08 06 07 09 03 0a ff c4 00 30 10 00 01 03 03 02 04 04 06 02 03 01 00 00 00 00 00 02 01 03 04 05 06 11 07 12 00 13 21 31 08 22 41 51 14 15 16 23 32 61 71 81 24 25 42 a1
                                          Data Ascii: JFIFHHCC000!1"AQ#2aq$%B


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          39192.168.2.449823185.155.184.554436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:26 UTC410OUTGET /media/mainstream/all/cf/winner_initial_m.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: */*
                                          Sec-Fetch-Site: none
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: empty
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          Cookie: cookie1=true
                                          2024-01-19 23:41:26 UTC783INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:26 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 950
                                          Connection: close
                                          ETag: "62a261739e9a386d39d542903d5ab050"
                                          Last-Modified: Wed, 20 Sep 2023 15:23:23 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41A8934E075
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1693134509#244024455/gid:0/gname:root/mode:33279/mtime:1652249423#198808000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:23.198808Z
                                          Expires: Sat, 18 Jan 2025 23:41:26 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:26 UTC950INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 02 02 02 02 02 02 02 02 02 02 02 02 02 02 03 04 03 02 02 03 04 05 04 04 04 04 04 05 06 05 05 05 05 05 05 06 06 07 07 08 07 07 06 09 09 0a 0a 09 09 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff db 00 43 01 03 03 03 05 04 05 09 06 06 09 0d 0b 09 0b 0d 0f 0e 0e 0e 0e 0f 0f 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1b 00 00 02 02 03 01 00 00 00 00 00 00 00 00 00 00 00 00 02 04 07 03 05 06 08 ff c4 00 30 10 00 00 05 03 02 04 03 07 05 00 00 00 00 00 00 00 01 02 03 04 05 00 06 12 11 61 07 13 31 51 08 21 75 14 22 36 37 41 71 b4 15 16 42 b3
                                          Data Ascii: JFIFHHCC000a1Q!u"67AqB


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          40192.168.2.449824185.155.184.554436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:26 UTC402OUTGET /media/mainstream/all/cf/winner_1.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: */*
                                          Sec-Fetch-Site: none
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: empty
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          Cookie: cookie1=true
                                          2024-01-19 23:41:26 UTC784INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:26 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 1434
                                          Connection: close
                                          ETag: "21bda39c69a0527bcb17d0f5d3ce9ebd"
                                          Last-Modified: Wed, 20 Sep 2023 15:23:23 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41A8A94F2F9
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1693134509#244024455/gid:0/gname:root/mode:33279/mtime:1652249422#798806000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:22.798806Z
                                          Expires: Sat, 18 Jan 2025 23:41:26 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:26 UTC1434INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 02 02 02 02 02 02 02 02 02 02 02 02 02 02 03 04 03 02 02 03 04 05 04 04 04 04 04 05 06 05 05 05 05 05 05 06 06 07 07 08 07 07 06 09 09 0a 0a 09 09 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff db 00 43 01 03 03 03 05 04 05 09 06 06 09 0d 0b 09 0b 0d 0f 0e 0e 0e 0e 0f 0f 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1a 00 00 02 03 01 01 00 00 00 00 00 00 00 00 00 00 00 06 09 05 07 08 0a 04 ff c4 00 35 10 00 01 03 03 02 04 03 05 06 07 00 00 00 00 00 00 01 02 03 04 05 06 11 00 12 07 13 21 31 22 41 51 08 14 15 61 71 23 42 52 72 91 a1 24 32
                                          Data Ascii: JFIFHHCC005!1"AQaq#BRr$2


