Edit tour

Windows Analysis Report
Palworld.exe

Overview

General Information

Sample name:	Palworld.exe
Analysis ID:	1383502
MD5:	a9181a14270ad54407a16516c05817be
SHA1:	9102e64d9101096509414208c228d8d93da8ad6d
SHA256:	0a661adf06c2bef40749e9eba17ffccef0eb0e76321a5a21ec11ca60c34fb0dc
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: Suspicious Process Patterns NTDS.DIT Exfil

Writes many files with high entropy

Checks for available system drives (often done to infect USB drives)

Connects to many different domains

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file contains strange resources

PE file does not import any functions

PE file overlay found

Sample file is different than original file name gathered from version info

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Tries to load missing DLLs

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64_ra

Palworld.exe (PID: 3284 cmdline: C:\Users\user\Desktop\Palworld.exe MD5: A9181A14270AD54407A16516C05817BE)

chrome.exe (PID: 2364 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=2116,i,8841958676898613242,11507238833919217486,262144 /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 5356 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6212 --field-trial-handle=2116,i,8841958676898613242,11507238833919217486,262144 /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

dxwebsetup.exe (PID: 3760 cmdline: "C:\Users\user\Downloads\dxwebsetup.exe" MD5: 2CBD6AD183914A0C554F0739069E77D7)

dxwebsetup.exe (PID: 3160 cmdline: "C:\Users\user\Downloads\dxwebsetup.exe" MD5: 2CBD6AD183914A0C554F0739069E77D7)

dxwsetup.exe (PID: 5416 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe MD5: AC3A5F7BE8CD13A863B50AB5FE00B71C)

Palworld.exe (PID: 2688 cmdline: "C:\Users\user\Desktop\Palworld.exe" MD5: A9181A14270AD54407A16516C05817BE)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Process Patterns NTDS.DIT Exfil

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe, CommandLine: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe, ParentCommandLine: "C:\Users\user\Downloads\dxwebsetup.exe" , ParentImage: C:\Users\user\Downloads\dxwebsetup.exe, ParentProcessId: 3160, ParentProcessName: dxwebsetup.exe, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe, ProcessId: 5416, ProcessName: dxwsetup.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\", EventID: 13, EventType: SetValue, Image: C:\Users\user\Downloads\dxwebsetup.exe, ProcessId: 3160, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Window detected: Installing Microsoft(R) DirectX(R)Welcome to setup for DirectXThe DirectX setup wizard guides you through installation of DirectX Runtime Components. Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement. You must accept the agreement to continue the setup.MICROSOFT SOFTWARE LICENSE TERMSMICROSOFT DIRECTX END USER RUNTIMEThese license terms are an agreement between Microsoft Corporation (or based on where you live one of its affiliates) and you. Please read them. They apply to the software named above which includes the media on which you received it if any. The terms also apply to any Microsoft* updates* supplements* Internet-based services and * support servicesfor this software unless other terms accompany those items. If so those terms apply.BY USING THE SOFTWARE YOU ACCEPT THESE TERMS. IF YOU DO NOT ACCEPT THEM DO NOT USE THE SOFTWARE.If you comply with these license terms you have the rights below.1. INSTALLATION AND USE RIGHTS. You may install and use any number of copies of the software on your devices.2. SCOPE OF LICENSE. The software is licensed not sold. This agreement only gives you some rights to use the software. Microsoft reserves all other rights. Unless applicable law gives you more rights despite this limitation you may use the software only as expressly permitted in this agreement. In doing so you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may not* work around any technical limitations in the software;* reverse engineer decompile or disassemble the software except and only to the extent that applicable law expressly permits despite this limitation;* make more copies of the software than specified in this agreement or allowed by applicable law despite this limitation;* publish the software for others to copy;* rent lease or lend the software;* transfer the software or this agreement to any third party; or* use the software for commercial software hosting services.3. BACKUP COPY. You may make one backup copy of the software. You may use it only to reinstall the software.4. DOCUMENTATION. Any person that has valid access to your computer or internal network may copy and use the documentation for your internal reference purposes.5. EXPORT RESTRICTIONS. The software is subject to United States export laws and regulations. You must comply with all domestic and international export laws and regulations that apply to the software. These laws include restrictions on destinations end users and end use. For additional information see www.microsoft.com/exporting.6. SUPPORT SERVICES. Because this software is as is we may not provide support services for it.7. ENTIRE AGREEMENT. This agreement and the terms for supplements updates Internet-based services and support services that you use are the entire agreement for the software and support services.8. APPLICABLE LAW.a. United States. If you acquired the s

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.17:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.58:443 -> 192.168.2.17:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.17:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.17:49961 version: TLS 1.2

Source: Palworld.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: DSETUP.pdb source: dsetup.dll.17.dr
Source:	Binary string: DSETUP.pdb0 source: dsetup.dll.17.dr
Source:	Binary string: wextract.pdb source: dxwebsetup.exe, dxwebsetup.exe, 00000011.00000002.2542730863.0000000001001000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: dsetup32.pdb source: dsetup32.dll.17.dr
Source:	Binary string: BootstrapPackagedGame-Win64-Shipping.pdb source: Palworld.exe
Source:	Binary string: dxwsetup.pdb source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815367597.0000000000171000.00000020.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr
Source:	Binary string: wextract.pdbU source: dxwebsetup.exe, 0000000E.00000000.1809607279.0000000001001000.00000020.00000001.01000000.00000006.sdmp, dxwebsetup.exe, 00000011.00000002.2542730863.0000000001001000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: dxupdate.pdb source: dxwsetup.exe, dxwsetup.exe, 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: e:	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File opened: c:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Downloads\dxwebsetup.exe	Code function: 17_2_01001C7F lstrcpy,lstrcpy,lstrcat,lstrcat,FindFirstFileA,lstrcpy,lstrcmp,lstrcmp,lstrcat,lstrcat,FindNextFileA,FindClose,RemoveDirectoryA,	17_2_01001C7F
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C68A3EB FindFirstFileA,FindClose,	18_2_6C68A3EB
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C68D86D GetWindowsDirectoryA,GetLastError,_strrchr,FindFirstFileA,FindFirstFileA,FindClose,FindClose,FindFirstFileA,FindClose,	18_2_6C68D86D
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C691473 WideCharToMultiByte,GetLastError,WideCharToMultiByte,GetLastError,WideCharToMultiByte,_strrchr,WideCharToMultiByte,_strrchr,WideCharToMultiByte,_strrchr,WideCharToMultiByte,_memset,FindFirstFileA,FindClose,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,	18_2_6C691473
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C68FB07 _memset,_memset,GetWindowsDirectoryA,GetLastError,_memset,FindFirstFileA,lstrcmpA,lstrcmpA,GetFileAttributesA,GetLastError,FindNextFileA,FindClose,	18_2_6C68FB07
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C68E7AF lstrcmpA,_memset,GetSystemDirectoryA,GetLastError,StringFromGUID2,WideCharToMultiByte,GetLastError,FindFirstFileA,FindNextFileA,FindClose,	18_2_6C68E7AF

Source: C:\Users\user\Downloads\dxwebsetup.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	File opened: C:\Users\user\AppData\Local\Temp\IXP000.TMP\	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	File opened: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Source: unknown

Network traffic detected: DNS query count 69

Source: Joe Sandbox View	IP Address: 13.107.246.41 13.107.246.41
Source: Joe Sandbox View	IP Address: 13.249.39.8 13.249.39.8
Source: Joe Sandbox View	IP Address: 104.18.25.173 104.18.25.173
Source: Joe Sandbox View	IP Address: 13.107.213.41 13.107.213.41

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.84
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.84
Source: unknown	TCP traffic detected without corresponding DNS query: 13.67.144.177
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.84
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.84
Source: unknown	TCP traffic detected without corresponding DNS query: 13.67.144.177
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.58
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NvNedGrehGN2W1y&MD=3Z8G6gZk HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.149&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.149Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=di&oit=1&cp=2&pgcl=7&gs_rn=42&psi=w2jj9Ekh5vGktcI5&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=dire&oit=1&cp=4&pgcl=7&gs_rn=42&psi=w2jj9Ekh5vGktcI5&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=direc&oit=1&cp=5&pgcl=7&gs_rn=42&psi=w2jj9Ekh5vGktcI5&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=direct&oit=1&cp=6&pgcl=7&gs_rn=42&psi=w2jj9Ekh5vGktcI5&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.GsbA68hXs80.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo899t-H8Lxb3OqzMDuPn6TV_i36ag/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=directx&oit=1&cp=7&pgcl=7&gs_rn=42&psi=w2jj9Ekh5vGktcI5&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
Source: global traffic	HTTP traffic detected: GET /search?q=directx+runtime&oq=directx&gs_lcrp=EgZjaHJvbWUqDQgBEAAYgwEYsQMYgAQyDwgAEEUYORiDARixAxiABDINCAEQABiDARixAxiABDINCAIQABiDARixAxiABDIKCAMQABixAxiABDIKCAQQABixAxiABDIHCAUQABiABDINCAYQABiDARixAxiABDIHCAcQABiABDINCAgQABiDARixAxiABDINCAkQABiDARixAxiABNIBCDQwNjFqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/2x/googlelogo_color_92x30dp.png HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=s82NdxBaGSH8HxMBLOcwvQpPzv4y-mUgW_d9F7q5R75kTlIRPMncU7iV21f6MmTKzsbm9O89dDCBLJZZNbykzIqZ9LcgUs96i2BkApgz8PH3PiG1Fhzsjr2PRztNhbt9gnl94FekHS0ArONy3z7WCbcUNDAac--5IhXnjkI59xc
Source: global traffic	HTTP traffic detected: GET /images/searchbox/desktop_searchbox_sprites318_hr.webp HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/search?q=directx+runtime&oq=directx&gs_lcrp=EgZjaHJvbWUqDQgBEAAYgwEYsQMYgAQyDwgAEEUYORiDARixAxiABDINCAEQABiDARixAxiABDINCAIQABiDARixAxiABDIKCAMQABixAxiABDIKCAQQABixAxiABDIHCAUQABiABDINCAYQABiDARixAxiABDIHCAcQABiABDINCAgQABiDARixAxiABDINCAkQABiDARixAxiABNIBCDQwNjFqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=s82NdxBaGSH8HxMBLOcwvQpPzv4y-mUgW_d9F7q5R75kTlIRPMncU7iV21f6MmTKzsbm9O89dDCBLJZZNbykzIqZ9LcgUs96i2BkApgz8PH3PiG1Fhzsjr2PRztNhbt9gnl94FekHS0ArONy3z7WCbcUNDAac--5IhXnjkI59xc
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=1/ed=1/dg=2/br=1/rs=ACT90oEp1_FAvFBtywXdkASv2V22tHKmTQ/ee=AfeaP:TkrAjf;Afksuc:wMx0R;BMxAGc:E5bFse;BgS6mb:fidj5d;BjwMce:cXX2Wb;CxXAWb:YyRLvc;DULqB:RKfG5c;DpcR3d:zL72xf;EABSZ:MXZt9d;ESrPQc:mNTJvc;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;EnlcNd:WeHg4;Erl4fe:FloWmf,FloWmf;F9mqte:UoRcbe;Fmv9Nc:O1Tzwc;G0KhTb:LIaoZ;G6wU6e:hezEbd;GleZL:J1A7Od;HMDDWe:G8QUdb;IBADCc:RYquRb;IoGlCf:b5lhvb;IsdWVc:qzxzOb;JXS8fb:Qj0suc;JbMT3:M25sS;JsbNhc:Xd8iUd;KOxcK:OZqGte;KQzWid:ZMKkN;KcokUb:KiuZBf;KeeMUb:HiPxjc;KpRAue:Tia57b;LBgRLc:XVMNvd;LEikZe:byfTOb,lsjVmc;LsNahb:ucGLNb;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Np8Qkd:Dpx6qc;Nyt6ic:jn2sGd;OgagBe:cNTe0;Oj465e:KG2eXe,KG2eXe;OohIYe:mpEAQb;Pjplud:EEDORb,PoEs9b;PqHfGe:im2cZe;Q1Ow7b:x5CSu;QGR0gd:Mlhmy;R2kc8b:ALJqWb;R4IIIb:QWfeKf;R9Ulx:CR7Ufe;RDNBlf:zPRCJb;SLtqO:Kh1xYe;SMDL4c:fTfGO,pnvXVc;SNUn3:ZwDk9d,x8cHvb;ShpF6e:N0pvGc;TxfV6d:YORN0b;U96pRd:FsR04;UDrY1c:eps46d;UVmjEd:EesRsb;UyG7Kb:wQd0G;V2HTTe:RolTY;VGRfx:VFqbr;VN6jIc:ddQyuf;VOcgDe:YquhTb;VsAqSb:PGf2Re;VxQ32b:k0XsBb;WCEKNd:I46Hvd;WDGyFe:jcVOxd;Wfmdue:g3MJlb;XUezZ:sa7lqb;YV5bee:IvPZ6d;ZMvdv:PHFPjb;ZWEUA:afR4Cf;a56pNe:JEfCwb;aAJE9c:WHW6Ef;aZ61od:arTwJ;bFZ6gf:RsDQqe;bcPXSc:gSZLJb;cEt90b:ws9Tlc;cFTWae:gT8qnd;coJ8e:KvoW8;dIoSBb:ZgGg9b;dLlj2:Qqt3Gf;daB6be:lMxGPd;dtl0hd:lLQWFe;eBAeSb:Ck63tb;eBZ5Nd:audvde;eHDfl:ofjVkb;eO3lse:nFClrf;fWLTFc:TVBJbf;g8nkx:U4MzKc;gaub4:TN6bMe;gtVSi:ekUOYd;h3MYod:cEt90b;hK67qb:QWEO5b;hLUtwc:KB8OKd;heHB1:sFczq;hjRo6e:F62sG;iFQyKf:QIhFr,vfuNJf;imqimf:jKGL2e;io8t5d:sgY6Zb;jY0zg:Q6tNgc;k2Qxcb:XY51pe;kCQyJ:ueyPK;kMFpHd:OTA3Ae;kbAm9d:MkHyGd;lkq0A:JyBE3e;nAFL3:NTMZac,s39S4;oGtAuc:sOXFj;oSUNyd:fTfGO,fTfGO,pnvXVc;oUlnpc:RagDlc;okUaUd:wItadb;pKJiXd:VCenhc;pNsl2d:j9Yuyc;pXdRYb:JKoKVe;pj82le:mg5CW;qGV2uc:HHi04c;qZx2Fc:j0xrE;qaS3gd:yiLg6e;qavrXe:zQzcXe;qddgKe:d7YSfd,x4FYXe;rQSrae:C6D5Fc;sP4Vbe:VwDzFe;sTsDMc:kHVSUb;tH4IIe:Ymry6;tosKvd:ZCqP3;trZL0b:qY8PFe;uY49fb:COQbmf;uknmt:GkPrzb;uuQkY:u2V3ud;vGrMZ:lPJJ0c;vfVwPd:lcrkwe;w3bZCb:ZPGaIb;w4rSdf:XKiZ9;w9w86d:dt4g2b;wQlYve:aLUfP;wR5FRb:TtcOte;wV5Pjc:L8KGxe;whEZac:F4AmNb;xBbsrc:NEW1Qc;xbe2wc:uRMPBc;yGxLoc:FmAr0c;yxTchf:KUM7Z;z97YGf:oug9te;zOsCQe:Ko78Df;zaIgPb:Qtpxbd/m=attn,cdos,gwc,hsm,jsa,mb4ZUb,d,csi,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow
Source: global traffic	HTTP traffic detected: GET /verify/ANsg4T5QHLvXpo4u06bQ1eEiExZGAYDL-COfDItNG4_cYY8YaN7qmLTCN_DEz-68J9Rsr_JOG2lQzsVa3hABiNicX3XPnK-qGPe1tOZGBNUUFvQmQfsQLw HTTP/1.1Host: id.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=s82NdxBaGSH8HxMBLOcwvQpPzv4y-mUgW_d9F7q5R75kTlIRPMncU7iV21f6MmTKzsbm9O89dDCBLJZZNbykzIqZ9LcgUs96i2BkApgz8PH3PiG1Fhzsjr2PRztNhbt9gnl94FekHS0ArONy3z7WCbcUNDAac--5IhXnjkI59xc
Source: global traffic	HTTP traffic detected: GET /compressiontest/gzip.html HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
Source: global traffic	HTTP traffic detected: GET /vi/m5Xz14RNOEE/mqdefault.jpg?sqp=-oaymwEFCJQBEFM&rs=AMzJL3k77br3KKy0bjWbmhAEHJOrBx75iw HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?q&cp=0&client=gws-wiz-serp&xssi=t&gs_pcrt=2&hl=en&authuser=0&pq=directx%20runtime&psi=Kze5ZY_EKtunqtsPm7mdiAw.1706637100809&dpr=1&ofp=GJrdgLGE5beKmQEYj7nR6tHOn6peGIGjt8XCkruerAEY5MrUtIevsffuARi4qbvXxoPa_io&nolsbt=1 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq
Source: global traffic	HTTP traffic detected: GET /complete/search?q=directx%20runtime&cp=0&client=desktop-gws-wiz-on-focus-serp&xssi=t&gs_pcrt=3&hl=en&authuser=0&pq=directx%20runtime&psi=Kze5ZY_EKtunqtsPm7mdiAw.1706637100809&dpr=1&ofp=EAEYmt2AsYTlt4qZARiPudHq0c6fql4YgaO3xcKSu56sARjkytS0h6-x9-4BGLipu9fGg9r-KjLkAQoaChhkaXJlY3R4IHJ1bnRpbWUgdmFsb3JhbnQKDAoKZGlyZWN0eCAxMgofCh1kaXJlY3R4IHJ1bnRpbWUgZnJlZSBkb3dubG9hZAolCiNkaXJlY3R4IHJ1bnRpbWUgZG93bmxvYWQgd2luZG93cyAxMAoMCgpkaXJlY3R4IDExChUKE2RpcmVjdHggMTIgZG93bmxvYWQKLAoqZGlyZWN0eCBlbmQtdXNlciBydW50aW1lIG9mZmxpbmUgaW5zdGFsbGVyChsKGWRpcmVjdHggb2ZmbGluZSBpbnN0YWxsZXIQRw HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/md=1/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=1/exm=SNUn3,attn,cEt90b,cdos,csi,d,dtl0hd,eHDfl,gwc,hsm,jsa,mb4ZUb,qddgKe,sTsDMc/excm=ABxRVc,AD6AIb,B0xr7b,CTwd8,CWOfE,CX5LId,CdOg1,D1J6He,FmnE6b,FuQWyc,GRJ32c,GXyz1,JxE93,KiXlnd,MRb7nf,NmR9jd,NsEUGe,Oa7Qpb,Ok4XMd,PE728b,PoJj8d,PvSBGf,QNvmne,RSlfle,TO0csb,TnXlGd,Trirbc,TurKxc,U3Ovcc,U6nlJe,UQpTU,UiPhkb,Uznx4d,VZLyBe,WxJ6g,XDlt7d,XHo6qe,XTkmZd,XbupY,YuNOCb,ZGLUZ,ZrXR8b,Zudxcb,a3cZoc,adn7N,ak946,bXyZdf,cKV22c,du3Q4e,eTv59e,f26on,fNMhz,hfJ9hb,jJtSzc,jkRPje,kCkfUb,kOSi0d,mL4hG,oXRDzc,pIseB,pMwOEe,pQk1fc,qngJBf,r24bR,rL2AR,sU6eaf,tlA71,tzTB5,vJPFse,vhpQNc,y25qZb,yChgtb,yfH2Bd,yn9Ffd,ypVg7e,yuQBec,zjNhL,zs9f9d/ed=1/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/ee=AfeaP:TkrAjf;Afksuc:wMx0R;BMxAGc:E5bFse;BgS6mb:fidj5d;BjwMce:cXX2Wb;CxXAWb:YyRLvc;DULqB:RKfG5c;DpcR3d:zL72xf;EABSZ:MXZt9d;ESrPQc:mNTJvc;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;EnlcNd:WeHg4;Erl4fe:FloWmf;F9mqte:UoRcbe;Fmv9Nc:O1Tzwc;G0KhTb:LIaoZ;G6wU6e:hezEbd;GleZL:J1A7Od;HMDDWe:G8QUdb;IBADCc:RYquRb;IoGlCf:b5lhvb;IsdWVc:qzxzOb;JXS8fb:Qj0suc;JbMT3:M25sS;JsbNhc:Xd8iUd;KOxcK:OZqGte;KQzWid:ZMKkN;KcokUb:KiuZBf;KeeMUb:HiPxjc;KpRAue:Tia57b;LBgRLc:XVMNvd;LEikZe:byfTOb,lsjVmc;LsNahb:ucGLNb;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Np8Qkd:Dpx6qc;Nyt6ic:jn2sGd;OgagBe:cNTe0;Oj465e:KG2eXe;OohIYe:mpEAQb;Pjplud:EEDORb,PoEs9b;PqHfGe:im2cZe;Q1Ow7b:x5CSu;QGR0gd:Mlhmy;R2kc8b:ALJqWb;R4IIIb:QWfeKf;R9Ulx:CR7Ufe;RDNBlf:zPRCJb;SLtqO:Kh1xYe;SMDL4c:fTfGO,pnvXVc;SNUn3:ZwDk9d,x8cHvb;ShpF6e:N0pvGc;TxfV6d:YORN0b;U96pRd:FsR04;UDrY1c:eps46d;UVmjEd:EesRsb;UyG7Kb:wQd0G;V2HTTe:RolTY;VGRfx:VFqbr;VN6jIc:ddQyuf;VOcgDe:YquhTb;VsAqSb:PGf2Re;VxQ32b:k0XsBb;WCEKNd:I46Hvd;WDGyFe:jcVOxd;Wfmdue:g3MJlb;XUezZ:sa7lqb;YV5bee:IvPZ6d;ZMvdv:PHFPjb;ZWEUA:afR4Cf;a56pNe:JEfCwb;aAJE9c:WHW6Ef;aZ61od:arTwJ;bFZ6gf:RsDQqe;bcPXSc:gSZLJb;cEt90b:ws9Tlc;cFTWae:gT8qnd;coJ8e:KvoW8;dIoSBb:ZgGg9b;dLlj2:Qqt3Gf;daB6be:lMxGPd;dtl0hd:lLQWFe;eBAeSb:Ck63tb;eBZ5Nd:audvde;eHDfl:ofjVkb;eO3lse:nFClrf;fWLTFc:TVBJbf;g8nkx:U4MzKc;gaub4:TN6bMe;gtVSi:ekUOYd;h3MYod:cEt90b;hK67qb:QWEO5b;hLUtwc:KB8OKd;heHB1:sFczq;hjRo6e:F62sG;iFQyKf:QIhFr,vfuNJf;imqimf:jKGL2e;io8t5d:sgY6Zb;jY0zg:Q6tNgc;k2Qxcb:XY51pe;kCQyJ:ueyPK;kMFpHd:OTA3Ae;kbAm9d:MkHyGd;lkq0A:JyBE3e;nAFL3:NTMZac,s39S4;oGtAuc:sOXFj;oSUNyd:fTfGO,pnvXVc;oUlnpc:RagDlc;okUaUd:wItadb;pKJiXd:VCenhc;pNsl2d:j9Yuyc;pXdRYb:JKoKVe;pj82le:mg5CW;qGV2uc:HHi04c;qZx2Fc:j0xrE;qaS3gd:yiLg6e;qavrXe:zQzcXe;qddgKe:d7YSfd,x4FYXe;rQSrae:C6D5Fc;sP4Vbe:VwDzFe;sTsDMc:kHVSUb;tH4IIe:Ymry6;tosKvd:ZCqP3;trZL0b:qY8PFe;uY49fb:COQbmf;uknmt:GkPrzb;uuQkY:u2V3ud;vGrMZ:lPJJ0c;vfVwPd:lcrkwe;w3bZCb:ZPGaIb;w4rSdf:XKiZ9;w9w86d:dt4g2b;wQlYve:aLUfP;wR5FRb:TtcOte;wV5Pjc:L8KGxe;whEZac:F4AmNb;xBbsrc:NEW1Qc;xbe2wc:uRMPBc;yGxLoc:FmAr0c;yxTchf:KUM7Z;z97YGf:oug9te;zOsCQe:Ko78Df;zaIgPb:Qtpxbd/m=ABJeBb,Da4hkd,Eox
Source: global traffic	HTTP traffic detected: GET /client_204?atyp=i&biw=1034&bih=870&dpr=1&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
Source: global traffic	HTTP traffic detected: GET /images/icons/material/system/1x/email_grey600_24dp.png HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.GsbA68hXs80.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo899t-H8Lxb3OqzMDuPn6TV_i36ag/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/excm=ABxRVc,AD6AIb,B0xr7b,CTwd8,CWOfE,CX5LId,CdOg1,D1J6He,FmnE6b,FuQWyc,GRJ32c,GXyz1,JxE93,KiXlnd,MRb7nf,NmR9jd,NsEUGe,Oa7Qpb,Ok4XMd,PE728b,PoJj8d,PvSBGf,QNvmne,RSlfle,TO0csb,TnXlGd,Trirbc,TurKxc,U3Ovcc,U6nlJe,UQpTU,UiPhkb,Uznx4d,VZLyBe,WxJ6g,XDlt7d,XHo6qe,XTkmZd,XbupY,YuNOCb,ZGLUZ,ZrXR8b,Zudxcb,a3cZoc,adn7N,ak946,bXyZdf,cKV22c,du3Q4e,eTv59e,f26on,fNMhz,hfJ9hb,jJtSzc,jkRPje,kCkfUb,kOSi0d,mL4hG,oXRDzc,pIseB,pMwOEe,pQk1fc,qngJBf,r24bR,rL2AR,sU6eaf,tlA71,tzTB5,vJPFse,vhpQNc,y25qZb,yChgtb,yfH2Bd,yn9Ffd,ypVg7e,yuQBec,zjNhL,zs9f9d/ed=1/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=sb_wiz,aa,abd,syr9,syrg,syrh,syrf,syri,sy10x,async,sy1ke,bgd,sy3a2,sy3a3,foot,sy1jz,sy5xh,kyn,sy2z2,lli,mu,sf,sy2kq,sy2kr,sy5yc,sonic,TxCJfd,sy6fl,sy6fm,qzxzOb,IsdWVc,sy1tb,sy2eo,sy1tf,sy2rn,sy6fk,syed,sy1ku,sy6fo,spch,tl,syyu,sync,syrc,syrd,sy1ll,sy1lm,sy1ln,EkevXb,sys9,SZXsif,sy11x,fiAufb,sys5,sy1jk,sy1jj,sy2kz,sy39h,sy3cy,sy3cz,sy3cx,sy3qg,sYEX8b,sy1l7,NEW1Qc,xBbsrc,sy1k1,sy1l9,IX53Tb,sywj,sywk,NO84gd,sy1h9,E9M6Uc,Zilivc,sy1qm,sy1qr,b5lhvb,IoGlCf,syv6,syv7,C8HsP,sywl,sywm,gOTY1,sywq,sywp,syws,sywt,sywv,sywu,syww,sy1sv,sy1sy,sy1ov,sy1o4,sy1nz,sy1ss,sy1st,sy1nf,sy1sq,sy1su,sy1sr,sy1sw,sy1sx,sy1sz,sy1t0,sy1t1,sy1t2,RJ1Nyd,syre,sy28z,C8ffD,sy290,sy292,ZUBru,sy291,sy293,sy294,rTuANe,syz9,sy2qb,yfZcPd,syyv,syyw,Dpem5c,syyr,sy282,sy28u,sy28v,sy28x,sy28w,sy28y,Fy1Pv,sy3ax,ROaKxe,sy3ay,sy3az,pj8IAe,sy3pi,vRe0ve,sy3pg,oWVrne,syz2,sy1a6,sy1a7,sy2aa,sy2a3,sy2a5,sy2rg,sy2a9,sy2rh,sy2ri,sy2rs,sy2v2,sy3b2,sy3pj,sy6fp,ogmBcd,sy2a6,sy3pf,Gg40M,sy477,GU4Gab,syuo,UBXHI,syup,R3fhkb,sy4e8,sy6q7,Q59Rjf,sy46l,T5VV,sy455,aDVF7,sy479,rhYw1b,sy1qf,sy1qj,sy1qk,Hlw0zd,M6QgBb,sy1qp,sy1qy,EO13pd,MpJwZc,UUJqVe,sy7d,sOXFj,sy7c,s39S4,NTMZac,nAFL3,oGtAuc,sy86,sy87,q0xTif,y05UD,sy123,sy124,sy125,sy126,sy127,sy12l,sy12m,sy1ge,sy1gf,sy1fd,sy314,sy1d1,sy1cx,sy1rn,sy1cy,sy1dh,sy1di,sy1d5,sy14l,sy1d4,sy1dl,sy1dk,sy1dm,sy1dn,syep,sy182,sy189,sy2np,sy2nq,sy2nr,sy1ds,sy2nz,syjt,sy3cr,sy3cs,sy6gm,sy18f,sy1cs,sy1ct,sy1cv,sy1d2,sy2ny,sy2o6,sy6gn,epYOx?xjs=s3 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi
Source: global traffic	HTTP traffic detected: GET /async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDhAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=9103415834496958732&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
Source: global traffic	HTTP traffic detected: GET /async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDRAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=3258071689962503910&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
Source: global traffic	HTTP traffic detected: GET /async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDBAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=7017065288382140415&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
Source: global traffic	HTTP traffic detected: GET /async/bgasy?ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cs=0&async=_fmt:jspb HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
Source: global traffic	HTTP traffic detected: GET /client_204?cs=1&opi=89978449 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/excm=ABxRVc,AD6AIb,B0xr7b,CTwd8,CWOfE,CX5LId,CdOg1,D1J6He,FmnE6b,FuQWyc,GRJ32c,GXyz1,JxE93,KiXlnd,MRb7nf,NmR9jd,NsEUGe,Oa7Qpb,Ok4XMd,PE728b,PoJj8d,PvSBGf,QNvmne,RSlfle,TO0csb,TnXlGd,Trirbc,TurKxc,U3Ovcc,U6nlJe,UQpTU,UiPhkb,Uznx4d,VZLyBe,WxJ6g,XDlt7d,XHo6qe,XTkmZd,XbupY,YuNOCb,ZGLUZ,ZrXR8b,Zudxcb,a3cZoc,adn7N,ak946,bXyZdf,cKV22c,du3Q4e,eTv59e,f26on,fNMhz,hfJ9hb,jJtSzc,jkRPje,kCkfUb,kOSi0d,mL4hG,oXRDzc,pIseB,pMwOEe,pQk1fc,qngJBf,r24bR,rL2AR,sU6eaf,tlA71,tzTB5,vJPFse,vhpQNc,y25qZb,yChgtb,yfH2Bd,yn9Ffd,ypVg7e,yuQBec,zjNhL,zs9f9d/ed=1/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=uKlGbf,sy1wl,sy3ap,DpX64d,sy3aq,EufiNb,sytm,P10Owf,synl,synv,gSZvdb,sy57c,vTw9Fc,sy1th,sy5de,SC7lYd,eTVOC,Pq506,kpAr,AjRVIe,tE6Rzd,phecbc,q28gvc,g0Ekse,jtFQAf,rKbWof,bIMMof,ARtdse,sy1wv,sy1ww,p2I2Je,z2eFcc,QzraZb,I9JIjc,nzu4Ud,gGYzg,FjjTod,tDA9G,UX8qee,tW711b,R6UkWb,xMHx5e,TnJGKb,SnmExf,synh,syr4,syhf,syih,sywz,syyf,syyg,Mbif2,syi3,syiy,sykd,syke,syk5,sykf,sykg,sysd,syhm,syhq,syi7,syiv,sy1al,syii,sy1am,sy1h7,sy1cg,sy1hb,sy1jd,sy1jc,sy1jq,sy1jr,sy1k0,sy1ms,sy1pd,sy1ou,sy1om,sy1p8,sy1p1,sy1p9,sy1pa,sy1pe,sy1pf,sy1ox,sy1pb,sy1px,sy1pw,sy1t3,sy1t4,sy1t5,sy1t9,sy1t8,sy1t6,sy1tr,sy1wo,sy1wx,syhc,sy1x2,sy1z1,syht,sy1z5,sy1wy,sy1x0,sy1x1,sy1x3,sy1x6,sy1x5,sy1wz,sy1x7,sy1x8,sy1x9,sy1xa,syi0,syim,sy1xe,sy1xf,sy1xg,syjw,syhs,syju,syjx,syrx,sy1xb,sy1xd,sy1xc,syh5,syh6,syi5,syi9,syis,syjn,syjo,syjq,syjs,sy1xj,sy1xk,sy1xi,sy1xl,sy1xm,syk4,sykq,sykr,syks,sykt,syku,sykv,sykw,sykx,syky,sykz,syl0,syl1,syl2,syl3,syl4,syl5,syl6,syl7,syl8,syl9,syla,sylb,sylc,syld,syle,sylf,sylg,sylh,sygq,syli,sylj,sylk,syll,sylm,syln,sy1xp,sy1xo,sy1xn,sy1xq,sy1xr,syk1,sy1xt,syk2,syk6,syk8,syka,sy1xu,sy1xv,sy1xw,syi4,sym9,syma,sy1xx,sy1bu,sy1wq,sy1xz,sy1y0,sy1y1,sy1y2,sy1y3,syho,syy5,syy2,syy6,syhk,syy7,syxh,syy8,syy9,sy1y6,sy1y7,sym7,sy1y5,sy1y8,sy1y9,sy1y4,sy1xy,sy1ya,sy1ea,sy1yi,syhd,syi8,syiu,syxz,syy0,syiw,sylz,symn,syy1,syy3,syz8,sy1e4,sy1e5,sy1eb,sy1ed,sy1ee,sy1xh,sy1yf,sy1yh,sy1yj,sy1ym,sy1yl,sy1yn,sy1yo,sy1yk,sy1yp,sy1yq,sy1yr,sy1ys,syjf,syjh,syjb,syjj,syjm,syr1,syr3,sy1yt,sy1yu,sykj,sykk,sykh,syki,syng,sy1yw,sy1yv,sy1yx,sykm,sykn,sykp,syso,sy1yz,sy1yy,sy1z0,sy1z2,sy1z3,sy1z4,sy1z6,sy1bp,sy1bq,syh8,syhu,sy1br,sy1bs,sy1bt,sy1w5,sy1w4,sy1w7,sy1x4,syxl,syxm,syxn,syxo,syxp,syxq,syxs,syxt,syxu,syxv,syxw,syxx,sy1yb,syj1,syxk,sy1yc,sy1yd,sy1ye,sy1z8,sy1z9,sy1z7,symb,sy1xs,sy1yg,sy1zb,sy1zc,sy1za,sy1zd,sy1ze,sy1zf,sy1zg,sy1zh,sy1zi,sy1zk,sy1zj,sy1zl,sy1ow,sy1p5,sy1zm,sy1zn,syij,sy1zo,sy1zp,syj6,sy1zq,sy1zr,sy1zs,syxy,sy1zt,sy1zu,exgaYe,sy1k3,sy3ph,bpec7b,sy1j8,sy20o,rhe7Pb,synf,synj,synk,DPreE,sy4u1,sy6vg,FH3rkc,sy3b0,sy3b1,qcH9Lc,sy2pr,sy3b3,YFicMc?xjs=s3 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Goog
Source: global traffic	HTTP traffic detected: GET /async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDhAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=9103415834496958732&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
Source: global traffic	HTTP traffic detected: GET /async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDRAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=3258071689962503910&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
Source: global traffic	HTTP traffic detected: GET /async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDBAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=7017065288382140415&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=sy3av,sy3qf,w4UyN,sy1j6,QKZgZd,sy1jf,sy1jg,Qj0suc,JXS8fb,sy1je,sy1ji,sy1jl,sy1jm,sy1jn,sy1jo,sy1jp,sy1js,Wct42,sysh,LiBxPe,sy46v,sy6kg,J9Q59e,sy46w,a6Sgfb?xjs=s3 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=WlNQGd,sy1le,sy1lf,nabPbb,sysv,sysw,sysz,syt0,syt2,syt3,sy3ps,sy6fi,VD4Qme,syew,BYwJlf,syqz,syr0,syr2,VEbNoe,sy297,sy299,sy29a,sy29b,NVlnE,sy298,Dq2Yjb,sy28r,sy28s,qmdEUe,sy29c,sy29d,UqGwg,sy4my,ND0kmf,sy1ja,sy1jb,uLYJpc,sy1j7,n7qy6d,sy1j9,HPGtmd,pjDTFb,sy279,sy27a,sy27b,KgxeNb,sy27d,khkNpe,sy3au,EfPGub?xjs=s3 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
Source: global traffic	HTTP traffic detected: GET /async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDhAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=9103415834496958732&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
Source: global traffic	HTTP traffic detected: GET /async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDRAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=3258071689962503910&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
Source: global traffic	HTTP traffic detected: GET /async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDBAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=7017065288382140415&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
Source: global traffic	HTTP traffic detected: GET /iframe_api?version=3 HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=kMFpHd,sy8j,bm51tf?xjs=s3 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
Source: global traffic	HTTP traffic detected: GET /s/player/6ee8f9ce/www-widgetapi.vflset/www-widgetapi.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=MmYKqDmYcs4; VISITOR_INFO1_LIVE=oCH7UytiVXo
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=syez,syf0,aLUfP?xjs=s3 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=sy11b,sy11c,dt4g2b?xjs=s3 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
Source: global traffic	HTTP traffic detected: GET /embed/?enablejsapi=1&rel=0&autoplay=0&playsinline=1&expflag=embeds_enable_muted_autoplay%3Atrue&fs=1 HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/search?q=directx+runtime&oq=directx&gs_lcrp=EgZjaHJvbWUqDQgBEAAYgwEYsQMYgAQyDwgAEEUYORiDARixAxiABDINCAEQABiDARixAxiABDINCAIQABiDARixAxiABDIKCAMQABixAxiABDIKCAQQABixAxiABDIHCAUQABiABDINCAYQABiDARixAxiABDIHCAcQABiABDINCAgQABiDARixAxiABDINCAkQABiDARixAxiABNIBCDQwNjFqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=MmYKqDmYcs4; VISITOR_INFO1_LIVE=oCH7UytiVXo
Source: global traffic	HTTP traffic detected: GET /s/player/6ee8f9ce/www-player.css HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.youtube.com/embed/?enablejsapi=1&rel=0&autoplay=0&playsinline=1&expflag=embeds_enable_muted_autoplay%3Atrue&fs=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=MmYKqDmYcs4; VISITOR_INFO1_LIVE=oCH7UytiVXo
Source: global traffic	HTTP traffic detected: GET /s/player/6ee8f9ce/player_ias.vflset/en_US/embed.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/embed/?enablejsapi=1&rel=0&autoplay=0&playsinline=1&expflag=embeds_enable_muted_autoplay%3Atrue&fs=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=MmYKqDmYcs4; VISITOR_INFO1_LIVE=oCH7UytiVXo
Source: global traffic	HTTP traffic detected: GET /s/player/6ee8f9ce/www-embed-player.vflset/www-embed-player.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/embed/?enablejsapi=1&rel=0&autoplay=0&playsinline=1&expflag=embeds_enable_muted_autoplay%3Atrue&fs=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=MmYKqDmYcs4; VISITOR_INFO1_LIVE=oCH7UytiVXo
Source: global traffic	HTTP traffic detected: GET /s/player/6ee8f9ce/player_ias.vflset/en_US/base.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/embed/?enablejsapi=1&rel=0&autoplay=0&playsinline=1&expflag=embeds_enable_muted_autoplay%3Atrue&fs=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=MmYKqDmYcs4; VISITOR_INFO1_LIVE=oCH7UytiVXo
Source: global traffic	HTTP traffic detected: GET /s/player/6ee8f9ce/player_ias.vflset/en_US/remote.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/embed/?enablejsapi=1&rel=0&autoplay=0&playsinline=1&expflag=embeds_enable_muted_autoplay%3Atrue&fs=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=MmYKqDmYcs4; VISITOR_INFO1_LIVE=oCH7UytiVXo
Source: global traffic	HTTP traffic detected: GET /pagead/id HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.youtube.comX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /instream/ad_status.js HTTP/1.1Host: static.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/id?slf_rd=1 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.youtube.comX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /meversion?partner=MSDLC&market=en-us&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r.gif?MonitorID=asgw&rid=805a442ee6889251004cff56e5e99d89&w3c=true&prot=https:&v=20190506&DATA=[{%22RequestID%22:%22afdxtest.z01.azurefd.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:638,%22T%22:1},{%22RequestID%22:%22afdxtest.z01.azurefd.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:152,%22T%22:1},{%22RequestID%22:%22fp.msedge.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:-1,%22T%22:1},{%22RequestID%22:%22ed3269487071b07864828ad1169325d0%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:-1,%22T%22:128}] HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: fp.msedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.shared.analytics.mectrl-3.gbl.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.23347.2/en-US/meBoot.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /www32/ptc/05d32363-d534-4d93-9b65-cde674775e71.js HTTP/1.1Host: cdnssl.clicktale.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.23347.2/en-US/meCore.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ptc/05d32363-d534-4d93-9b65-cde674775e71.js HTTP/1.1Host: cdnssl.clicktale.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /A1133099-331c-4cdf-89b0-06dc20e168021.js HTTP/1.1Host: d.impactradius-event.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16.000/content/js/MeControl_MhktgtiMAnSkSgiYU2_TkQ2.js HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=EA76ADE95776D2EC7F000101%40AdobeOrg&d_nsid=0&ts=1706637121162 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: /Origin: https://www.microsoft.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pcc/05d32363-d534-4d93-9b65-cde674775e71.js?DeploymentConfigName=Release_20230511&Version=2 HTTP/1.1Host: cdnssl.clicktale.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /www/bridge-WR110.js HTTP/1.1Host: cdnssl.clicktale.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr?id=1770559986549030&ev=PixelInitialized&dpo=LDU&dpoco=0&dpost=0&ts=1706637121398 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr?id=undefined&ev=PixelInitialized&dpo=LDU&dpoco=0&dpost=0&ts=1706637121398 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr?id=1770559986549030&ev=PageView&dpo=LDU&dpoco=0&dpost=0&ts=1706637121398 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr?id=undefined&ev=PageView&dpo=LDU&dpoco=0&dpost=0&ts=1706637121398 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /me/mecache?partner=msdlc&wreply=https%3A%2F%2Fwww.microsoft.com HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/923371515/?guid=ON&script=0&url=www.microsoft.com%2Fen-us%2Fdownload%2Fdetails.aspx&data=ecomm_pagetype%3Dother HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ats/ats?cmd=RT&AdvertiserID=4249&platform=TUMRI&ActionID=20114&ActionName=Microsoft_Store_RT_Pixel&ut1=&ut2=en&ut3=us&cachebuster=223825862 HTTP/1.1Host: ats.everesttech.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dest5.html?d_nsid=0 HTTP/1.1Host: mscom.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=35050774984483340004567475019318048768
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=EA76ADE95776D2EC7F000101%40AdobeOrg&mid=34589668024764103034595590011699581199&ts=1706637121821 HTTP/1.1Host: msftenterprise.sc.omtrdc.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: /Origin: https://www.microsoft.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pageview?ex=&pvt=n&la=en-US&uc=0&url=https%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fdownload%2Fdetails.aspx%3Fid%3D35&dr=https%3A%2F%2Fwww.google.com%2F&dw=1017&dh=2538&ww=1034&wh=870&sw=1280&sh=1024&uu=96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4&sn=1&hd=1706637121&v=13.83.0&pid=2422&pn=1&r=171300 HTTP/1.1Host: c.clicktale.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pageEvent?value=H4sIAAAAAAAAAwsIcVZwD%2FV0UahRMDBNMTYyNjPWTTE1NtE1SbE01rVMMjPVTU5JNTM3MTc3TTU3BAC5OujJLwAAAA%3D%3D&ct=2&isETR=false&isCustomHashId=false&v=13.83.0&pid=2422&pn=1&sn=1&uu=96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4&r=393565 HTTP/1.1Host: c.clicktale.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pageEvent?value=H4sIAAAAAAAAA3POz0vLTLdSCErNSU0sTo03MjAyNjA1NAQA5ZGESRgAAAA%3D&ct=2&isETR=false&isCustomHashId=false&v=13.83.0&pid=2422&pn=1&sn=1&uu=96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4&r=024492 HTTP/1.1Host: c.clicktale.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dvar?v=13.83.0&pid=2422&pn=1&sn=1&uu=96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4&dv=H4sIAAAAAAAAA6tWCghxjncvzUxRslIyME0xNjI2M9ZNMTU20TVJsTTWtUwyM9VNTkk1MzcxNzdNNTdUqgUAotlAIzMAAAA%3D&ct=2&r=246796 HTTP/1.1Host: c.clicktale.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/923371515/?guid=ON&script=0&url=www.microsoft.com%2Fen-us%2Fdownload%2Fdetails.aspx&data=ecomm_pagetype%3Dother&is_vtc=1&cid=CAQSGwAvHhf_Vd2Mkqic_BIKrDlFV8Om8wwf6G-ZhQ&random=3815492425 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-01-30-17; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
Source: global traffic	HTTP traffic detected: GET /pageEvent?value=H4sIAAAAAAAAA8vPy8lPTFGoUXDOz0vLTC8tSlWozC8tUgguLUpLTE4FSpgoFJekFhQDAPRW154pAAAA&ct=2&isETR=false&isCustomHashId=false&v=13.83.0&pid=2422&pn=1&sn=1&uu=96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4&r=113321 HTTP/1.1Host: c.clicktale.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=411&dpuuid=Zbk3QwAAAGzR0xva HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553
Source: global traffic	HTTP traffic detected: GET /365868.gif?partner_uid=35050774984483340004567475019318048768 HTTP/1.1Host: idsync.rlcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tag/uet/4000034?insights=1 HTTP/1.1Host: www.clarity.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuid?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D358%26dpuuid%3D%24UID HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/?return=&cid=7593&tpsync=no&auth= HTTP/1.1Host: www.ojrq.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MzUwNTA3NzQ5ODQ0ODMzNDAwMDQ1Njc0NzUwMTkzMTgwNDg3Njg= HTTP/1.1Host: cm.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /1000.gif?memo=CKyqFhIxCi0IARCYEhomMzUwNTA3NzQ5ODQ0ODMzNDAwMDQ1Njc0NzUwMTkzMTgwNDg3NjgQABoNCMPu5K0GEgUI6AcQAEIASgA HTTP/1.1Host: idsync.rlcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: rlas3=eKwtq0lZ/flxovLVeYToWVTIh2jBHaOMvP3BGDUDkRw=; pxrc=CAA=
Source: global traffic	HTTP traffic detected: GET /s/0.7.20/clarity.js HTTP/1.1Host: www.clarity.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XANDR_PANID=0U84jn1ew9ikPVt7_w3fV-ISfsCe9Ihc9la-kJur8ncyUhWxqD3Sx06SfQjg93aWzvvzpuruaMR21JdAcdeLWKJ8KsCpVkZhV1B8KCKoSgQ.; receive-cookie-deprecation=1; uuid2=535537844608889607
Source: global traffic	HTTP traffic detected: GET /dvar?v=13.83.0&pid=2422&pn=1&sn=1&uu=96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4&dv=H4sIAAAAAAAAA1WQ0UvDMBDG%2F5WjL9swZe1cRX07y6YWlNKu%2BDDGSNtDAmkiSYoM9X83qYPhS758Iff77u4rwocj7o7pTXaXQgy4RCDFWynUO%2FCuGw13BH0QoRWQdWL4u442fJk9St1y6SvfqPVnaXQ%2FA%2Bx1S4CKy5MTnQVDH9o4sKNwFN1HnE9xLo3YOX61zta3vnyPDYMcGRQlg6Y%2B%2BKfmaQvf8OxosCAU5NyDKhqE6slAzSVd3OY1bmoWJCC21STeBWiBcVF6UJYsswTmlR5VD6uF72bK3l16Sa%2BzJAmrkJ%2F8ZGM%2FaliKl33ttKHzkHAF%2F%2BwcNy%2BLg8chxhMhj35%2BAYjXMCZdAQAA&ct=2&r=474970 HTTP/1.1Host: c.clicktale.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=771&dpuuid=CAESENggFu3tzOCGc387ChgMM6w&google_cver=1?gdpr=0&gdpr_consent= HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887; dpm=35050774984483340004567475019318048768
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=477&dpuuid=a32adb534ed7b015ab5f979962884ce67525e2a0283d43d778da44e182749c01b0da87c991749652 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887; dpm=35050774984483340004567475019318048768
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=358&dpuuid=535537844608889607 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887; dpm=35050774984483340004567475019318048768
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NvNedGrehGN2W1y&MD=3Z8G6gZk HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=782&dpuuid=Zbk3QwAAAGzR0xva HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884
Source: global traffic	HTTP traffic detected: GET /i/adsct?p_user_id=35050774984483340004567475019318048768&p_id=38594 HTTP/1.1Host: analytics.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track/cmf/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&domain=www.microsoft.com&ttd_tpi=1 HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pixel/p-vj4AYjBqd6VJ2.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP/1.1Host: cms.quantserve.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=1957&dpuuid=235DAA179B1F6089140CBE019A496167 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=3047&dpuuid=5873EF962A9843&gdpr=0&gdpr_consent= HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890\|3047-1-1706637129886
Source: global traffic	HTTP traffic detected: GET /i.match?p=b13&u=35050774984483340004567475019318048768&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$ HTTP/1.1Host: a.tribalfusion.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /z/i.match?p=b13&u=35050774984483340004567475019318048768&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$ HTTP/1.1Host: s.tribalfusion.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ANON_ID=atnoeUriItxP3PTTfUSuwbKqJ63rewTSSb34AXlw
Source: global traffic	HTTP traffic detected: GET /cms?partner_id=ADOBE&_hosted_id=35050774984483340004567475019318048768&gdpr=0&gdpr_consent= HTTP/1.1Host: cms.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=22054 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890\|3047-1-1706637129886\|22054-1-1706637130883\|30646-1-1706637131888
Source: global traffic	HTTP traffic detected: GET /ups/58782/cms?partner_id=ADOBE&_hosted_id=35050774984483340004567475019318048768&gdpr=0&gdpr_consent= HTTP/1.1Host: ups.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: A3=d=AQABBE03uWUCEFWu7doihFyFzYzJN-r2wxsFEgEBAQGIumXDZfGAziMA_eMAAA&S=AQAAAuVSLiP59Sh0eVinCS4hPZc
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=30646?dpuuid=y-GUgwg.xE2pFMcbpyXNvyw.wczz.DSnmIwWo-~A HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890\|3047-1-1706637129886\|22054-1-1706637130883\|30646-1-1706637131888\|53196-1-1706637132888
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=57282&dpuuid=0C29F8072DAC5CAE99535F32A7D13BAE HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890\|3047-1-1706637129886\|22054-1-1706637130883\|30646-1-1706637131888\|53196-1-1706637132888\|38117-1-1706637133877\|57282-1-1706637134881
Source: global traffic	HTTP traffic detected: GET /dmp/adobe/user?dd_uuid=35050774984483340004567475019318048768 HTTP/1.1Host: bttrack.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuid?redir=%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D72352%26dpuuid%3D$UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP/1.1Host: dmpsync.3lift.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dv/sync?tid=6 HTTP/1.1Host: ag.innovid.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D72352%26dpuuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: dmpsync.3lift.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: tluid=3226875877078116803796
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=80742&dpuuid=99c5e057-9d5a-425b-9d30-6752d1836cd6 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890\|3047-1-1706637129886\|22054-1-1706637130883\|30646-1-1706637131888\|53196-1-1706637132888\|38117-1-1706637133877\|57282-1-1706637134881\|49276-1-1706637135885\|72352-1-1706637136874\|80742-1-1706637137880
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=72352&dpuuid=3226875877078116803796&gdpr=0&gdpr_consent= HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890\|3047-1-1706637129886\|22054-1-1706637130883\|30646-1-1706637131888\|53196-1-1706637132888\|38117-1-1706637133877\|57282-1-1706637134881\|49276-1-1706637135885\|72352-1-1706637136874\|80742-1-1706637137880\|81309-1-1706637138883
Source: global traffic	HTTP traffic detected: GET /CookieSyncAdobe HTTP/1.1Host: rtb.adentifi.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /map/c=9828/tp=ADBE/gdpr=0/gdpr_consent=/tpid=35050774984483340004567475019318048768?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id} HTTP/1.1Host: sync.crwdcntrl.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /map/ct=y/c=9828/tp=ADBE/gdpr=0/gdpr_consent=/tpid=35050774984483340004567475019318048768?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id} HTTP/1.1Host: sync.crwdcntrl.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _cc_cc=ctst
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=121998&dpuuid=d2e823aefb96712d90244489d20af824 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890\|3047-1-1706637129886\|22054-1-1706637130883\|30646-1-1706637131888\|53196-1-1706637132888\|38117-1-1706637133877\|57282-1-1706637134881\|49276-1-1706637135885\|72352-1-1706637136874\|80742-1-1706637137880\|81309-1-1706637138883\|121998-1-1706637139875\|144228-1-1706637140884
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=782&dpuuid=Zbk3QwAAAGzR0xva HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890\|3047-1-1706637129886\|22054-1-1706637130883\|30646-1-1706637131888\|53196-1-1706637132888\|38117-1-1706637133877\|57282-1-1706637134881\|49276-1-1706637135885\|72352-1-1706637136874\|80742-1-1706637137880\|81309-1-1706637138883\|121998-1-1706637139875\|144228-1-1706637140884
Source: global traffic	HTTP traffic detected: GET /pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WmJrM1F3QUFBR3pSMHh2YQ== HTTP/1.1Host: cm.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUmjUykVjVbva7WYqm-tzFHCJeOSmPnq-o0aH-0LuwZxXO2DvAErgDo1GJB_uNc
Source: global traffic	HTTP traffic detected: GET /rum?cm_dsp_id=88&external_user_id=Zbk3QwAAAGzR0xva HTTP/1.1Host: dsum-sec.casalemedia.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rum?cm_dsp_id=88&external_user_id=Zbk3QwAAAGzR0xva&C=1 HTTP/1.1Host: dsum-sec.casalemedia.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CMID=Zbk3WqdpVPwfFuWW3lkEqAAA; CMPS=084; CMPRO=084
Source: global traffic	HTTP traffic detected: GET /setuid?entity=158&code=Zbk3QwAAAGzR0xva HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XANDR_PANID=0U84jn1ew9ikPVt7_w3fV-ISfsCe9Ihc9la-kJur8ncyUhWxqD3Sx06SfQjg93aWzvvzpuruaMR21JdAcdeLWKJ8KsCpVkZhV1B8KCKoSgQ.; receive-cookie-deprecation=1; uuid2=535537844608889607
Source: global traffic	HTTP traffic detected: GET /w/1.0/sd?id=537148856&val=Zbk3QwAAAGzR0xva HTTP/1.1Host: us-u.openx.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Zbk3QwAAAGzR0xva HTTP/1.1Host: image2.pubmatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fr/b.php?p=1531105787105294&e=Zbk3QwAAAGzR0xva&t=2592000&o=0 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sg/adobe/1/cm?gdpr=0&gdpr_consent= HTTP/1.1Host: trc.taboola.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync?nid=adobe HTTP/1.1Host: sync.srv.stackadapt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=390122&dpuuid=4QGHe0AkU19ZmYu7n2WfX1G1OUo HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890\|3047-1-1706637129886\|22054-1-1706637130883\|30646-1-1706637131888\|53196-1-1706637132888\|38117-1-1706637133877\|57282-1-1706637134881\|49276-1-1706637135885\|72352-1-1706637136874\|80742-1-1706637137880\|81309-1-1706637138883\|121998-1-1706637139875\|144228-1-1706637140884\|144229-1-1706637141887\|144230-1-1706637142878\|144231-1-1706637143886\|144232-1-1706637144888\|144233-1-1706637145886\|144234-1-1706637146889\|144235-1-1706637147875\|144236-1-1706637148881\|144237-1-1706637149884\|147592-1-1706637150876\|390122-1-1706637151882

Source: chromecache_474.11.dr	String found in binary or memory: "sameAs":["https://www.facebook.com/Microsoft","https://twitter.com/microsoft"] equals www.facebook.com (Facebook)
Source: chromecache_474.11.dr	String found in binary or memory: "sameAs":["https://www.facebook.com/Microsoft","https://twitter.com/microsoft"] equals www.twitter.com (Twitter)
Source: chromecache_474.11.dr	String found in binary or memory: <a class="d-inline-block " href="https://www.facebook.com/Microsoft" target="_blank" aria-label="Follow Microsoft on Facebook opens in new tab" data-bi-ecn="Facebook" data-bi-bhvr="126" data-bi-cn="Facebook" data-bi-socchn="Facebook" data-bi-ct="Social Button" data-bi-pa="body" data-bi-compnm="Social Follow - horizontal"> equals www.facebook.com (Facebook)
Source: chromecache_401.11.dr	String found in binary or memory: (g.Bp(c,"redirector.googlevideo.com"),d=c.toString()):c.j.match("rr?[1-9].*\\.c\\.youtube\\.com$")?(g.Bp(c,"www.youtube.com"),d=c.toString()):(c=nAa(d),qK(c)&&(d=c));c=new g.gQ(d);c.set("cmo=pf","1");e&&c.set("cmo=td","a1.googlevideo.com");return c}; equals www.youtube.com (Youtube)
Source: chromecache_406.11.dr	String found in binary or memory: ...</span></div></div><div class="kb0PBd cvP2Ce" data-sncf="2" data-snf="mCCBcf"><div class="fG8Fp uo4vr"></div></div></div></div></div></div><div class="ULSxyf"><div class="MjjYud"><div><div jsname="pKB8Bc" class="g PmEWq" data-hveid="CF4QAA"><div><div><div jscontroller="rTuANe" data-ar="1.7778" data-cid="478144fd" data-eiv="1" data-esrvl="1" data-preloadapi="1" data-surl="https://www.youtube.com/watch?v=m5Xz14RNOEE" data-tpvid="" data-vid="m5Xz14RNOEE" data-vurl="" jsaction="h5M12e;rcuQ6b:npT2md;"><div><div class="xe8e1b"><div class="nhaZ2c"><div><span jscontroller="msmzHf" jsaction="rcuQ6b:npT2md;PYDNKe:bLV6Bd;mLt3mc"><a jsname="UWckNb" href="https://www.youtube.com/watch?v=m5Xz14RNOEE" data-ved="2ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQtwJ6BAheEAI" ping="/url?sa=t&source=web&rct=j&opi=89978449&url=https://www.youtube.com/watch%3Fv%3Dm5Xz14RNOEE&ved=2ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQtwJ6BAheEAI"><br><h3 class="LC20lb MBeuO DKV0Md">The Following Components Are Required To Run ... - YouTube</h3><div class="notranslate TbwUpd NJjxre iUh30 ojE3Fb"><span class="H9lube"><div class="eqA2re NjwKYd Vwoesf" aria-hidden="true"><img class="XNo5Ab" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAdElEQVR4AWP4//8/RZh6BgCZAkDsAMUNWDFCXgDFACCVAGKSiBPABgCRAYgiExuADAigwIAEkAENOBU8ePD/v4MDPgMa8BoABxs2/P+voECBAQcOkGwAwgsBAXi9gD8QBQQIBiLF0UhRQsKXlAuITcoDnxsBPl4957WudCUAAAAASUVORK5CYII=" style="height:18px;width:18px" alt=""></div></span><div class="GTRloc"><span class="VuuXrf">YouTube  equals www.youtube.com (Youtube)
Source: chromecache_401.11.dr	String found in binary or memory: a))):this.Zd(g.tW(a.errorMessage)):this.Zd(vW(this,"HTML5_NO_AVAILABLE_FORMATS_FALLBACK_WITH_LINK_SHORT","//www.youtube.com/supported_browsers")):(a=d.hostLanguage,c="//support.google.com/youtube/?p=player_error1",a&&(c=g.$m(c,{hl:a})),this.Zd(vW(this,"GENERIC_WITH_LINK_AND_CPN",c,!0)),d.Nc&&!d.D&&sXa(this,function(e){if(g.fV(e,b.api,!DS(b.api.U()))){e={as3:!1,html5:!0,player:!0,cpn:b.api.getVideoData().clientPlaybackNonce};var f=b.api;f.xc("onFeedbackArticleRequest",{articleId:3037019,helpContext:"player_error", equals www.youtube.com (Youtube)
Source: chromecache_401.11.dr	String found in binary or memory: a.hl);this.region=b?b.contentRegion\|\|"US":QC("US",a.cr);this.hostLanguage=b?b.hostLanguage\|\|"en":QC("en",a.host_language);this.Ho=!this.kd&&Math.random()<g.OJ(this.experiments,"web_player_api_logging_fraction");this.Za=!this.kd;this.enabledEngageTypes=new Set;this.deviceIsAudioOnly=!(null==b\|\|!b.deviceIsAudioOnly);this.Rd=PC(this.Rd,a.ismb);this.Oo?(r=a.vss_host\|\|"s.youtube.com","s.youtube.com"===r&&(r=nQa(this.Ga)\|\|"www.youtube.com")):r="video.google.com";this.Qm=r;oQa(this,a,!0);this.Na=new ZR; equals www.youtube.com (Youtube)
Source: chromecache_401.11.dr	String found in binary or memory: a.severity,e,$K(a.details),f)}else this.qa.oa("nonfatalerror",a),d=/^pp/.test(this.videoData.clientPlaybackNonce),this.oe(a.errorCode,a.details),d&&"manifest.net.connect"===a.errorCode&&(a="https://www.youtube.com/generate_204?cpn="+this.videoData.clientPlaybackNonce+"&t="+(0,g.SD)(),NU(a,"manifest",function(h){b.G=!0;b.va("pathprobe",h)},function(h){b.oe(h.errorCode,h.details)}))}}; equals www.youtube.com (Youtube)
Source: chromecache_455.11.dr	String found in binary or memory: function Pr(a,b,c){this.o=this.g=this.h=null;this.i=0;this.G=!1;this.u=[];this.l=null;this.O={};if(!a)throw Error("YouTube player element ID required.");this.id=Qa(this);this.K=c;c=document;if(a="string"===typeof a?c.getElementById(a):a)if(c="iframe"===a.tagName.toLowerCase(),b.host\|\|(b.host=c?ac(a.src):"https://www.youtube.com"),this.h=new Jr(b),c\|\|(b=Qr(this,a),this.o=a,(c=a.parentNode)&&c.replaceChild(b,a),a=b),this.g=a,this.g.id\|\|(this.g.id="widget"+Qa(this.g)),Dr[this.g.id]=this,window.postMessage){this.l= equals www.youtube.com (Youtube)
Source: chromecache_401.11.dr	String found in binary or memory: g.BS=function(a){a=nQa(a.Ga);return"www.youtube-nocookie.com"===a?"www.youtube.com":a}; equals www.youtube.com (Youtube)
Source: chromecache_401.11.dr	String found in binary or memory: g.MS=function(a){var b=g.BS(a);zQa.includes(b)&&(b="www.youtube.com");return a.protocol+"://"+b}; equals www.youtube.com (Youtube)
Source: chromecache_401.11.dr	String found in binary or memory: g.Ua("Goog_AdSense_Lidar_getUrlSignalsList",jhb);var Xza=na(["//tpc.googlesyndication.com/sodar/",""]);var wLa={C3a:0,z3a:1,w3a:2,x3a:3,y3a:4,B3a:5,A3a:6};var zoa=(new Date).getTime();var Mka="://secure-...imrworldwide.com/ ://cdn.imrworldwide.com/ ://aksecure.imrworldwide.com/ ://[^.]*.moatads.com ://youtube[0-9]+.moatpixel.com ://pm.adsafeprotected.com/youtube ://pm.test-adsafeprotected.com/youtube ://e[0-9]+.yt.srs.doubleverify.com www.google.com/pagead/xsul www.youtube.com/pagead/slav".split(" "),Nka=/\bocr\b/;var Pka=/(?:\[\|%5B)([a-zA-Z0-9_]+)(?:\]\|%5D)/g;g.w(Ou,g.Md);Ou.prototype.dispose=function(){window.removeEventListener("offline",this.C);window.removeEventListener("online",this.C);this.Gn.Oj(this.G);delete Ou.instance}; equals www.youtube.com (Youtube)
Source: chromecache_401.11.dr	String found in binary or memory: g.k.getVideoUrl=function(a,b,c,d,e,f){b={list:b};c&&(e?b.time_continue=c:b.t=c);c=g.BS(this);e="www.youtube.com"===c;!f&&d&&e?f="https://youtu.be/"+a:g.wS(this)?(f="https://"+c+"/fire",b.v=a):(f&&e?(f=this.protocol+"://"+c+"/shorts/"+a,d&&(b.feature="share")):(f=this.protocol+"://"+c+"/watch",b.v=a),gE&&(a=koa())&&(b.ebc=a));return g.$m(f,b)}; equals www.youtube.com (Youtube)
Source: chromecache_401.11.dr	String found in binary or memory: iPa=function(a,b){if(!a.j["0"]){var c=new nL("0","fakesb",{video:new kL(0,0,0,void 0,void 0,"auto")});a.j["0"]=b?new lR(new g.gQ("http://www.youtube.com/videoplayback"),c,"fake"):new wR(new g.gQ("http://www.youtube.com/videoplayback"),c,new VQ(0,0),new VQ(0,0))}}; equals www.youtube.com (Youtube)
Source: chromecache_401.11.dr	String found in binary or memory: this.X.Ba&&(a.authuser=this.X.Ba);this.X.pageId&&(a.pageid=this.X.pageId);isNaN(this.cryptoPeriodIndex)\|\|(a.cpi=this.cryptoPeriodIndex.toString());var e=(e=/_(TV\|STB\|GAME\|OTT\|ATV\|BDP)_/.exec(g.oc()))?e[1]:"";"ATV"===e&&(a.cdt=e);this.G=a;this.G.session_id=d;this.ma=!0;"widevine"===this.B.flavor&&(this.G.hdr="1");"playready"===this.B.flavor&&(b=Number(WR(b.experiments,"playready_first_play_expiration")),!isNaN(b)&&0<=b&&(this.G.mfpe=""+b),this.ma=!1);b="";g.PR(this.B)?OR(this.B)?(d=c.B)&&(b="https://www.youtube.com/api/drm/fps?ek="+ equals www.youtube.com (Youtube)
Source: chromecache_401.11.dr	String found in binary or memory: this.protocol+"://www.youtube.com/";h=b?b.eventLabel:a.el;d="detailpage";"adunit"===h?d=this.D?"embedded":"detailpage":"embedded"===h\|\|this.K?d=OC(d,h,iQa):h&&(d="embedded");this.Ka=d;ata();h=null;d=b?b.playerStyle:a.ps;f=g.Hb(jQa,d);!d\|\|f&&!this.K\|\|(h=d);this.playerStyle=h;this.ma=(this.N=g.Hb(jQa,this.playerStyle))&&"play"!==this.playerStyle&&"jamboard"!==this.playerStyle;this.Oo=!this.ma;this.Ua=NC(!1,a.disableplaybackui);this.disablePaidContentOverlay=NC(!1,null==b?void 0:b.disablePaidContentOverlay); equals www.youtube.com (Youtube)
Source: chromecache_401.11.dr	String found in binary or memory: var X3={};var ldb=/[&\?]action_proxy=1/,kdb=/[&\?]token=([\w-])/,mdb=/[&\?]video_id=([\w-])/,ndb=/[&\?]index=([\d-])/,odb=/[&\?]m_pos_ms=([\d-])/,rdb=/[&\?]vvt=([\w-]*)/,edb="ca_type dt el flash u_tz u_his u_h u_w u_ah u_aw u_cd u_nplug u_nmime frm u_java bc bih biw brdim vis wgl".split(" "),pdb="www.youtube-nocookie.com youtube-nocookie.com www.youtube-nocookie.com:443 youtube.googleapis.com www.youtubeedu.com www.youtubeeducation.com video.google.com redirector.gvt1.com".split(" "),hdb={android:"ANDROID", equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1696586925X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: AC9A64CD89F84E63943FA8FE73357759X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A41090080B6X-MSEdge-ExternalExp: asynccls1cf,bfbwsbcm0921tf,d-thshld42,fliptrat6,msaslm5t,qfswpos_t1,wsbref-t,wsbuacfX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 951Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=4590362BB5CF472B95BBEDB3112D4B7B; _SS=SID=1DC02F3E55E9691B00B73C9C54F0686B&CPID=1696586926722&AC=1&CPH=4790f32e; _EDGE_S=SID=1DC02F3E55E9691B00B73C9C54F0686B; SRCHUID=V=2&GUID=1F8137B2323E40B3851AF1909FBE6E0A&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1696586886&IPMH=f2fb8120&IPMID=1696586925774&LUT=1696586525257; CortanaAppUID=99325A50A46066F842A6B684698F464A; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B

Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815367597.0000000000171000.00000020.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1EWISV70/NP01_InstallerBing
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewcscz70/SettingsPrivacy&http://g.msn.com/1ewcscz70/InstallerMU%Optionale
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewcscz70/SettingsTermUse
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewdede70/SettingsPrivacy&http://g.msn.com/1ewdede70/InstallerMU#DirectX
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewdede70/SettingsTermUse
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewenus70/SettingsPrivacy&http://g.msn.com/1ewenus70/InstallerMUPA
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewenus70/SettingsTermUse
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1eweses70/SettingsPrivacy&http://g.msn.com/1eweses70/InstallerMU$DirectX
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1eweses70/SettingsTermUse
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewfrfr70/SettingsPrivacy&http://g.msn.com/1ewfrfr70/InstallerMU&Componenti
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewfrfr70/SettingsTermUse
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewitit70/SettingsPrivacy&http://g.msn.com/1ewitit70/InstallerMU
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewitit70/SettingsTermUse
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewjajp70/SettingsPrivacy&http://g.msn.com/1ewjajp70/InstallerMU
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewjajp70/SettingsTermUse
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewkokr70/SettingsPrivacy&http://g.msn.com/1ewkokr70/InstallerMU(Optionele
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewkokr70/SettingsTermUse
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewnlnl70/SettingsPrivacy&http://g.msn.com/1ewnlnl70/InstallerMU0Opcjonalne
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewnlnl70/SettingsTermUse
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewplpl70/SettingsPrivacy&http://g.msn.com/1ewplpl70/InstallerMU5Componentes
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewplpl70/SettingsTermUse
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewptbr70/SettingsPrivacy&http://g.msn.com/1ewptbr70/InstallerMU-
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewptbr70/SettingsTermUse
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewruru70/SettingsPrivacy&http://g.msn.com/1ewruru70/InstallerMU&Valfria
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewruru70/SettingsTermUse
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewsvse70/SettingsPrivacy&http://g.msn.com/1ewsvse70/InstallerMU
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewsvse70/SettingsTermUse
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewzhcn70/SettingsPrivacy&http://g.msn.com/1ewzhcn70/InstallerMU8Componentes
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewzhcn70/SettingsTermUse
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewzhtw70/SettingsPrivacy&http://g.msn.com/1ewzhtw70/InstallerMU#Voliteln
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://g.msn.com/1ewzhtw70/SettingsTermUse
Source: chromecache_474.11.dr	String found in binary or memory: http://schema.org/Organization
Source: chromecache_406.11.dr	String found in binary or memory: http://schema.org/SearchResultsPage
Source: chromecache_401.11.dr, chromecache_455.11.dr, chromecache_395.11.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: dxwsetup.exe.17.dr, dsetup32.dll.17.dr	String found in binary or memory: http://www.BetaPlace.com
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://www.BetaPlace.com.?
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://www.BetaPlace.comEContinuare
Source: chromecache_507.11.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: dsetup32.dll.17.dr	String found in binary or memory: http://www.betaplace.com
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000D22000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000003.1817216028.0000000001474000.00000004.00000020.00020000.00000000.sdmp, dsetup32.dll.17.dr	String found in binary or memory: http://www.betaplace.com.
Source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	String found in binary or memory: http://www.betaplace.com.DInstalacn
Source: chromecache_404.11.dr	String found in binary or memory: http://www.broofa.com
Source: chromecache_401.11.dr	String found in binary or memory: http://www.youtube.com/videoplayback
Source: chromecache_401.11.dr	String found in binary or memory: http://youtube.com/drm/2012/10/10
Source: chromecache_401.11.dr	String found in binary or memory: http://youtube.com/streaming/metadata/segment/102015
Source: chromecache_401.11.dr	String found in binary or memory: http://youtube.com/streaming/otf/durations/112015
Source: chromecache_401.11.dr	String found in binary or memory: http://youtube.com/yt/2012/10/10
Source: chromecache_474.11.dr	String found in binary or memory: https://accdn.lpsnmedia.net
Source: chromecache_401.11.dr	String found in binary or memory: https://admin.youtube.com
Source: chromecache_474.11.dr	String found in binary or memory: https://aka.ms/MicrosoftEdgeDownload"
Source: chromecache_474.11.dr	String found in binary or memory: https://aka.ms/directx_x64_appx
Source: chromecache_474.11.dr	String found in binary or memory: https://aka.ms/directx_x86_appx
Source: chromecache_474.11.dr	String found in binary or memory: https://aka.ms/dxsetup
Source: chromecache_474.11.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_474.11.dr	String found in binary or memory: https://analytics.tiktok.com
Source: chromecache_404.11.dr	String found in binary or memory: https://apis.google.com
Source: chromecache_458.11.dr	String found in binary or memory: https://breeze.aimon.applicationinsights.io
Source: chromecache_474.11.dr	String found in binary or memory: https://cdnssl.clicktale.net
Source: chromecache_474.11.dr	String found in binary or memory: https://cdnssl.clicktale.net/www32/ptc/05d32363-d534-4d93-9b65-cde674775e71.js
Source: chromecache_474.11.dr	String found in binary or memory: https://d.impactradius-event.com
Source: chromecache_458.11.dr	String found in binary or memory: https://dc-int.services.visualstudio.com
Source: chromecache_458.11.dr	String found in binary or memory: https://dc.services.visualstudio.com
Source: dxwsetup.exe, 00000012.00000003.1920062429.0000000001503000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://devblogs.(
Source: chromecache_455.11.dr	String found in binary or memory: https://developers.google.com/youtube/iframe_api_reference#Events
Source: chromecache_406.11.dr	String found in binary or memory: https://directx-end-user-runtime-web-installer-june-2010.en.lo4d.com
Source: chromecache_406.11.dr	String found in binary or memory: https://directx-end-user-runtime-web-installer-june-2010.en.lo4d.com/windows
Source: chromecache_406.11.dr	String found in binary or memory: https://directx-end-user-runtime-web-installer-june-2010.en.lo4d.com/windows&ved=2ahUKEwjPhdrQ1o
Source: chromecache_401.11.dr	String found in binary or memory: https://docs.google.com/get_video_info
Source: chromecache_404.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_404.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_404.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_404.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chromecache_401.11.dr, chromecache_455.11.dr, chromecache_395.11.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: chromecache_444.11.dr	String found in binary or memory: https://github.com/microsoft/clarity
Source: chromecache_401.11.dr	String found in binary or memory: https://i.ytimg.com/vi/
Source: chromecache_474.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net
Source: chromecache_474.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: chromecache_474.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4xdax"
Source: chromecache_401.11.dr	String found in binary or memory: https://jnn-pa.googleapis.com
Source: chromecache_474.11.dr	String found in binary or memory: https://js.monitor.azure.com
Source: chromecache_511.11.dr	String found in binary or memory: https://lens.google.com
Source: chromecache_406.11.dr	String found in binary or memory: https://linustechtips.com
Source: chromecache_406.11.dr	String found in binary or memory: https://linustechtips.com/topic/1526292-the-following-components-are-required-to-run-this-program-di
Source: dxwsetup.exe, 00000012.00000003.2507720971.00000000014E3000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000003.1907183316.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: chromecache_474.11.dr	String found in binary or memory: https://login.live.com/me.srf?wa=wsignin1.0
Source: chromecache_474.11.dr	String found in binary or memory: https://lpcdn.lpsnmedia.net
Source: chromecache_474.11.dr	String found in binary or memory: https://lptag.liveperson.net
Source: chromecache_474.11.dr	String found in binary or memory: https://mem.gfx.ms
Source: chromecache_474.11.dr	String found in binary or memory: https://onedrive.live.com/about/en-us/
Source: chromecache_474.11.dr	String found in binary or memory: https://outlook.live.com/owa/
Source: chromecache_511.11.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_474.11.dr	String found in binary or memory: https://publisher.liveperson.net
Source: chromecache_401.11.dr	String found in binary or memory: https://redux.js.org/api/store#subscribelistener
Source: chromecache_401.11.dr	String found in binary or memory: https://redux.js.org/tutorials/fundamentals/part-4-store#creating-a-store-with-enhancers
Source: chromecache_401.11.dr	String found in binary or memory: https://redux.js.org/tutorials/fundamentals/part-4-store#middleware
Source: chromecache_401.11.dr	String found in binary or memory: https://redux.js.org/tutorials/fundamentals/part-6-async-logic#using-the-redux-thunk-middleware
Source: chromecache_474.11.dr	String found in binary or memory: https://schema.org
Source: chromecache_406.11.dr	String found in binary or memory: https://support.activision.com
Source: chromecache_406.11.dr	String found in binary or memory: https://support.activision.com/articles/directx-errors#:~:text
Source: chromecache_406.11.dr	String found in binary or memory: https://support.activision.com/articles/directx-errors%23:~:text%3DAnswer%253A%2520If%2520you%2520re
Source: chromecache_511.11.dr	String found in binary or memory: https://support.google.com/websearch/answer/106230
Source: chromecache_401.11.dr	String found in binary or memory: https://support.google.com/youtube/?p=missing_quality
Source: chromecache_401.11.dr	String found in binary or memory: https://support.google.com/youtube/?p=noaudio
Source: chromecache_401.11.dr	String found in binary or memory: https://support.google.com/youtube/?p=report_playback
Source: chromecache_401.11.dr	String found in binary or memory: https://support.google.com/youtube/answer/6276924
Source: chromecache_474.11.dr	String found in binary or memory: https://twitter.com/microsoft
Source: chromecache_511.11.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_401.11.dr	String found in binary or memory: https://viacon.corp.google.com
Source: chromecache_474.11.dr	String found in binary or memory: https://www.clarity.ms
Source: chromecache_406.11.dr	String found in binary or memory: https://www.google.com
Source: chromecache_511.11.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: chromecache_401.11.dr	String found in binary or memory: https://www.googleapis.com/certificateprovisioning/v1/devicecertificates/create?key=AIzaSyB-5OLKTx2i
Source: chromecache_404.11.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_404.11.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_404.11.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chromecache_404.11.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chromecache_404.11.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/search_black_24dp.png
Source: chromecache_404.11.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chromecache_401.11.dr	String found in binary or memory: https://www.gstatic.com/ytlr/img/sign_in_avatar_default.png?rn=
Source: chromecache_406.11.dr	String found in binary or memory: https://www.guru3d.com
Source: chromecache_406.11.dr	String found in binary or memory: https://www.guru3d.com/download/directx-end-user-runtimes-(june-2010)/
Source: chromecache_406.11.dr	String found in binary or memory: https://www.guru3d.com/download/directx-end-user-runtimes-(june-2010)/&ved=2ahUKEwjPhdrQ1oWEAxXb
Source: chromecache_406.11.dr	String found in binary or memory: https://www.lifewire.com
Source: chromecache_406.11.dr	String found in binary or memory: https://www.lifewire.com/how-to-download-install-directx-2624489
Source: chromecache_406.11.dr	String found in binary or memory: https://www.lifewire.com/how-to-download-install-directx-2624489#toc-do-i-need-to-install-directx-on
Source: chromecache_406.11.dr	String found in binary or memory: https://www.lifewire.com/how-to-download-install-directx-2624489%23toc-do-i-need-to-install-directx-
Source: chromecache_474.11.dr	String found in binary or memory: https://www.onenote.com/
Source: chromecache_406.11.dr	String found in binary or memory: https://www.partitionwizard.com
Source: chromecache_406.11.dr	String found in binary or memory: https://www.partitionwizard.com/partitionmanager/directx-error-modern-warfare.html#:~:text
Source: chromecache_406.11.dr	String found in binary or memory: https://www.partitionwizard.com/partitionmanager/directx-error-modern-warfare.html%23:~:text%3DThe%2
Source: chromecache_406.11.dr	String found in binary or memory: https://www.partitionwizard.com/partitionmanager/directx-runtime.html
Source: chromecache_406.11.dr	String found in binary or memory: https://www.reddit.com/r/ValorantTechSupport/comments/168w8fg/directx_runtime_error/
Source: chromecache_406.11.dr	String found in binary or memory: https://www.reddit.com/r/ValorantTechSupport/comments/168w8fg/directx_runtime_error/&ved=2ahUKEw
Source: chromecache_474.11.dr	String found in binary or memory: https://www.skype.com/en/
Source: chromecache_406.11.dr	String found in binary or memory: https://www.techpowerup.com
Source: chromecache_406.11.dr	String found in binary or memory: https://www.techpowerup.com/download/directx-redistributable-runtime/
Source: chromecache_406.11.dr	String found in binary or memory: https://www.techpowerup.com/download/directx-redistributable-runtime/&ved=2ahUKEwjPhdrQ1oWEAxXbk
Source: chromecache_474.11.dr	String found in binary or memory: https://www.xbox.com/
Source: chromecache_474.11.dr	String found in binary or memory: https://www.xbox.com/en-us/games/store/pc-game-pass/cfq7ttc0kgq8?icid=CNavAllPCGamePass
Source: chromecache_474.11.dr	String found in binary or memory: https://www.xbox.com/en-us/games/store/xbox-game-pass-ultimate/cfq7ttc0khs0?icid=CNavAllXboxGamePass
Source: chromecache_455.11.dr	String found in binary or memory: https://www.youtube.com
Source: chromecache_401.11.dr	String found in binary or memory: https://www.youtube.com/api/drm/fps?ek=
Source: chromecache_401.11.dr	String found in binary or memory: https://www.youtube.com/generate_204?cpn=
Source: chromecache_406.11.dr	String found in binary or memory: https://www.youtube.com/watch%3Fv%3Dm5Xz14RNOEE&ved=2ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQtwJ6BAheEAI
Source: chromecache_406.11.dr	String found in binary or memory: https://www.youtube.com/watch?v=m5Xz14RNOEE
Source: chromecache_401.11.dr	String found in binary or memory: https://youtu.be/
Source: chromecache_401.11.dr	String found in binary or memory: https://youtube.com/api/drm/fps?ek=uninitialized
Source: chromecache_401.11.dr	String found in binary or memory: https://youtubei.googleapis.com/youtubei/
Source: chromecache_401.11.dr	String found in binary or memory: https://yurt.corp.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.17:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.58:443 -> 192.168.2.17:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.17:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.17:49961 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Jun2010_d3dcsx_43_x86[1].cab entropy: 7.99695515494	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS472A52.tmp\Jun2010_d3dcsx_43_x86.cab entropy: 7.99695519262	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Dec2006_d3dx9_32_x86[1].cab entropy: 7.99909224767	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS469ECB.tmp\Dec2006_d3dx9_32_x86.cab entropy: 7.99909224767	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Dec2006_d3dx9_32_x86.cab entropy: 7.99909224767	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Apr2007_d3dx9_33_x86[1].cab entropy: 7.99928426182	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46A4A7.tmp\Apr2007_d3dx9_33_x86.cab entropy: 7.99928426182	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Apr2007_d3dx9_33_x86.cab entropy: 7.99928426182	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Apr2007_d3dx10_33_x86[1].cab entropy: 7.99896802841	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46AAB2.tmp\Apr2007_d3dx10_33_x86.cab entropy: 7.99896802841	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Apr2007_d3dx10_33_x86.cab entropy: 7.99896802841	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Jun2007_d3dx9_34_x86[1].cab entropy: 7.99906642826	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46AF94.tmp\Jun2007_d3dx9_34_x86.cab entropy: 7.99906642826	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Jun2007_d3dx9_34_x86.cab entropy: 7.99906642826	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Jun2007_d3dx10_34_x86[1].cab entropy: 7.9989902264	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46B513.tmp\Jun2007_d3dx10_34_x86.cab entropy: 7.9989902264	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Jun2007_d3dx10_34_x86.cab entropy: 7.9989902264	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Aug2007_d3dx9_35_x86[1].cab entropy: 7.9991869164	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46B9F5.tmp\Aug2007_d3dx9_35_x86.cab entropy: 7.9991869164	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Aug2007_d3dx9_35_x86.cab entropy: 7.9991869164	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Aug2007_d3dx10_35_x86[1].cab entropy: 7.9986813742	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46BF92.tmp\Aug2007_d3dx10_35_x86.cab entropy: 7.9986813742	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Aug2007_d3dx10_35_x86.cab entropy: 7.9986813742	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Nov2007_d3dx9_36_x86[1].cab entropy: 7.99907865291	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46C4F1.tmp\Nov2007_d3dx9_36_x86.cab entropy: 7.99907865291	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Nov2007_d3dx9_36_x86.cab entropy: 7.99907865291	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Nov2007_d3dx10_36_x86[1].cab entropy: 7.99885807363	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46CA7F.tmp\Nov2007_d3dx10_36_x86.cab entropy: 7.99885807363	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Dec2006_d3dx10_00_x86[1].cab entropy: 7.99660427625	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Nov2007_d3dx10_36_x86.cab entropy: 7.99885807363	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS4665F9.tmp\Dec2006_d3dx10_00_x86.cab entropy: 7.99660427625	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Mar2008_d3dx9_37_x86[1].cab entropy: 7.99972380205	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Dec2006_d3dx10_00_x86.cab entropy: 7.99660427625	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46CFDE.tmp\Mar2008_d3dx9_37_x86.cab entropy: 7.99972380205	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Dec2006_d3dx10_00_x64[1].cab entropy: 7.99694629492	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Mar2008_d3dx9_37_x86.cab entropy: 7.99972380205	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS466A3E.tmp\Dec2006_d3dx10_00_x64.cab entropy: 7.99694629492	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Mar2008_d3dx10_37_x86[1].cab entropy: 7.99894945695	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Dec2006_d3dx10_00_x64.cab entropy: 7.99694629492	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46D57B.tmp\Mar2008_d3dx10_37_x86.cab entropy: 7.99894945695	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Mar2008_d3dx10_37_x86.cab entropy: 7.99894945695	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Jun2008_d3dx9_38_x86[1].cab entropy: 7.99972642235	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46DA6D.tmp\Jun2008_d3dx9_38_x86.cab entropy: 7.99972642235	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Jun2008_d3dx9_38_x86.cab entropy: 7.99972642235	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Jun2008_d3dx10_38_x86[1].cab entropy: 7.99898013077	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46DFFB.tmp\Jun2008_d3dx10_38_x86.cab entropy: 7.99898013077	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Feb2005_d3dx9_24_x86[1].cab entropy: 7.99897272471	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Jun2008_d3dx10_38_x86.cab entropy: 7.99898013077	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46755A.tmp\Feb2005_d3dx9_24_x86.cab entropy: 7.99897272471	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Aug2008_d3dx9_39_x86[1].cab entropy: 7.9996829971	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Feb2005_d3dx9_24_x86.cab entropy: 7.99897272471	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46E4FC.tmp\Aug2008_d3dx9_39_x86.cab entropy: 7.9996829971	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Apr2005_d3dx9_25_x86[1].cab entropy: 7.99907513517	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Aug2008_d3dx9_39_x86.cab entropy: 7.9996829971	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS467A7B.tmp\Apr2005_d3dx9_25_x86.cab entropy: 7.99907513517	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Aug2008_d3dx10_39_x86[1].cab entropy: 7.99888618458	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Apr2005_d3dx9_25_x86.cab entropy: 7.99907513517	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46EA4C.tmp\Aug2008_d3dx10_39_x86.cab entropy: 7.99888618458	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Jun2005_d3dx9_26_x86[1].cab entropy: 7.99904021782	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Aug2008_d3dx10_39_x86.cab entropy: 7.99888618458	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS467FCA.tmp\Jun2005_d3dx9_26_x86.cab entropy: 7.99904021782	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Nov2008_d3dx9_40_x86[1].cab entropy: 7.99964527898	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Jun2005_d3dx9_26_x86.cab entropy: 7.99904021782	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46EF7C.tmp\Nov2008_d3dx9_40_x86.cab entropy: 7.99964527898	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Aug2005_d3dx9_27_x86[1].cab entropy: 7.99913898215	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Nov2008_d3dx9_40_x86.cab entropy: 7.99964527898	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS4684FA.tmp\Aug2005_d3dx9_27_x86.cab entropy: 7.99913898215	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Nov2008_d3dx10_40_x86[1].cab entropy: 7.99901184706	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Aug2005_d3dx9_27_x86.cab entropy: 7.99913898215	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46F4FA.tmp\Nov2008_d3dx10_40_x86.cab entropy: 7.99901184706	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Dec2005_d3dx9_28_x86[1].cab entropy: 7.99912186515	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Nov2008_d3dx10_40_x86.cab entropy: 7.99901184706	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS4689FB.tmp\Dec2005_d3dx9_28_x86.cab entropy: 7.99912186515	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Mar2009_d3dx9_41_x86[1].cab entropy: 7.99977242309	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Dec2005_d3dx9_28_x86.cab entropy: 7.99912186515	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46FA1A.tmp\Mar2009_d3dx9_41_x86.cab entropy: 7.99977242309	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Feb2006_d3dx9_29_x86[1].cab entropy: 7.99922866964	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Mar2009_d3dx9_41_x86.cab entropy: 7.99977242309	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS468EFD.tmp\Feb2006_d3dx9_29_x86.cab entropy: 7.99922866964	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Mar2009_d3dx10_41_x86[1].cab entropy: 7.99875716031	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46FFB8.tmp\Mar2009_d3dx10_41_x86.cab entropy: 7.99875716031	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Feb2006_d3dx9_29_x86.cab entropy: 7.99922866964	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Mar2009_d3dx10_41_x86.cab entropy: 7.99875716031	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Aug2009_d3dx9_42_x86[1].cab entropy: 7.99947517428	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Apr2006_d3dx9_30_x86[1].cab entropy: 7.99905051808	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS4704F8.tmp\Aug2009_d3dx9_42_x86.cab entropy: 7.99947517428	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46947B.tmp\Apr2006_d3dx9_30_x86.cab entropy: 7.99905051808	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Aug2009_d3dx9_42_x86.cab entropy: 7.99947517428	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Apr2006_d3dx9_30_x86.cab entropy: 7.99905051808	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Aug2009_d3dx10_42_x86[1].cab entropy: 7.99617858979	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Oct2006_d3dx9_31_x86[1].cab entropy: 7.99908172452	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS4709F9.tmp\Aug2009_d3dx10_42_x86.cab entropy: 7.99617858979	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS46998C.tmp\Oct2006_d3dx9_31_x86.cab entropy: 7.99908172452	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Aug2009_d3dx10_42_x86.cab entropy: 7.99617858979	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Oct2006_d3dx9_31_x86.cab entropy: 7.99908172452	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Aug2009_d3dx11_42_x86[1].cab entropy: 7.99133262696	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS470DC2.tmp\Aug2009_d3dx11_42_x86.cab entropy: 7.99133262696	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Aug2009_d3dx11_42_x86.cab entropy: 7.99133262696	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Aug2009_d3dcsx_42_x86[1].cab entropy: 7.99929609474	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS47116B.tmp\Aug2009_d3dcsx_42_x86.cab entropy: 7.99929609474	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Aug2009_d3dcsx_42_x86.cab entropy: 7.99929609474	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Aug2009_D3DCompiler_42_x86[1].cab entropy: 7.99844166401	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS4718CE.tmp\Aug2009_D3DCompiler_42_x86.cab entropy: 7.99844166401	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Aug2009_D3DCompiler_42_x86.cab entropy: 7.99844166401	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Jun2010_d3dx9_43_x86[1].cab entropy: 7.99938038089	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS471DDF.tmp\Jun2010_d3dx9_43_x86.cab entropy: 7.99938038089	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Jun2010_d3dx9_43_x86.cab entropy: 7.99938038089	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Jun2010_d3dx10_43_x86[1].cab entropy: 7.99666344587	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS47231E.tmp\Jun2010_d3dx10_43_x86.cab entropy: 7.99666344587	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Jun2010_d3dx10_43_x86.cab entropy: 7.99666344587	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Jun2010_d3dx11_43_x86[1].cab entropy: 7.9918106197	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS4726E7.tmp\Jun2010_d3dx11_43_x86.cab entropy: 7.9918106197	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\Jun2010_d3dx11_43_x86.cab entropy: 7.9918106197	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\dxupdate[1].cab entropy: 7.99005571784	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\msdownld.tmp\AS463294.tmp\dxupdate.cab entropy: 7.99005571784	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\dxupdate.cab entropy: 7.99005571784	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

File created: C:\Windows\Logs\DirectX.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

File deleted: C:\Windows\SysWOW64\directx\websetup\SET147D.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C69680F	18_2_6C69680F
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C6A1DD6	18_2_6C6A1DD6
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C690362	18_2_6C690362
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C68D86D	18_2_6C68D86D
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C690CB3	18_2_6C690CB3
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C692D36	18_2_6C692D36
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C69D200	18_2_6C69D200
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C68EA87	18_2_6C68EA87
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C69FF6D	18_2_6C69FF6D

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: String function: 6C689BC1 appears 324 times
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: String function: 6C69D1A0 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: String function: 6C68B0F6 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: String function: 6C689A40 appears 211 times

Source: Unconfirmed 602765.crdownload.10.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 224531 bytes, 5 files, at 0x2c "dsetup.dll" "dsetup32.dll", ID 5930, number 1, 69 datablocks, 0x1503 compression
Source: chromecache_437.11.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 224531 bytes, 5 files, at 0x2c "dsetup.dll" "dsetup32.dll", ID 5930, number 1, 69 datablocks, 0x1503 compression
Source: dxwsetup.exe.17.dr	Static PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: dxwsetup.exe.17.dr	Static PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: dxwsetup.exe.17.dr	Static PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary

Source: dxwsetup.exe.17.dr	Static PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: dxwsetup.exe.17.dr	Static PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: dxwsetup.exe.17.dr	Static PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary

Source: 7068c74f-67f6-4374-a493-185b4ad86778.tmp.10.dr

Static PE information: No import functions for PE file found

Source: 7068c74f-67f6-4374-a493-185b4ad86778.tmp.10.dr

Static PE information: Data appended to the last section found

Source: Palworld.exe, 00000007.00000000.1277225007.00007FF74F762000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameBootstrapPackagedGame-Win64-Shipping.exeD vs Palworld.exe
Source: Palworld.exe	Binary or memory string: OriginalFilenameBootstrapPackagedGame-Win64-Shipping.exeD vs Palworld.exe

Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: msvcp140_2.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: xinput1_3.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: spinf.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: spfileq.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: inseng.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: ieadvpack.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: msvcp140_2.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: xinput1_3.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Palworld.exe	Section loaded: wintypes.dll	Jump to behavior

Source: classification engine

Classification label: mal48.rans.winEXE@48/288@155/57

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Code function: 18_2_6C689BC1 __wstrtime,__wstrtime,_strrchr,FormatMessageA,LocalFree,GetLastError,

18_2_6C689BC1

Source: C:\Users\user\Downloads\dxwebsetup.exe

Code function: 17_2_010018B5 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,

17_2_010018B5

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Code function: 18_2_6C68E634 GetDiskFreeSpaceA,GetLastError,GetModuleHandleA,GetLastError,GetProcAddress,GetLastError,GetLastError,

18_2_6C68E634

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Code function: 18_2_6C69A2F6 CreateEventA,CoInitialize,CoCreateInstance,

18_2_6C69A2F6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Mutant created: \Sessions\1\BaseNamedObjects\DXWSETUP

Source: C:\Users\user\Downloads\dxwebsetup.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: Palworld.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Palworld.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Palworld.exe C:\Users\user\Desktop\Palworld.exe
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=2116,i,8841958676898613242,11507238833919217486,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6212 --field-trial-handle=2116,i,8841958676898613242,11507238833919217486,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\dxwebsetup.exe "C:\Users\user\Downloads\dxwebsetup.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\dxwebsetup.exe "C:\Users\user\Downloads\dxwebsetup.exe"
Source: C:\Users\user\Downloads\dxwebsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Source: unknown	Process created: C:\Users\user\Desktop\Palworld.exe "C:\Users\user\Desktop\Palworld.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=2116,i,8841958676898613242,11507238833919217486,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6212 --field-trial-handle=2116,i,8841958676898613242,11507238833919217486,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\dxwebsetup.exe "C:\Users\user\Downloads\dxwebsetup.exe"	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E449686-C509-11CF-AAFA-00AA00B6015C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Source: Palworld.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: Palworld.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Palworld.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Palworld.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Palworld.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Palworld.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Palworld.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Palworld.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Palworld.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: DSETUP.pdb source: dsetup.dll.17.dr
Source:	Binary string: DSETUP.pdb0 source: dsetup.dll.17.dr
Source:	Binary string: wextract.pdb source: dxwebsetup.exe, dxwebsetup.exe, 00000011.00000002.2542730863.0000000001001000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: dsetup32.pdb source: dsetup32.dll.17.dr
Source:	Binary string: BootstrapPackagedGame-Win64-Shipping.pdb source: Palworld.exe
Source:	Binary string: dxwsetup.pdb source: dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815367597.0000000000171000.00000020.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr
Source:	Binary string: wextract.pdbU source: dxwebsetup.exe, 0000000E.00000000.1809607279.0000000001001000.00000020.00000001.01000000.00000006.sdmp, dxwebsetup.exe, 00000011.00000002.2542730863.0000000001001000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: dxupdate.pdb source: dxwsetup.exe, dxwsetup.exe, 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp

Source: Palworld.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Palworld.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Palworld.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Palworld.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Palworld.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Code function: 18_2_6C68B4D6 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetLastError,GetLastError,GetLastError,

18_2_6C68B4D6

Source: 7068c74f-67f6-4374-a493-185b4ad86778.tmp.10.dr	Static PE information: real checksum: 0x54af2 should be: 0xaa5c
Source: Palworld.exe	Static PE information: real checksum: 0x0 should be: 0x358c3

Source: Palworld.exe

Static PE information: section name: _RDATA

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Code function: 18_2_6C69D1E5 push ecx; ret

18_2_6C69D1F8

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\dsetup32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\SET148E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\dsetup.dll (copy)	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 437	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\dxwebsetup.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxupdate.dll	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 602765.crdownload	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\7068c74f-67f6-4374-a493-185b4ad86778.tmp	Jump to dropped file
Source: C:\Users\user\Downloads\dxwebsetup.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup.dll	Jump to dropped file
Source: C:\Users\user\Downloads\dxwebsetup.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\SET147D.tmp	Jump to dropped file
Source: C:\Users\user\Downloads\dxwebsetup.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\dsetup32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\SET148E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\dsetup.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	File created: C:\Windows\SysWOW64\directx\websetup\SET147D.tmp	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: Chrome Cache Entry: 437

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C69680F _strnlen,GetPrivateProfileStringA,	18_2_6C69680F
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C68C99A _realloc,GetPrivateProfileSectionNamesA,	18_2_6C68C99A
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C68F070 GetPrivateProfileIntA,_strnlen,CharLowerA,_strnlen,_strnlen,_strnlen,CharLowerA,_strnlen,_strnlen,_strnlen,_strnlen,	18_2_6C68F070
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C68C01B _memset,GetPrivateProfileStringA,	18_2_6C68C01B
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C690CB3 DirectXUpdateGetSetupInformation,GetModuleFileNameA,GetLastError,_strnlen,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,	18_2_6C690CB3
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C69097D _memset,_memset,GetPrivateProfileStringA,GetPrivateProfileStringA,_strrchr,GetPrivateProfileStringA,GetVersionExA,GetLastError,	18_2_6C69097D
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C68EA87 GetSystemDirectoryA,GetLastError,GetPrivateProfileStringA,lstrcmpA,lstrcmpA,_strnlen,lstrcmpA,lstrcmpA,	18_2_6C68EA87
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C68D792 GetPrivateProfileStringA,	18_2_6C68D792

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Downloads\dxwebsetup.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior

Source: C:\Users\user\Downloads\dxwebsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\directx\websetup\dsetup32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\directx\websetup\SET148E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\directx\websetup\dsetup.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxupdate.dll	Jump to dropped file
Source: C:\Users\user\Downloads\dxwebsetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\directx\websetup\SET147D.tmp	Jump to dropped file
Source: C:\Users\user\Downloads\dxwebsetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup32.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Evaded block: after key decision			graph_18-13788
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Evaded block: after key decision			graph_18-14773

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_18-13672

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_18-12934

Source: C:\Users\user\Downloads\dxwebsetup.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_17-239

Source: C:\Users\user\Downloads\dxwebsetup.exe	Code function: 17_2_01001C7F lstrcpy,lstrcpy,lstrcat,lstrcat,FindFirstFileA,lstrcpy,lstrcmp,lstrcmp,lstrcat,lstrcat,FindNextFileA,FindClose,RemoveDirectoryA,	17_2_01001C7F
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C68A3EB FindFirstFileA,FindClose,	18_2_6C68A3EB
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C68D86D GetWindowsDirectoryA,GetLastError,_strrchr,FindFirstFileA,FindFirstFileA,FindClose,FindClose,FindFirstFileA,FindClose,	18_2_6C68D86D
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C691473 WideCharToMultiByte,GetLastError,WideCharToMultiByte,GetLastError,WideCharToMultiByte,_strrchr,WideCharToMultiByte,_strrchr,WideCharToMultiByte,_strrchr,WideCharToMultiByte,_memset,FindFirstFileA,FindClose,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,	18_2_6C691473
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C68FB07 _memset,_memset,GetWindowsDirectoryA,GetLastError,_memset,FindFirstFileA,lstrcmpA,lstrcmpA,GetFileAttributesA,GetLastError,FindNextFileA,FindClose,	18_2_6C68FB07
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C68E7AF lstrcmpA,_memset,GetSystemDirectoryA,GetLastError,StringFromGUID2,WideCharToMultiByte,GetLastError,FindFirstFileA,FindNextFileA,FindClose,	18_2_6C68E7AF

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Code function: 18_2_6C6A62CB __get_wpgmptr,VirtualQuery,GetSystemInfo,GetModuleHandleW,GetProcAddress,VirtualAlloc,VirtualProtect,

18_2_6C6A62CB

Source: C:\Users\user\Downloads\dxwebsetup.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	File opened: C:\Users\user\AppData\Local\Temp\IXP000.TMP\	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	File opened: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup.dll	Jump to behavior
Source: C:\Users\user\Downloads\dxwebsetup.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Source: dxwsetup.exe, 00000012.00000003.1907183316.00000000014A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWuJ
Source: dxwsetup.exe, 00000012.00000003.1907183316.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000003.1907183316.00000000014A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

API call chain: ExitProcess graph end node

graph_18-12936

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Code function: 18_2_6C6898CF GetWindowsDirectoryA,OutputDebugStringA,CreateDirectoryA,GetLastError,__wstrtime,__wstrtime,

18_2_6C6898CF

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Code function: 18_2_6C68B4D6 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetLastError,GetLastError,GetLastError,

18_2_6C68B4D6

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Code function: 18_2_6C6A5A16 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,SetEndOfFile,GetLastError,

18_2_6C6A5A16

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C69AE6A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		18_2_6C69AE6A
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	Code function: 18_2_6C6A56F8 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		18_2_6C6A56F8

Source: C:\Users\user\Downloads\dxwebsetup.exe

Code function: 17_2_0100168B GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,LocalFree,CloseHandle,

17_2_0100168B

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Code function: GetLocaleInfoA,

18_2_6C6A6092

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Code function: 18_2_6C69ACA5 GetLocalTime,

18_2_6C69ACA5

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Code function: 18_2_6C69A48C GetVersionExA,__heap_term,GetCommandLineA,___crtGetEnvironmentStringsA,__mtterm,__mtterm,__heap_term,___set_flsgetvalue,__freeptd,

18_2_6C69A48C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	5 Native API	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	31 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Process Injection	1 Access Token Manipulation	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Registry Run Keys / Startup Folder	1 Process Injection	Security Account Manager	11 Peripheral Device Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	15 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Palworld.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup32.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxupdate.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe	0%	ReversingLabs
C:\Users\user\Downloads\Unconfirmed 602765.crdownload	0%	ReversingLabs
C:\Users\user\Downloads\dxwebsetup.exe (copy)	0%	ReversingLabs
C:\Windows\SysWOW64\directx\websetup\SET147D.tmp	0%	ReversingLabs
C:\Windows\SysWOW64\directx\websetup\SET148E.tmp	0%	ReversingLabs
C:\Windows\SysWOW64\directx\websetup\dsetup.dll (copy)	0%	ReversingLabs
C:\Windows\SysWOW64\directx\websetup\dsetup32.dll (copy)	0%	ReversingLabs
Chrome Cache Entry: 437	0%	ReversingLabs