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          41192.168.2.449825185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:26 UTC792OUTGET /media/mainstream/all/cf/winner_initial_r.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: no-cors
                                          Sec-Fetch-Dest: image
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          Cookie: cookie1=true
                                          2024-01-19 23:41:26 UTC783INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:26 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 807
                                          Connection: close
                                          ETag: "3c777668dafeeb70ccc712b2772d7bc5"
                                          Last-Modified: Wed, 20 Sep 2023 15:23:23 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41A8FFBF6D4
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1693134509#244024455/gid:0/gname:root/mode:33279/mtime:1652249423#254808000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:23.254808Z
                                          Expires: Sat, 18 Jan 2025 23:41:26 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:26 UTC807INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 02 02 02 02 02 02 02 02 02 02 02 02 02 02 03 04 03 02 02 03 04 05 04 04 04 04 04 05 06 05 05 05 05 05 05 06 06 07 07 08 07 07 06 09 09 0a 0a 09 09 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff db 00 43 01 03 03 03 05 04 05 09 06 06 09 0d 0b 09 0b 0d 0f 0e 0e 0e 0e 0f 0f 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1b 00 01 00 02 03 01 01 00 00 00 00 00 00 00 00 00 00 00 05 08 01 02 06 07 03 ff c4 00 29 10 00 00 06 01 04 01 03 04 03 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 11 12 13 21 08 31 41 14 22 51 61 15 23 42 ff c4 00 1b 01 01
                                          Data Ascii: JFIFHHCC00)!1A"Qa#B


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          42192.168.2.449827136.243.216.2354436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:26 UTC367OUTGET /ExtService.svc/getextparams HTTP/1.1
                                          Host: jsontdsexit2.com
                                          Connection: keep-alive
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: */*
                                          Sec-Fetch-Site: none
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: empty
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          2024-01-19 23:41:26 UTC213INHTTP/1.1 200 OK
                                          Server: nginx
                                          Date: Fri, 19 Jan 2024 23:41:26 GMT
                                          Content-Type: application/json; charset=utf-8
                                          Content-Length: 607
                                          Connection: close
                                          Vary: Accept-Encoding
                                          Access-Control-Allow-Origin: *
                                          2024-01-19 23:41:26 UTC607INData Raw: 7b 22 63 63 22 3a 22 55 53 22 2c 22 63 6e 61 6d 65 73 22 3a 7b 22 64 65 22 3a 22 55 53 41 22 2c 22 65 6e 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 65 73 22 3a 22 45 73 74 61 64 6f 73 20 55 6e 69 64 6f 73 22 2c 22 66 72 22 3a 22 c3 89 74 61 74 73 20 55 6e 69 73 22 2c 22 6a 61 22 3a 22 e3 82 a2 e3 83 a1 e3 83 aa e3 82 ab 22 2c 22 70 74 2d 42 52 22 3a 22 45 55 41 22 2c 22 72 75 22 3a 22 d0 a1 d0 a8 d0 90 22 2c 22 7a 68 2d 43 4e 22 3a 22 e7 be 8e e5 9b bd 22 7d 2c 22 63 69 74 79 22 3a 7b 22 64 65 22 3a 22 41 74 6c 61 6e 74 61 22 2c 22 65 6e 22 3a 22 41 74 6c 61 6e 74 61 22 2c 22 65 73 22 3a 22 41 74 6c 61 6e 74 61 22 2c 22 66 72 22 3a 22 41 74 6c 61 6e 74 61 22 2c 22 6a 61 22 3a 22 e3 82 a2 e3 83 88 e3 83 a9 e3 83 b3 e3 82 bf 22 2c 22 70 74 2d
                                          Data Ascii: {"cc":"US","cnames":{"de":"USA","en":"United States","es":"Estados Unidos","fr":"tats Unis","ja":"","pt-BR":"EUA","ru":"","zh-CN":""},"city":{"de":"Atlanta","en":"Atlanta","es":"Atlanta","fr":"Atlanta","ja":"","pt-


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          43192.168.2.449828185.155.184.554436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:26 UTC402OUTGET /media/mainstream/all/cf/winner_3.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: */*
                                          Sec-Fetch-Site: none
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: empty
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          Cookie: cookie1=true
                                          2024-01-19 23:41:27 UTC784INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:27 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 1721
                                          Connection: close
                                          ETag: "6442f84b2acd86e6e571a24313651987"
                                          Last-Modified: Wed, 20 Sep 2023 15:23:23 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41AAC2E8BA2
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1693134509#244024455/gid:0/gname:root/mode:33279/mtime:1652249422#914806000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:22.914806Z
                                          Expires: Sat, 18 Jan 2025 23:41:27 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:27 UTC1721INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 03 02 02 02 02 02 03 02 02 02 03 03 03 03 04 06 04 04 04 04 04 08 06 06 05 06 09 08 0a 0a 09 08 09 09 0a 0c 0f 0c 0a 0b 0e 0b 09 09 0d 11 0d 0e 0f 10 10 11 10 0a 0c 12 13 12 10 13 0f 10 10 10 ff db 00 43 01 03 03 03 04 03 04 08 04 04 08 10 0b 09 0b 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 ff c2 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1a 00 01 00 03 01 01 01 00 00 00 00 00 00 00 00 00 00 07 04 06 08 05 01 02 ff c4 00 1b 01 00 02 03 01 01 01 00 00 00 00 00 00 00 00 00 00 03 04 00 05 06 01 02 07 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 f7 2e a1 cc e2 cf bf
                                          Data Ascii: JFIFCC00.


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          44192.168.2.449831185.155.184.554436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:27 UTC409OUTGET /media/mainstream/flag-icon/flags/4x3/us.svg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: */*
                                          Sec-Fetch-Site: none
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: empty
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          Cookie: cookie1=true
                                          2024-01-19 23:41:27 UTC789INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:27 GMT
                                          Content-Type: image/svg+xml
                                          Content-Length: 6215
                                          Connection: close
                                          Content-Security-Policy: block-all-mixed-content
                                          ETag: "2b327bda75ccb4c9c3cd7ea61c4fed82"
                                          Last-Modified: Mon, 20 Feb 2023 09:34:00 GMT
                                          No-Gzip-Compression: true
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Request-Id: 17ABE41AC371C021
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1676843396#131757554/gid:0/gname:root/mode:33279/mtime:1655387477#446639958/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-06-16T13:51:17.446639958Z
                                          Expires: Sat, 18 Jan 2025 23:41:27 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:27 UTC3307INData Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 68 65 69 67 68 74 3d 22 34 38 30 22 20 77 69 64 74 68 3d 22 36 34 30 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 36 34 30 20 34 38 30 22 3e 0d 0a 20 20 3c 67 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 73 63 61 6c 65 28 2e 39 33 37 35 29 22 3e 0d 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 70 74 22 3e 0d 0a 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 30 20 30 68 39 37 32 2e 38 31 76 33 39 2e 33 38 35 48 30 7a 6d 30 20 37 38 2e 37 37 68 39 37 32 2e 38 31 76 33 39 2e 33 38 35 48 30 7a 6d 30 20 37 38 2e 37 37 68 39 37 32 2e 38 31 76 33 39 2e 33 38 35 48 30 7a
                                          Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" height="480" width="640" viewBox="0 0 640 480"> <g fill-rule="evenodd" transform="scale(.9375)"> <g stroke-width="1pt"> <path d="M0 0h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0z
                                          2024-01-19 23:41:27 UTC2908INData Raw: 30 2e 38 39 36 2d 39 2e 32 36 39 2d 36 2e 37 33 34 2d 39 2e 32 36 39 20 36 2e 37 33 34 20 33 2e 35 34 2d 31 30 2e 38 39 36 2d 39 2e 32 36 39 2d 36 2e 37 33 35 68 31 31 2e 34 35 38 7a 6d 36 34 2e 38 35 32 20 30 6c 33 2e 35 34 20 31 30 2e 38 39 36 68 31 31 2e 34 35 37 6c 2d 39 2e 32 36 39 20 36 2e 37 33 35 20 33 2e 35 34 20 31 30 2e 38 39 36 2d 39 2e 32 36 38 2d 36 2e 37 33 34 2d 39 2e 32 37 20 36 2e 37 33 34 20 33 2e 35 34 31 2d 31 30 2e 38 39 36 2d 39 2e 32 37 2d 36 2e 37 33 35 68 31 31 2e 34 35 38 7a 6d 36 34 2e 38 35 35 20 30 6c 33 2e 35 34 20 31 30 2e 38 39 36 68 31 31 2e 34 35 38 6c 2d 39 2e 32 37 20 36 2e 37 33 35 20 33 2e 35 34 31 20 31 30 2e 38 39 36 2d 39 2e 32 37 2d 36 2e 37 33 34 2d 39 2e 32 36 38 20 36 2e 37 33 34 20 33 2e 35 34 2d 31 30 2e 38
                                          Data Ascii: 0.896-9.269-6.734-9.269 6.734 3.54-10.896-9.269-6.735h11.458zm64.852 0l3.54 10.896h11.457l-9.269 6.735 3.54 10.896-9.268-6.734-9.27 6.734 3.541-10.896-9.27-6.735h11.458zm64.855 0l3.54 10.896h11.458l-9.27 6.735 3.541 10.896-9.27-6.734-9.268 6.734 3.54-10.8