Source	Detection	Scanner	Label
https://www.clarity.ms/s/0.7.20/clarity.js	0%	URL Reputation	safe
https://redux.js.org/tutorials/fundamentals/part-4-store#creating-a-store-with-enhancers	0%	URL Reputation	safe
https://redux.js.org/tutorials/fundamentals/part-4-store#middleware	0%	URL Reputation	safe
https://d.impactradius-event.com	0%	URL Reputation	safe
https://bttrack.com/dmp/adobe/user?dd_uuid=35050774984483340004567475019318048768	0%	Avira URL Cloud	safe
https://rtb.adentifi.com/CookieSyncAdobe	0%	Avira URL Cloud	safe
https://srm.bf.contentsquare.net/exist?v=13.83.0&pid=2422&pn=1&sn=1&uu=96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4	0%	Avira URL Cloud	safe
https://devblogs.(	0%	Avira URL Cloud	safe
http://www.betaplace.com	0%	Avira URL Cloud	safe
http://www.BetaPlace.com.?	0%	Avira URL Cloud	safe
http://www.BetaPlace.comEContinuare	0%	Avira URL Cloud	safe
https://mem.gfx.ms/meversion?partner=MSDLC&market=en-us&uhf=1	0%	Avira URL Cloud	safe
https://www.clarity.ms/tag/uet/4000034?insights=1	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
global.px.quantserve.com	192.184.69.201	true	false	high
i.ytimg.com	142.251.15.119	true	false	high
sni1gl.wpc.alphacdn.net	152.195.19.97	true	false	unknown
us-east-eb2.3lift.com	52.223.22.214	true	false	high
bttrack.com	192.132.33.68	true	false	unknown
dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	3.215.173.68	true	false	high
dualstack.tls13.taboola.map.fastly.net	151.101.193.44	true	false	unknown
microsoft.msafflnk.net	35.174.142.23	true	false	unknown
sync.crwdcntrl.net	50.19.176.119	true	false	high
cm.g.doubleclick.net	173.194.219.157	true	false	high
aragorn-prod-va-lb.inbake.com	34.224.206.102	true	false	unknown
www.google.com	173.194.219.103	true	false	high
d.impactradius-event.com	35.186.249.72	true	false	unknown
cs1227.wpc.alphacdn.net	192.229.211.199	true	false	unknown
liveperson.map.fastly.net	151.101.193.192	true	false	unknown
match.adsrvr.org	52.223.40.198	true	false	high
star-mini.c10r.facebook.com	31.13.65.36	true	false	high
c.bf.contentsquare.net	34.206.180.7	true	false	unknown
www.ojrq.net	34.95.127.121	true	false	high
us-u.openx.net	35.244.159.8	true	false	high
plus.l.google.com	64.233.177.100	true	false	high
s.twitter.com	104.244.42.131	true	false	high
k.bf.contentsquare.net	54.162.65.117	true	false	unknown
static.doubleclick.net	74.125.138.148	true	false	high
q-aus1.contentsquare.net	3.94.15.197	true	false	unknown
youtube-ui.l.google.com	74.125.138.190	true	false	high
googleads.g.doubleclick.net	142.250.9.157	true	false	high
a.tribalfusion.com	104.18.25.173	true	false	high
clients.l.google.com	173.194.219.101	true	false	high
part-0007.t-0009.t-msedge.net	13.107.213.35	true	false	unknown
lpcdn.lpsnmedia.net	34.120.154.120	true	false	high
s.tribalfusion.com	104.18.25.173	true	false	high
dco-ats-00-1519508033.us-east-1.elb.amazonaws.com	3.224.195.202	true	false	high
adobetarget.data.adobedc.net	63.140.39.248	true	false	unknown
idsync.rlcdn.com	35.244.154.8	true	false	high
tunnel.googlezip.net	216.239.34.157	true	false	unknown
id.google.com	172.217.23.99	true	false	high
rtb.adentifi.com	18.214.166.242	true	false	unknown
part-0012.t-0009.t-msedge.net	13.107.213.40	true	false	unknown
sync.srv.stackadapt.com	52.87.115.253	true	false	high
msftenterprise.sc.omtrdc.net	63.140.39.15	true	false	unknown
accounts.google.com	173.194.219.84	true	false	high
part-0013.t-0009.t-msedge.net	13.107.213.41	true	false	unknown
srm.bf.contentsquare.net	3.208.151.21	true	false	unknown
dsum-sec.casalemedia.com	104.18.36.155	true	false	high
pug-njrpb.pubmnet.com	162.248.18.37	true	false	unknown
dns-tunnel-check.googlezip.net	216.239.34.159	true	false	unknown
ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud	34.200.65.202	true	false	unknown
ib.anycast.adnxs.com	68.67.160.137	true	false	high
d1xbuscas8tetl.cloudfront.net	13.249.39.8	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
ats.everesttech.net	unknown	unknown	false	high
ag.innovid.com	unknown	unknown	false	high
idpix.media6degrees.com	unknown	unknown	false	high
px.owneriq.net	unknown	unknown	false	high
cm.everesttech.net	unknown	unknown	false	high
jadserve.postrelease.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
dmpsync.3lift.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
accdn.lpsnmedia.net	unknown	unknown	false	high
rtd.tubemogul.com	unknown	unknown	false	high
pixel.rubiconproject.com	unknown	unknown	false	high
logincdn.msftauth.net	unknown	unknown	false	unknown
trc.taboola.com	unknown	unknown	false	high
px.ads.linkedin.com	unknown	unknown	false	high
cms.analytics.yahoo.com	unknown	unknown	false	high
sync-tm.everesttech.net	unknown	unknown	false	high
c.clicktale.net	unknown	unknown	false	high
ds.reson8.com	unknown	unknown	false	unknown
ups.analytics.yahoo.com	unknown	unknown	false	high
q-aus1.clicktale.net	unknown	unknown	false	high
image2.pubmatic.com	unknown	unknown	false	high
publisher.liveperson.net	unknown	unknown	false	high
cdnssl.clicktale.net	unknown	unknown	false	high
dpm.demdex.net	unknown	unknown	false	high
rtd-tm.everesttech.net	unknown	unknown	false	high
servedby.flashtalking.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
k-aus1.clicktale.net	unknown	unknown	false	high
www.clarity.ms	unknown	unknown	false	unknown
www.linkedin.com	unknown	unknown	false	high
mscom.demdex.net	unknown	unknown	false	high
mem.gfx.ms	unknown	unknown	false	unknown
analytics.twitter.com	unknown	unknown	false	high
c.s-microsoft.com	unknown	unknown	false	high
u.clarity.ms	unknown	unknown	false	unknown
cms.quantserve.com	unknown	unknown	false	high
analytics.tiktok.com	unknown	unknown	false	unknown
ib.adnxs.com	unknown	unknown	false	high
sync.search.spotxchange.com	unknown	unknown	false	high
lptag.liveperson.net	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
acctcdn.msftauth.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/gen_204?atyp=csi&ei=Kze5ZY_EKtunqtsPm7mdiAw&s=async&astyp=asyncContextualTask&rt=ttfb.687,ft.688&zx=1706637104517&opi=89978449	false		high
https://www.clarity.ms/s/0.7.20/clarity.js	false	URL Reputation: safe	unknown
https://dmpsync.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D72352%26dpuuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D	false		high
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Zbk3QwAAAGzR0xva&C=1	false		high
https://dpm.demdex.net/ibs:dpid=390122&dpuuid=4QGHe0AkU19ZmYu7n2WfX1G1OUo	false		high
https://cdnssl.clicktale.net/ptc/05d32363-d534-4d93-9b65-cde674775e71.js	false		high
https://cdnssl.clicktale.net/www/bridge-WR110.js	false		high
https://www.google.com/gen_204?atyp=i&ei=Kze5ZY_EKtunqtsPm7mdiAw&ct=kptm:il&iw=1017&ih=853&r=0&sh=1024&sw=1280&tmw=374&tmh=82&nvi=6&eg=0&zx=1706637102152&opi=89978449	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=directx&oit=1&cp=7&pgcl=7&gs_rn=42&psi=w2jj9Ekh5vGktcI5&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/gen_204?atyp=csi&ei=Kze5ZY_EKtunqtsPm7mdiAw&s=async&astyp=asyncContextualTask&rt=ttfb.460,ft.461&zx=1706637105983&opi=89978449	false		high
https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8	false		high
https://cdnssl.clicktale.net/www32/ptc/05d32363-d534-4d93-9b65-cde674775e71.js	false		high
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1	false		high
https://dpm.demdex.net/ibs:dpid=1957&dpuuid=235DAA179B1F6089140CBE019A496167	false		high
https://www.youtube.com/s/player/6ee8f9ce/player_ias.vflset/en_US/embed.js	false		high
https://js.monitor.azure.com/scripts/c/ms.shared.analytics.mectrl-3.gbl.min.js	false		high
https://srm.bf.contentsquare.net/exist?v=13.83.0&pid=2422&pn=1&sn=1&uu=96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4	false	Avira URL Cloud: safe	unknown
https://www.google.com/gen_204?atyp=i&ei=Kze5ZY_EKtunqtsPm7mdiAw&ct=slh&v=t1&im=M&pv=0.518824515729305&me=160:1706637105586,B,2610:0,R,1,CCgQAA,735,165,393,1297:0,R,1,CCgQBg,736,237,392,1174:0,R,1,CC0QAA,736,237,392,1174:0,R,1,CEQQAA,756,237,372,187:0,R,1,CD4QAA,756,237,372,168:0,R,1,CD4QAQ,756,237,372,168:0,R,1,CD8QAA,756,237,372,168:0,R,1,CD8QAg,1009,373,119,32:0,R,1,CEUQAA,756,448,372,509:0,R,1,CEEQAA,756,448,372,488:0,R,1,CDEQAA,756,448,372,133:0,R,1,CDEQAQ,756,448,372,133:0,R,1,CDMQAA,756,581,372,29:0,R,1,CC4QAA,756,610,372,29:0,R,1,CC8QAA,756,639,372,29:0,R,1,CDAQAA,756,668,372,51:0,R,1,CDIQAA,756,735,372,201:0,R,1,CDIQAQ,756,736,372,66:0,R,1,CDIQBg,756,803,372,66:0,R,1,CDIQCw,756,870,372,66:9891,h,1,CAcQAA,o:0,h,1,CAUQGQ,o:4,e,B&zx=1706637115482&opi=89978449	false		high
https://mscom.demdex.net/dest5.html?d_nsid=0	false		high
https://cms.quantserve.com/pixel/p-vj4AYjBqd6VJ2.gif?idmatch=0&gdpr=0&gdpr_consent=	false		high
https://s.tribalfusion.com/z/i.match?p=b13&u=35050774984483340004567475019318048768&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$	false		high
https://www.google.com/gen_204?atyp=i&ei=Kze5ZY_EKtunqtsPm7mdiAw&ct=slh&v=t1&im=M&pv=0.518824515729305&me=135:1706637100852,R,1,CDMQAA,756,495,372,29:0,R,1,CC4QAA,756,524,372,29:0,R,1,CC8QAA,756,553,372,29:0,R,1,CDAQAA,756,582,372,51:0,R,1,CDIQAA,756,649,372,201:0,R,1,CDIQAQ,756,650,372,66:0,R,1,CDIQBg,756,717,372,66:0,R,1,CDIQCw,756,784,372,66:13,h,1,CAUQGQ,i:18,h,1,CB0QAA,i:22,h,1,CCIQAQ,i:47,h,1,CCIQAQ,o:0,h,1,CCAQAQ,i:75,h,1,CCAQAQ,o:0,h,1,CB8QAQ,i:72,h,1,CB8QAQ,o:0,h,1,CB4QAQ,i:73,h,1,CB4QAQ,o:48,h,1,CB0QAA,o:143,h,1,CAcQAA,i:3095,G,1,CAcQAA,216,48,1:0,c,244,219:0,G,1,CAcQAA,216,48:0,G,1,CAUQGQ,216,48:3,e,U&zx=1706637104461&opi=89978449	false		high
https://bttrack.com/dmp/adobe/user?dd_uuid=35050774984483340004567475019318048768	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=dire&oit=1&cp=4&pgcl=7&gs_rn=42&psi=w2jj9Ekh5vGktcI5&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://sync.srv.stackadapt.com/sync?nid=adobe	false		high
https://www.google.com/gen_204?atyp=csi&ei=Kze5ZY_EKtunqtsPm7mdiAw&s=async&astyp=asyncContextualTask&rt=ttfb.688,ft.689&zx=1706637102837&opi=89978449	false		high
https://rtb.adentifi.com/CookieSyncAdobe	false	Avira URL Cloud: safe	unknown
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Zbk3QwAAAGzR0xva	false		high
https://cms.analytics.yahoo.com/cms?partner_id=ADOBE&_hosted_id=35050774984483340004567475019318048768&gdpr=0&gdpr_consent=	false		high
https://www.google.com/xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=1/exm=SNUn3,attn,cEt90b,cdos,csi,d,dtl0hd,eHDfl,gwc,hsm,jsa,mb4ZUb,qddgKe,sTsDMc/excm=ABxRVc,AD6AIb,B0xr7b,CTwd8,CWOfE,CX5LId,CdOg1,D1J6He,FmnE6b,FuQWyc,GRJ32c,GXyz1,JxE93,KiXlnd,MRb7nf,NmR9jd,NsEUGe,Oa7Qpb,Ok4XMd,PE728b,PoJj8d,PvSBGf,QNvmne,RSlfle,TO0csb,TnXlGd,Trirbc,TurKxc,U3Ovcc,U6nlJe,UQpTU,UiPhkb,Uznx4d,VZLyBe,WxJ6g,XDlt7d,XHo6qe,XTkmZd,XbupY,YuNOCb,ZGLUZ,ZrXR8b,Zudxcb,a3cZoc,adn7N,ak946,bXyZdf,cKV22c,du3Q4e,eTv59e,f26on,fNMhz,hfJ9hb,jJtSzc,jkRPje,kCkfUb,kOSi0d,mL4hG,oXRDzc,pIseB,pMwOEe,pQk1fc,qngJBf,r24bR,rL2AR,sU6eaf,tlA71,tzTB5,vJPFse,vhpQNc,y25qZb,yChgtb,yfH2Bd,yn9Ffd,ypVg7e,yuQBec,zjNhL,zs9f9d/ed=1/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/ee=AfeaP:TkrAjf;Afksuc:wMx0R;BMxAGc:E5bFse;BgS6mb:fidj5d;BjwMce:cXX2Wb;CxXAWb:YyRLvc;DULqB:RKfG5c;DpcR3d:zL72xf;EABSZ:MXZt9d;ESrPQc:mNTJvc;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;EnlcNd:WeHg4;Erl4fe:FloWmf;F9mqte:UoRcbe;Fmv9Nc:O1Tzwc;G0KhTb:LIaoZ;G6wU6e:hezEbd;GleZL:J1A7Od;HMDDWe:G8QUdb;IBADCc:RYquRb;IoGlCf:b5lhvb;IsdWVc:qzxzOb;JXS8fb:Qj0suc;JbMT3:M25sS;JsbNhc:Xd8iUd;KOxcK:OZqGte;KQzWid:ZMKkN;KcokUb:KiuZBf;KeeMUb:HiPxjc;KpRAue:Tia57b;LBgRLc:XVMNvd;LEikZe:byfTOb,lsjVmc;LsNahb:ucGLNb;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Np8Qkd:Dpx6qc;Nyt6ic:jn2sGd;OgagBe:cNTe0;Oj465e:KG2eXe;OohIYe:mpEAQb;Pjplud:EEDORb,PoEs9b;PqHfGe:im2cZe;Q1Ow7b:x5CSu;QGR0gd:Mlhmy;R2kc8b:ALJqWb;R4IIIb:QWfeKf;R9Ulx:CR7Ufe;RDNBlf:zPRCJb;SLtqO:Kh1xYe;SMDL4c:fTfGO,pnvXVc;SNUn3:ZwDk9d,x8cHvb;ShpF6e:N0pvGc;TxfV6d:YORN0b;U96pRd:FsR04;UDrY1c:eps46d;UVmjEd:EesRsb;UyG7Kb:wQd0G;V2HTTe:RolTY;VGRfx:VFqbr;VN6jIc:ddQyuf;VOcgDe:YquhTb;VsAqSb:PGf2Re;VxQ32b:k0XsBb;WCEKNd:I46Hvd;WDGyFe:jcVOxd;Wfmdue:g3MJlb;XUezZ:sa7lqb;YV5bee:IvPZ6d;ZMvdv:PHFPjb;ZWEUA:afR4Cf;a56pNe:JEfCwb;aAJE9c:WHW6Ef;aZ61od:arTwJ;bFZ6gf:RsDQqe;bcPXSc:gSZLJb;cEt90b:ws9Tlc;cFTWae:gT8qnd;coJ8e:KvoW8;dIoSBb:ZgGg9b;dLlj2:Qqt3Gf;daB6be:lMxGPd;dtl0hd:lLQWFe;eBAeSb:Ck63tb;eBZ5Nd:audvde;eHDfl:ofjVkb;eO3lse:nFClrf;fWLTFc:TVBJbf;g8nkx:U4MzKc;gaub4:TN6bMe;gtVSi:ekUOYd;h3MYod:cEt90b;hK67qb:QWEO5b;hLUtwc:KB8OKd;heHB1:sFczq;hjRo6e:F62sG;iFQyKf:QIhFr,vfuNJf;imqimf:jKGL2e;io8t5d:sgY6Zb;jY0zg:Q6tNgc;k2Qxcb:XY51pe;kCQyJ:ueyPK;kMFpHd:OTA3Ae;kbAm9d:MkHyGd;lkq0A:JyBE3e;nAFL3:NTMZac,s39S4;oGtAuc:sOXFj;oSUNyd:fTfGO,pnvXVc;oUlnpc:RagDlc;okUaUd:wItadb;pKJiXd:VCenhc;pNsl2d:j9Yuyc;pXdRYb:JKoKVe;pj82le:mg5CW;qGV2uc:HHi04c;qZx2Fc:j0xrE;qaS3gd:yiLg6e;qavrXe:zQzcXe;qddgKe:d7YSfd,x4FYXe;rQSrae:C6D5Fc;sP4Vbe:VwDzFe;sTsDMc:kHVSUb;tH4IIe:Ymry6;tosKvd:ZCqP3;trZL0b:qY8PFe;uY49fb:COQbmf;uknmt:GkPrzb;uuQkY:u2V3ud;vGrMZ:lPJJ0c;vfVwPd:lcrkwe;w3bZCb:ZPGaIb;w4rSdf:XKiZ9;w9w86d:dt4g2b;wQlYve:aLUfP;wR5FRb:TtcOte;wV5Pjc:L8KGxe;whEZac:F4AmNb;xBbsrc:NEW1Qc;xbe2wc:uRMPBc;yGxLoc:FmAr0c;yxTchf:KUM7Z;z97YGf:oug9te;zOsCQe:Ko78Df;zaIgPb:Qtpxbd/m=ABJeBb,Da4hkd,Eox39d,GCSbhd,GElbSc,HYSCof,J4ga1b,KHourd,M0hWhd,QhoyLd,Um3BXb,Wo3n8,aD8OEe,cSX9Xe,etGP4c,fcDBE,msmzHf,nPaQu,pFsdhd,pHXghd,tIj4fb,vrkJ0e,xfmZMb?xjs=s1	false		high
https://ib.adnxs.com/setuid?entity=158&code=Zbk3QwAAAGzR0xva	false		high
https://dpm.demdex.net/ibs:dpid=3047&dpuuid=5873EF962A9843&gdpr=0&gdpr_consent=	false		high
https://ag.innovid.com/dv/sync?tid=6	false		high
https://www.google.com/xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=syez,syf0,aLUfP?xjs=s3	false		high
https://mem.gfx.ms/meversion?partner=MSDLC&market=en-us&uhf=1	false	Avira URL Cloud: safe	unknown
https://www.google.com/gen_204?atyp=csi&ei=Kze5ZY_EKtunqtsPm7mdiAw&s=async&astyp=asyncContextualTask&rt=ttfb.675,ft.676&zx=1706637104519&opi=89978449	false		high
https://idsync.rlcdn.com/365868.gif?partner_uid=35050774984483340004567475019318048768	false		high
https://dmpsync.3lift.com/getuid?redir=%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D72352%26dpuuid%3D$UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	false		high
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID	false		high
https://www.facebook.com/tr?id=undefined&ev=PixelInitialized&dpo=LDU&dpoco=0&dpost=0&ts=1706637121398	false		high
https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-GUgwg.xE2pFMcbpyXNvyw.wczz.DSnmIwWo-~A	false		high
https://www.google.com/gen_204?atyp=i&ei=Kze5ZY_EKtunqtsPm7mdiAw&ct=slh&v=t1&pv=0.518824515729305&me=69:1706637100833,R,1,CCgQAA,735,165,393,1211:0,R,1,CCkQAA,736,165,392,72:0,R,1,CCgQBg,736,237,392,1088:0,R,1,CC0QAA,736,237,392,1088:0,R,1,CEQQAA,756,237,372,101:0,R,1,CD4QAA,756,237,372,82:0,R,1,CD4QAQ,756,237,372,82:0,R,1,CD8QAA,756,237,372,82:0,R,1,CDgQAA,756,237,199,82:0,R,1,CD0QAA,957,237,84,82:0,R,1,CDwQAA,756,321,126,82:0,R,1,CDsQAA,884,321,119,82:0,R,1,CDkQAA,1005,321,123,82:0,R,1,CD8QAg,1009,287,119,32:0,R,1,CEUQAA,756,362,372,509:0,R,1,CEEQAA,756,362,372,488:0,R,1,CDEQAA,756,362,372,133:0,R,1,CDEQAQ,756,362,372,133:0,R,1,CDMQAA,756,495,372,29:0,R,1,CC4QAA,756,524,372,29:0,R,1,CC8QAA,756,553,372,29:0,R,1,CDAQAA,756,582,372,51:0,R,1,CDIQAA,756,649,372,201:0,R,1,CDIQAQ,756,650,372,66:0,R,1,CDIQBg,756,717,372,66:0,R,1,CDIQCw,756,784,372,66:19,T:0,R,1,9,24,36,92,33:0,R,1,CA8QAA,24,88,800,40:0,R,1,CBYQAQ,24,88,73,40:0,R,1,CBMQAQ,103,88,110,40:0,R,1,CBIQAQ,219,88,111,40:0,R,1,CBEQAQ,336,88,76,40:0,R,1,CG0QAQ,418,88,123,40:0,R,1,CGkQAQ,547,88,65,40:0,R,1,CGwQAQ,618,88,49,40:0,R,1,CGoQAQ,673,88,61,40:0,R,1,CGsQAQ,740,88,81,40:0,R,1,CAUQGQ,28,171,652,1968:0,R,1,CAcQAA,28,171,600,117:0,R,1,CB0QAA,28,332,652,248:0,R,1,CB4QAQ,28,369,652,48:0,R,1,CB8QAQ,28,418,652,48:0,R,1,CCAQAQ,28,467,652,48:0,R,1,CCIQAQ,28,516,652,48:0,R,1,CBoQAA,28,624,600,139:0,R,1,CBUQAA,28,807,600,117:0,R,1,CAoQAA,756,165,372,2445:0,R,1,CCgQAA,735,165,393,1211:0,R,1,CCkQAA,736,165,392,72:0,R,1,CCgQBg,736,237,392,1088:0,R,1,CC0QAA,736,237,392,1088:0,R,1,CEQQAA,756,237,372,101:0,R,1,CD4QAA,756,237,372,82:0,R,1,CD4QAQ,756,237,372,82:0,R,1,CD8QAA,756,237,372,82:0,R,1,CDgQAA,756,237,199,82:0,R,1,CD0QAA,957,237,84,82:0,R,1,CDwQAA,756,321,126,82:0,R,1,CDsQAA,884,321,119,82:0,R,1,CDkQAA,1005,321,123,82:0,R,1,CD8QAg,1009,287,119,32:0,R,1,CEUQAA,756,362,372,509:0,R,1,CEEQAA,756,362,372,488:0,R,1,CDEQAA,756,362,372,133:0,R,1,CDEQAQ,756,362,372,133&zx=1706637100858&opi=89978449	false		high
https://www.clarity.ms/tag/uet/4000034?insights=1	false	Avira URL Cloud: safe	unknown
https://www.google.com/gen_204?s=web&t=aft&atyp=csi&ei=Kze5ZY_EKtunqtsPm7mdiAw&rt=wsrt.348,aft.675,afti.675,aftr.399,afts.356,frts.326,frvt.675,hst.151,prt.491,sct.295&frtp=317&imn=38&ima=3&imad=2&imac=3&wh=870&aft=1&aftp=870&opi=89978449	false		high
https://i.ytimg.com/vi/m5Xz14RNOEE/mqdefault.jpg?sqp=-oaymwEFCJQBEFM&rs=AMzJL3k77br3KKy0bjWbmhAEHJOrBx75iw	false		high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.GsbA68hXs80.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo899t-H8Lxb3OqzMDuPn6TV_i36ag/cb=gapi.loaded_0	false		high
https://dpm.demdex.net/ibs:dpid=477&dpuuid=a32adb534ed7b015ab5f979962884ce67525e2a0283d43d778da44e182749c01b0da87c991749652	false		high
https://www.youtube.com/s/player/6ee8f9ce/www-widgetapi.vflset/www-widgetapi.js	false		high
https://www.google.com/xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=kMFpHd,sy8j,bm51tf?xjs=s3	false		high
https://c.clicktale.net/dvar?v=13.83.0&pid=2422&pn=1&sn=1&uu=96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4&dv=H4sIAAAAAAAAA1WQ0UvDMBDG%2F5WjL9swZe1cRX07y6YWlNKu%2BDDGSNtDAmkiSYoM9X83qYPhS758Iff77u4rwocj7o7pTXaXQgy4RCDFWynUO%2FCuGw13BH0QoRWQdWL4u442fJk9St1y6SvfqPVnaXQ%2FA%2Bx1S4CKy5MTnQVDH9o4sKNwFN1HnE9xLo3YOX61zta3vnyPDYMcGRQlg6Y%2B%2BKfmaQvf8OxosCAU5NyDKhqE6slAzSVd3OY1bmoWJCC21STeBWiBcVF6UJYsswTmlR5VD6uF72bK3l16Sa%2BzJAmrkJ%2F8ZGM%2FaliKl33ttKHzkHAF%2F%2BwcNy%2BLg8chxhMhj35%2BAYjXMCZdAQAA&ct=2&r=474970	false		high
https://dpm.demdex.net/ibs:dpid=72352&dpuuid=3226875877078116803796&gdpr=0&gdpr_consent=	false		high
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zbk3QwAAAGzR0xva	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=direct&oit=1&cp=6&pgcl=7&gs_rn=42&psi=w2jj9Ekh5vGktcI5&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDhAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=9103415834496958732&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://outlook.live.com/owa/	chromecache_474.11.dr	false		high
https://redux.js.org/tutorials/fundamentals/part-4-store#creating-a-store-with-enhancers	chromecache_401.11.dr	false	URL Reputation: safe	unknown
https://twitter.com/microsoft	chromecache_474.11.dr	false		high
http://g.msn.com/1ewdede70/SettingsTermUse	dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	false		high
http://g.msn.com/1ewenus70/SettingsTermUse	dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	false		high
https://support.activision.com/articles/directx-errors%23:~:text%3DAnswer%253A%2520If%2520you%2520re	chromecache_406.11.dr	false		high
http://g.msn.com/1ewsvse70/SettingsTermUse	dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	false		high
https://www.youtube.com	chromecache_455.11.dr	false		high
https://lptag.liveperson.net	chromecache_474.11.dr	false		high
https://admin.youtube.com	chromecache_401.11.dr	false		high
http://g.msn.com/1ewkokr70/SettingsPrivacy&http://g.msn.com/1ewkokr70/InstallerMU(Optionele	dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	false		high
http://www.betaplace.com	dsetup32.dll.17.dr	false	Avira URL Cloud: safe	unknown
https://support.activision.com	chromecache_406.11.dr	false		high
http://g.msn.com/1ewkokr70/SettingsTermUse	dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	false		high
https://redux.js.org/tutorials/fundamentals/part-4-store#middleware	chromecache_401.11.dr	false	URL Reputation: safe	unknown
https://d.impactradius-event.com	chromecache_474.11.dr	false	URL Reputation: safe	unknown
https://github.com/microsoft/clarity	chromecache_444.11.dr	false		high
https://yurt.corp.google.com	chromecache_401.11.dr	false		high
https://www.youtube.com/generate_204?cpn=	chromecache_401.11.dr	false		high
https://www.skype.com/en/	chromecache_474.11.dr	false		high
https://www.techpowerup.com	chromecache_406.11.dr	false		high
https://schema.org	chromecache_474.11.dr	false		high
https://www.youtube.com/watch?v=m5Xz14RNOEE	chromecache_406.11.dr	false		high
https://www.onenote.com/	chromecache_474.11.dr	false		high
http://g.msn.com/1ewzhcn70/SettingsPrivacy&http://g.msn.com/1ewzhcn70/InstallerMU8Componentes	dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	false		high
http://g.msn.com/1ewruru70/SettingsTermUse	dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	false		high
http://tools.ietf.org/html/rfc1950	chromecache_401.11.dr, chromecache_455.11.dr, chromecache_395.11.dr	false		high
https://directx-end-user-runtime-web-installer-june-2010.en.lo4d.com	chromecache_406.11.dr	false		high
http://g.msn.com/1ewfrfr70/SettingsPrivacy&http://g.msn.com/1ewfrfr70/InstallerMU&Componenti	dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	false		high
https://breeze.aimon.applicationinsights.io	chromecache_458.11.dr	false		high
https://linustechtips.com/topic/1526292-the-following-components-are-required-to-run-this-program-di	chromecache_406.11.dr	false		high
https://www.xbox.com/en-us/games/store/xbox-game-pass-ultimate/cfq7ttc0khs0?icid=CNavAllXboxGamePass	chromecache_474.11.dr	false		high
https://www.guru3d.com/download/directx-end-user-runtimes-(june-2010)/&ved=2ahUKEwjPhdrQ1oWEAxXb	chromecache_406.11.dr	false		high
https://www.google.com/log?format=json&hasfast=true	chromecache_511.11.dr	false		high
https://devblogs.(	dxwsetup.exe, 00000012.00000003.1920062429.0000000001503000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://lens.google.com	chromecache_511.11.dr	false		high
https://support.google.com/youtube/?p=report_playback	chromecache_401.11.dr	false		high
https://developers.google.com/youtube/iframe_api_reference#Events	chromecache_455.11.dr	false		high
http://youtube.com/streaming/metadata/segment/102015	chromecache_401.11.dr	false		high
http://www.BetaPlace.com.?	dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	false	Avira URL Cloud: safe	unknown
https://dc-int.services.visualstudio.com	chromecache_458.11.dr	false		high
https://youtu.be/	chromecache_401.11.dr	false		high
http://www.BetaPlace.comEContinuare	dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	false	Avira URL Cloud: safe	unknown
http://g.msn.com/1ewzhtw70/SettingsTermUse	dxwebsetup.exe, 00000011.00000003.1814248445.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp, dxwsetup.exe, 00000012.00000000.1815440454.0000000000194000.00000002.00000001.01000000.00000007.sdmp, dxwsetup.exe.17.dr	false		high
https://apis.google.com	chromecache_404.11.dr	false		high
https://www.lifewire.com	chromecache_406.11.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.41	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.249.39.8	d1xbuscas8tetl.cloudfront.net	United States	16509	AMAZON-02US	false
104.18.25.173	a.tribalfusion.com	United States	13335	CLOUDFLARENETUS	false
35.244.154.8	idsync.rlcdn.com	United States	15169	GOOGLEUS	false
173.194.219.157	cm.g.doubleclick.net	United States	15169	GOOGLEUS	false
3.215.173.68	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
34.95.127.121	www.ojrq.net	United States	15169	GOOGLEUS	false
34.120.154.120	lpcdn.lpsnmedia.net	United States	15169	GOOGLEUS	false
34.206.180.7	c.bf.contentsquare.net	United States	14618	AMAZON-AESUS	false
13.107.213.41	part-0013.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
74.125.138.190	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
13.107.213.40	part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.215.190	unknown	United States	15169	GOOGLEUS	false
54.211.243.61	unknown	United States	14618	AMAZON-AESUS	false
151.101.193.44	dualstack.tls13.taboola.map.fastly.net	United States	54113	FASTLYUS	false
68.67.160.137	ib.anycast.adnxs.com	United States	29990	ASN-APPNEXUS	false
52.201.196.73	unknown	United States	14618	AMAZON-AESUS	false
74.125.138.148	static.doubleclick.net	United States	15169	GOOGLEUS	false
3.224.195.202	dco-ats-00-1519508033.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
35.174.142.23	microsoft.msafflnk.net	United States	14618	AMAZON-AESUS	false
173.194.219.105	unknown	United States	15169	GOOGLEUS	false
173.194.219.103	www.google.com	United States	15169	GOOGLEUS	false
104.244.42.131	s.twitter.com	United States	13414	TWITTERUS	false
50.19.176.119	sync.crwdcntrl.net	United States	14618	AMAZON-AESUS	false
173.194.219.101	clients.l.google.com	United States	15169	GOOGLEUS	false
104.18.36.155	dsum-sec.casalemedia.com	United States	13335	CLOUDFLARENETUS	false
52.87.115.253	sync.srv.stackadapt.com	United States	14618	AMAZON-AESUS	false
34.224.206.102	aragorn-prod-va-lb.inbake.com	United States	14618	AMAZON-AESUS	false
54.162.65.117	k.bf.contentsquare.net	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.15.119	i.ytimg.com	United States	15169	GOOGLEUS	false
74.125.136.157	unknown	United States	15169	GOOGLEUS	false
52.223.40.198	match.adsrvr.org	United States	8987	AMAZONEXPANSIONGB	false
31.13.65.36	star-mini.c10r.facebook.com	Ireland	32934	FACEBOOKUS	false
3.94.15.197	q-aus1.contentsquare.net	United States	14618	AMAZON-AESUS	false
63.140.39.248	adobetarget.data.adobedc.net	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
35.244.159.8	us-u.openx.net	United States	15169	GOOGLEUS	false
172.217.23.99	id.google.com	United States	15169	GOOGLEUS	false
142.250.9.157	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
34.200.65.202	ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud	United States	14618	AMAZON-AESUS	false
63.140.39.15	msftenterprise.sc.omtrdc.net	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
192.132.33.68	bttrack.com	United States	18568	BIDTELLECTUS	false
192.184.69.201	global.px.quantserve.com	United States	27281	QUANTCASTUS	false
31.13.66.35	unknown	Ireland	32934	FACEBOOKUS	false
3.208.151.21	srm.bf.contentsquare.net	United States	14618	AMAZON-AESUS	false
172.217.215.119	unknown	United States	15169	GOOGLEUS	false
173.194.219.84	accounts.google.com	United States	15169	GOOGLEUS	false
52.223.22.214	us-east-eb2.3lift.com	United States	8987	AMAZONEXPANSIONGB	false
13.107.213.35	part-0007.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.101.193.192	liveperson.map.fastly.net	United States	54113	FASTLYUS	false
35.186.249.72	d.impactradius-event.com	United States	15169	GOOGLEUS	false
64.233.177.100	plus.l.google.com	United States	15169	GOOGLEUS	false
18.214.166.242	rtb.adentifi.com	United States	14618	AMAZON-AESUS	false
64.233.176.102	unknown	United States	15169	GOOGLEUS	false
216.239.34.157	tunnel.googlezip.net	United States	15169	GOOGLEUS	false
162.248.18.37	pug-njrpb.pubmnet.com	United States	62713	AS-PUBMATICUS	false

Private

IP
192.168.2.17

General Information

Joe Sandbox version:	39.0.0 Ruby
Analysis ID:	1383502
Start date and time:	2024-01-30 18:50:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Palworld.exe
Detection:	MAL
Classification:	mal48.rans.winEXE@48/288@155/57
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 36 Number of non-executed functions: 97
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.31.50.93, 108.177.122.94, 34.104.35.123, 64.233.177.94, 142.250.9.113, 142.250.9.139, 142.250.9.100, 142.250.9.102, 142.250.9.101, 142.250.9.138, 74.125.138.94, 142.250.105.94, 172.253.124.95, 74.125.138.95, 64.233.176.95, 142.251.15.95, 64.233.185.95, 142.250.9.95, 142.250.105.95, 173.194.219.95, 108.177.122.95, 74.125.136.95, 172.217.215.95, 64.233.177.95, 23.46.241.122, 142.250.9.94, 64.233.176.94, 23.48.105.4, 23.48.105.6, 23.55.60.32, 23.55.60.27, 23.220.189.181, 208.89.12.153, 208.89.12.91, 52.167.30.171, 204.79.197.200, 13.107.21.200, 23.203.48.168, 23.203.48.155, 23.203.48.159, 23.47.204.56, 40.74.98.192, 40.126.29.5, 40.126.29.15, 20.190.157.11, 40.126.29.11, 40.126.29.6, 40.126.29.12, 40.126.29.9, 40.126.29.8, 172.217.215.97, 13.107.42.14, 34.192.2.2, 44.195.198.195, 44.213.220.232, 18.215.141.215, 3.231.17.111, 23.23.73.123, 184.31.50.9, 4.227.249.197, 151.101.130.49, 151.101.66.49, 151.101.194.49, 151.101.2.49, 172.64.151.238, 104.18.36.18, 23.7.59.179
Excluded domains from analysis (whitelisted): greenid-prod-pme.eastus2.cloudapp.azure.com, aijscdn2.afd.azureedge.net, lgincdnmsftuswe2.azureedge.net, pme-greenid-prod.trafficmanager.net, slscr.update.microsoft.com, e13678.dscb.akamaiedge.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, clarity-ingest-eus-d-sc.eastus.cloudapp.azure.com, publisher.livepersonk.akadns.net, fs-wildcard.microsoft.com.edgekey.net, l-0005.l-msedge.net, www.microsoft.com-c-3.edgekey.net, ats.everesttech.net.akadns.net, dlc-shim.trafficmanager.net, e12671.dscd.akamaiedge.net, login.live.com, download.microsoft.com.edgekey.net, e16604.g.akamaiedge.net, main.dl.ms.akadns.net, update.googleapis.com, download.microsoft.com, www.gstatic.com, acctcdnvzeuno.azureedge.net, acctcdnvzeuno.ec.azureedge.net, san-ion.secure4.scene7.com.edgekey.net, fpt2.microsoft.com, fs.microsoft.com, acctcdnmsftuswe2.azureedge.net, content-autofill.googleapis.com, dual-a-0001.a-msedge.net, www.tm.v4.a.prd.aadg.akadns.net, cm.everesttec
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
VT rate limit hit for: Palworld.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3.215.173.68	https://www.resonn.link.walawalago.com/	Get hash	malicious	Unknown	Browse
3.215.173.68	http://sub.nabprotect-livechat.com/	Get hash	malicious	Unknown	Browse
13.107.246.41	http://y84x.mjt.lu/lnk/CAAABPdweCoAAAAAAAAAAAVG8MwAAAA6pnMAAAAAAAvpOQBlhIO4-ImJ1UImRBC5CNVIkLSaswAL-7Q/2/r-vXj7XjX0azsD7QNKNH-A/aHR0cHM6Ly9hcHBjZW50ZXIubXMvaW52aXRhdGlvbnMvb3JnL2IxNjM2ZDYzMTE0YTM0MjBkYWFmNTg4YTE5N2Y0N2MxNGY4ZDViNWMyM2ZjM2RhYTgxMWM0ODgwOWM1ZTZkNjQ	Get hash	malicious	Unknown	Browse	appcenter.ms/
13.107.246.41	http://url7816.acetaxi.com/ls/click?upn=k9eqZnPBEZmPVPka3LxS61O1ksdCJOgznvtiwccqzi2-2BneqvfCXEJ-2FQj-2BZo7snmCwDunBahf2LYhfs7qQp7-2F23xLStq-2BkxJ70xqVvyXzkWM-3D8Cie_z5TGfmB4A65PPE2hDgRdrx6OZsZ3AmrJLHJ0M9ePWeHP5QDTWsAVp117uXam9dNn-2BGSxHeP-2BInRF-2Bgy2v-2FXBPODjmLss6NRV2RYsUYD7um77hgLl0ET9pPGTHF-2BQ1m6-2Fw7-2B-2B9DJOpakZj874YLC8uUep0F7rZMDlM46gmHmQqqAeCV477M0h2b07T2IcXu0hzUcKftN0UG2jhPq8qo00cQl0gvOLl-2BjChyaOdLpENao-3D	Get hash	malicious	Unknown	Browse	twiliosolutions.azurefd.net/
34.206.180.7	https://arrowlumber.atlassian.net/wiki/external/ZGE5ODE2YmQ2NDk0NDc1Njk4YWFiZWMyZDk4NjE2NTk	Get hash	malicious	HTMLPhisher	Browse
34.206.180.7	https://ymcaspbc.atlassian.net/wiki/external/ODZmMGZkZmM2MGRiNGM3NTllNzc1YWM3MmNmNGM3ZGU	Get hash	malicious	Unknown	Browse
13.249.39.8	http://finecaptcha.azurewebsites.net	Get hash	malicious	Unknown	Browse
	https://prc-homes.uk/wp-images/26738903/content/Security_on_your_card_account.html	Get hash	malicious	HTMLPhisher	Browse
	American_Express_account_review_notifications.html	Get hash	malicious	HTMLPhisher	Browse
	https://pub-e9c42a3c33664feaa705bbb8f53b17d4.r2.dev/indexSecurity.html	Get hash	malicious	HTMLPhisher	Browse
	https://pub-136966ac6c4d472899a16103f84443bf.r2.dev/indexSecurity.html	Get hash	malicious	HTMLPhisher	Browse
104.18.25.173	RE Scales shared a file X298988876 (689Ko).msg	Get hash	malicious	Unknown	Browse
	https://metabrotato.com/	Get hash	malicious	Unknown	Browse
	https://t.ly/YNu39	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan-Spy.AgentTesla.19330.30734.exe	Get hash	malicious	Unknown	Browse
	http://googlechrome.com.cn	Get hash	malicious	Unknown	Browse
	https://hr-a65.pages.dev/account/js-reporting/?crumb=uZ4.07kERLI&message=javascript_not_enabled&ref=%2Faccount%2Fchallenge%2Fpassword	Get hash	malicious	HTMLPhisher	Browse
	https://nhh1.pages.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://outlook.office365.com/Encryption/retrieve.ashx?recipientemailaddress=calirm%40hinckleyallen.com&senderemailaddress=tbutler%40selecttile.com&senderorganization=AwF%2fAAAAAnsAAAADAQAAABwI7eyIdK1Fmg7tJT6AoKRPVT1uZWZpbmlzaC5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVBSMTBBMDA1LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT01ALHrYkuTtSqpa%2fBaTIIAhQ049Q29uZmlndXJhdGlvbixDTj1uZWZpbmlzaC5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVBSMTBBMDA1LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B&messageid=%3cMN2PR10MB354902DD4F9E7E374D653825C5732%40MN2PR10MB3549.namprd10.prod.outlook.com%3e&cfmRecipient=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40nefinish.onmicrosoft.com&consumerEncryption=false&senderorgid=36858cd5-f8d2-412e-9bf1-1695355a0ce6&urldecoded=1&e4e_sdata=S1q69%2byxUSz41CMA2XskYsk5wrxtq6jxddPK7VSa3cL9FPranF5%2fcI7gsG5FyjHiAJdM8aBbEOWOk8g8HcQJwyv1kPlY8ZQsMnS57qPSCWnbTWbRkg20LhzXqITTpTDSfyDJ6usXbPt6Ae54FMLGUoLUpmwhnYNBlyfuaOrfaFWzUDNYTYrDrVF6xGlQ5puWcwZF4HDbqhnWlPNwJP9Zn42UKnm9HnzXTdUR7N1WYF6Zoq1UkikerFXtOQzIcuLLNFM9rosdR4ZMytXXdEWc4X2b6YxKJMIuiJq5zIKWgqPblTHsJCnTz80n6rfH%2fj2xwfO805SSLx0znCBl5DwWqA%3d%3d	Get hash	malicious	Unknown	Browse
	http://url3948.rickhansen.com/ls/click?upn=mt-2BpP9XKXFpxyT-2BZ8LvZwhP2KGeLZ9ZHoGM7uEXarEHM-2F4pH7vF2AroIc8w3vogP7DCA23QFNJ-2FS5tN-2Boa7BLH6SFVy7yF-2FVVVe5ikUK79Un8TU-2BZEFJGaplFzK-2FxyWqS4KvVOjdYJwOmiJt4ruIx8u4WomIrwyj2GGANB3v-2BFU-3Dj7nI_BgO-2FprwtGDPWtmrD4vx2xz4oCnshrwZk15-2Bo65e53G8v781drlMU7eZysSj-2F2IkpdVlaNqXHBqo9jNpHNdlchXOSi4ldDUQd8zIkjqZSyOTOe8KQT-2Bg5bnI6I85b7QbMLnYqxsXkIfeAVS9G7v4rJL-2FoQxwfoJUD2Tlfkr7AnfSLwyl6Iy7ZVSAweeaPjBRhgfbxmEeOMLu5EMv825k9Gw-3D-3D	Get hash	malicious	Unknown	Browse
	http://mylovelybluesky.com	Get hash	malicious	Unknown	Browse
13.107.213.41	http://www.serviceadg.com	Get hash	malicious	Unknown	Browse	fr.linkedin.com/company/service-adg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bttrack.com	RE Scales shared a file X298988876 (689Ko).msg	Get hash	malicious	Unknown	Browse	192.132.33.68
	http://0a4m.webslotvip.xyz/4ynPva3260BhWs273ricfnufvcp14480RNJCKNHQEONTLNB689674ACCJ9307O12	Get hash	malicious	Unknown	Browse	192.132.33.67
	https://atadfsrgse.square.site/	Get hash	malicious	Unknown	Browse	192.132.33.67
	ATT00002.html	Get hash	malicious	HTMLPhisher	Browse	192.132.33.68
	https://trustwall.azurewebsites.net/	Get hash	malicious	Unknown	Browse	192.132.33.67
	https://metamafsk.azurewebsites.net/	Get hash	malicious	Unknown	Browse	192.132.33.69
	https://lidoe.azurewebsites.net/	Get hash	malicious	Unknown	Browse	192.132.33.69
	https://finecaptcha.azurewebsites.net	Get hash	malicious	Unknown	Browse	192.132.33.69
	http://finecaptcha.azurewebsites.net	Get hash	malicious	Unknown	Browse	192.132.33.67
	Env#U00edo CFDI FACTURA FFD - A8w1t0A4o3N7D86750507859.html	Get hash	malicious	Unknown	Browse	192.132.33.67
dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	https://protect-us.mimecast.com/s/WmtgC2krQxIovQN4I2X4tR?domain=click-notification.capitalone.com	Get hash	malicious	Unknown	Browse	52.204.246.173
	https://acrobat.adobe.com/id/urn%3Aaaid%3Asc%3AVA6C2%3Afddc3650-f6be-4ca6-aa21-9de68961e0e6/?x_api_client_id=loggedout_home&x_api_client_location=adobe&viewer%21megaVerb=group-edit&filetype=application%2Fpdf	Get hash	malicious	Unknown	Browse	54.156.241.118
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:e7f4c320-ba98-45d1-a439-22e568f28ba2	Get hash	malicious	Unknown	Browse	34.206.63.221
	RE Scales shared a file X298988876 (689Ko).msg	Get hash	malicious	Unknown	Browse	3.237.59.54
	http://52.216.221.32	Get hash	malicious	Unknown	Browse	34.201.247.102
	EbLVClBnSw.exe	Get hash	malicious	Unknown	Browse	54.172.142.205
	https://www.moneyket.link.sunfancal.com/	Get hash	malicious	Unknown	Browse	44.196.200.15
	https://www.moneyket.link.didiancj.com/	Get hash	malicious	Unknown	Browse	107.23.6.4
	https://www.moneyket.link.habonera.com/	Get hash	malicious	Unknown	Browse	50.17.221.242
	https://www.moneyket.link.kulouhui.com/	Get hash	malicious	Unknown	Browse	52.207.30.198
sni1gl.wpc.alphacdn.net	http:///lerimef473cubenecom.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	152.195.19.97
	https://outlook.cyberlab-x.com/mail	Get hash	malicious	Unknown	Browse	152.195.19.97
	https://vfiiexe.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	152.195.19.97
	https://u41337755.ct.sendgrid.net/ls/click?upn=waPHK9zMCe9R5IQlth8GGnaIAom8rqw3QLrA0U84y31o-2B5I-2B2z-2FOwiHOxNAlC5TxwiWz59DQO-2FtwZ95kKVkYBXYXKha-2FS3mhIGGqOQkgflo-3D5Reu_BgpgE-2FyPsk5g8yjzkBFYC9v5n7d0Px7Ih3MDQtp2m-2FWQw2Cuqr9s3IezsXHPKZDcA-2Bk-2Bkgf3ZPQBNt2r4nK1hXo13FK-2FB3Tln8CbIj7KovtJ9-2B8BYCPW6KD4lAGjxZWn8P2qrqLj9579eeFt-2BXlihfpiKBQ8WcQbJdP0nypZNWgGOQsJWRRLT3MphoI6GgPyAUbA-2BgZ6tK-2BDkBVHPFlgV5k4taF0blBGSiVDylWarKI-3D	Get hash	malicious	HTMLPhisher	Browse	152.195.19.97
	Audits_Distribution Notice.msg	Get hash	malicious	HTMLPhisher	Browse	152.195.19.97
	https://ad.doubleclick.net/clk;265186560;90846275;t;pc=%5BTPAS_ID%5D?//geniebroots%E3%80%82com/phpfile/rahc0c1ro5ianbggqwkdsf6ufnn7jolo15webcflp0bnelsrujohtelw4knxh4muirbbwpiqnmxhw6o71vktxvreda3oowswwrljf27it3s4puewrgrigembujrth68xupzhbegfezobam8bfk3mb02lfrpso4xqk2v5670icpargpmkvtelqoszhiqzhwjnv6aemhyk/anVlcmdlbi5zZWlkbGVyQGlwcm90ZXguZGU=	Get hash	malicious	HTMLPhisher	Browse	152.195.19.97
	https://ad.doubleclick.net/clk;265186560;90846275;t;pc=%5BTPAS_ID%5D?//putterbugs.com/site/wsde.basdfsd/d2FkZS5iYWxsYXJkQHN0b25lcmdyb3VwLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	152.195.19.97
	https://bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b%2C8d23fb3%2C492093b&p1=//cohostingcars.com%2Fincludi%2Flicences%2F35lddh/dGVzdEB0ZXN0LmNvbQ=	Get hash	malicious	HTMLPhisher	Browse	152.195.19.97
	https://1drv.ms/b/s!AtS4AT1e0BnKbeR4gH9MVXH2aYA	Get hash	malicious	Unknown	Browse	152.195.19.97
	ATT00002.html	Get hash	malicious	HTMLPhisher	Browse	152.195.19.97
global.px.quantserve.com	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:e7f4c320-ba98-45d1-a439-22e568f28ba2	Get hash	malicious	Unknown	Browse	192.184.69.239
	https://linsrancongbiknu.gq/?c=jydfn&s=687474703a2f2f646174696e6773722e636f6d2f6e65772f3f733d383426263732333030373730333535333838362664693d37672d3131342665643d73747526693d61646d696e38342c36353033382c44464f5832364073747564656e742e672d706973642e6f72672c4465766f6e2674733d31373036353537303230263738363238373132353235313235	Get hash	malicious	Unknown	Browse	192.184.69.252
	RE Scales shared a file X298988876 (689Ko).msg	Get hash	malicious	Unknown	Browse	192.184.68.166
	https://winscp.net/download/WinSCP-6.1.2-Setup.exe	Get hash	malicious	Unknown	Browse	192.184.69.215
	https://metabrotato.com/	Get hash	malicious	Unknown	Browse	192.184.69.252
	https://t.ly/YNu39	Get hash	malicious	Unknown	Browse	192.184.69.215
	http://0a4m.webslotvip.xyz/4ynPva3260BhWs273ricfnufvcp14480RNJCKNHQEONTLNB689674ACCJ9307O12	Get hash	malicious	Unknown	Browse	192.184.69.215
	Chepstow Hospital 2024.html	Get hash	malicious	Unknown	Browse	192.184.69.239
	https://atadfsrgse.square.site/	Get hash	malicious	Unknown	Browse	192.184.69.201
	http://googlechrome.com.cn	Get hash	malicious	Unknown	Browse	192.184.69.252
us-east-eb2.3lift.com	https://nclozif.cn/	Get hash	malicious	Unknown	Browse	35.71.139.29
	RE Scales shared a file X298988876 (689Ko).msg	Get hash	malicious	Unknown	Browse	35.71.139.29
	edge_x86_KB91412024.exe	Get hash	malicious	Unknown	Browse	52.223.22.214
	https://vip38.net/	Get hash	malicious	Unknown	Browse	35.71.139.29
	http://0a4m.webslotvip.xyz/4ynPva3260BhWs273ricfnufvcp14480RNJCKNHQEONTLNB689674ACCJ9307O12	Get hash	malicious	Unknown	Browse	52.223.22.214
	Chepstow Hospital 2024.html	Get hash	malicious	Unknown	Browse	52.223.22.214
	https://hr-a65.pages.dev/account/js-reporting/?crumb=uZ4.07kERLI&message=javascript_not_enabled&ref=%2Faccount%2Fchallenge%2Fpassword	Get hash	malicious	HTMLPhisher	Browse	52.223.22.214
	https://www.google.com/url?rct=j&sa=t&url=https://cricfit.com/know-everything-about-nassau-county-international-cricket-stadium-new-yorks-grand-venue/&ct=ga&cd=CAEYACoTMzQ2MjY3NDU4MDM1MTU0MjcyNjIaNDg2YTljMDhmODczN2NiODpjb206ZW46VVM&usg=AOvVaw1XZtMH-kXd__m5Ea_T5csP	Get hash	malicious	Unknown	Browse	52.223.22.214
	https://zoom-download.pics	Get hash	malicious	Unknown	Browse	52.223.22.214
	https://watchlivestreamall24.xyz/%C3%96ppningsevent-ny-butik/	Get hash	malicious	Unknown	Browse	52.223.22.214