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          45192.168.2.449832185.155.184.554436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:27 UTC406OUTGET /media/mainstream/all/cf/winner_heart.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: */*
                                          Sec-Fetch-Site: none
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: empty
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          Cookie: cookie1=true
                                          2024-01-19 23:41:27 UTC784INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:27 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 1428
                                          Connection: close
                                          ETag: "d1d2ce3b77a4b6f4347c3ae674142664"
                                          Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41AC03DC5AF
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1695223403#315746011/gid:0/gname:root/mode:33279/mtime:1652249423#138807000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:23.138807Z
                                          Expires: Sat, 18 Jan 2025 23:41:27 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:27 UTC1428INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 02 03 03 03 03 03 04 07 05 04 04 04 04 09 06 07 05 07 0a 09 0b 0b 0a 09 0a 0a 0c 0d 11 0e 0c 0c 10 0c 0a 0a 0e 14 0f 10 11 12 13 13 13 0b 0e 14 16 14 12 16 11 12 13 12 ff db 00 43 01 03 03 03 04 04 04 08 05 05 08 12 0c 0a 0c 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 ff c2 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1a 00 00 02 03 01 01 00 00 00 00 00 00 00 00 00 00 00 07 09 03 06 08 05 04 ff c4 00 1c 01 00 01 04 03 01 00 00 00 00 00 00 00 00 00 00 00 03 00 02 04 07 01 06 08 05 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 6a 09 08 45 b1 e3
                                          Data Ascii: JFIFCC00jE


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          46192.168.2.449830185.155.184.554436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:27 UTC405OUTGET /media/mainstream/all/cf/winner_cat2.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: */*
                                          Sec-Fetch-Site: none
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: empty
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          Cookie: cookie1=true
                                          2024-01-19 23:41:27 UTC783INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:27 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 1388
                                          Connection: close
                                          ETag: "0ac513ee31a4aa2855ef74476d76c95a"
                                          Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41ABF85D036
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1695223403#311746001/gid:0/gname:root/mode:33279/mtime:1652249423#82807000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:23.082807Z
                                          Expires: Sat, 18 Jan 2025 23:41:27 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:27 UTC1388INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 03 02 02 02 02 02 03 02 02 02 03 03 03 03 04 06 04 04 04 04 04 08 06 06 05 06 09 08 0a 0a 09 08 09 09 0a 0c 0f 0c 0a 0b 0e 0b 09 09 0d 11 0d 0e 0f 10 10 11 10 0a 0c 12 13 12 10 13 0f 10 10 10 ff db 00 43 01 03 03 03 04 03 04 08 04 04 08 10 0b 09 0b 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 ff c2 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1b 00 00 02 02 03 01 00 00 00 00 00 00 00 00 00 00 00 07 08 05 06 02 04 09 03 ff c4 00 1b 01 00 03 00 03 01 01 00 00 00 00 00 00 00 00 00 00 02 03 06 00 01 04 05 07 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 5b b8 ba 22 09 56
                                          Data Ascii: JFIFCC00["V