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://falcon.us-2.crowdstrike.com/search/	Get hash	malicious	Unknown	Browse	35.164.131.68
	bot.arm6.elf	Get hash	malicious	Mirai	Browse	34.254.182.186
	https://www.canva.com/design/DAF7XjVVXrs/-M-ZAkUHHNvwgc7hHkRTJQ/view?utm_content=DAF7XjVVXrs&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	99.86.229.18
	xuPFIoUdut.exe	Get hash	malicious	Njrat	Browse	3.67.161.133
	R3ov8eFFFP.exe	Get hash	malicious	Njrat	Browse	18.197.239.5
	https://optout.oracle-zoominfo-notice.com/acton/ct/45126/s-00a2-2401/Bct/g-00e9/l-00e4:4e5156/ct2_0/1/lu?sid=TV2%3A77KSjIGlP&c=E,1,oEV6T_FZXfcwsLJPdLRKsm5UxG5l1_dNlD0IFImFpjO05VML-T178ZPmvZqk5ormfZ0PuJEmGpb9jj51uxHqZ7XbQK5xoBbVXlPrmcKyudGsVoZJQcz-cg,,&typo=1	Get hash	malicious	Unknown	Browse	52.85.151.27
	Disputes_2Pages-Fax (2).html	Get hash	malicious	Unknown	Browse	108.156.152.114
	Fax-847-0944.xlsx	Get hash	malicious	HTMLPhisher	Browse	99.86.229.114
	https://protect-us.mimecast.com/s/WmtgC2krQxIovQN4I2X4tR?domain=click-notification.capitalone.com	Get hash	malicious	Unknown	Browse	3.124.226.107
	Garfieldpolice_Receipt_823481010238.html	Get hash	malicious	HTMLPhisher	Browse	99.84.108.67
CLOUDFLARENETUS	http://klienref.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	EL76BXXsn2.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Xmrig, zgRAT	Browse	104.21.47.178
	K7wVV.vbs	Get hash	malicious	Unknown	Browse	104.22.52.71
	https://falcon.us-2.crowdstrike.com/search/	Get hash	malicious	Unknown	Browse	172.64.155.119
	https://www.canva.com/design/DAF7XjVVXrs/-M-ZAkUHHNvwgc7hHkRTJQ/view?utm_content=DAF7XjVVXrs&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.17.239.159
	file.exe	Get hash	malicious	Amadey, Fabookie, Glupteba, Stealc, Vidar	Browse	172.67.155.208
	HTTP://G3.RS:8080/AbAxXuAEis/op2yTFYQ8ljBBAMiL/CBCCBB204142611?fj54059	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://ecv.microsoft.com/zvxKfmNPZn	Get hash	malicious	HTMLPhisher	Browse	172.64.207.38
	https://link.mail.beehiiv.com/ls/click?upn=RJBLNjPHu2yKk-2Bu16K2FB3NBHFZoz97yjUwDDm-2FqWUaniKiHQ8kznOGZr1KyPDWb-2FcSrNdDqHTGUbfEK9WejqqsPTCaBIRy-2FczcE6GOqVHDDcD5SziBBsDXvKJj8DzCQiNEppuaFfPWlQG6bWZcxYM5y5ULuVGc4sFI1J4hnt2EYQspHuoiu9Ey-2Fxs9Oi3llwVTW_z-2BtqlVCnjZSGfdpo5Cb4PcEYh8VboE4TPRaGEZhhwsJcBz3D3KrX0EH-2Bin1-2F8dlB6mljS1nnpaWWJa7VlaLTeIDghSGeEKqtYyrIyNvJma38SRpT5U4k5CtKEXPg6odS6VIQ-2FCSCC3AcX6ZoTvNXIaQ1MQ4twV71OpBVk5P5cx6DgU12uGtemTVhPYmCGQiHnJEtztIuU9ZQ2aNx-2FYdWwPlWJ-2Bcv2nAtzB6lKK4zPT3fX9UQbasaJSMUBQnSzNo1t9ZgrKZkm2v5haTvnoViKkCXSnt1l7YsskjDMkD-2Bj3IH2DU8aT69iXF8XiCPC1rLZ9SbqPvmRvlOGNjYfCAff9q318RGxqNjiiHcmAdwv4DWF0RbH5lTIdAhQkvU21D6KIreh54W3NsC2aQ5fr-2B7jFA-2Fn7D52YnmgXV0hIRvsNSv6FUAv4pH6i6EcTpAvhWG	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://optout.oracle-zoominfo-notice.com/acton/ct/45126/s-00a2-2401/Bct/g-00e9/l-00e4:4e5156/ct0_0/1/ms?sid=TV2%3A77KSjIGlP&c=E,1,H-3I34XCofY7CF4iLd9q9505Lnh108c4c1QSwg7mHu3TUhi8HaN-c5B4E5BGKwmzPKEc7h-Ma-Mc5tw_999BWeVa_kzCI2Uw24xRcuxYnYYEa_L2BpDayMpTQw,,&typo=1	Get hash	malicious	Unknown	Browse	172.67.199.186
AMAZON-AESUS	https://falcon.us-2.crowdstrike.com/search/	Get hash	malicious	Unknown	Browse	50.16.211.97
	https://www.canva.com/design/DAF7XjVVXrs/-M-ZAkUHHNvwgc7hHkRTJQ/view?utm_content=DAF7XjVVXrs&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	52.203.149.164
	https://optout.oracle-zoominfo-notice.com/acton/ct/45126/s-00a2-2401/Bct/g-00e9/l-00e4:4e5156/ct0_0/1/ms?sid=TV2%3A77KSjIGlP&c=E,1,H-3I34XCofY7CF4iLd9q9505Lnh108c4c1QSwg7mHu3TUhi8HaN-c5B4E5BGKwmzPKEc7h-Ma-Mc5tw_999BWeVa_kzCI2Uw24xRcuxYnYYEa_L2BpDayMpTQw,,&typo=1	Get hash	malicious	Unknown	Browse	3.233.159.182
	https://optout.oracle-zoominfo-notice.com/acton/ct/45126/s-00a2-2401/Bct/g-00e9/l-00e4:4e5156/ct1_0/1/lu?sid=TV2%3A77KSjIGlP&c=E,1,LGDi1DUhY2tIeheA-u9shqcUMetsFVFGeYy5XaiToSP9iPBdeiUA1tQCqV2canPEUMoaxPpIFMwKbQaigZTkU36yAW_0YmJTjPT-IU9c&typo=1	Get hash	malicious	Unknown	Browse	3.233.155.103
	https://control-eligibility-657302.netlify.app/case-2000048	Get hash	malicious	Unknown	Browse	54.84.236.175
	https://protect-us.mimecast.com/s/WmtgC2krQxIovQN4I2X4tR?domain=click-notification.capitalone.com	Get hash	malicious	Unknown	Browse	52.204.246.173
	Garfieldpolice_Receipt_823481010238.html	Get hash	malicious	HTMLPhisher	Browse	23.22.173.247
	https://ad.doubleclick.net/clk;265186560;90846275;t;pc=%5BTPAS_ID%5D?//b3groover.com/html/xtml/3jv6hhtqoycydubawq4q0vkugtsynvny48qryppx7dhenfjqlwkk6qcqxsvbp7bq346ltip18tnamlwgiy2ulkd1zvmqe5oublogi1mrebjnrbytt634ropk41uqpmdplsjbqshs1l4nlmna1m81gbqowtvmkuiezp8cyyauc2aqgm6luxzldz6xgq3rficooly7z7i7/YW5kcmV3LmRvc3NAc3VtbWl0YmhjLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	23.22.173.247
	https://t.ly/vUxxB	Get hash	malicious	Unknown	Browse	34.203.143.4
	https://www.bing.com/ck/a?!&&p=bd0766a2437219cbJmltdHM9MTcwNjQ4NjQwMCZpZ3VpZD0xMmI2NWRiOC0xMDdlLTYxYmYtMGUxMS00ZTQ0MTExNDYwNzYmaW5zaWQ9NTE5Mg&ptn=3&ver=2&hsh=3&fclid=12b65db8-107e-61bf-0e11-4e4411146076&psq=rayautox.co.za&u=a1aHR0cDovL3d3dy5yYXlhdXRveC5jby56YS8&ntb=1	Get hash	malicious	Unknown	Browse	35.168.166.60
AMAZON-AESUS	https://falcon.us-2.crowdstrike.com/search/	Get hash	malicious	Unknown	Browse	50.16.211.97
	https://www.canva.com/design/DAF7XjVVXrs/-M-ZAkUHHNvwgc7hHkRTJQ/view?utm_content=DAF7XjVVXrs&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	52.203.149.164
	https://optout.oracle-zoominfo-notice.com/acton/ct/45126/s-00a2-2401/Bct/g-00e9/l-00e4:4e5156/ct0_0/1/ms?sid=TV2%3A77KSjIGlP&c=E,1,H-3I34XCofY7CF4iLd9q9505Lnh108c4c1QSwg7mHu3TUhi8HaN-c5B4E5BGKwmzPKEc7h-Ma-Mc5tw_999BWeVa_kzCI2Uw24xRcuxYnYYEa_L2BpDayMpTQw,,&typo=1	Get hash	malicious	Unknown	Browse	3.233.159.182
	https://optout.oracle-zoominfo-notice.com/acton/ct/45126/s-00a2-2401/Bct/g-00e9/l-00e4:4e5156/ct1_0/1/lu?sid=TV2%3A77KSjIGlP&c=E,1,LGDi1DUhY2tIeheA-u9shqcUMetsFVFGeYy5XaiToSP9iPBdeiUA1tQCqV2canPEUMoaxPpIFMwKbQaigZTkU36yAW_0YmJTjPT-IU9c&typo=1	Get hash	malicious	Unknown	Browse	3.233.155.103
	https://control-eligibility-657302.netlify.app/case-2000048	Get hash	malicious	Unknown	Browse	54.84.236.175
	https://protect-us.mimecast.com/s/WmtgC2krQxIovQN4I2X4tR?domain=click-notification.capitalone.com	Get hash	malicious	Unknown	Browse	52.204.246.173
	Garfieldpolice_Receipt_823481010238.html	Get hash	malicious	HTMLPhisher	Browse	23.22.173.247
	https://ad.doubleclick.net/clk;265186560;90846275;t;pc=%5BTPAS_ID%5D?//b3groover.com/html/xtml/3jv6hhtqoycydubawq4q0vkugtsynvny48qryppx7dhenfjqlwkk6qcqxsvbp7bq346ltip18tnamlwgiy2ulkd1zvmqe5oublogi1mrebjnrbytt634ropk41uqpmdplsjbqshs1l4nlmna1m81gbqowtvmkuiezp8cyyauc2aqgm6luxzldz6xgq3rficooly7z7i7/YW5kcmV3LmRvc3NAc3VtbWl0YmhjLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	23.22.173.247
	https://t.ly/vUxxB	Get hash	malicious	Unknown	Browse	34.203.143.4
	https://www.bing.com/ck/a?!&&p=bd0766a2437219cbJmltdHM9MTcwNjQ4NjQwMCZpZ3VpZD0xMmI2NWRiOC0xMDdlLTYxYmYtMGUxMS00ZTQ0MTExNDYwNzYmaW5zaWQ9NTE5Mg&ptn=3&ver=2&hsh=3&fclid=12b65db8-107e-61bf-0e11-4e4411146076&psq=rayautox.co.za&u=a1aHR0cDovL3d3dy5yYXlhdXRveC5jby56YS8&ntb=1	Get hash	malicious	Unknown	Browse	35.168.166.60
MICROSOFT-CORP-MSN-AS-BLOCKUS	EL76BXXsn2.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Xmrig, zgRAT	Browse	20.79.30.95
	https://falcon.us-2.crowdstrike.com/search/	Get hash	malicious	Unknown	Browse	13.107.246.40
	http://ecv.microsoft.com/zvxKfmNPZn	Get hash	malicious	HTMLPhisher	Browse	13.107.226.41
	file.exe	Get hash	malicious	RedLine	Browse	20.79.30.95
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=xyUGhl2bVUOmtShFGwg2LZ3FKIMjX35GvVD59jUPGMhUMFE3N1ZDNUlKUkZDNkRZUlJQQUdYSDBPTi4u	Get hash	malicious	Unknown	Browse	13.107.213.41
	https://9fbb8547.dc08e5abf96b10f3ab21bd72.workers.dev	Get hash	malicious	HTMLPhisher	Browse	52.96.183.226
	https://ecv.microsoft.com/sQaG6Mh4Hv	Get hash	malicious	Unknown	Browse	13.107.213.41
	Fax-847-0944.xlsx	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	Specifications & Profile Drawings For Ascential Tech (3).html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	https://ecv.microsoft.com/DqwsPYDrNh	Get hash	malicious	Unknown	Browse	13.107.246.41
MICROSOFT-CORP-MSN-AS-BLOCKUS	EL76BXXsn2.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Xmrig, zgRAT	Browse	20.79.30.95
	https://falcon.us-2.crowdstrike.com/search/	Get hash	malicious	Unknown	Browse	13.107.246.40
	http://ecv.microsoft.com/zvxKfmNPZn	Get hash	malicious	HTMLPhisher	Browse	13.107.226.41
	file.exe	Get hash	malicious	RedLine	Browse	20.79.30.95
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=xyUGhl2bVUOmtShFGwg2LZ3FKIMjX35GvVD59jUPGMhUMFE3N1ZDNUlKUkZDNkRZUlJQQUdYSDBPTi4u	Get hash	malicious	Unknown	Browse	13.107.213.41
	https://9fbb8547.dc08e5abf96b10f3ab21bd72.workers.dev	Get hash	malicious	HTMLPhisher	Browse	52.96.183.226
	https://ecv.microsoft.com/sQaG6Mh4Hv	Get hash	malicious	Unknown	Browse	13.107.213.41
	Fax-847-0944.xlsx	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	Specifications & Profile Drawings For Ascential Tech (3).html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	https://ecv.microsoft.com/DqwsPYDrNh	Get hash	malicious	Unknown	Browse	13.107.246.41

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://klienref.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	173.222.162.58 204.79.197.222 52.165.165.26
	http://ripnoticebook.com/cdn-vs/cache.php	Get hash	malicious	Unknown	Browse	173.222.162.58 204.79.197.222 52.165.165.26
	https://falcon.us-2.crowdstrike.com/search/	Get hash	malicious	Unknown	Browse	173.222.162.58 204.79.197.222 52.165.165.26
	statement.html	Get hash	malicious	Unknown	Browse	173.222.162.58 204.79.197.222 52.165.165.26
	https://www.canva.com/design/DAF7XjVVXrs/-M-ZAkUHHNvwgc7hHkRTJQ/view?utm_content=DAF7XjVVXrs&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	173.222.162.58 204.79.197.222 52.165.165.26
	https://link.mail.beehiiv.com/ls/click?upn=RJBLNjPHu2yKk-2Bu16K2FB3NBHFZoz97yjUwDDm-2FqWUaniKiHQ8kznOGZr1KyPDWb-2FcSrNdDqHTGUbfEK9WejqqsPTCaBIRy-2FczcE6GOqVHDDcD5SziBBsDXvKJj8DzCQiNEppuaFfPWlQG6bWZcxYM5y5ULuVGc4sFI1J4hnt2EYQspHuoiu9Ey-2Fxs9Oi3llwVTW_z-2BtqlVCnjZSGfdpo5Cb4PcEYh8VboE4TPRaGEZhhwsJcBz3D3KrX0EH-2Bin1-2F8dlB6mljS1nnpaWWJa7VlaLTeIDghSGeEKqtYyrIyNvJma38SRpT5U4k5CtKEXPg6odS6VIQ-2FCSCC3AcX6ZoTvNXIaQ1MQ4twV71OpBVk5P5cx6DgU12uGtemTVhPYmCGQiHnJEtztIuU9ZQ2aNx-2FYdWwPlWJ-2Bcv2nAtzB6lKK4zPT3fX9UQbasaJSMUBQnSzNo1t9ZgrKZkm2v5haTvnoViKkCXSnt1l7YsskjDMkD-2Bj3IH2DU8aT69iXF8XiCPC1rLZ9SbqPvmRvlOGNjYfCAff9q318RGxqNjiiHcmAdwv4DWF0RbH5lTIdAhQkvU21D6KIreh54W3NsC2aQ5fr-2B7jFA-2Fn7D52YnmgXV0hIRvsNSv6FUAv4pH6i6EcTpAvhWG	Get hash	malicious	HTMLPhisher	Browse	173.222.162.58 204.79.197.222 52.165.165.26
	https://optout.oracle-zoominfo-notice.com/acton/ct/45126/s-00a2-2401/Bct/g-00e9/l-00e4:4e5156/ct2_0/1/lu?sid=TV2%3A77KSjIGlP&c=E,1,oEV6T_FZXfcwsLJPdLRKsm5UxG5l1_dNlD0IFImFpjO05VML-T178ZPmvZqk5ormfZ0PuJEmGpb9jj51uxHqZ7XbQK5xoBbVXlPrmcKyudGsVoZJQcz-cg,,&typo=1	Get hash	malicious	Unknown	Browse	173.222.162.58 204.79.197.222 52.165.165.26
	https://optout.oracle-zoominfo-notice.com/acton/ct/45126/s-00a2-2401/Bct/g-00e9/l-00e4:4e5156/ct0_0/1/ms?sid=TV2%3A77KSjIGlP&c=E,1,H-3I34XCofY7CF4iLd9q9505Lnh108c4c1QSwg7mHu3TUhi8HaN-c5B4E5BGKwmzPKEc7h-Ma-Mc5tw_999BWeVa_kzCI2Uw24xRcuxYnYYEa_L2BpDayMpTQw,,&typo=1	Get hash	malicious	Unknown	Browse	173.222.162.58 204.79.197.222 52.165.165.26
	https://optout.oracle-zoominfo-notice.com/acton/ct/45126/s-00a2-2401/Bct/g-00e9/l-00e4:4e5156/ct1_0/1/lu?sid=TV2%3A77KSjIGlP&c=E,1,LGDi1DUhY2tIeheA-u9shqcUMetsFVFGeYy5XaiToSP9iPBdeiUA1tQCqV2canPEUMoaxPpIFMwKbQaigZTkU36yAW_0YmJTjPT-IU9c&typo=1	Get hash	malicious	Unknown	Browse	173.222.162.58 204.79.197.222 52.165.165.26
	https://transfer-sdksechr.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	173.222.162.58 204.79.197.222 52.165.165.26

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup.dll	5b1cxnTnnS.exe	Get hash	malicious	Unknown	Browse
	JITStarter.exe	Get hash	malicious	Unknown	Browse
	JITStarter.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup32.dll	5b1cxnTnnS.exe	Get hash	malicious	Unknown	Browse
	JITStarter.exe	Get hash	malicious	Unknown	Browse
	JITStarter.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Apr2007_xinput_x64[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 90857 bytes, 6 files, at 0x44 +A "xinput1_3_x64.cat" +A "xinput1_3.dll", flags 0x4, ID 9350, number 1, extra bytes 20 in head, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	100025
Entropy (8bit):	7.988437274786544
Encrypted:	false
SSDEEP:	3072:Mt5OSvuXSf2rbZu4Kmsr4eLRwPC5B9y7q:MTOBXSSpFI4/PM/ye
MD5:	FAE84E0773A74F367124C6D871516B7B
SHA1:	CAF8B9D7D4AF965BF445D052D1E835B680D6BBC3
SHA-256:	86EE073C199B5080FE4F5BE6AC24BB1117FEA42E4BBCD828B4F0EC26C669B22C
SHA-512:	CAF1381CAE7417B57FAEF56D0023BF90C90406748F8813AB85C687DDB81E2498D2F1D5F4BC154903FD5A19836E6F245CD6F5D3927A383F1ACC3BCC41B58FD09B
Malicious:	false
Reputation:	low
Preview:	MSCF.....b......D................$...........b...#...................(.........6+. .xinput1_3_x64.cat.h....(.....6. .xinput1_3.dll.h..........6.. .infinst.exe.\...h......6H. .apr2007_xinput_x64.inf............6G. .xinput1_3_x64.inf.....a......6H. .xinput1_3_x64_xp.inf...<.6..CK.\.\S.?....H3`@....B.....t.....D!.! " ].{..`AW........b.k/(....fNN ..z.}...g..of.7...\|3#.]4.j...."V.;u.".,..t....... o.!G4.G.<........!.I.P.'..t-B..T.N5...U.......2..S.....:....Ju.S.Q..v"D%..y.KR..B...a (.4.....7......x!L.\..u@.@...B.-G0......A..g...Dj8.j..L.X.."0."...^...kP.&@.}.....PP..k.p..\|.`..P..D"... .H.1.h.^.G...#...+Ls..7..!qH."@..."..;,....Iz;u.t....>..Ki.y.~.5M`)SR(..$....&P:........-F...@....-..C.&V....N...Z..!....~.....{X"eo.5.D6.u...Y.9...8.......pg8....g....4....j@.S..T..C.H..7..ID...!.HP}.....7U..@?1".yMi....aA.....[..&.M.0A..'L,.q. 6`..DZ...i2.t..(Sw...e..X..6 ..y$...>....D.&R......>....~..U.Z...X.B.5:HAn.IU..[ ..MH...8..Tgg'.H.G$H.$........)a...E b.y.>........t.....dF.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Aug2005_d3dx9_27_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1071684 bytes, 5 files, at 0x44 +A "d3dx9_27_x86.cat" +A "d3dx9_27.dll", flags 0x4, ID 6926, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1080852
Entropy (8bit):	7.999138982152864
Encrypted:	true
SSDEEP:	24576:sP2N00PXWcq4UsDMMlsOgDUaQFMBZ0To2xIG:sP2CuZQsVl96fQiZMo2xz
MD5:	3E91448A7481A78318DCE123790EE31A
SHA1:	AE5FE894790624BAD3E59234577E5CB009196FDF
SHA-256:	8C062B22DC2814D4F426827B4BF8CFD95989FD986FB3AAA23438A485EE748D6D
SHA-512:	F8318BD7CA4271FC328D19428E4688DA898B6D7FB56CC185AD661D4A18C8169392C63515D7DD2D0B65CBD1F23892D7A0A5D3D77A4CDA6230BA03B3B917E5C39A
Malicious:	true
Reputation:	low
Preview:	MSCF....DZ......D...........................DZ...#..............H...<..........2.. .d3dx9_27_x86.cat..d#.<......2b. .d3dx9_27.dll.......#....2.. .aug2005_d3dx9_27_x86.inf.......#....2.. .d3dx9_27_w9x.inf.....p.#....2.. .d3dx9_27_x86.inf.]Z...>..CK..X.[...C.)...1(v.).. 3."J.P.. @(.&.Y..v...].....{.cW.$("..w.....yN<?v.5k.......q.Y..0......Z&.9N.!.....f.0.X...9b......fF......iL..+c...ff.tx.f....no.II...2.LO6..arY...u..PZM..9.6f..H.<...._..G".K.1...R.I..\|......=!....\O}<[/E.#..>.......+...........v!..C..:..Q.$.....s....LD.Q.i....h....b..aB3c.a.b.W..c.151/,./r.rD>...(.i..%!.......\.......Sn.\|t.[{F..Mq..\..5.d......J....J.3&....jN../S_N...Qg...gA..3..:...T.0f7.k..&.a.{o.+.j....:..j.f.s..54..`.}..g......?h....bf...w.(......C)(...$.........gJ~..`.;..P>...e.......c.C..@K...d0.@M0(.YM$.y..78..U.Y...J........W......A.04)...&4..{?....Ce..W.;..0m..x.9......n....Io!.!.>...o.......],OQ..0.Q..[KR5QrU.2)I...m.kU."<^..S..3.Q.....".b.F..UF.uJ....:lZ...p.2.R.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Aug2006_xinput_x64[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 81182 bytes, 5 files, at 0x44 +A "xinput1_2_x64.cat" +A "xinput1_2.dll", flags 0x4, ID 7454, number 1, extra bytes 20 in head, 5 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	90350
Entropy (8bit):	7.985841057262195
Encrypted:	false
SSDEEP:	1536:5lQFOMW9t2gGQtmxC4LbB8GXjgvW/j44krD+W2MLdk6v5yO1Ha6DB/4RPjz6ITda:rIOMWm+tmnbXjVkWW1lgO166cjz6z
MD5:	A9D582E44E46E36F37EDB7CBC761179D
SHA1:	ED1BEF64385E94CE89AFA704D38408E23B31FA79
SHA-256:	C26633D38E0A91B9BE70382E916A83D50E219609F7E05CFB2D27DFAFBE480B43
SHA-512:	20011BFB547DEDCE8E6FCEDA22C3A3A83DB140E8A20844F3B0E8741B4474C1FEA73D84708B801E83EAE3CD2D8A2D6C851C3F7CD0154C0382A78BC2C2DF6B01E5
Malicious:	false
Reputation:	low
Preview:	MSCF.....=......D............................=...#.............................4.R .xinput1_2_x64.cat..G.........4.K .xinput1_2.dll......f.....4.K .infinst.exe.V...'m.....4}R .aug2006_xinput_x64.inf.....}p.....4}R .xinput1_2_x64.inf....%p9..CK.[.\SI.....I..1`D...]A......A....D .)4........E]...`.....^VV.........{.\.]......~./w.9s...9sf.E..k.....l@...Y.......Cu4.....t......I.Q.<u)ey...k1...K0.)....u..+..{..&...Z....@=].X....'..$qD...y.kZ.+..O..x .....F.@..........A.wd..........;......<@i.. ..s(G..J..".q.#..c.u...=.H<"A.H..C..;.>....43V.4..1y.;..j.yK"F}.F..#.RY.h.u.2.....p.C...u...b.:..E1.?f........H@]..;..DfR.T.%..-.....h....@...;...Z=@..pGb.b... .........n.....b>...R~...J...X...0.?..P7..........p6."/=.Z mI.r..X..x...ey...m#.>Pi.ZY.".....Xi..B..S.....7....=P7k}L..."bB.....;.....)...;..L...`B.PG.8.d..q....e.E....D.T.$..H..X.A..,6..y.\|..4...x...K.....o...6`mB.T+.B..0..[..Q4MS.D?.9j.+...<..'.0.9"...5.l-S...8.#H..XF..puM5#.8.R..7..2.L.p..'....\../.....a....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Aug2009_D3DCompiler_42_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 894638 bytes, 5 files, at 0x44 "D3DCompiler_42.dll" "D3DCompiler_42_x86.cat", flags 0x4, ID 10010, number 1, extra bytes 20 in head, 61 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	903806
Entropy (8bit):	7.998441664012848
Encrypted:	true
SSDEEP:	24576:kWl8lkb28nNHiYNk9tb59zmj000KFiBudeBsbgy:No8NHi7/pAJioEy
MD5:	87BDAE64FD47A75F867A290EC7B8A4B7
SHA1:	DD9E69E1815E8BC161E8EB89A0F2A296074BB95D
SHA-256:	6BD32337826F5A5141FC06391919A249E984150905C2546DC8BFC33D41A24E82
SHA-512:	C8F7A490722741DF4E03823880C6D623FF16AB648A40C1B1C8F7BF26C92499EB34C4596BF239337CD23A57974757958AD9A30D42A4141DC0E7522F998ED3893A
Malicious:	true
Preview:	MSCF............D................'...............#..............=...X!........$;....D3DCompiler_42.dll.....X!....$;...D3DCompiler_42_x86.cat.!....;....$;...D3DCompiler_42_x86.inf.<....>....$;...D3DCompiler_42_x86_xp.inf.....4A....$;...AUG2009_D3DCompiler_42_x86.inf. ..$..CK.Zyx...?..P....%i..@.mh...,e.Y...5...&.!K).Pe.........;..zq.j... ./..s./dR...=.}.....y.o....93I;.+X.c,.....-Ln..o.)z.<.m..F..e...s.\|a....!w@...A=..jj(.T}A.j.j@.j..=...c...=...m.....m...m...6.h.o...[....m.h.k+...s<./F.R.'.<..7Vs...f.......]..M...O6.NVD....o.{v...-.ub..........5..q."....V6..m..B._l..w...mI....j.S...mdlG.c..0.*U.p.. ..?.;"ZS..}?b\\|...=.<...q...Wb.s..9..:.VG(......ExM.w.Mp.4.N..g...Vjg..7./\nG....Wyn..l.."..;..6...v....S....b1.Y...^..Sk..P....vRl.x..!.u..)Z(B.u.gQL.(...R0..../)>.x...<..d.3(..h.h.XE...."......}T.....(.S<O.(....(n......\|......b&.....E.y....),.m{ml7.7..S.G.....[(.S..XE.L..Hc.L...6.w(vR\|C...."......y.........M....o..-.....[.h.b....V4.I9...D.As..]h....).]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Aug2009_d3dx9_42_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 722496 bytes, 5 files, at 0x44 "d3dx9_42.dll" "d3dx9_42_x86.cat", flags 0x4, ID 7080, number 1, extra bytes 20 in head, 59 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	731664
Entropy (8bit):	7.999475174279291
Encrypted:	true
SSDEEP:	12288:IDTg2rIyRKFAtmsFp1UChyax+LFl9NiHEpMH5Vfe8PIqEqnyA6F56J2:M02fKYVFvhKLFl9NikiH5V28PXyA6GJ2
MD5:	9BC8213933598D050827D20A4573486C
SHA1:	E6F9BA62756A00C53746419DEA221881AEB336CF
SHA-256:	9C96B6FC4DF5C0EFCA9F0D653976772B2B964243214F99066E4CA4AA6DF791DD
SHA-512:	A1920D042963CDDA41DF44044DE5B94B4CEE6EFA102F633214E384918D93D2D6A31EB388BDBD00C7E9C199281E3B71CAA5242E9A42E7F0BE27EDF90A3CF6890C
Malicious:	true
Preview:	MSCF....@.......D...........................@....#..............;...X.........$;....d3dx9_42.dll.....X.....$;...d3dx9_42_x86.cat...........$;...d3dx9_42_x86.inf.,.........$;...d3dx9_42_x86_xp.inf.\.........$;...AUG2009_d3dx9_42_x86.inf.....::..[.... .......5!.P..wO.n..pOc....7...l.c.n..slmk]....]...B..W..D..UJ...P........C.......l8..y^.S.N.I..7%.....].n...d...>.#....zT{6+..X.UB. AA......u7{0...n. ....d..R....=...D...F.......n..n..~U.]..U.EX, .......A^;...(...<.@#0/..O.!...i.#.C....D...D.cwC.v.y.<+.....g.l....f.k...W...[..I&...M..W.&Z..^..MB...:.LyQv.l.U.=Y..%....8Ls.......-..".U.....s.f.YVvX...-..8T..m...=..9.CN!89....f.2.G.....:s.G...>.......c^.Z..=h.l..Q..w..yc.\i.Z.^...$cw.T.".d`.jhL;.ZqB.L.{...Z....h{=s.....a.4.1../..`....\|;I...;...$.m!l'.g..pa.).b0..:.tT...T..{..<..T.....z.....!....,..\|.@.../..A.....q.......@.....................\|..5...[..p.6....FE.../.609$.....+.Q.f.N3.....L; ..6./.j.4.a.E2....(G0,...x..5...IBS.._......9.....%0.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Jun2007_d3dx9_34_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1601326 bytes, 5 files, at 0x44 +A "d3dx9_34_x86.cat" +A "d3dx9_34.dll", flags 0x4, ID 7195, number 1, extra bytes 20 in head, 108 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1610494
Entropy (8bit):	7.999066428256981
Encrypted:	true
SSDEEP:	24576:ZBdkB3TM+mIf4qyM0iJRy3QvQDxPYKhatPJZcg9QwJeYX34eq2F37kRVeLbdiL3q:ZPU3TMXxDVI3vQ2KSBP4YH4aAELbdK3q
MD5:	FE8FEB215FAE59866DCD68C1604D97AA
SHA1:	CEDACA678D15E78AA458B965ABB467E8964A1FAB
SHA-256:	1C1E1C6F68BA556A0AF09A38C32EB421C543A4848C4B42D25867C98DAB3B3A50
SHA-512:	9955336B561E4FD3BA3DA7FC086643E811048A25A7E68344D2CC5CAB091980BAAE1C04CE41328B59C896662E2875886B78EC869852B2D1DAAA46AF38C894A3F2
Malicious:	true
Preview:	MSCF.....o......D............................o...#..............l....(.........6.. .d3dx9_34_x86.cat.h_5..(.....6.. .d3dx9_34.dll.......5....6.. .d3dx9_34_x86.inf.,.....5....6.. .d3dx9_34_x86_xp.inf.\...7.5....6.. .jun2007_d3dx9_34_x86.inf.A.".l>..CK..\...;T.D...1.(.`...2CH..........`.UD.....b.;va.;6...w.{.f.l..9.....w?..=k....=.;..........Zh.....<m--.....^..:.z.#_g.~.>.Z.Z..C..\|...5..J.P..JKK.(.0...>+.G..~.hy{c....b2.,..!..?E.&.j.1.u.=.1.B...q...p..>...q.Y....x..\6.uB......>........A..A.f.1..{v.Z...F.F.\|:.[.Z!..@$.IA.H""ET.J.c.........d..G.....\...xco.#.G......`k?d..E..s...B,........O.0(?..r.......TD..y.W..FkkkC+i...&..!@... ..xP_>(#!...b.O.>,P.8d......lM>..R-t...[.lm2.WS\|.u..._.K/.3.3.~.1a....+....q....o.M.O>o..Y...O/..B.y_...V..5..5..$#~.+.H..5.B.tu...../.......\|.[.(5q.YT5...II..@K._.d0.@M (.U.p...J.!Q_....5.....O....?].k.)..3.u.an}.....6A. .]].....rg....Z.0...}...u.....P$geq..]t/......e.JE."VE.(...LhNu..(...L!g.0...:m:...V(T4~.^...2...y

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Jun2008_d3dx9_38_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1457918 bytes, 5 files, at 0x44 "d3dx9_38.dll" "d3dx9_38_x86.cat", flags 0x4, ID 7184, number 1, extra bytes 20 in head, 118 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1467086
Entropy (8bit):	7.999726422350297
Encrypted:	true
SSDEEP:	24576:HGIly6o6H1kEznWRpKpx5A0SBF/VnjmkC8nAMzh08qF4QH5/RSzsExkqv4Q9hHi0:Hh46Tn/UXVjmiJlO4sVRSzdk5uhCbOka
MD5:	E2FB2E37C342983493C776BD81943978
SHA1:	2A8F3C45CF979966D4D4D42A4D34F05C72C7E29E
SHA-256:	57E57A6348E55AAACA6BED5E27BBDD0A4BD0DDE69C77F4D26C805BE6384BE927
SHA-512:	2D297F607C5A098A3D2B19E7F88AA12F720AF3C23FE6DDCE7D4659A9184D1CF8F8A76F35B8ACB639B48CDAD8998C919215A03B89207E2BB1829EA3D8A9EFB95A
Malicious:	true
Preview:	MSCF.....>......D............................>...#..............v.....:........8wq..d3dx9_38.dll.<'....:....8.r..d3dx9_38_x86.cat.....D.:....8.r..d3dx9_38_x86.inf.,...O.:....8.r..d3dx9_38_x86_xp.inf.\...{.:....8.r..Jun2008_d3dx9_38_x86.inf. .,:..[.... .,......$Q.f...<....B..W...WWRT%.,..6mZ....k.!H}_.aAkk..C..............Z...1.5.!....S.-.Uy....# ...g....3...q.u.N..Nz.2Zq..D..+r."S9..ZT$.QD...UM..4......P....@...f.h...}..l7.{l.e7..#.b.$_...Q_...#......CC@)@......@......1...`....D.$m....wgg...B...n..E..{x,u.{.VK.;:.7.M$IO3v.u..v.p.%...N.X/.:Q..E...(/n..%Y...."..X.)}U.5...9F\.C>.....9..L.1.T.....4I.$R...5.L'.e.H.`.....H.._....9...XQS....r..>H.Gw..I.}.I...S.M.#Q....a[.....C.o...HR6\|..#....Ccu.^....=...f.N..LH.nMzk.k.....k..V..S..^.^,BdOQ.E..^.q..y.z.A{x..g8....i.....l.....f...a,..\xzC...r.@...C~....\.....!8..)....ZU ..%.e.xG..<.i.....yVH.AA......M.F....Ph..,.Uap.....9...-...v.V.... \|..*......X...6....P...,.K.O.Qe...).]`..C..............,..+.q.........w...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Jun2010_d3dcsx_43_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 756228 bytes, 5 files, at 0x44 "d3dcsx_43.dll" "d3dcsx_43_x86.cat", flags 0x4, ID 7878, number 1, extra bytes 20 in head, 58 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	765396
Entropy (8bit):	7.996955154936438
Encrypted:	true
SSDEEP:	12288:C8Dx0/99rEneJVyrxcsaWmeUEEBTJNCK/FcZZXlewc3/2tqCyrIUl3z82ItDwh2Z:XDO19AVrRfEHNZWZrs3+ICyco3MDISTT
MD5:	E34C0CF1BD5A68C80BDC709A452EB322
SHA1:	4DD4553EC7E2E42D51A716B1F4CB58588BCAA164
SHA-256:	799B517227812252481C9C9B22CF16FF185FFC20B9273612C8A37153B53AAD93
SHA-512:	3488A52F6FD3681B10624546B923368245F969330D4909E91C5B58F159CD24B258A8A2274D62243CA5CA9F1FB40F9F248B3BD92283F775DD24BAF68ECC5FD03D
Malicious:	true
Preview:	MSCF............D................................#..............:...`..........<!]..d3dcsx_43.dll.....`......<B'..d3dcsx_43_x86.cat...........<.&..d3dcsx_43_x86.inf.(..........<.&..d3dcsx_43_x86_xp.inf.c..........<.&..JUN2010_d3dcsx_43_x86.inf.UR.....CK.{t.e.....6.I.Zp....a/.v.U#.Hi.%..V.f......&[(. .R..l.Tm4VA..."..-JA.Z.@....J.....x.....$.\|..y\|....fv7..._..wf.-.N.QJ..z.......Q.....<aG....=5.K...,......^.....]]....`..`GWp.9........S..c...>9kG.P.M...\......^O..[:.7.5..s.....\|.........#.\|.....TS.Xu0.....W.5.J...G....{.....8.E...J.:B..l...9...........E..Q..'8j.....u.a.V.T.$Y.....O.V..?.HW.._..........rMiA..g.;r....M'.Iy>9Z...!Y.sF.'......<.}..<......X....o;5..T.,..g.3\|.....\....QOK.#5 .Vj....3."R'J...z.Q......n..R}R.K.J.:Ej...uHj..CR;.6K...>...QWK.Im..U.A.g...'.N..J.,..j.:Kj.....R.H]..Nj.TV~6#.Tj.T.T...R.R..;j...R.H.H....\|.5..'.d...z.kU.eR....z..d.......PO.6..J....ZT...t8T..d...D8.ji2.Lf$..lGw....7^s............k.j.q/...\.f..}ek'....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Nov2007_d3dx9_36_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1703400 bytes, 5 files, at 0x44 +A "d3dx9_36_x86.cat" +A "d3dx9_36.dll", flags 0x4, ID 7211, number 1, extra bytes 20 in head, 115 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1712568
Entropy (8bit):	7.999078652914364
Encrypted:	true
SSDEEP:	24576:fMb9V3TN8vuaBYlFhEbpdjRsI+CpoUjrn++qWYxhiUX21LVpmI9P2BZbcNU7YBP1:kJEvlmFMpdj/Npocz++q3X2tnLAcm0Bt
MD5:	C5E127067EE6CACDD2F8962E6005542E
SHA1:	22C571E4DA75A6E5DFE02E3E3587F40C2939C745
SHA-256:	F52CC1304B533083B3FC5553C49433C0E4E46D66D567B9DE0B558CA518DB1544
SHA-512:	E70DF11AF8CB5D51C3111B8327371EA40292580F06D7D265F2449B89A4941C4740BDE904367FBCB4158512939BBD7C7A3DC20D3642475789FC075A2AE8E27860
Malicious:	true
Preview:	MSCF............D...............+................#..............s...>'........V7.. .d3dx9_36_x86.cat...8.>'....L7.y .d3dx9_36.dll.....F#9...V7O. .d3dx9_36_x86.inf.,...Q&9...V7O. .d3dx9_36_x86_xp.inf.\...}(9...V7O. .nov2007_d3dx9_36_x86.inf..*G~.;..CK..TS..._....E..)...!4...iR.....Z."] .."......K..T@.B.....]....\|...w......y...w.3w..7..//s..R3...H.N{/..F.Yj..J..@..a^.........,.a.^M....".!.,T>......T. .h..-..]./.8.^..../%..q0....x..',4.....Y.9...2..!+...!]Pp.J.`...=.B.W<(.........d.d.l/.Xq,9}9> ..l.}....@......R.dY.x.8@.(..C!.?...)....f.-a.l.+6..U..vbO.q.%]s.....H...$g.... .=...l8. X2.I@.b....Y.V"...[..f5{.$`K.e3.....PE;.Nx`@.f..$....r...i>[..$]`A.:.....jv~.gg...Y....M.....x7...H..'.J.y..oV......j.aU...fc....U..i.....B.q..N>...`........`H9XVN.r..![.+..!H...B..i.-....r...f`l....V.?{.z..H.Ym../.o...Q...p....<d..,....9.7O..c....d.<.`.L..!..{...b .>.QH..)..B.........,...Hx..$a8N.^.rE.+Z..c#h...Xu..,.D"b.h..z$=....G./...l....z./.F..)..v....v':..5....G...... ...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Nov2008_d3dx9_40_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1544836 bytes, 5 files, at 0x44 "d3dx9_40.dll" "d3dx9_40_x86.cat", flags 0x4, ID 7155, number 1, extra bytes 20 in head, 134 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1554004
Entropy (8bit):	7.999645278979612
Encrypted:	true
SSDEEP:	24576:K3tdQkdeoPJLiej+pb7Q15LwQrpLeWvYMWbPBmcnILz+0Byna:2dvdeAweSBQPLwgpCWvYMQ5mcnIH+m
MD5:	75556D89FDD442967A23993C9111D997
SHA1:	003DE53653C0CC84F8C3D617D1F76FB475F1A7CB
SHA-256:	863AC3438F57158D4F53900C6924BFDC132AB43A5AF57D4658E65842836B4FA1
SHA-512:	6086114500DBBF4DB9D0A9C3F72732995BB9A3AB5C135EAD53143749B95651B37B64BE7A52CA09388DE90216FD00486FDFCFBC87D42D77FAC469F82B5290E06D
Malicious:	true
Preview:	MSCF............D................................#..................P.B.......O9.2..d3dx9_40.dll.....P.B...O9n:..d3dx9_40_x86.cat.......B...O9h8..d3dx9_40_x86.inf.,.....B...O9h8..d3dx9_40_x86_xp.inf.\.....B...O9h8..Nov2008_d3dx9_40_x86.inf..=.:.:..[.... .2......$Q.f...<....!Z.J.+...ea..U.q....ha.x.y...........=.h!............X.{.<,.....?..b.):.[J{....^=mv:.i.e..}9s............F.QN.^+.).p...!9.4L..B.k ....F.}..R.. ..D%P4@...'2.$C..EU..:_... ..=.....2...Q...H\|..2.hi....H3..%JA.O...s.n-..<.<..9;7p.wnxw,\|\|.....du.......)..$3CN.'.)j..\|...x.w..>..4.D..."..I.'.=.....$.7..m...J..F....0..F.XD..v....."*\|2...A.H.R..b.()! .\|..Hh`....Q.K...NH..9../^...\|[!.)k...8._C/~D.W..K4.}.B.T.b.Kw..si..6.E.#6w......_.,.>6{r$X&:....s.w......k....h'5......3...0XOG.^.=..j....sFg.jO. t..?.S.l5?.t...s....`...]......'$LJ.........Z]h.. ..h.l.5b....F..0......m.....P.....n....Z.... <..7.@...,`@..#.i.r....... ......@....\|....e/.pa...@Q.A..'.EL..7H..?^..C.........]i p..N7....:i.P.........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Oct2006_d3dx9_31_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1121257 bytes, 5 files, at 0x44 +A "d3dx9_31_x86.cat" +A "d3dx9_31.dll", flags 0x4, ID 6911, number 1, extra bytes 20 in head, 75 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1130449
Entropy (8bit):	7.9990817245216945
Encrypted:	true
SSDEEP:	24576:fd5gyP75nbAgKdWsTLSCs3BZnH50ve35Jxroo6DS:F5fP75nbt0STRZn9nxrb5
MD5:	F778928C9EB950EF493857F76A5811AD
SHA1:	EA82D97077534751297AE0848FB1672E8F21E51E
SHA-256:	4891E2DEA9D1798F6A89308E58C61A38E612F8433301EA2376AE14C3DFCB3021
SHA-512:	1F382A287FC6763B8E8D66825E8256DFB7D0DEAD6B6A6B51DD7C4A5C86D536CC7EF4128BE0CE495FE17C859018750072DC7B43E3476D1BA435F209CC4EB6D43F
Malicious:	true
Preview:	MSCF............D................................#..............K.............<5m. .d3dx9_31_x86.cat...$.......<5.. .d3dx9_31.dll.......$...<5.. .d3dx9_31_w9x.inf.......$...<5.. .d3dx9_31_x86.inf.......$...<5.. .oct2006_d3dx9_31_x86.inf.j5o.s>..CK..\....oh"....Fl..'.......i.vC..... `..w...6.....`.....;..E..........l.w.3....Y,..+......yg.a.....$.`0...6...XZ4.FX..J...l.V..o;F^..lH....3'.f0..G.m..P.[>...G..j..c^....p.<OAO.N.q.Z.E...hk..H...'@../.B.....q`K...y"..-9.r.'.9...x.O.R.8.......c....`Gc..C....>......X.......\|0c..tz......./....-.faa.0..<,.V.^X..B......:/...y...3...X.GZ..T......Bi[.KY.x..A...3.[...s..l..J..U..h.../2Z"7......k....yB.E^.r....T........K.....,...X..)..C...z4.....b......o..yv5.!5...CD`&.\.<0..P.y9..e..`{m8..K.:(.....w..la..@.++.N... .y6.m.......,.c...[lc....d..AM.6........ .P...uD.........m...........m.e.`9t..+..aa..@5.y}r.\..rJ.={9f...3...fO4.u.V6u-z.....t.n...A..0%.T....L'.[K...Uh....Ul....vum.........N.U..).)Q...x.RaPk5..X3z.e...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\dxupdate[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 91192 bytes, 3 files, at 0x44 "dxupdate.dll" "dxupdate.inf", flags 0x4, ID 3666, number 1, extra bytes 20 in head, 8 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	100360
Entropy (8bit):	7.9900557178400815
Encrypted:	true
SSDEEP:	3072:lvknxJpNYAzRstaRkz0BwwnNbSa+vp5647S:FkZNXsERk6wwBSa+vnl2
MD5:	4AFD7F5C0574A0EFD163740ECB142011
SHA1:	3EBCA5343804FE94D50026DA91647442DA084302
SHA-256:	6E39B3FDB6722EA8AA0DC8F46AE0D8BD6496DD0F5F56BAC618A0A7DD22D6CFB2
SHA-512:	6F974ACEC7D6C1B6A423B28810B0840E77A9F9C1F9632C5CBA875BD895E076C7E03112285635CF633C2FA9A4D4E2F4A57437AE8DF88A7882184FF6685EE15F3F
Malicious:	true
Preview:	MSCF....8d......D...............R...........8d...#............................~>.%..dxupdate.dll.02........h=...dxupdate.inf.1...0.....~>.%..dxupdate.cif.T....'..CK.Z}.$.U....;..@.e!.#....G===.=+".?..+.s..l8....o.{....;.+..(...d,..HVd..,......(..[&H.........Y.Y..~..{.gv.vW.'.....^......^...}...1v....2.*.~.......y...a_.....^Z..V?H.Q..bo(..0.Ra...q(..`o....W.....4~...q.?...F.............].....~c...O7^..W..x.?...l.=.~$......'..o;.._.....'u.aK......=..X.........g........~.].[..+..\b._........p.=.....w...%..@.o-.....O2..w...~sn..D_:....G).../e.Q_/....=Y.x........p.0..^....w...A}..'..... ...P.7....3.av...?...Kl.......>t...O`..b.]....x..Y....._...x..}....@.....1.9.o....[.?.......)...g..'.1.i../.^.\|..=........x...L.6`...>..,...K./....6...........A.#.?.8.\|....?.\|......w%K.>@..(.I...9.../....].....%v7.>.....-@.p....E........6...Kc..p?@.....8.\|.p/..xg...7...^.(..7..X~?..........#...w...q..U....f.... ..?<.\...}.K.Z.,]+...../..-......e...aO....a9Y......Wg.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Apr2006_d3dx9_30_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1109261 bytes, 5 files, at 0x44 +A "d3dx9_30_x86.cat" +A "d3dx9_30.dll", flags 0x4, ID 6903, number 1, extra bytes 20 in head, 74 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1118429
Entropy (8bit):	7.999050518080374
Encrypted:	true
SSDEEP:	24576:OreyPa6AC8e290lruGDhi3TSvHDh+ISNvRNhPmJ0RRuu:cNoeYEuTSvjh+R3WKRv
MD5:	B3D644A116C54AFDA42A61B0058BE112
SHA1:	9AF7DDC29EEF98810A1A2F85DB0B19B2EC771437
SHA-256:	CA7B9C6A49E986C350147F00A6C95C5B577847B5667B75681A1EE15E3A189106
SHA-512:	A2D2F12B7B37BD8F5C8465DD13AD31942DF11EE5ED5423DEEEB178E6B594587706D2C5116258BE1562CAA5ECA691358AF3CB83B77898D1012FF521017D199165
Malicious:	true
Preview:	MSCF............D................................#..............J..............44f .d3dx9_30_x86.cat..p$........4.e .d3dx9_30.dll......$....4.e .apr2006_d3dx9_30_x86.inf.....z.$....4.e .d3dx9_30_w9x.inf.....+.$....4.e .d3dx9_30_x86.inf.v..[>..CK..X.K..=.. ....+..MBI.. M@.n..QH0....#....c..b/..{.z....E..y.......N8?gg..{..=..{...W..;..:....IA.....a.`.......43GX..r..,.f...+FA..,.....2..a0..2......Z.ty.Ih...m0w..es0Ww.[/.n%q.Z.I...ho......#...G.....\.. 1.P6....;.s.cZ.......t.B...X...LL..X.C.......B.......~......@..!..8..O..O..!mR..fbb.0.8L.f..XO.R.-......Y...y...Q4."5JD...p..s.T.f.2z.6..~...........9VPR.f.BH=.bg.s,.T.!=......O..........B...\|\|}...X..5]R.0.....c.+.4..S....E.7.y...[....3...2$..:qt...7T......Q..@X..Ji...q.Z8.Ea(..@zS.D.3;.b..a.}L.;..PG/-....(...../vL_...@K....c..&....f..y.....3.8fW:.T:N7..W:..t.t...#(.FK.k..X..&...;_...Be.w.....b6.z<..za..}_7.afQ......O{,..Thu...).'+..0{:.V}kI.&Z.JU&&*...B..[.'..t.vK.9.`]..!.)Vht.8e.\.T.....i......I.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Apr2007_d3dx10_33_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 689905 bytes, 6 files, at 0x44 +A "d3dx10_33_x86.cat" +A "d3dcompiler_33.dll", flags 0x4, ID 9049, number 1, extra bytes 20 in head, 49 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	699073
Entropy (8bit):	7.998968028413629
Encrypted:	true
SSDEEP:	12288:SHwziN1v34WzSc6IA6ajvY8ov8ZdReUTQ8Mr47JYCophIa9sNDn1QcILtw6:V01wWzCI3ajjls4NpAsNDnMw6
MD5:	F784B8A0FD84C8AC3F218A9842D8DA56
SHA1:	FB7B4B0F81CD5F1C6A900C71BFD4524AF9A79ECE
SHA-256:	949068035CE57BBB3658217EC04F8DE7A122C6E7857B6F8B0CA002EB573DF553
SHA-512:	01B818AA5188CDE3504E289AEDCA2D31A6C5AED479B18A2C78271828AE04BEBCD4082051B7F4EECA8A31E8EE5ADBA158420ECDCB21371C735E4781EE5F661DBF
Malicious:	true
Preview:	MSCF...........D...............Y#..............#..............1....).........6{. .d3dx10_33_x86.cat.p%...)....l6O. .d3dcompiler_33.dll.h...2O....o6=. .d3dx10_33.dll............6E. .apr2007_d3dx10_33_x86.inf.I...7......6E. .d3dx10_33_x86.inf.i..........6E. .d3dx10_33_x86_xp.inf..j"(.2..CK.y<...........l.al..)e.!a.&...l3.-.h....j.,."D.R..O...%W).gFn........}.z5..<s..s>.s>..\|...U*x...Z..!..E..U...<$.....y0.sPH)....<..<.4.M.@...U.......\).@..6.'.Yi.!.....R.@.&..X..i..z..Y....`...C...).Cz...p.9H$...t@....I.s....;.[.C+A"..<.7.w3..A..u...s8$....ma.Y5.3.e C.e.yAAP ...@L..8.,?..h.a..E2=..9=.......e5\|a./3B"q....Zh.P...6P.."....k....:.w..:.h%.....H.0u......+..D.+!..-...9.sD...O...QZ.a..8v#......Q..N..l%....c..?P..........>.....~......0.F.VB!1ii..v5.4.R.R.....LX.X.........w.8.'.~..p.8.......A......6w.\...~..[.B.E.!..h....uQR..q.....O.....R......Cth-.....$z..B..00.l.Uo.. '..m..fB..}...ij....<..RX._......k .k1.xH......A3y.<~V>.s^gV.8+.;+...CP..+. &.....PH..).UA{...E..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Apr2007_xinput_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 47342 bytes, 5 files, at 0x44 +A "xinput1_3_x86.cat" +A "xinput1_3.dll", flags 0x4, ID 8235, number 1, extra bytes 20 in head, 3 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	56510
Entropy (8bit):	7.973777529821975
Encrypted:	false
SSDEEP:	1536:BcnwcwzHEdb27WH2SfZDNu75ddnVR+ZFaNk0ZKn4:4wb+2eZonQwt
MD5:	B362EC93463D8B6381A864D35D38C512
SHA1:	7CE47EBCEDA117D8B9748B5B2D3A6AE99FC239DF
SHA-256:	B6C1166C57D91AFEEEAA745238D0D6465FF2084F0606FD29FAF1BFA9E008A6C5
SHA-512:	CC57733912E2A296A11CD078372C3B43F1256A93EC5BECD0D1B520EB210FCE60938AA1CAA6DBBCA03292A05495B5ECD212EE5F77E3EBABB11EF31F1975B2D09E
Malicious:	false
Preview:	MSCF...........D...............+ ..............#...................(.........6{. .xinput1_3_x86.cat.h?...(.....6.. .xinput1_3.dll......h.....6G. .apr2007_xinput_x86.inf......m.....6G. .xinput1_3_x86.inf./....p.....6G. .xinput1_3_x86_xp.inf.i...T5..CK.y<.....Y.d..H.<3.1....=...`,cbB.f...RkB..V..E...,.[$I.R(~g..n........}....<....y>.9.s.....f&.s)E.F..Cp ..Q...D 0<0.;....R.....3.\...4...F.1QI...........@..O....2.f....I\...a...c4.0.....,...0.!..6.. M...@..:..ocp.A.K6......... .F..!...[....+..,...0n...<..@cl`+Xe^.X.t.$.;{X@.P....@d..N=.....Z..g....&...#...%]....~.........C. #..u...h(.4^.4.... a.a...#.Z<....%.{..5..n$....P@[..C<01..Y...F.\..[.H.H.l..f.l.X.0...l.4.A....+B.~.\|.l.YO0..k}i>~V..O.f...M0n^.?..B..........a.......N.w/==J.{..D@0..Q.....%..@6..Z.\|......@@.4..a.....q......t....4v....dI.Ym..^...........[7.XH.8Y.nR..d.<.;O.."k...d.y2aV..4....D...5..B".H~.....+x_o.4....c.#.`..0...v.F4........I.Q$.....x....._..;]...O[....l....?..:.......Q._....2.;.~...NXz

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Aug2006_xinput_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 40098 bytes, 4 files, at 0x44 +A "xinput1_2_x86.cat" +A "xinput1_2.dll", flags 0x4, ID 6335, number 1, extra bytes 20 in head, 3 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	49266
Entropy (8bit):	7.9632460736333766
Encrypted:	false
SSDEEP:	768:OuG396sAA1wXXvVFc2755DkphtVmUkt/lnkvH0odpl/q1nk:vwQsAhFcSmpJ3kt/xcd7ek
MD5:	16B968CA0C435EE45E77A84C2D0364A9
SHA1:	90B17A60A34F6335787A6B2D489CBCD3A4EA98C8
SHA-256:	6DD7C0ABE37D3DF7AA6DB7BB352260F4A15DC965FF9D30AA32FE9595C1A18300
SHA-512:	3BBBFDF8B5673641EC066C3FB52E6B0D5CE0BC6ED6BFF17AB4AC3FA69A8628B09E5EC8322FC39D2A206974B54D297CAAFF9410197E26D090FE74F963CD535045
Malicious:	false
Preview:	MSCF............D................................#.............................4.R .xinput1_2_x86.cat............4.K .xinput1_2.dll............4}R .aug2006_xinput_x86.inf............4}R .xinput1_2_x86.inf.....>..CK.\|.\SG..M.. @...mTT.0.(..D..M...+K0 ..D.`...T.Zkk.Am.V..k...V[l...+....*Z4....P..........&w.3g.9..\.Kz<tp..N.;.]Y...%=.!...b.............%v_88.t`qXK.;......B..3..c.8...................a...aA..C..)t...FP.q.%......'.B...("...D0.(..Al(..BY.<..."...s.!...1....&."...a..;6;h.P.#.X...p.H....c..q,..1.'..^.CL..h.C..h.%......f...S.l.'h.p.p.E.......\..G..1..'.)D>.Cd.JB..u.....6..i..A.>...&.......]..J....C..h."........x.......4....0.H.?..P.=.Z"zEaJU...F./...Y.t...~.o.y9<..9.l..7=.9_..d...!.r.F0...4..c2...a.3..y0..B..nD<.K...s!d.9\|...p.0\|a.U.a.=x.v$.OM.1u{...qQ,..._.R....y..f"...33...@... ......[..1.a.....0.x8..@.N.`i..0...b..c.wYs.L>&..9..A.......UXL.n..8x.....z......W+..... o.'.v.r...$g....R...4.u.r..J.P+......./o:C...Sg.g.&.3r..^.vG.v^...I.s...9..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Aug2007_d3dx10_35_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 790907 bytes, 6 files, at 0x44 +A "d3dx10_35_x86.cat" +A "d3dcompiler_35.dll", flags 0x4, ID 9055, number 1, extra bytes 20 in head, 56 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	800075
Entropy (8bit):	7.9986813742013325
Encrypted:	true
SSDEEP:	24576:iTo6mZ4UtaxS5hNsXjnUQEnnR62vSNE6xr8M6:iTdwtqAUXjU7nQaSNvxo
MD5:	DDC4AF0D53B477E5AF77942E7118B66E
SHA1:	81AD8201DCF653A6E977C4506A274D0BAC12643C
SHA-256:	9536166EE7CC1100CFE24E01532E8E4DEED6BAA838B4C025581F2CA046A25915
SHA-512:	1E082D7E7855BC0AF6EC09D4A69FD4A1B0A3A31E4DE8FAA52FA0BDCD601C501ADA6216DDDB83058F37AB4A371068E0F344BDF42F2551943BE19BD719D99BA93C
Malicious:	true
Preview:	MSCF....{.......D..............._#..........{....#..............8....).........6P. .d3dx10_35_x86.cat.p....).....6. .d3dcompiler_35.dll.h...2......6. .d3dx10_35.dll.c..........6F. .aug2007_d3dx10_35_x86.inf.I..........6F. .d3dx10_35_x86.inf.i...F......6F. .d3dx10_35_x86_xp.inf.. ......CK.y8............H.<3.1....=...`.&&[...m^...&D.l.%Z.TJ).....%.R..L...z.....{u]..<...y.....qn...e5\..1.1.....L.b.*D".x~....4....@0.....@#XD>D&.].T..........K..,.<(.81A.z.]..A....0.......Y.l......F[.C...R.`...8...$...A....2..8-..F..e.=j.J.ud..dM.I.........!.h..l.+..,....t9..r..!_h.D.. ..,3..hQsQnYE.+V.wL....;.....3#B"...Zh'...........2.Hx.....:2.%......:.&..'... .!.H.%.<..Tj......A3C.W..e....Dpe...]....!....&H.....I..~d...$C }.>.#...}3....X}.F..G!1....r6...WD.....L}.K..t.....)#...6.L.&...........)....9.!p.b....x.....{..f........s.a.U..^..,..3?.............Ck.....!.s.......`.oZk............K[i.g.....E7...f.7f...`.....3...F.....i.?K&.....d.,Yk.L...........,.L...D.Au..].8.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Aug2008_d3dx10_39_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 843207 bytes, 6 files, at 0x44 "d3dx10_39.dll" "D3DCompiler_39.dll", flags 0x4, ID 8952, number 1, extra bytes 20 in head, 61 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	852375
Entropy (8bit):	7.998886184584254
Encrypted:	true
SSDEEP:	24576:E6Ih4DqlkwAjhr1mB+uYgrCvCZNmJ9ndKo4XYbX:E664DQkwAj/oNCvCZIdN4ID
MD5:	5380053AC4C344BD38604022476B1C1D
SHA1:	043DC8F49BCA3BF0BD85E858F5C2EEDF68565C0D
SHA-256:	84800C55F773D5D6913E344E41BABA58CF07CEC2E6C7114CA3BF48E8F355419F
SHA-512:	F3CE2DEF6E2E8A1D2C07F627E3C437A1BBA0B2E456020A84121346472BE3D28E0FC69623BD408F35A2C639C83DD2787F998DEDFE42B7625DC71500824B035FEC
Malicious:	true
Preview:	MSCF............D................"...............#..............=....$.........8 X..d3dx10_39.dll......$.....8.X..D3DCompiler_39.dll.f(..(......8.2..d3dx10_39_x86.cat.I..........8.2..d3dx10_39_x86.inf.i..........8.2..d3dx10_39_x86_xp.inf.c...@......8.2..Aug2008_d3dx10_39_x86.inf.,"..%,..CK..\.....\./.R3...$...Hef.K0..D<....V..uvA4.J.yTx..YjvY..<.2.133.J.[...O.g.Q.J..gf.....r^.}..s~g..3...F..!...eB>$.e .~..Z.j@V....C]..-..-N.!.Dc.c2.lv..!0b......$&.n.....yH..cz./...\|...w.;y../+.......l.\|~...?...{..-<Us.(n..M.U...(Bz.I.WCc.q.I..uuu....2O.K}.~_x...P..B.D.P.].C-e..O..x.tJ.....Y....'o5%dE...+..../..".tp...Ap..i^.$.0W.....!...b../.W..y.B.....#.m.k}O.k..z...N........W.3.......S.F..].E..j,.;.xe..I`6p.V..._O..K`.H.C....f.....'..3@?@O..`...@&p..P...W..>HO.....,..CA........0...m.....D....0.....x.S...l.....'....`.....%....{....1y.t...Qp.t..{..A.0c.......k.....@!x......RA/.....@c......}...n.......`.x.L.cA...A ...P..S....2}{%".,....d8..^.K..p.xGE...+..\`:X.>.G.o.Y

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Aug2009_d3dcsx_42_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 3313780 bytes, 5 files, at 0x44 "d3dcsx_42.dll" "d3dcsx_42_x86.cat", flags 0x4, ID 7865, number 1, extra bytes 20 in head, 169 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	3322948
Entropy (8bit):	7.9992960947448655
Encrypted:	true
SSDEEP:	98304:hd4ZyuDJf9oMm+hWh3ZHD8VZQCbsY/ny66RHX:BuD8b2WUZQCg+ny/
MD5:	73BA11CE0E936726FC9FCB882F8B91EA
SHA1:	4A4BABE3AC751E60AE6B5B0D69C93FA53D7FCD21
SHA-256:	A9A704B73531D6BF59A421AB5C046C19A16D2B0B07F09816DBE9DA4550A24B17
SHA-512:	9A198EB93D5623651D2981A277EAB4C345C08161254D0127D90C97344450AC1A7FD5C8AC840048A43A347E3296B286B646EA0FBA88F0C7BCE1CEED1484112D56
Malicious:	true
Preview:	MSCF....t.2.....D...........................t.2..#..................`.S.......$;....d3dcsx_42.dll.....`.S...$;...d3dcsx_42_x86.cat.......T...$;...d3dcsx_42_x86.inf.(.....T...$;...d3dcsx_42_x86_xp.inf.c.....T...$;...AUG2009_d3dcsx_42_x86.inf.?b5B.]..CK.w\T..7.Mnb.QA..E..Q .B...AD..X.q.JS.H..&&.....HS... .a.n.((..J/....!R.a.y..g0......<....9.}.^{.....do3.sb........PL....V......_.\|)V..w.a.d.>.#~k.......Z.t.......e.o...#.k.,..x.8.(/\.......5.4....?.Z.B;.9;t/....@..^&..C...m.........f.....#N..._e.c(&f....].-\|.....>X..?>..S.#&..!..v.BLl1*b.^.&....},..r\|4...}Dy...@....\,.^..R....#v....Gl..j%v..w.k...^.....(...........l..m..,............k..J ..?.o.FL.{e........Cj.{..=.-&.oe_?_'8's....~..k.o.}]<}.a.^jnb.....j...........U..3p.....]pl.C..)8.....#V.G..Yp\.#....0.C..q8...#6.G+..p..:...)....#..G8...H.#..z8..x..8._.;Rp......8.....A8hp..#..Sp\.#..Ox....8..0.c3.RpLk.<.x..-8R.#....q..x..~.?}]Jz.bU8L...........j..z.K...6.{Cl..6.sVsV.Z.....sGUrE;..'..a.#>.._Q.U}....sb.\....}-A.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Jun2005_d3dx9_26_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1058965 bytes, 5 files, at 0x44 +A "d3dx9_26_x86.cat" +A "d3dx9_26.dll", flags 0x4, ID 6937, number 1, extra bytes 20 in head, 71 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1068133
Entropy (8bit):	7.999040217820951
Encrypted:	true
SSDEEP:	24576:NxFMsUF1MmwONoWu85w6SFBu+vveJ0sut3z2A1s9z/D8gigA:V3dm3NoW+9FBhuJ9ut36A1s9z78giP
MD5:	029359EBCA4BA5945282E0C021B26102
SHA1:	6107919F51E1B952CA600F832A6F86CBBED064B5
SHA-256:	C44EABF5BE3B87CD845950670C27F6A1E5D92B7758BA7C39C7849B1EE1C649C0
SHA-512:	FA007F257F5267119B247EC4ED368E51FD73E6AEA3097E2FC4E78078C063AF34D161FD1BDCAF3097BB575D2614DBA226A624D060009EE4F7BEDA697EFCF42BB7
Malicious:	true
Preview:	MSCF.....(......D............................(...#..............G...7..........2b} .d3dx9_26_x86.cat...#.7......2Z\| .d3dx9_26.dll......,#....2.} .d3dx9_26_w9x.inf......-#....2.} .d3dx9_26_x86.inf......0#....2.} .jun2005_d3dx9_26_x86.inf...N..>..CK..X....'.. ..P.....&!. .%.A........`.....;v..WTd..........w......{.{..<'...3..;}....=Xv3.e.vc:.yg.i.....1.....V.F.:.fMj ,.\|.e.....F..5#?.\|6.M.j[Z..k3.....g.f.B(..=v......a<.7..a.=.:...h.f.X6.."..I..I......Od:.!9......~1.H..q.....'....y..\...E..u.S\|K.a...:c..B..8g:!?._..E:.A.H...N.a..j..~pI.....V.k.l.W.....X..........`4.2(.....e.>...0...!L..>p.....2d..r<...afffPK.6..t0.V.'HA.....j.o...5B+. .....hy...... M..5t...K.<>..@.G........~h..Xw.B.....F~>.?l..7..].}Xp.m.!......x~6.aY_.rmH..sr.."Q..]..d3.{.bXX`P....io...AZ.i..$..1....Gl.....d..AM:6.......p./(..Q.1..1..q....O.c~.c........04...\|s3...}..x..I.r..).m.K1.o#.Q.Fa...X7.baY......G{......Z5S.HU..c.tp.z6.4m.B=P...d.6...g.....W..aM...z...L.R.W%...z.F.n.5....54EG.R