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          47192.168.2.449833185.155.184.554436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:27 UTC402OUTGET /media/mainstream/all/cf/winner_4.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: */*
                                          Sec-Fetch-Site: none
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: empty
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          Cookie: cookie1=true
                                          2024-01-19 23:41:27 UTC784INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:27 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 1891
                                          Connection: close
                                          ETag: "7ba72cafb47b63a3277ff2ee2f06d7df"
                                          Last-Modified: Wed, 20 Sep 2023 15:23:23 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41AC08C8E8B
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1693134509#244024455/gid:0/gname:root/mode:33279/mtime:1652249422#970807000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:22.970807Z
                                          Expires: Sat, 18 Jan 2025 23:41:27 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:27 UTC1891INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 02 02 02 02 02 02 02 02 02 02 02 02 02 02 03 04 03 02 02 03 04 05 04 04 04 04 04 05 06 05 05 05 05 05 05 06 06 07 07 08 07 07 06 09 09 0a 0a 09 09 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff db 00 43 01 03 03 03 05 04 05 09 06 06 09 0d 0b 09 0b 0d 0f 0e 0e 0e 0e 0f 0f 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1a 00 00 02 03 01 01 00 00 00 00 00 00 00 00 00 00 00 05 08 06 07 09 03 0a ff c4 00 30 10 00 01 03 03 02 04 04 06 02 03 01 00 00 00 00 00 02 01 03 04 05 06 11 07 12 00 13 21 31 08 22 41 51 14 15 16 23 32 61 71 81 24 25 42 a1
                                          Data Ascii: JFIFHHCC000!1"AQ#2aq$%B


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          48192.168.2.449834185.155.184.554436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:27 UTC410OUTGET /media/mainstream/all/cf/winner_initial_r.jpg HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: */*
                                          Sec-Fetch-Site: none
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: empty
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          Cookie: cookie1=true
                                          2024-01-19 23:41:27 UTC782INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:27 GMT
                                          Content-Type: image/jpeg
                                          Content-Length: 807
                                          Connection: close
                                          Content-Security-Policy: block-all-mixed-content
                                          ETag: "3c777668dafeeb70ccc712b2772d7bc5"
                                          Last-Modified: Mon, 20 Feb 2023 09:33:03 GMT
                                          No-Gzip-Compression: true
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Request-Id: 17ABE41ACA7DC310
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1676843277#791577239/gid:0/gname:root/mode:33279/mtime:1652249423#254808000/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-05-11T06:10:23.254808Z
                                          Expires: Sat, 18 Jan 2025 23:41:27 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:27 UTC807INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 02 02 02 02 02 02 02 02 02 02 02 02 02 02 03 04 03 02 02 03 04 05 04 04 04 04 04 05 06 05 05 05 05 05 05 06 06 07 07 08 07 07 06 09 09 0a 0a 09 09 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff db 00 43 01 03 03 03 05 04 05 09 06 06 09 0d 0b 09 0b 0d 0f 0e 0e 0e 0e 0f 0f 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 00 30 00 30 03 01 11 00 02 11 01 03 11 01 ff c4 00 1b 00 01 00 02 03 01 01 00 00 00 00 00 00 00 00 00 00 00 05 08 01 02 06 07 03 ff c4 00 29 10 00 00 06 01 04 01 03 04 03 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 11 12 13 21 08 31 41 14 22 51 61 15 23 42 ff c4 00 1b 01 01
                                          Data Ascii: JFIFHHCC00)!1A"Qa#B