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Jun2010_d3dx11_43_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 103485 bytes, 5 files, at 0x44 "d3dx11_43.dll" "d3dx11_43_x86.cat", flags 0x4, ID 7298, number 1, extra bytes 20 in head, 8 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	112653
Entropy (8bit):	7.991810619702373
Encrypted:	true
SSDEEP:	3072:tXMVzDTlrM28bEHSqgik2ono4DQQ/7cuBFbb9aD4:tXMxNjG4gikye5FBtBr
MD5:	061BBA3836B3FFCBB01B150467BBE951
SHA1:	00D8FBCD4068B3199D3D393BB4B86BF82985480D
SHA-256:	B80DB68CD82CAF8BEDAEE62808171B20C546A76499C3AD53014E3BD2FBD2918D
SHA-512:	AEC8327E1CCC0B33B3E32D66A5EE25C4B70A227B708D10F61EBAD2D998F3BE68145FA85C50BAA16A21EE766B336B1432FBEC02C75D698793092015C832B6FC26
Malicious:	true
Preview:	MSCF....=.......D...........................=....#..................`..........<!]..d3dx11_43.dll.....`......<B'..d3dx11_43_x86.cat............<.&..d3dx11_43_x86.inf.(..........<.&..d3dx11_43_x86_xp.inf.c..........<.&..JUN2010_d3dx11_43_x86.inf.kK.. ..CK.\|.\.U........:(.....;.........\.".+...K......a....f.eZVZf../M.2M1M35.bj..%~gf.,gv.........~>..<..{.y.93.{fv.c..(%EQd......?...?...z.i.^u=.g.b..>.%......s...\Qa..'[.U5....c\|Z...Zl.....m....\u....s....\|.....2...s...rE^ Wn..J..j\|.$...2....mO.ul.E.V..c.7R...E..+t...2p....@>.V`..<.).Rp.._UrI{h.../Z..0\|...sQJACQ..J.....F%..W.T......E.{P.....1..A..U.6...2.J..\|^a\|.....Zl....\|.>.tT.P.x..=C.......V..b'^..K....}.s...op.....?..'=...2T>.l).....l.2Od?E.S.....V .GV.l<.Q. .Bv.]7......d...MB..,..72Od..WR...D.6.M.V!{...d%..B...@.L..j..:..(.=.G....b..BV.l...d....B........p%u....F.....l.!.G..l.2.,.. d...\|..Qm.v....G..L...).C..c.#.Ih...................ee.......VPL....8X...H1.=A1...q....2.E!.l..M.E..jTw.z.y..*d....m...Y.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Mar2008_d3dx10_37_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 812300 bytes, 6 files, at 0x44 "d3dx10_37.dll" "D3DCompiler_37.dll", flags 0x4, ID 8943, number 1, extra bytes 20 in head, 58 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	821468
Entropy (8bit):	7.9989494569533655
Encrypted:	true
SSDEEP:	12288:k8Yjgk28yEYvDLX3XmZcLHo9yLvTJqnrT+LprnNjjjGM6pdKi814DYnciABrI55V:1Yjp/yEcfLI9y4rORNYdKibxBrIS6
MD5:	8234B9B90BCBB5077E1B5FAA0B66D1A9
SHA1:	E9207C572FDEC592B7C17A7F9C6F875C8A55B1F0
SHA-256:	6A2727269E6CAC7C4D2E316333D29BAC0DC1CD7F51C36C0C08B0388203DEDAD2
SHA-512:	74C94A6E092D7C828FC1E3FAEE4B21917AFC3CACEC04F260754190D0533F93A58289763AC620E5A577F7865902023B30548CDA4D9E968C90EE13050AD6D1E8C5
Malicious:	true
Preview:	MSCF.....e......D................"...........e...#..............:.............E8...d3dx10_37.dll...........e8....D3DCompiler_37.dll.f(..(.....e8K...d3dx10_37_x86.cat.I.........e8....d3dx10_37_x86.inf.i.........e8....d3dx10_37_x86_xp.inf.c...@.....e8....Mar2008_d3dx10_37_x86.inf...-..,..CK..\TU........[fz.,P..0}Q.a.L...T..`.f.;........i..io{n....ej.i.Yb........;w....r.....s...9.<g.%f.4.F.q...F."_zr.........6.4}..I.8.;o..9L..j.9.43..Z.....M`rl&..A.....n.b..Q.....;..).).MK{J...!...1..T'....:..&...,*O.k\.!}4.d.vH/5.0.....x-!.....{.c..@......Dm53SG.W..A..5..MK..P.?ZK64'd..%.4p......'..v.a-..3!...iYM...Jc.B.i..^.4.;.....b....:..i..'Ui{2.$m.t(w..w...Km..ZrM:..7g.p.w.m$..k..`..n..7JK.`...%..O..d..`....@2h.j.s.ZR.V....?..p-i.:../...@.X.&..:RK..y`"p.. ...a..\.@Y..l...<0.lB\|6.d...Ac..N..=`.(..@.._.....)...`(....\..\|....@.~i..-....z}.........]..'.........<0...d...A.h......e..@...6....,.....D0..A....A8...@K.a..6/.\.&t.$/.V.I.....f.".....t.$.....H..X.6....$

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Mar2009_d3dx10_41_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1034785 bytes, 6 files, at 0x44 "d3dx10_41.dll" "D3DCompiler_41.dll", flags 0x4, ID 8914, number 1, extra bytes 20 in head, 71 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1043953
Entropy (8bit):	7.998757160305283
Encrypted:	true
SSDEEP:	24576:JAEjuCeK6JgAkPBJoBgsqDP8FbGACV0L/sW0G+vv2:JFuCeVJqyxqDUFb9CV8r
MD5:	45E83CBA5710A1DE7D3990A288122E85
SHA1:	23C4BFBDDCFB11ACB7C47C409825F039AF7EB908
SHA-256:	B7DA29103CDF374DE0C09713CB985035EAC45FB8B394D3B8157D8A7562A89899
SHA-512:	8C56D376D349AA00948E1F3C6168DADE76AC9A26ADE1AAC5A385DCF0253602F5A2973483D083425195DB6AD7717494FD3CF674F5549774AC608CEFA2A88BF0A7
Malicious:	true
Preview:	MSCF....!.......D................"..........!....#..............G...P.........i:k{..d3dx10_41.dll.h-..P.....i:k{..D3DCompiler_41.dll.......#...p:.r..d3dx10_41_x86.cat.I...a4#...p:.r..d3dx10_41_x86.inf.i....7#...p:.r..d3dx10_41_x86_xp.inf.c....:#...p:.r..Mar2009_d3dx10_41_x86.inf.Nn.>.0..CK.wT.I..{.G.C.QQ.#(I.T`..Q.........0.b..5`Xs..bD.@..f1.9..x....Yw..{...s..U...[.kjj.....h3...TV2.nFx92?~=....m.l.[n.[..(81)]..R&..Sd...J.,F!Se..Re..A..e..~}..b.e[.fd.np.+..[......R;.z.....v....N.~...ibx.h.S.....W...7..-.a.8...`...$u..A.0K....j1..g..A.^k1...Pj.]bm.ym..~t...+d..`..LG}..X...#.J.....;'e.Z.-.2..m.0....[W..#......j.05.Z.R.!..:.jd..e.........O..7:...\....k..bY...s4W).. ..%.......:g............p..Z...... ..<5.2..].... ..X.,..!~.0...v..k.c.1.2..V.10.L.#.R.x.=.S.9.....27.S@.....d. .p.l.d......}.\...;.e./.0 ...&.~...8.\...:.L;.'....R..."`;p.....>...........BhW6.I&..D.!.3`...M...>u.....S.A......E@...0.P..@8....v.9....X@..."e....'..`c...(...^..R.'p...4....{ ...f...2....h

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Apr2005_d3dx9_25_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1073002 bytes, 5 files, at 0x44 +A "d3dx9_25_x86.cat" +A "d3dx9_25.dll", flags 0x4, ID 6922, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1082170
Entropy (8bit):	7.999075135168916
Encrypted:	true
SSDEEP:	24576:i0BodqhH/OCy8M+j5lcB4ZfeXBXUd/QLML9bw6Uzc12:iUbffy/+lmBXF8Ioxw6Uo12
MD5:	9C5DCA423D9D68349D290DF291DDBEEF
SHA1:	D9F1CAE586470EA309CE9F115525B0504FFFAEA4
SHA-256:	5487ED4E969A822E5C481CEFB1D4DA3066B1D5EC8C55798B246915ECB58A8665
SHA-512:	9F50599321F45FB7451B0A1C0F1DCBD6B4A4E60EE27B0EF5AA29168C1BCE5B08F34329916EA2EA655CD632D0A19C81953C2A5F1277F6A96FB63AFC098236509D
Malicious:	true
Preview:	MSCF....j_......D...........................j_...#..............H...7.........r2. .d3dx9_25_x86.cat..#.7.....r2}. .d3dx9_25.dll.......#...r2,. .apr2005_d3dx9_25_x86.inf.......#...r2,. .d3dx9_25_w9x.inf.....k.#...r2,. .d3dx9_25_x86.inf.(.0.?..CK..\....'4.A..".+.@.%..C.4).b!@..$.....a..k.#..v.w.w.]xg...............9{......k....q....6.Z&Ey-.@.....a.0.T...9b......a...b....ilk.+c.5.af.o.vl..............<....s.z..V.7........fa\.G\$En..._..\|$.?9.O...!..H.<...#.,...!.^N.<.g"..=.V\|O.a..gwcw...t.c.......X..4(.).. .?.S..0k..._2{<%X.......m.....D&&..v.c ....Av...u.l. K2......R.0.&.XO8b..p."H@^..2..jbb...hg.&...>.>....u..x....2...@.~....9..u.a.M.X...S5d_..\|}z"h..1.....<...Z!...V).............}OO...n.2..Q....../.......R+[C..l..(...@......1........$..vs..K. m...e...b..\}u.+.....?..bg...P.......%.pRgTq.t.t.e<..t.Y._.X.?F.(../.......abb.G5.qkb.\..Z...g.....g..(.....f..Lz.8...h.e....t.R.fJ.iJNCv}:.V.:..m.B..JIQrlA..Z5..HR..)9-...:.......V.JP.)t*.....6m....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Apr2006_xinput_x64[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 81141 bytes, 5 files, at 0x44 +A "xinput1_1_x64.cat" +A "xinput1_1.dll", flags 0x4, ID 7457, number 1, extra bytes 20 in head, 5 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	90309
Entropy (8bit):	7.986243949537019
Encrypted:	false
SSDEEP:	1536:/0CNqg1WzKHJUq/JSlvxToeSNOUp9BttldRL9zaMNez4fbI9YKztrIrm:/hIg1cEJUxvxlSNOUpfttldRL9zkzAI5
MD5:	B0669F7D395078BEE0087B089F0B45C5
SHA1:	30506FC3DCE9532EF0A8CB3973347EC9C3C9875F
SHA-256:	E63A67783EF7624559F95AB697BF8AFBDAB7ACE31200283EF840E6B94AA16E5A
SHA-512:	D7EFCFD85B3CB6CB9B1936B701A9D7D91A6094AA08D8C933EDF8493C6AD57BE05A579980A404B35E9721F71B45F4CAE28399FCA3FF5DF20A9A3138B90F86B94C
Malicious:	false
Preview:	MSCF.....<......D...............!............<...#.............................44f .xinput1_1_x64.cat..F.........4.d .xinput1_1.dll......e.....4.d .infinst.exe.V....l.....4.e .apr2006_xinput_x64.inf......o.....4.e .xinput1_1_x64.inf.. ...9..CK.{.XSI..MHh..AD.. .7t...4..H.TTB...$.."...,...v].{Y{...u..k.......w..pA..}......<.\.9s.w.9sf.x...}...y..L......j`.c2..6..>..L.i.......F.......QZ...X.p.}c.i.`.,^X/l.8...m._..Fv0.}pOO.................N..>....O 6......X..s....A.'.s0....X...c._0.\|...?... .....IM.Ln..e..&..$...6?...K.....f7../.A..2...@=..7.`..L&..u:...w.>...q.q'=&...Sf....'..,.S`R,..aJ..@.nO.6.....TEF+.K...4.-.$....<e........ob.^..\({@).F.A.../.'..I../.F>@}..N.f....h...........q\.7#.~...Rm.2...HO0...{...dx....d..00<.3.v..........d....o:.e...,.....I..^v&.t .O..)Y;.B.7\|Q.K....Oo...g.L..5.I.....;t.i.\Z.V..>../..G+.!....z5,.*....1.L..#....58..f....7.x..Va~....bY....\+..U.-M.D..H....d"n{..b.X..V...Lqz..k.h.5..I.d)E..x'.hc.dp.Dr.8E,.(.R..+..5.YZS.1.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Apr2007_d3dx9_33_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1600079 bytes, 5 files, at 0x44 +A "d3dx9_33_x86.cat" +A "d3dx9_33.dll", flags 0x4, ID 7180, number 1, extra bytes 20 in head, 108 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1609247
Entropy (8bit):	7.999284261824255
Encrypted:	true
SSDEEP:	24576:4cQY0tIpwa5ydxGuruluTsRWo1Iq9e5m98yiN9/0rjVH60mPxr/1MQK:4cIIi+G9rul8uooec98yi//0rjoDZrCF
MD5:	A5915EC0BE93D7EEBE8800CE761EE6DC
SHA1:	E8BBC21C2B5F0E5801286F07E3DA09DBC67C3961
SHA-256:	EFA2E6DE548401376A575E83A79DE019AA38F191D63FDEF3BD2B07D8CB33E3D7
SHA-512:	02259FF3C8478CBA134A8F8408AA624B7165CED97C0AED8C9626034599DD5439F84D1AF9EEFC4191898B0A524E5FFAFB9875EC00E740CEBE97EAC4C2DD0E31AA
Malicious:	true
Preview:	MSCF....Oj......D...........................Oj...#..............l....(.........6{. .d3dx9_33_x86.cat.hW5..(....l6O. .d3dx9_33.dll.\.....5....6B. .apr2007_d3dx9_33_x86.inf.....\.5....6B. .d3dx9_33_x86.inf.,...g.5....6B. .d3dx9_33_x86_xp.inf.6^]Z.;..CK.y<.....Y.[.J..".<3..K.AJ.CQa.&a..-.L.vE...")[e..!E)e...(q.W).g..t...?.....Ws^...\|.9...9.=.3..L.XN.U.&... ...L.p.b ..,....$.BJp@0.....@#.x^D...T.`~N./J~... ..A6..Tj.....s.....a...A.....#YV..`&B.m...!"....O.h.x.....!M ..e. k@...$C.7..F...7.%...............C".Xk..V..Y.....9...B>.n......J..<......{..w.MORA....v...H..l%.....`...;l.:..T@'Y]..9,H.`.,....A.....u..p.a.....D./!..VZ..1P..I......C..........9..4..1.z......h....W...~.}"hK.m..sA..}<;..w...,8.[a.y.!X...HM....qf.!....i.~.m`.O5...T&......2?...,%#.YCTh......H....@.a........?....7..}.+.c.S.\...-.%`.......1...5......24..........5.....yy-v..R.......{.C..@"....n..C.I.`.ZX....@.MH..+9Q[.\|.rD.j ...A.(.Vb.ZZx.f......F..}h..X....~[.Cs.S\|....RV9JT.k.....c....C...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Aug2007_d3dx9_35_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1702192 bytes, 5 files, at 0x44 +A "d3dx9_35_x86.cat" +A "d3dx9_35.dll", flags 0x4, ID 7184, number 1, extra bytes 20 in head, 115 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1711360
Entropy (8bit):	7.999186916403002
Encrypted:	true
SSDEEP:	24576:91jqFBu+YTN2MuQ4R6dPnknsGmQA+re+1ZGD+rCbaNHy196aqlF35RJT1q/P0a+8:9FyMTN57+MPO++rB44S1I/F35zhqFR
MD5:	3ED592E6CDAE66B1C0671D9EC417A738
SHA1:	9F083FFE00A8E5EABF282130CD16044B488B6E0D
SHA-256:	4914D2B5C3251B00C0CC236F51AFE469728D92B50C953C66D213F079AC928EAC
SHA-512:	0144DD9A83F953EABAAFF3C41F17A363100C9A2CCD932321A4AFE990D8FCB5A430E842DE9146C983409B6366CD974E318A535E6475B10839A6679844CB7D23B7
Malicious:	true
Preview:	MSCF....0.......D...........................0....#..............s....(.........6P. .d3dx9_35_x86.cat.h.8..(.....6. .d3dx9_35.dll.\.....9....6B. .aug2007_d3dx9_35_x86.inf.....\.9....6B. .d3dx9_35_x86.inf.,...g.9....6B. .d3dx9_35_x86_xp.inf..n_.;..CK.y<.....Y.[.J.f.d.;c..l...."a..2&&[..E.BEY.EZl.%Z.(..%.+%I....3.[}...q..s?..\|.w..=.s.s..y..2.S8y..........L.8.....0\| .'.. .....LD.'.2'..c.ya.L.a...........C.....C.....^...T..x,.j.X....\.......2a2H.<`.`.c@. BwM(a.#..P....&[R.... $.B.....{....\....5.<$...q.t..qp..c.Z..J...DK...d...A@.....:t...^...X.....K...zg>......U.A..#..1v....`'d..d......A.Bf.@y.$a.d.....,.2W.=."t..........".p8.%......C.0....l.F......X.Q......R.....]...c..Y.Y.<t.'...}.........gK....of...........8Gv6......O.....N!d.?...E...g3a....`...G.R2..-@.6@......\..`H$...4...&...g.6..M.........r2K.s.....FM(......}....hCJVC.T.y..@...C...d..Yk.L`....D..L....>d#.08\.h....&...&......ox...4.2......'K....R...(E...@..6RH..A..t.1 ......s........).T..\.G..........w...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Aug2008_d3dx9_39_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1458712 bytes, 5 files, at 0x44 "d3dx9_39.dll" "d3dx9_39_x86.cat", flags 0x4, ID 7173, number 1, extra bytes 20 in head, 118 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1467880
Entropy (8bit):	7.999682997096517
Encrypted:	true
SSDEEP:	24576:ztDuVYfr3zZ3dHi+rHI8lVs1WutNXBoY4RbifcKly/kNwSh1mMbS8X/9Wv8PiL:JDnr3zZ31lVsgENSsfcKaZAFF88+
MD5:	4379902C4180A9A6BF40B847372CEC5A
SHA1:	C7FC8184D5620154B9BFD6FBC8820A78C4EEE592
SHA-256:	61E703E8D231412F135B4ABA629122D9CB69AC9EE39FA3CBBE6B95DE05097A8B
SHA-512:	9269F49A5CA90143C50B817E9F5AEC0FC4C32BA1B6D3A21CC5448CAD21A16A902540C8CFC1825B124CE39E0BDC479ADE4354B6BE15B2067E3033E04998E0710A
Malicious:	true
Preview:	MSCF.....B......D............................B...#..............v.....:........8.X..d3dx9_39.dll.<'....:....8.2..d3dx9_39_x86.cat.....D.:....8.2..d3dx9_39_x86.inf.,...O.:....8.2..d3dx9_39_x86_xp.inf.\...{.:....8.2..Aug2008_d3dx9_39_x86.inf....$:..[.... .1......$Q.f...<....B..we..]w.QR..B.).V..i.k..Z........=......d.. .....2..cLfl..A..w4[..VBs.{...^...S..a..]Z...%vh...9..Ro...K..r.}..ZP......".i..5P..."..............."......I.c.on..F...&..K @T.=...C..a ..!..q...Pb.=........hY.b..i`AY..<xwqvlx,t......Yg..R....g1fG..i..4.o.......S_...V..N.K.N..qQ.....Etr.1...E..:..\|..../e..<...9.s.....%.RT. .M!.$(2b[X.NT.B...HT.?.!.<\|4~.?........Si.Xe...l}....J.J\|LN...R.o..@W!.y.8..t'....%A.!I..U.A>..~..........u....2SR.[...9Te.?..U....y*.M.yxnx...z.J..V...(.....X.\|...f.h.....?.LGt..UT...o.7.0..h[.P..`...`../$LED..'.E. \|.A-.w...6.+.\;.h...H...........8...A...0.n....9- p..M. r.V.!...W...r.Y......BO.d...{4.. ....U..A ).....9f.e............`P..w[.......$..o.L1.~.R.M@\AC....W.%..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Aug2009_d3dx11_42_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 99084 bytes, 5 files, at 0x44 "d3dx11_42.dll" "d3dx11_42_x86.cat", flags 0x4, ID 7285, number 1, extra bytes 20 in head, 8 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	108252
Entropy (8bit):	7.991332626956763
Encrypted:	true
SSDEEP:	1536:MI9cI4N24813fwIsfQqzjoroJ1OL79D+0sFGmNjFRchFxLvk5yswFa8D+0qlt6s1:Pah8Vo/1uLJoGmZEFxLvcwM8DZcZxb
MD5:	DD47F1E6DC19405F467DD41924267AD0
SHA1:	85636EE0C4AF61C44D0B4634D8A25476CF203AE9
SHA-256:	39FF69BA9161D376C035D31023D2FDEECB9148A2439ABE3AFD8F608F7E05E09B
SHA-512:	F77C4CEF5CB7E927948F75C23A190E73D6C75B4F55915859046533A10AA3C5ABAC77D8BEF71A79368C499C85009213E542094B85B94B69E62AA66B60616777C3
Malicious:	true
Preview:	MSCF............D...............u................#..................P.........$;....d3dx11_42.dll.....P.....$;...d3dx11_42_x86.cat..........$;...d3dx11_42_x86.inf.(........$;...d3dx11_42_x86_xp.inf.c.........$;...AUG2009_d3dx11_42_x86.inf.ix..@ ..CK.[.X.G.....<..: .QQ.9...S@..A.......p..D._M<.A7&F.q.f]c..xD..Wc.....F7..H..b.._.]=T.tbo.......\|O}..[U_.U]o.L......(%..V..Nq.(.....=v........R..3.K.......2c....Zm,..+k.%.....2k.e........s3Xx...C....~..P.X..o..~..[....../A.?...\Rl.QRX.g.sz<E....g..s..[/s.(5..T..>/.(.9F&;.c\|..).k....6y.7+P..d...U.J.H7(.x.E.B}.1`..Z. .C....lTP...C7....._^h7F..t....T[.V.r.J.....&?F...Pd.6#..H\|....).<.....U...g...5..5..RjE.=.sc:...x1..[..w..p...8."..Y8.....AV...E".A..p...%d."..5d.!..l4..d}..#.A...#;.l.....!.....Xd...!3"...G...d_"...^do![.l..i.& ..,...d}.9#S.....IA.C......E.6..![...dS..#+@6..@.....m..:......v!{..Zd. [.l&..-.....9..C9...}.x..Y9=.F...k.Z^.^...!{...........R...d.._...~2z_O.mXG.._...XkYEI.....^iA.p.....=...wa;...N.6.2

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Dec2006_d3dx10_00_x64[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 206847 bytes, 5 files, at 0x44 +A "d3dx10_00_x64.cat" +A "d3dx10.dll", flags 0x4, ID 6580, number 1, extra bytes 20 in head, 17 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	216015
Entropy (8bit):	7.996946294916653
Encrypted:	true
SSDEEP:	3072:SGo145qtWQt9fL4bBHlKqDfaqaGm3+vqm9/Xx0b6POnzED/RIxeqTk0T:SGo145qtbt1LaeB36/xc6PkV
MD5:	681407075E9B19E5EF2218832F6FAD71
SHA1:	E4F4D292A36CD9A3034007EF9D2005694307EB52
SHA-256:	F9BD5BB083BD55D1D2A690BC66D6D9DA0B1A8B49F09E811E788C030669121118
SHA-512:	E983E7DD3F40510816FF3AE836600A186DBA827B484B0C346C20E43E229189A86D4CB5CF219C1FC35B77AB0668866446F6E9206B279931C927D4ED66AD3625F1
Malicious:	true
Preview:	MSCF.....'......D............................'...#.............................5#a .d3dx10_00_x64.cat..)........}5.h .d3dx10.dll......H.....5T_ .infinst.exe......O.....5.` .d3dx10_00_x64.inf......Q.....5.` .dec2006_d3dx10_00_x64.inf......:..[.... .Vm.....%A.P...?..,..".._.R.&.F.J.J.K.^.^...".U.!. ...BvJ...G......(.........C~.b...V...i.Z..O.<.%. .C...@l....a........XBq..Q.]g..2;..+d.[T[.Q..(ji..J...........T%.E.5.o3w.;.x.p.+@...JH...JA%.`.F..^....z..B......D.....S. \.3....."A%'n..h.f%.E.Ue.T..61....i.....m.X.......Wu...pf.a...............G.B...........$..%....R...`K.x....U,/...aH........S..^..2....h.E.6....B.K.A..........4!@7..........2...].}...".2..Z...!V.......-.6..<...{}..............o.~.ST.}.O.H.,....U.N.;..g{j.~a...^..7.n#.......SJ....~3}I9.\s.o....u.c;.../...RT....O~.R......L>C....W...K....P..z..........f%........::...vr.hC.Z.5...75+^...........evQ...8....v..)...W{..O/..<$....t...;. t..,&F.]&@.R..3e._.KZ.....C\|../...^.p&..`\SVd.......ge..E.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Feb2006_d3dx9_29_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1078760 bytes, 5 files, at 0x44 +A "d3dx9_29_x86.cat" +A "d3dx9_29.dll", flags 0x4, ID 6921, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1087928
Entropy (8bit):	7.99922866964108
Encrypted:	true
SSDEEP:	24576:MWlF24ngnZPhX4ciAwvVHgK6SgHY6OmSfLV+:MWls4gnZTmHx6SgnPCY
MD5:	F6CC1C08D0F569B5F59108D39CE3508B
SHA1:	E9CF7EDC8C9C4B57A9BADD8386A2117EC5785AAB
SHA-256:	4114E76799AF3DA9DB3DAE51305DAD70A05B757E506E4A327092D536CCA7EE75
SHA-512:	86DF72D5B15396ACB504C1AC9DE7FF5C0CC9C95A90FDD82DAEDC55BAAD490CC47A71CB511571D37E25DD9BC1EE9652B9723E33879BC1756A7881A8E61EBC59ED
Malicious:	true
Preview:	MSCF.....u......D............................u...#..............H.............C4.F .d3dx9_29_x86.cat..#.......C4hE .d3dx9_29.dll......#...C4hF .d3dx9_29_w9x.inf.....x.#...C4hF .d3dx9_29_x86.inf.......#...C4iF .feb2006_d3dx9_29_x86.inf.w.6..>..CK..X.[...C.Q...1XQ.N..........T,..D .$....c.]......#..{.z..]..E....}...?......f.=..=.g.....v..]F.Y3j...8...&....V..S=S.f...1]aQ......a...1..Q...V.....m..e........s..m.[c.....yl.{/.^%q.Z.I ..hg..DH..........$..........AB.....!N.w=!F.g. .s.p.B...X...LL..X.c ....z.B...........b.81...>:/b.......511A..[.&.3vo.'.V)..kgjb...\..\|..!(.i..%#...8..9Um..]_.E...c.o.{....\|j..r4..CN..2....K..].t.E..CH.2b}I.A_.D...5s.e....K..&...n.K....a..p.$29...o.HN..[..k...d......1V.....P..9..e.....p9...c=..RQ .7.H61.e ......I~.v.....p}:.1.:r.i....qb..@K.......AM.(.QM....%.p....+.9....~.J~.J~.J~.....-....`.0LLl...3nL.....t.f/...x.9......n....I/!.!V..X........S,OU..`.tt..u$i...]...`.6...o..(..).-..tD.....L.B.S.+c.:.Z.n......od<..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Jun2010_d3dx10_43_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 191323 bytes, 5 files, at 0x44 "d3dx10_43.dll" "d3dx10_43_x86.cat", flags 0x4, ID 7293, number 1, extra bytes 20 in head, 15 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	200491
Entropy (8bit):	7.9966634458730566
Encrypted:	true
SSDEEP:	3072:kD2Fju8h1xkWCD/5e8U2LK1aQAMxVz2aoOxoY4+ApyP0EwMGvFas+8QJgdBvCD7D:kwbCleyYagxVCaoV+ApcnG9aKQJaw/
MD5:	591A61BD06C73C70F93DAC5AF2D8E924
SHA1:	C9D36AC5E2ACAC31A7413D22ED1C09C71CC96FFB
SHA-256:	F0BC06CEB484D97CF01526F9223DF7B4357D166C4391869F2E7D514DC1FE769B
SHA-512:	3E2E3318A700A6ED82A21018403CA99728C8A56B7DF81F99A5D705B586CEE1141586DBF19A01EF1F1A72DDC8F45DDB51BA5769AE4634B02233EF1AC4E0FBA5D4
Malicious:	true
Preview:	MSCF....[.......D...............}...........[....#..................`/.........<!]..d3dx10_43.dll.....`/.....<B'..d3dx10_43_x86.cat......I.....<.&..d3dx10_43_x86.inf.(....L.....<.&..d3dx10_43_x86_xp.inf.c....O.....<.&..JUN2010_d3dx10_43_x86.inf..=.h`1..CK..T.I....8....ePQP....SENJ..1 q....a@EE.a]E.5....F.t...s.v.iM._W7+..:..........oW.NMM....e...1.+.f.#..2.....7.S..V..\|..O.yX.2]..Q'jbReq1.Z+.U.4..R%........6....<./...gU.g.)...u.y....dj.....UJ'j....[/.../E....e\.._...^..Gb..}....37..2L..a..q...../.\|...z.#e$.ZU7...vnkmh?W....-..L^...h.0.....>.Y._....f.......vpO#.1..6_U.o.......h.#.`.d....j.F.0.6.1..>.H...`'J..A.%6.tM.\.:<.......F...!.K......?t.:...../...2..=...2....&e^...I.M`........H."........@&0.X...%.1..p.h3L(..V....K...5....X........x.]..@}.F.8.......%.T`.....=...!...x`40...v.g...k..6...@. .......wh.@ .......F..+..#`.....p_-e*.3...^`+....&..@.......o....:.... ....c.&p.8.....6.K..@......e~....H.w..R..........`.0.X....G..`)k.8...-0.....n.....R......f..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Mar2008_d3dx9_37_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1437322 bytes, 5 files, at 0x44 "d3dx9_37.dll" "d3dx9_37_x86.cat", flags 0x4, ID 7166, number 1, extra bytes 20 in head, 116 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1446490
Entropy (8bit):	7.99972380205062
Encrypted:	true
SSDEEP:	24576:vFs/gTzoeHhwLMLDjl5XbCzgxt0Q98wWz35UM0vE03yYCmPI7ik:veKTHhbLDbDP0Q5UUtBC2PAz
MD5:	8ED75E3205C2B989FF2B5A7D2F0BA2DF
SHA1:	88846203588464C0BA19907C126C72F7D683B793
SHA-256:	91A50D9EFCDFBCDF22A91D6FBB0F50D3C2AA75F926D05CC166020BF7AAF30E28
SHA-512:	D0CF0E3AAD9C8C43A927D1BBBD253B9FE4C97B638AD9A56F671EBEDA68FC9BC17CC980D93095FBB248DD61DC11B7E46C22D72CEE848B150F7A13EAD9E08A7891
Malicious:	true
Preview:	MSCF............D................................#..............t.....9.......e8....d3dx9_37.dll.<'....9...e8I...d3dx9_37_x86.cat.....D.9...e8....d3dx9_37_x86.inf.,...O.9...e8....d3dx9_37_x86_xp.inf.\...{.9...e8....Mar2008_d3dx9_37_x86.inf..$.0:..[.... 92......$Q.f...>J...h.].W...uWL.I...W]J.X..V..{..Z........X.G{<..033.4..P..........ek \|.b./..gFB'S...K.....fe.5.u..T<{..H....XG84QbDR.8X.Hf.H..46...H"0 ..HH.S.............(_ ..w...H.....Q..P..vT.t@.G+...1...YH... V..Y4H..P..1R$l/..20!ls'...;....;..kmttyu...x.s....q.....q$.C..5k....(....B.r..y..<.6...Fz..hn..-.....Q.3Z...@.1.V..S?...a\|....(6.......D. ....)Ej....GJ%.5 ........G.w>......p...i}..<.\|..b.&!..7E.yU.O-.D......O.UC..yIA.Aj.._..D...VOc....{.f]J.<...r.)o.\|-...>.PWF.....;.;..vb....4..QV'f.$......:S.hi...~...}3k......\...}a.......L5..e....\|.....1..n...T...t......[....Z.].e....d.A......'..\|.V.2.\|Ax..W..........B.>...x.. ..\|.`...L.h..H.i.....@-.aa...7...K ...../..l.x....r...0>x..@/X...W..L..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\Mar2009_d3dx9_41_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1606486 bytes, 5 files, at 0x44 "d3dx9_41.dll" "d3dx9_41_x86.cat", flags 0x4, ID 7142, number 1, extra bytes 20 in head, 128 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1615654
Entropy (8bit):	7.999772423092358
Encrypted:	true
SSDEEP:	24576:xFtN95ew18Yl4WTrZnZSibmmq18Whxp9pWISiIz9cXwowwenm2AB4qDA2mV7Q:newRFZ8ib6T3p9pW9/Z4bM/XkA+
MD5:	901567428D8C82756D7BF5A406441BD7
SHA1:	6E3C22147F3DA77AC8F20D615CA32B5EF2A0ED28
SHA-256:	32356344AEDDF709C9D5302D8F3FCC1FF1BE2E82D8D17833A2086400AF248794
SHA-512:	6FD4C429E32480BDFF4E58BA8BC0D28FE97C9FF5EF1FABBB856230EFA669246A354F99B723E7483D548B74C121AC8BA9CBA2B5BC3C18F35EE828302D392CF6ED
Malicious:	true
Preview:	MSCF....V.......D...........................V....#..................X.?.......i:k{..d3dx9_41.dll.....X.?...p:.r..d3dx9_41_x86.cat.......?...p:.r..d3dx9_41_x86.inf.,.....?...p:.r..d3dx9_41_x86_xp.inf.\.....?...p:.r..Mar2009_d3dx9_41_x86.inf.x..#.9..[.... .3......$Q.f...<...!..vW]....]eJ.Uaq....a.Zk....}_..=hk..C.=...."......?1<..izt.`Y.._ .....H.`...uI35.:.,L.....I.;...........&...B......I....!@.A...A....a......................#..&.E....J..%. ......!..Q0..P.F......$.!...q..yXf..d....7,v......Y.....Q......EI.&..Rm....d.I....D........WJ...`.u..WK..K........yQo...2...W.U\.C.m...a.k.kpq.U..C.5.Hh).......<R.s.l.+.......);........%.g.g.....i..I.U.).H......l./._...<.C....a....U8.'.,.0GR....=.5....E.......jln..MKiliw..Q......,.2{..k...\.X$.......Q4..??...ns...?....t.\|.8U..>WJ./.>S..Vp.....0...3 ....'!....,R........Ph..#.t.7=.?p....D.....hX..H....J.`...Z.......$7t.......a...\|S....(..G. ...V+`...,.X.P..lZ`...X>Bt....E*aM..(`..0......BA3..p.%..OE.c``.BU....).P5

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Apr2006_xinput_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 40050 bytes, 4 files, at 0x44 +A "xinput1_1_x86.cat" +A "xinput1_1.dll", flags 0x4, ID 6338, number 1, extra bytes 20 in head, 3 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	49218
Entropy (8bit):	7.962835058038329
Encrypted:	false
SSDEEP:	768:rrXN+lWp5tvn2v0JeuXfYYJDyRIvwde6hecBLdKd+d4RUJ6HwyQs34VvD4:3gl6tfTVXwcWuqe6htcaJyQW4VvD4
MD5:	E207FB904E641246F3F7234DB74121FC
SHA1:	1BE8C50C074699BDD9184714E9022B7A2F8BF928
SHA-256:	3FDF63211B0DD38069A9C1DF74D7BC42742DE003CEF72AD1486AAA92D74546FA
SHA-512:	ED95D53BC351C98C0322753265B0A21C98DF97D0E2FBBC58A6836BFF374B7540B0CEA21371CD4A7EAD654210A42E1F9809CAC6E4EAE2ECF0EF2B88E220DC37F7
Malicious:	false
Preview:	MSCF....r.......D...........................r....#.............................46f .xinput1_1_x86.cat............4.d .xinput1_1.dll............4.e .apr2006_xinput_x86.inf.....R......4.e .xinput1_1_x86.inf...G..>..CK..\SG.8\|....&l....-n.6....(Z........"PH..,...+.G.V..b..V....Zm.Z..Xm..ZQ..E.{.......}....&L.g.9s....Jz?tp..N.;.]Y....!...b......t.c..'D%v[...8.8..........F.spf2y,.Gpe.w.......d...o.vs.........G...).bQ....cE%....."..GH.`"....D..B!..i.1..... ..0.. ..K# ...@*...C!M....R....SDq.c...b....#!6....b.....(/.`.....Q....(.!.pE....lB.a....L.M..[..E.........\|...;.H!..".P.j........9..<.t.l....]5w.;...R.9qQx...@x..8.........$.1.az!.Z..?.rDP+...c..)U'J..E.H..j....%.......w.;..x.O...>........`0.A4..d.....dT...Q.3..y0.."..].x"...\|.C.bs.,...`..h..#D..y.v..OM.1u{..C .X.N......+0....f2...3;...@...P......Z.......H.x.E<....A.-.4OA.Vi.f......."n\....b\...\M+.e.....k.N.q.`....%.@.../Q..V.e...s..."w.......KI........4.u.p..J^.V....D....t.0J...H.HMVg.d....B.v.]..)..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Aug2009_d3dx10_42_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 186171 bytes, 5 files, at 0x44 "d3dx10_42.dll" "d3dx10_42_x86.cat", flags 0x4, ID 7280, number 1, extra bytes 20 in head, 15 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	195339
Entropy (8bit):	7.996178589789764
Encrypted:	true
SSDEEP:	3072:/hxMUzbnbaWbX0JkFvs5aQnkW6sJ/Fw395/lfLxBQLgGlekmQI84HAGujR7j:5CEbiqvs5aQnkW6A/8jlzxBw0/Erd1X
MD5:	F264AF5A36B889B4F17EB4D4F9680B4F
SHA1:	1DF087EA99D321EC96D0D2F1C66BEE94883D6F08
SHA-256:	BB46189EB8CB7769EB7BE00CFBC35902072FA9408313EF53F423E5AE5C728F61
SHA-512:	73AE1CF3CAFBA148F4E5B4D8AC12A7AA41F6ECAC86C139C6A7714F90F3DC61C444DC152A3AD3C2CA800C1A1F4955A2B508735F8490666B57D1420FB7A7BFC269
Malicious:	true
Preview:	MSCF....;.......D...............p...........;....#..................P.........$;....d3dx10_42.dll.....P.....$;...d3dx10_42_x86.cat...........$;...d3dx10_42_x86.inf.(.........$;...d3dx10_42_x86_xp.inf.c.........$;...AUG2009_d3dx10_42_x86.inf.\|..f.0..CK..T.I....8....e0.JVT`..Q......A..a@..i.k..........b.bN......fE.]...y...s._W..~.......9.6.0:../....^.._..F{.3......7.NHL.....T......Z.....Sd.)2W. Y.2Na....^.lk....+......V.J...j.W.vI.Xj.V....Y..^$....&.&....9..azKt..6....2..e..).,..6...0,......Z.a...R...k........(..V.E.....2..C....p>r..Y.].sR&....)....i.0.....W..#(.....j.p5.ZvR.!..:.jd..e............7:(..\....kZ..b^...s4W).. L.%......:g......./..5.......eW).....t.2..].... ..X.,.. ~80...v..k.#.1.2.....0..PF.....z.]......\.\.N.E.J`6....p.....@_..;...p.8........x.....y.6.(p.x..XJ..@O........E.v.0p...m4.8.,.6.%...P.lh.. ...B.g..0.....>v.....S.A......E@...0.P..@8....v.9..h....xc*e....'..`..._...........M.lg..P..-.!......L...@$0.........j5..m.{ .H.f.[...C@