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          49192.168.2.449835185.155.186.254436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:27 UTC710OUTGET /media/mainstream/alert.mp3 HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                          sec-ch-ua-mobile: ?0
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          sec-ch-ua-platform: "Windows"
                                          Accept: */*
                                          Sec-Fetch-Site: same-origin
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: empty
                                          Referer: https://2041.awlivedose.live/ubxplwqi/article2041.doc?u=6w3kaew&o=uvdg6dv&cid=uomgcwv9&t=sweepstakes&f=1&sid=t1~x0hgjdzxqkzaumrwysnznltv&fp=GI2Fw%2FVe3BGeXNdZNxapug%3D%3D
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          Cookie: cookie1=true
                                          2024-01-19 23:41:27 UTC786INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:27 GMT
                                          Content-Type: audio/mpeg
                                          Content-Length: 8802
                                          Connection: close
                                          Content-Security-Policy: block-all-mixed-content
                                          ETag: "6d2d3da2ea28ace816fa4a138829dc18"
                                          Last-Modified: Mon, 20 Feb 2023 09:33:01 GMT
                                          No-Gzip-Compression: true
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Request-Id: 17ABE41ACEF124C3
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1676843338#351669788/gid:0/gname:root/mode:33279/mtime:1655387452#802583242/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-06-16T13:50:52.802583242Z
                                          Expires: Sat, 18 Jan 2025 23:41:27 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:27 UTC3310INData Raw: 49 44 33 03 00 00 00 00 00 0f 54 43 4f 4e 00 00 00 05 00 00 00 28 31 32 29 ff fa 92 c0 9a 0c 00 00 10 91 18 fd a7 a5 2b 88 a9 00 64 70 20 00 00 57 4a db 6d b6 db 8d 00 80 27 65 c8 70 17 05 49 ce d2 c9 05 5f 64 08 30 b8 ac a0 9c 81 09 b4 11 9a f2 47 28 64 f5 4c 5d c4 6d 90 18 23 6c 81 92 42 e6 c5 0c ea 6f 41 b0 f5 8b c9 57 93 a8 81 36 ff 52 d8 2e 88 90 b9 b5 10 60 80 48 17 3e 28 72 e7 0c 86 17 6e 6a 20 64 13 68 2e 88 30 74 9d 22 44 c9 d7 6f f5 1c 46 58 f1 21 1e c1 4c 46 f4 1b 0c 9e f8 41 77 23 92 0c 0f 10 45 62 c0 69 ff 84 4f 0f c1 18 f0 e4 72 48 df ff c0 0c 92 81 30 a8 01 25 00 00 e0 f3 c9 77 9c 76 2a d3 91 6a 84 ea 19 5c 56 94 6b 19 48 bf 38 a6 b0 7b 29 bc 5b b0 04 b1 00 00 56 22 bd 03 ff ff ff e4 03 3f 72 23 61 d1 3e dd 65 a8 df 02 e6 f6 b1 1e 37 bb cf
                                          Data Ascii: ID3TCON(12)+dp WJm'epI_d0G(dL]m#lBoAW6R.`H>(rnj dh.0t"DoFX!LFAw#EbiOrH0%wv*j\VkH8{)[V"?r#a>e7
                                          2024-01-19 23:41:27 UTC4096INData Raw: 15 30 30 20 20 38 c8 30 a8 39 70 03 80 ca 04 01 41 a9 0c 80 92 50 02 13 d0 90 3c 03 1e 02 84 02 8c 06 06 0b 03 c8 02 06 01 09 98 e0 4c 66 50 19 ac 06 67 d3 fb 9a 85 0c 61 f2 01 ff fa 92 c0 43 11 bf 00 1e b9 91 53 fc fe 80 2c 3d 32 ab 34 fd f1 b4 8f 4a e6 08 0d 01 86 64 c2 90 50 88 c0 80 70 a8 08 90 06 cf da e3 1f 79 62 cc 36 02 7d df 47 e2 2f 15 87 a1 98 f5 0c b2 0f 91 46 6d 4b 60 89 bc 24 f4 b3 b2 a8 a4 b1 fb a4 85 4e ca a5 51 f8 61 87 b3 cb 34 9d 80 a4 39 5d 88 5b 99 9e bd 2e d5 b9 ae 5e 97 5d d6 3c a2 bb 8e 70 cd 06 58 52 7e 32 ea b4 10 6a 6e 22 25 26 54 95 a6 73 d5 9c a2 52 1a 3e 5c c7 5d c7 9d 94 63 63 1c f5 97 7f 3c 67 b7 ce 7d 9d e7 2b 04 78 65 76 66 6d ad ae a7 88 ef bf 5c 1d d0 18 9d b5 ee 23 aa b2 4c a0 5c 9a 00 7e 62 68 85 bc a1 d4 3f bb c2 f4
                                          Data Ascii: 00 809pAP<LfPgaCS,=24JdPpyb6}G/FmK`$NQa49][.^]<pXR~2jn"%&TsR>\]cc<g}+xevfm\#L\~bh?
                                          2024-01-19 23:41:27 UTC1396INData Raw: 3d 8f 0e 9e 1a 41 ef 43 94 06 a4 6c 0e d7 b5 8a 62 08 29 bb bb 7a 1b 6e 84 51 2e cc ff ff e0 06 5f 3f 7b f6 ef e5 7c db fc 1e c4 99 73 26 e4 db ac 5a c1 6d 00 2d 35 f8 f1 3c 3f c6 4b f7 62 ee c5 ef 3f 96 b7 9f ef e7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fa 92 c0 34 a6 ff 80 2b 08 05 21 21 00 00 00 ca 8a 24 30 31 8c e0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                          Data Ascii: =AClb)znQ._?{|s&Zm-5<?Kb?4+!!$01


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          50192.168.2.449839185.155.184.554436024C:\Program Files\Google\Chrome\Application\chrome.exe
                                          TimestampBytes transferredDirectionData
                                          2024-01-19 23:41:32 UTC392OUTGET /media/mainstream/alert.mp3 HTTP/1.1
                                          Host: 2041.awlivedose.live
                                          Connection: keep-alive
                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                          Accept: */*
                                          Sec-Fetch-Site: none
                                          Sec-Fetch-Mode: cors
                                          Sec-Fetch-Dest: empty
                                          Accept-Encoding: gzip, deflate, br
                                          Accept-Language: en-US,en;q=0.9
                                          Cookie: cookie1=true
                                          2024-01-19 23:41:33 UTC787INHTTP/1.1 200 OK
                                          Server: openresty
                                          Date: Fri, 19 Jan 2024 23:41:33 GMT
                                          Content-Type: audio/mpeg
                                          Content-Length: 8802
                                          Connection: close
                                          ETag: "6d2d3da2ea28ace816fa4a138829dc18"
                                          Last-Modified: Wed, 20 Sep 2023 15:23:21 GMT
                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                          Vary: Origin
                                          Vary: Accept-Encoding
                                          X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
                                          X-Amz-Request-Id: 17ABE41C0FAD6DBF
                                          X-Content-Type-Options: nosniff
                                          X-Xss-Protection: 1; mode=block
                                          x-amz-meta-mc-attrs: atime:1693134509#348024780/gid:0/gname:root/mode:33279/mtime:1655387452#802583242/uid:0/uname:root
                                          x-amz-meta-mm-source-mtime: 2022-06-16T13:50:52.802583242Z
                                          Expires: Sat, 18 Jan 2025 23:41:33 GMT
                                          Cache-Control: max-age=31536000
                                          Accept-Ranges: bytes
                                          2024-01-19 23:41:33 UTC3309INData Raw: 49 44 33 03 00 00 00 00 00 0f 54 43 4f 4e 00 00 00 05 00 00 00 28 31 32 29 ff fa 92 c0 9a 0c 00 00 10 91 18 fd a7 a5 2b 88 a9 00 64 70 20 00 00 57 4a db 6d b6 db 8d 00 80 27 65 c8 70 17 05 49 ce d2 c9 05 5f 64 08 30 b8 ac a0 9c 81 09 b4 11 9a f2 47 28 64 f5 4c 5d c4 6d 90 18 23 6c 81 92 42 e6 c5 0c ea 6f 41 b0 f5 8b c9 57 93 a8 81 36 ff 52 d8 2e 88 90 b9 b5 10 60 80 48 17 3e 28 72 e7 0c 86 17 6e 6a 20 64 13 68 2e 88 30 74 9d 22 44 c9 d7 6f f5 1c 46 58 f1 21 1e c1 4c 46 f4 1b 0c 9e f8 41 77 23 92 0c 0f 10 45 62 c0 69 ff 84 4f 0f c1 18 f0 e4 72 48 df ff c0 0c 92 81 30 a8 01 25 00 00 e0 f3 c9 77 9c 76 2a d3 91 6a 84 ea 19 5c 56 94 6b 19 48 bf 38 a6 b0 7b 29 bc 5b b0 04 b1 00 00 56 22 bd 03 ff ff ff e4 03 3f 72 23 61 d1 3e dd 65 a8 df 02 e6 f6 b1 1e 37 bb cf
                                          Data Ascii: ID3TCON(12)+dp WJm'epI_d0G(dL]m#lBoAW6R.`H>(rnj dh.0t"DoFX!LFAw#EbiOrH0%wv*j\VkH8{)[V"?r#a>e7
                                          2024-01-19 23:41:33 UTC4096INData Raw: 08 15 30 30 20 20 38 c8 30 a8 39 70 03 80 ca 04 01 41 a9 0c 80 92 50 02 13 d0 90 3c 03 1e 02 84 02 8c 06 06 0b 03 c8 02 06 01 09 98 e0 4c 66 50 19 ac 06 67 d3 fb 9a 85 0c 61 f2 01 ff fa 92 c0 43 11 bf 00 1e b9 91 53 fc fe 80 2c 3d 32 ab 34 fd f1 b4 8f 4a e6 08 0d 01 86 64 c2 90 50 88 c0 80 70 a8 08 90 06 cf da e3 1f 79 62 cc 36 02 7d df 47 e2 2f 15 87 a1 98 f5 0c b2 0f 91 46 6d 4b 60 89 bc 24 f4 b3 b2 a8 a4 b1 fb a4 85 4e ca a5 51 f8 61 87 b3 cb 34 9d 80 a4 39 5d 88 5b 99 9e bd 2e d5 b9 ae 5e 97 5d d6 3c a2 bb 8e 70 cd 06 58 52 7e 32 ea b4 10 6a 6e 22 25 26 54 95 a6 73 d5 9c a2 52 1a 3e 5c c7 5d c7 9d 94 63 63 1c f5 97 7f 3c 67 b7 ce 7d 9d e7 2b 04 78 65 76 66 6d ad ae a7 88 ef bf 5c 1d d0 18 9d b5 ee 23 aa b2 4c a0 5c 9a 00 7e 62 68 85 bc a1 d4 3f bb c2
                                          Data Ascii: 00 809pAP<LfPgaCS,=24JdPpyb6}G/FmK`$NQa49][.^]<pXR~2jn"%&TsR>\]cc<g}+xevfm\#L\~bh?
                                          2024-01-19 23:41:33 UTC1397INData Raw: 65 3d 8f 0e 9e 1a 41 ef 43 94 06 a4 6c 0e d7 b5 8a 62 08 29 bb bb 7a 1b 6e 84 51 2e cc ff ff e0 06 5f 3f 7b f6 ef e5 7c db fc 1e c4 99 73 26 e4 db ac 5a c1 6d 00 2d 35 f8 f1 3c 3f c6 4b f7 62 ee c5 ef 3f 96 b7 9f ef e7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fa 92 c0 34 a6 ff 80 2b 08 05 21 21 00 00 00 ca 8a 24 30 31 8c e0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                          Data Ascii: e=AClb)znQ._?{|s&Zm-5<?Kb?4+!!$01


                                          Click to jump to process

                                          Click to jump to process

                                          Click to jump to process

                                          Target ID:0
                                          Start time:00:41:05
                                          Start date:20/01/2024
                                          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
                                          Imagebase:0x7ff76e190000
                                          File size:3'242'272 bytes
                                          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:low
                                          Has exited:false

                                          Target ID:2
                                          Start time:00:41:09
                                          Start date:20/01/2024
                                          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          Wow64 process (32bit):false
                                          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=2000,i,14316904190830729481,610904523097346633,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                          Imagebase:0x7ff76e190000
                                          File size:3'242'272 bytes
                                          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:low
                                          Has exited:false

                                          Target ID:3
                                          Start time:00:41:11
                                          Start date:20/01/2024
                                          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" "https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/
                                          Imagebase:0x7ff76e190000
                                          File size:3'242'272 bytes
                                          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:low
                                          Has exited:true

                                          Target ID:5
                                          Start time:00:41:25
                                          Start date:20/01/2024
                                          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                          Wow64 process (32bit):false
                                          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5660 --field-trial-handle=2000,i,14316904190830729481,610904523097346633,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                          Imagebase:0x7ff76e190000
                                          File size:3'242'272 bytes
                                          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                          Has elevated privileges:false
                                          Has administrator privileges:false
                                          Programmed in:C, C++ or other language
                                          Reputation:low
                                          Has exited:false

                                          No disassembly