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Dec2005_d3dx9_28_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1073496 bytes, 5 files, at 0x44 +A "d3dx9_28_x86.cat" +A "d3dx9_28.dll", flags 0x4, ID 6914, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1082664
Entropy (8bit):	7.999121865147412
Encrypted:	true
SSDEEP:	24576:Wa0lNxqf7fg42FhNffA/Lj41q7+YeSFfSKidHVmTJwagz8u:WHXx652fNffm0oleSt3Fwa3u
MD5:	B1CCAAFF46FE022439F7DE5EB9EC226F
SHA1:	8BB7225DF13E6B449D318E2649AEB45A5F24DAF7
SHA-256:	645F8D90B07C69330A8C7C8912D70538411C9A6B2813048DA8AD3C3119487F93
SHA-512:	2B59C07584D45705273A975A0223E4443DB190675558AB89D92E1572DE4843BE3D0D1267818B19185E4E438A8BCFA2AF5FB5EF2A119DA270BE4540576FD78C77
Malicious:	true
Preview:	MSCF....Xa......D...........................Xa...#..............H..............3g. .d3dx9_28_x86.cat..t#........3). .d3dx9_28.dll......#....38. .d3dx9_28_w9x.inf.....x.#....38. .d3dx9_28_x86.inf.......#....38. .dec2005_d3dx9_28_x86.inf...a.>..CK..X.[...C.)...1X..S.I...(M@A.......Pm..;......,.`...=.#v.$("..w.{...yN<?..=k.^..=s...o.jw..et.=..YA..=H.eF..l...,;.17kj....+.jw..Y.ry6..\.Y.4.igecJ...,.g.yp.F.yc.....X...e...L6.....SI..j......."6."...2.... ..+..O$B,..6l. ..B1l.`.....A..rN2..ggf..g..... ..H..Dp$.1..h..X.O..Pi...[LC.L..!d.\....fff................lknfYP@_..\|...Q4.!.JBJ..0...Ri[4.=..r<...b.3M/F].._S.J.."......"...P%@...`..l..J./.!.3.M.....y.l...TI.d~8.0fwf.J)M.C.U....<n7......./..&..P.R0...Q.JU..2.`...2.ri....vp:.Lg.:(.....7.H2.p.!....N.).A...bg......$..6.M5Nj.e.U..-9..P..L.5...G5.......A.P.6..6..v.i..6..6........-....`.........&3nN..K.&w.g-c....4K.9..}...U}.."VCf}*b]..B..+.j.D..d5`..k...j...4UR..... ..Ux."].d5g6..l.70&.%J.^...Q.U.5...9..~

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Dec2006_d3dx10_00_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 185760 bytes, 4 files, at 0x44 +A "d3dx10_00_x86.cat" +A "d3dx10.dll", flags 0x4, ID 5461, number 1, extra bytes 20 in head, 14 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	194952
Entropy (8bit):	7.9966042762544145
Encrypted:	true
SSDEEP:	3072:x4mJ4SadBGg8IZrdosr2nqOwY7l43gRDlcGgp6VMslgVwxikcBmEi21wx8MqX+dN:xJJ4VWgzZptAqOf6wRD5g0VlgVwxL21I
MD5:	75C33157D8A1B123D01B2EAC91573C98
SHA1:	E3E65896CE0520413979C0143C3AA9BD3A6A27D3
SHA-256:	02DAA8B5AC3752F76C3BFD9A505EBF22B1B4B41E44EB92CE2799033B2330D186
SHA-512:	F0F1F1DEA5938E1C7FF2ADF7C8D421C2E68E6D3A8CDF18D0F2F3FE1C6837A4F37B367D2D974C35832D1D85A619948DD0F250C7D6DC4AE39F618F5A2893EAC7DD
Malicious:	true
Preview:	MSCF............D...............U................#.............................5.a .d3dx10_00_x86.cat...........}5.h .d3dx10.dll............5.` .d3dx10_00_x86.inf............5.` .dec2006_d3dx10_00_x86.inf....9.>..CK..\.K...C..DEA.P.$.......$...%.A.....0 F.Y.s.1#...#..f.......y...}....ZU..jU......SP.=.gB..GQ....>.5.p8.*<%.y3uY.....Xv.....G.S..)/...A.x....@U.GN.....{,.0nI..@.......d.......R..S....s..B.........B...H. ;.. 9..<...nL.5..!..4=.>.o....A..u.i^...dd..x!.....p...@Jn.;H.L...d......&$. ..\|<&/;.O...!.A..%##C.RZ...YG....Z.h..ee........+..D...D&.F.....?.a...Io..hg.5..blP..I.......B....`..,.....u..=A...<.%!.8.,.0....b...v.O..a....#.._J....3o.........F..Z {".t\..H..eo..1h.m.0.a....1....Bc..s.^..V..Bq.x...D(.E....@...&......<._..xv......OB....6L......y.. ....$3.....AB.&.cC8C".p.9.,[..mZ...C+....J.....A.04...rY.....7.y..!^....>j.+yj-#.#...h23.e..)....f....k.:@.-..3...,...O..Vl..#....MIK.Yk@j...^!,96O".....T...\.H,IIL....dfXw.u..e.w.F...C...Y).I\....&.[.4.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Dec2006_d3dx9_32_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1568416 bytes, 4 files, at 0x44 +A "d3dx9_32_x86.cat" +A "d3dx9_32.dll", flags 0x4, ID 5512, number 1, extra bytes 20 in head, 105 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1577608
Entropy (8bit):	7.999092247669469
Encrypted:	true
SSDEEP:	49152:VKo9fY3tlVm3JjPueurZ8zQbC88LHhpu97Sm:V13BFurZ8U18uSm
MD5:	A5BEAD938AFDC63ADFECC1DAF5049D7F
SHA1:	B3D5BF56F6B9BF87C33009A088BA7785B6363B4E
SHA-256:	A1CC7603302EE53D54F4353C223D95E223706924D99B864220B13814EF93EEFB
SHA-512:	C9244BBCFE60F347EC8785B1A41B6E243153624EA73B16DB4D624239A69FA76D2DF2E54039D8F4D2C495890AC17B676E390F796118B4E16D9F03683247190362
Malicious:	true
Preview:	MSCF............D................................#..............i..............5.a .d3dx9_32_x86.cat..G4.......}5.h .d3dx9_32.dll......f4....5.` .d3dx9_32_x86.inf.M....i4....5.` .dec2006_d3dx9_32_x86.inf.4.$G.@..CK..\.K..?.........7...a....4.... @..LB. `..b..;......{/.;.g7A......}......uv.3.....9X....:.G...`.eT..p...X,..V..C]c.....3^aV......n..3..N.0K3s..%.eb...e../...7..$.~.e#+...<....=..U...R...<..I8..H.D..L.. 1.!........np..\...a...D.'....@(:./.A..{...H.e...b...4Y.c.<..P...H..............].;gl.$q.........}..%,.g.....X.C...HAUZQ1..C.PM.v.\q...T.0Y.3.a.#.\!...O........A)...K....\....PF.X..te...P...B....).).V.(]Jt...A}.S.t\|1S#z....\}./.....\..............(..0....'}..N.]......y,..~.R....f.P.E.T....d#.k.b..`P.../..0W.K&....!.!........M......EL&..bBA.b....q.H.Q.5..5..u....{.ka.k.s.PA^.e.5....c#......d...2..).V.e....2.^.;.....L.....s.`.iK...Q..N.Q.%.T......k..M...U...d...H.W..f.I......kF;X..;.%..N.....j.....6......L.T.).JU"["..`....1..........D.QO,..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Feb2005_d3dx9_24_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1007265 bytes, 4 files, at 0x44 +A "d3dx9_24_x86.cat" +A "d3dx9_24.dll", flags 0x4, ID 4987, number 1, extra bytes 20 in head, 69 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1016433
Entropy (8bit):	7.998972724711677
Encrypted:	true
SSDEEP:	24576:T/HUK+hlSM4jwe8WpmQUrxiUyULWoF/V++TYrjVdLa1:bHURewe8W4VN8uF/VhMr5s1
MD5:	7029866BA46EC477449510BEEE74F473
SHA1:	D2F2C21EAB1C277C930A0D2839903ECC55A9B3E8
SHA-256:	3D4E48874BDDCD739CF79BF2B3FD195D7C3E861F738DC2EAB19F347545F83068
SHA-512:	B8D709775C8D7CA246D0E52FF33017EE9A718B6C97C008181CD0C43DB7E60023D30D2F99A4930EBA124AF2F80452CBF27836D5B87E2968FB0F594ECA1EBF78DD
Malicious:	true
Preview:	MSCF.....^......D...............{............^...#..............E...7.........E2.. .d3dx9_24_x86.cat...!.7.....E2.. .d3dx9_24.dll......."...92.. .d3dx9_24_w9x.inf......."...92.. .d3dx9_24_x86.inf.(~m.?..CK..\.Y..O..........H.$@..(M..X.. R.I...6...#.^.......{w..}&............{.3..gf.e.....0*`..kFm.......i.`p....X..Y-..7]n^..9...e.(.7..^..V.FO+...v.,e.^..l(i~w...M...l...s...z..U.7.c5.b.3..........#1.I.'.F2.C.@.......'Hx /..K.~.`g.).0..".8y....0.8...N.\|..v.u@...P...H.R......c;W....yg..x....s...2..\...}..%21.D..... ...q.....E,.....q.Ee..$...66...pGr}.. +..!&&&PK..f.r...x.'..<.. ....kH..@....~l....\....@fD...+y..:UC.%...zy1.........~j..v..{%..v[S.ZEE...5....i;..1.(...&.x._.......R+[A..l..z(.e. .k..jbf.@.336T.[...'...J/-..uHc.u.....6..U.....).l...&.".9.X..H\.N...d.V.g...^...Jv..PQ~#?....V.......j:..p.....k.R.......0o.~..F..70.).4b7......+.:.&.)Qd(9...i....J35q.....T%..b._....,..........)Qjt.DU.B.R.s..-.`.......4HE...JObJDlG.4x......lb..<..C..sHD.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Jun2007_d3dx10_34_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 692512 bytes, 6 files, at 0x44 +A "d3dx10_34_x86.cat" +A "d3dcompiler_34.dll", flags 0x4, ID 9065, number 1, extra bytes 20 in head, 49 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	701680
Entropy (8bit):	7.9989902264021255
Encrypted:	true
SSDEEP:	12288:SuBBWP1krfKO0BZwB6ux8hBXsRbD3RazqgwLdJPMqHy7qdXCyhUW3zE:DBTrZ0BZwV8fXsprRaxsDBHyWdXg5
MD5:	19383CBADA5DF3662303271CC9882314
SHA1:	123C97C33F7EF2BA345B220450F181D440412E6B
SHA-256:	8EC971C91040618338AC2369188F3E5D7C85A5B1E3B9FC8E752DD845D295CDBA
SHA-512:	A4C6ACC9FF656E05D75AE0081C65C200B584209C99FD001494C4D206F2CE8A78D2DD3644E51018574928F3B9E9373BF7EC8C5147A3590B54D1C6D50E61342853
Malicious:	true
Preview:	MSCF.... .......D...............i#.......... ....#..............1....).........6.. .d3dx10_34_x86.cat.p)...).....6.. .d3dcompiler_34.dll.h...2S.....6.. .d3dx10_34.dll.I..........6.. .d3dx10_34_x86.inf.i..........6.. .d3dx10_34_x86_xp.inf.c...L......6.. .jun2007_d3dx10_34_x86.inf.....{5..CK.\|.\|......m:..s66...$.\.-K2...B....-.%..\...zI....-.@...!@..<Z(.@..B..@.?..'.k.......f.67;;;;3..gQi....O.7..F....J.m........".z.=.;9.s.D........P...PV.\.U.D......M...3.{K.k>...[z.u#Q...D,..%.%.$j,@wDT..D..]................8\.S.....X......$....q..pP>.0.8.(q.IQ..;GGq.H.@...z.F...~(...=............W...9....._A.qtt.D:[.......7D...&..N..ee.J....H..LeS,e...CY....K m..9..\....._.e....E..@R..J)p..~e...I......uA..8<>).X.#....P..O.BN...a9#I})RW..J4P./.i.'..v.Po..5.+K...[..+K..2... `]....@............q.($. <B$...8@..b<." ...b.y..,.<..OK.."..t..q...{^..5..l........J.(Q.o.Yn.]z.:x6.T..J.Z..zG........ .W..-..l.....2.\O..f/.......TJ&W"S$.2.@.2.a.....C.......A...{..!.\|. ....UVJ7.#.\T..k..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Jun2008_d3dx10_38_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 843959 bytes, 6 files, at 0x44 "d3dx10_38.dll" "D3DCompiler_38.dll", flags 0x4, ID 8962, number 1, extra bytes 20 in head, 61 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	853127
Entropy (8bit):	7.998980130768887
Encrypted:	true
SSDEEP:	24576:IKcIh4DqtGLRndZKm4zZTQb4BJ+gfG07QyGeZH:IKc64DgG9dIZTQb4L+GGIGeZH
MD5:	B0E2B612DAF28B145B197A4DB0A9B721
SHA1:	F69266E4AF3D2DE31A2A2E416F10B0F44737739A
SHA-256:	E8DC1063C9434EED8D633741B19CDFA1889581041E2214B87B5159E3EA087F3C
SHA-512:	6E31F18CB75CE69D291D0ABD15EDADF02C0693033351DFB2F435312A47540AA223C8176209725C14A05FA6494153A3E191B2FB7CB8C5CEE11FB42371CE67392B
Malicious:	true
Preview:	MSCF............D................#...............#..............=....$.........8wq..d3dx10_38.dll......$.....8wq..D3DCompiler_38.dll.f(..(......8.r..d3dx10_38_x86.cat.I..........8.r..d3dx10_38_x86.inf.i..........8.r..d3dx10_38_x86_xp.inf.c...@......8.r..Jun2008_d3dx10_38_x86.inf...E7%,..CK..\.....\./BS3...$.......p.&..x"........h....J.,5.,._.e....y..-y...#.......YXPP+..y.......y....o*.&..........\....i...YQcs..u.77K.8..h......h..]L...y6.bc..S.\.Y..]..aM.iyo.Xr..2....w...^V.Y.v)..s..w..;..z...........S..WY.b...!....q..W............y.~.x...P..!z.S.....2..{W.x.tJ.....Y....'o5"dE...(...\|o.U'.tpJ....8..4.j.vT.+TrVWy.`.P..{![...O.<.!...F...V.........C.k.E.h._..AM..+...E.jG.U.R.F:.].E...Xvw.?....'..,....................A-p...l.[.J....4.. .$.,...`2X.W.c..=Y.>........i.....A-p.?.....`.8..qp.`...A.....P_1.....? ]O....A?P.&........%..c. ..v...,h.=...AK0........k......d..... ....A{....... .\|o......&..\|......0........d.....[m......X...%C.D.2X.....'&.4..@o......98.~..c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Jun2010_d3dx9_43_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 762076 bytes, 5 files, at 0x44 "d3dx9_43.dll" "d3dx9_43_x86.cat", flags 0x4, ID 7093, number 1, extra bytes 20 in head, 62 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	771244
Entropy (8bit):	7.999380380890997
Encrypted:	true
SSDEEP:	12288:E0b5pTUIVIRxV+yb+HJFnXQRGr85UpzQ3VztxmHN8DMFy0BJ1lSIug3SqHAlzJYf:l51NVO+XVLs3VztQHmYjBJb931I1NYI0
MD5:	BF124B64FC3774F61D30DE0A405F0C6C
SHA1:	2F8A8BABFA4E51555FCF125E8373D9C5F7F7434A
SHA-256:	457C5CE48EAA0FE551B46DFFC1E4DCA985D261686D8D4E6BCED533EE1F682FCE
SHA-512:	935922CE74BD399E8358693562F86C9B4B6308A6E33586A5DD61924F8B6B2CFD6CB2E472FD082B9EA32C0ABB9A799A0BA9103B4C316342F8072A7A3782C2116C
Malicious:	true
Preview:	MSCF...........D...............................#..............>...X}.........<!]..d3dx9_43.dll.....X}.....<C'..d3dx9_43_x86.cat...........<.&..d3dx9_43_x86.inf.,.........<.&..d3dx9_43_x86_xp.inf.\..........<.&..JUN2010_d3dx9_43_x86.inf.[.'.":..[.... .......5!.P..wOnf..O..........9vm..o..f.6.....+I).H]..t.....T...v.!..M.......>>.{..._..t....g...:..jh.N....K...vJ.r.. ....;J.zq.........H....'....d.=...{O.4.xIBC..L7..2....... ..E5`5`........<s...9..(.b3. .."t....M\.;...0.........H....K.5$...L.Ha....%..e..V........{.t....#3kk.sR6.....I.u.Em....b.Dl'.E.[.D.N....m53%...'.m;.>..yf.6..pN..N.y...-.5Y...f.......-.B#.......;.D]......G.8.5...G.......x..}...!.GwT.......WwKuT...Y.l[f..}ji...{.h{...x.u.....>..1....k..v.D."W..ZA..<...7=c2QN.Y.......v..k&aHudg.W...`HbV{.Q..CJk..nLpw..#.&5.%S...G.&.`....]...EpFY...(....P\..+/`..&..ap....S....BR..'....s..c........p..B..j....c..D....mU.x....N.r..QfEz`...}.._...........8..$..........!.G...i.@..P...."c..d.L00...QX.B0.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Nov2007_d3dx10_36_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 797924 bytes, 6 files, at 0x44 +A "d3dx10_36_x86.cat" +A "d3dcompiler_36.dll", flags 0x4, ID 9083, number 1, extra bytes 20 in head, 56 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	807092
Entropy (8bit):	7.998858073625772
Encrypted:	true
SSDEEP:	24576:EL+Y8gC2xQcaINcDDHwNXjNOl93uN850V7ZcR0SEDR3l3M:vD2xaINcDHIzhs0Vwz6c
MD5:	3D9A0C59156D03DA0F19C2440E695637
SHA1:	55B050991CB17410C75ADC3913066BAEDB482ED0
SHA-256:	BDF7FB01C02783A4F8C9F5E7911F5CAE3E2A7CBC425B90B36F9EA6EEF2C27DE3
SHA-512:	E9A662498C43865E917F0778B772D6964517E41289CBF5A0B8A4E44D8C4B4E9A5049C76F2ECBE4ACC7E9CFCC3F1D87A75C3F8703E66804CE758969814BA14FDA
Malicious:	true
Preview:	MSCF.....,......D...............{#...........,...#..............8...h(........V7.. .d3dx10_36_x86.cat.....h(....L7.y .d3dcompiler_36.dll.h.... ....B7.O .d3dx10_36.dll.I.........V7P. .d3dx10_36_x86.inf.i...1.....V7P. .d3dx10_36_x86_xp.inf.c.........V7P. .nov2007_d3dx10_36_x86.inf..d.....CK..8.....Y..^(4cK.......H....0..F.]1..$.(W...P.-..J.).[.%Q....M.v......>Os.c.......=.\|.}..d.r.5....q.s.J..*k8....y89....e...D...Q.!aL./,..l...@~N..J~..)...=..].)......o.@.... ......,R...".@&L.i..........Z.6`..C.......]6.Z.._V..J T.B......l......,..t.6.....md.p..5...l.....B...aI,.F.mU..<T...@Hf.......d{..... ..1.0$.....j.AE..#'..'.%..%....4..p..P.g%..(.H..d..........R#..L..H. mXq..c......6tU$....cii.e............1dA...f.... .........U.B..b.....Fj.z;x...f2. gY.....9.u24. .O&....!E-.....R.d+...5.b..![.dG.....""{U.C...........9p.M....Y\|.\f......E....).J...d..0.l.A......0$.....}....e......t..^W..LM(.$,... +.....A..K...f.p..dD...,..E2n..2/k-...d.E2.-.@.S...1.........pA..H..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Nov2008_d3dx10_40_x86[1].cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 959461 bytes, 6 files, at 0x44 "d3dx10_40.dll" "D3DCompiler_40.dll", flags 0x4, ID 8926, number 1, extra bytes 20 in head, 77 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	968629
Entropy (8bit):	7.999011847061652
Encrypted:	true
SSDEEP:	24576:JKTxCzc8gSDnU8Hz10a0s65QckarHGlImJtXn+QbtU0sHsqzn:mxCzs29r0WQma69nBbtU0sjzn
MD5:	5DFEB46E60795266DA03F2D0A67E7ACD
SHA1:	A77758873E5544E8AD22ACF469C4A0FD0C944A88
SHA-256:	EC52B075A3E9C7FE468B317E0FF977964B1003D560065128741F4392BF47C49A
SHA-512:	6EC058811AC017BE3CD3A46559CD73126666F41B0FA58D92C1168CF2A2E0E2357B19F65531C786EC81A438975DBECE440C5E7B6C653AFA5428CE6C444179AF6C
Malicious:	true
Preview:	MSCF...........D................"..............#..............M...X.........O9.2..d3dx10_40.dll.`...X.....O9.2..D3DCompiler_40.dll.......%...O9p:..d3dx10_40_x86.cat.I...g.&...O9h8..d3dx10_40_x86.inf.i.....&...O9h8..d3dx10_40_x86_xp.inf.c.... &...O9h8..Nov2008_d3dx10_40_x86.inf....X.0..CK..T...{..J........D...$.....$.2.....&L+...u..Q.5#f...W].9cN...w..Qd...y.......9~.}..]u+tOMM...r.].a.O..f7#.\........m.l._a.[..,4Q.&KU...c.eq1)).,V!S...)2...Y.^a.Q..b........y_x.W..Q^J^.j..P..gB...<w....E_).$j..q.\|y..{.'....1V-..N.bt..%...A.0K....u...O...K.u.F.H(u>.X.vbd.......)..Ltg)c.a..J..\|.V).N.F`G.Lxk..Rf.-.<1b...0..y...y!.g..F1Z.v..T..o......i.............!Jku.:..i...e.....Z.HR.0...6.....zk1..._.-.L....a).Gx.).........@6...........P.\....?`.....f...\|.r......L9......S.T ........o:J.'.E`?..x..?...$........z.......,.<.'..D.j .....G...3...G;.......p...&@W...;....^........R .X.....L ............-...........'.r`7........)........=......r..j,e..j.)..........uX)..p.B...

C:\Users\user\AppData\Local\Temp\IXP000.TMP\DXI3822.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	57739
Entropy (8bit):	5.6901788814132646
Encrypted:	false
SSDEEP:	768:eNIkdgBl0DBU0qwUqB7otN4PTHhy4m1Io/sF6UcmI2rIEoguD0dpY4rI8dgXl0dl:epECjtutVj072Xwt7O49vQzztSZs5KLz
MD5:	2C4D9E4773084F33092CED15678A2C46
SHA1:	BAD603D543470157EFFD4876A684B9CFD5075524
SHA-256:	ED710D035CCAAB0914810BECF2F5DB2816DBA3A351F3666A38A903C80C16997A
SHA-512:	D2E34CAC195CFEDE8BC64BDC92721C574963FF522618EDA4D7172F664AEB4C8675FD3D4F3658391EE5EAA398BCD2CE5D8F80DEECF51AF176F5C4BB2D2695E04E
Malicious:	false
Preview:	[Version]..Signature=$Chicago$..DisplayName=%SetupTitle%..MinFileSize=2000....[DirectX]..SectionType=Group..Priority=100..DisplayName=%DirectX%....[DirectX_Win9X]..DisplayName=%DirectX_Win9X%..Details=%DirectX_Desc%..SectionType=Component..Platform=Win98,Millen..Group=DirectX..Size=4608,0..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL1="audio_w9x.cab",3..URL2="dinput_w9x_81.cab",3..URL3="dplay_w9x.cab",3..URL4="dshow_w9x.cab",3..URL5="dshow_w9x_81.cab",3..URL6="graphics_w9x.cab",3..URL7="graphics_w9x_81.cab",3..URL8="ks_w9x.cab",3..URL9="vb_w9x.cab",3..URL10="bda_w9x.cab",3..URL11="setup_w9x.cab",3..Version="9,29,1974,0"....[DirectX_Win98_ENG]..DisplayName=%DirectX_Win98%..Details=%DirectX_Desc%..SectionType=Component..Platform=Win98,Millen..Group=DirectX..Size=4348,0..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL1="audio_w9x_eng.cab",3..URL2="dinput_w9x_81_eng.cab",3..URL3="dplay_w9x_eng.cab",3..URL4="dshow_w9x_eng.cab",3..URL5="dxdiag_w9x_eng.cab",3..URL6="graphics_w9x_eng.cab"

C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup.dll

Download File

Process:	C:\Users\user\Downloads\dxwebsetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95576
Entropy (8bit):	6.500059286855779
Encrypted:	false
SSDEEP:	1536:BG8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHM:BptQv1iyODswNLmqxY3AMV71Ev54EAxa
MD5:	984CAD22FA542A08C5D22941B888D8DC
SHA1:	3E3522E7F3AF329F2235B0F0850D664D5377B3CD
SHA-256:	57BC22850BB8E0BCC511A9B54CD3DA18EEC61F3088940C07D63B9B74E7FE2308
SHA-512:	8EF171218B331F0591A4B2A5E68DCBAE98F5891518CE877F1D8D1769C59C0F4DDAE43CC43DA6606975078F889C832F0666484DB9E047782E7A0AE4A2D41F5BEF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 5b1cxnTnnS.exe, Detection: malicious, Browse Filename: JITStarter.exe, Detection: malicious, Browse Filename: JITStarter.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........xx...+...+...+..+...+...+F..+.6k+...+.6x+...+.6{+...+...+...+...+...+...+...+...+...+Rich...+................PE..L......M...........!........N.......k.......@.......................................Z....@..........................5..y...........p..h............^..X.......H...0................................6..@............................................text...)(.......*.................. ..`.data..../...@......................@....rsrc...h....p.......@..............@..@.reloc...............H..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\dsetup32.dll

Download File

Process:	C:\Users\user\Downloads\dxwebsetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1566040
Entropy (8bit):	6.387345800194587
Encrypted:	false
SSDEEP:	24576:GIQ+ddddddddddddddxOOOOOOOOOOOOOO2iWeXiWeXiWeXiWeXiWeXiWeXiWeXig:GIQsOOOOOOOOOOOOOO2iWeXiWeXiWeXV
MD5:	A5412A144F63D639B47FCC1BA68CB029
SHA1:	81BD5F1C99B22C0266F3F59959DFB4EA023BE47E
SHA-256:	8A011DA043A4B81E2B3D41A332E0FF23A65D546BD7636E8BC74885E8746927D6
SHA-512:	2679A4CB690E8D709CB5E57B59315D22F69F91EFA6C4EE841943751C882B0C0457FD4A3376AC3832C757C6DFAFFB7D844909C5665B86A95339AF586097EE0405
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 5b1cxnTnnS.exe, Detection: malicious, Browse Filename: JITStarter.exe, Detection: malicious, Browse Filename: JITStarter.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^..?...?...?...G6..?...?..U?.......?.......?.......?...I>..?...I...?...I...?...I?..?...I8..?..Rich.?..........................PE..L......M...........!................c........................................ ............@.................................$...........P...............X............................................^..@...............h............................text............................... ..`.data....4..........................@....rsrc...P...........................@..@.reloc..D).......*..................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxupdate.cif

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	66865
Entropy (8bit):	5.567626982635727
Encrypted:	false
SSDEEP:	768:Wn+OeDyG6lG9CVGQM6UP8XUUkw8KlNxLkPkjdARflPp0VZRTBM9oZPFASJu71N1F:V
MD5:	B36D3F105D18E55534AD605CBF061A92
SHA1:	788EF2DE1DEA6C8FE1D23A2E1007542F7321ED79
SHA-256:	C6C5E877E92D387E977C135765075B7610DF2500E21C16E106A225216E6442AE
SHA-512:	35AE00DA025FD578205337A018B35176095A876CD3C3CF67A3E8A8E69CD750A4CCC34CE240F11FAE3418E5E93CAF5082C987F0C63F9D953ED7CB8D9271E03B62
Malicious:	false
Preview:	..[Version]..Signature=$Chicago$..DisplayName=%SetupTitle%..MinFileSize=2000....[DirectX]..SectionType=Group..Priority=100..DisplayName=%DirectX%....[DXUpdate_Feb2005_x86]..DisplayName=%Feb2005%..Details=%DirectX_Desc%..SectionType=Component..Platform=NT5..Group=DirectX..Size=990,0..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL1="Feb2005_d3dx9_24_x86.cab",3..Version=4,09,00,0904....[DXUpdate_Feb2005_x64]..DisplayName=%Feb2005%..Details=%DirectX_Desc%..SectionType=Component..Platform=NT5..Group=DirectX..Size=1220,0..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL1="Feb2005_d3dx9_24_x64.cab",3..Version=4,09,00,0904....[DXUpdate_Apr2005_x86]..DisplayName=%Apr2005%..Details=%DirectX_Desc%..SectionType=Component..Platform=NT5..Group=DirectX..Size=1055,0..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL1="Apr2005_d3dx9_25_x86.cab",3..Version=4,09,00,0904....[DXUpdate_Apr2005_x64]..DisplayName=%Apr2005%..Details=%DirectX_Desc%..SectionType=Component..Platform=NT5..Group=DirectX..Size=1317

C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxupdate.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	177152
Entropy (8bit):	6.549767948531931
Encrypted:	false
SSDEEP:	3072:KU6LKKnw8i/9S7BLGKm/nuFV3uNgosUBxr+2y97CqGIpHtWMeJnQRLj+bTHyKaY:Iw8aIMrfuFVeNgosUBxra4rIZsqq
MD5:	7ED554B08E5B69578F9DE012822C39C9
SHA1:	036D04513E134786B4758DEF5AFF83D19BF50C6E
SHA-256:	FB4F297E295C802B1377C6684734B7249D55743DFB7C14807BEF59A1B5DB63A2
SHA-512:	7AF5F9C4A3AD5C120BCDD681B958808ADA4D885D21AEB4A009A36A674AD3ECE9B51837212A982DB6142A6B5580E5B68D46971B802456701391CE40785AE6EBD9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............M...M...M.CM...M...MJ..M...M...M...M...M...M...M..KM...M..zM...M..{M...M..JM...M..MM...MRich...M................PE..L......M...........!.....j...n............................................................@.........................pw..V....j..........8.......................X...p...................................@...............8............................text....h.......j.................. ..`.data....:...........n..............@....rsrc...8...........................@..@.reloc..0&.......(..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxupdate.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	12848
Entropy (8bit):	5.071095411173453
Encrypted:	false
SSDEEP:	384:eXTiDxtV0xxmBxbD6Ys7s6xHOJYwYdDxAp8xXZyUxIJM:eXiM
MD5:	E6A74342F328AFA559D5B0544E113571
SHA1:	A08B053DFD061391942D359C70F9DD406A968B7D
SHA-256:	93F5589499EE4EE2812D73C0D8FEACBBCFE8C47B6D98572486BC0EFF3C5906CA
SHA-512:	1E35E5BDFF1D551DA6C1220A1A228C657A56A70DEDF5BE2D9273FC540F9C9F0BB73469595309EA1FF561BE7480EE92D16F7ACBBD597136F4FC5F9B8B65ECDFAD
Malicious:	false
Preview:	..; ---- Common sections ----..[Version]..Signature = "$CHICAGO$"..AdvancedINF = 2.0..Provider = %MSFT%..SetupClass = BASE....[Strings]..MSFT = "Microsoft"....[MDXDLLs]..Microsoft.DirectX.AudioVideoPlayback.dll..Microsoft.DirectX.Diagnostics.dll..Microsoft.DirectX.Direct3D.dll..Microsoft.DirectX.Direct3DX.dll..Microsoft.DirectX.DirectDraw.dll..Microsoft.DirectX.DirectInput.dll..Microsoft.DirectX.DirectPlay.dll..Microsoft.DirectX.DirectSound.dll..Microsoft.DirectX.dll......; ---- Windows 98 ----..[4.09.00.0904.00-4.09.00.0904.00_Win98_Feb2005_d3dx9_24_x86.cab]..NumberOfFiles=4..Size=2178 ;approximately total file size (Size * 1024 bytes)..CopyCount=1..d3dx9_24_w9x.inf....[4.09.00.0904.00-4.09.00.0904.00_Win98_Feb2005_MDX_x86.MSI]..NumberOfFiles=1..Size=1788 ;approximately total file size (Size * 1024 bytes)..CopyCount=1..Dependencies=feb2005_d3dx9_24_x86.cab..Feb2005_MDX_x86.MSI......; ---- Windows ME ----..[4.09.00.0904.00-4.09.00.0904.00_WinME_Feb2005_d3dx9_24_x86.cab]..N

C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.cif

Download File

Process:	C:\Users\user\Downloads\dxwebsetup.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	57739
Entropy (8bit):	5.6901788814132646
Encrypted:	false
SSDEEP:	768:eNIkdgBl0DBU0qwUqB7otN4PTHhy4m1Io/sF6UcmI2rIEoguD0dpY4rI8dgXl0dl:epECjtutVj072Xwt7O49vQzztSZs5KLz
MD5:	2C4D9E4773084F33092CED15678A2C46
SHA1:	BAD603D543470157EFFD4876A684B9CFD5075524
SHA-256:	ED710D035CCAAB0914810BECF2F5DB2816DBA3A351F3666A38A903C80C16997A
SHA-512:	D2E34CAC195CFEDE8BC64BDC92721C574963FF522618EDA4D7172F664AEB4C8675FD3D4F3658391EE5EAA398BCD2CE5D8F80DEECF51AF176F5C4BB2D2695E04E
Malicious:	false
Preview:	[Version]..Signature=$Chicago$..DisplayName=%SetupTitle%..MinFileSize=2000....[DirectX]..SectionType=Group..Priority=100..DisplayName=%DirectX%....[DirectX_Win9X]..DisplayName=%DirectX_Win9X%..Details=%DirectX_Desc%..SectionType=Component..Platform=Win98,Millen..Group=DirectX..Size=4608,0..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL1="audio_w9x.cab",3..URL2="dinput_w9x_81.cab",3..URL3="dplay_w9x.cab",3..URL4="dshow_w9x.cab",3..URL5="dshow_w9x_81.cab",3..URL6="graphics_w9x.cab",3..URL7="graphics_w9x_81.cab",3..URL8="ks_w9x.cab",3..URL9="vb_w9x.cab",3..URL10="bda_w9x.cab",3..URL11="setup_w9x.cab",3..Version="9,29,1974,0"....[DirectX_Win98_ENG]..DisplayName=%DirectX_Win98%..Details=%DirectX_Desc%..SectionType=Component..Platform=Win98,Millen..Group=DirectX..Size=4348,0..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL1="audio_w9x_eng.cab",3..URL2="dinput_w9x_81_eng.cab",3..URL3="dplay_w9x_eng.cab",3..URL4="dshow_w9x_eng.cab",3..URL5="dxdiag_w9x_eng.cab",3..URL6="graphics_w9x_eng.cab"

C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Download File

Process:	C:\Users\user\Downloads\dxwebsetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	527360
Entropy (8bit):	6.071483982747115
Encrypted:	false
SSDEEP:	3072:diqLKVd9Aqq3Z/yKxAG2ur4IhUNJ4g3nO9hpRH0gQSpHt+akOC8BTDmsikzWX+us:DFAKJr4IWNJ4MOrpRBQS3kydI+xyS
MD5:	AC3A5F7BE8CD13A863B50AB5FE00B71C
SHA1:	EEE417CD92E263B84DD3B5DCC2B4B463FE6E84D9
SHA-256:	8F5E89298E3DC2E22D47515900C37CCA4EE121C5BA06A6D962D40AD6E1A595DA
SHA-512:	C8BBE791373DAD681F0AC9F5AB538119BDE685D4F901F5DB085C73163FC2E868972B2DE60E72CCD44F745F1FD88FCDE2E27F32302D8CBD3C1F43E6E657C79FBA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NQ.2.0ga.0ga.0ga-..a/0ga-..a.0ga-..a.0ga.H.a.0ga.0fa.0gaeF.a.0gaeF.a.0gaeF.a.0gaeF.a.0gaRich.0ga................PE..L......M..................... ...............................................P......._....@...... ..........................\|........@..$....................0.......................................U..@............................................text............................... ..`.data....3..........................@....rsrc...$....@......................@..@.reloc.......0... ..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf

Download File

Process:	C:\Users\user\Downloads\dxwebsetup.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	477
Entropy (8bit):	5.237059564403252
Encrypted:	false
SSDEEP:	6:AEAv+BIHfXhPJycXlnMlr4TFagtVFIglFdW8HEwF2T2GHEdqT2azM2GvjokVj2aE:BBIpPJhXlnMYFz2gkDvqtwqa9YS7r
MD5:	AD8982EAA02C7AD4D7CDCBC248CAA941
SHA1:	4CCD8E038D73A5361D754C7598ED238FC040D16B
SHA-256:	D63C35E9B43EB0F28FFC28F61C9C9A306DA9C9DE3386770A7EB19FAA44DBFC00
SHA-512:	5C805D78BAFFF06C36B5DF6286709DDF2D36808280F92E62DC4C285EDD9176195A764D5CF0BB000DA53CA8BBF66DDD61D852E4259E3113F6529E2D7BDBDD6E28
Malicious:	false
Preview:	[Version]..Signature="$CHICAGO$"..AdvancedINF=2.0..Provider = %MSFT%....[SourceDisksNames]..1 = %DiskName%,DXWSETUP.EXE,0....[SourceDisksFiles]..dsetup.dll=1..dsetup32.dll=1....[DestinationDirs]..DSetupDLL=11,directx\websetup....[DirectX_WinNT]..CopyFiles=DSetupDLL....[DirectX_Win9X]..CopyFiles=DSetupDLL....[CleanUp]..DelFiles=DSetupDLL....[DSetupDLL]..dsetup.dll,,,32..dsetup32.dll,,,32....[Strings]..MSFT = "Microsoft"..DiskName = "DXWSETUP"....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 30 16:51:35 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9814399727989853
Encrypted:	false
SSDEEP:	48:8KOdbTE7+6i6He0idAKZdA1JehwiZUklqehekJy+3:8KKkT/Yy
MD5:	A3FC6ED4740E612813A48798D4D33D77
SHA1:	9C3CBFF7EB20D97C2FEB333786B382771248A7C7
SHA-256:	238032B204FC29B755DA80DD21B0E39082BD74C4BCBB536449D2021DF8F42314
SHA-512:	EEB935F0B8118BBFFCCB45ABB6AEB5BF610978AA210E43A9FF51BFE917988DA2E763ED9BF1919E14AC5DF57BB5CDEEC8960156A1643CD4032E395CF926A4019F
Malicious:	false
Preview:	L..................F.@.. ...$+.,....hoS..S......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I>X`.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V>Xp.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V>Xp.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V>Xp............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V>Xr............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........5..N.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 30 16:51:34 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9995377312633646
Encrypted:	false
SSDEEP:	48:8WgOdbTE7+6i6He0idAKZdA10eh/iZUkAQkqehvkJy+2:8WgKkx9Q0Yy
MD5:	B481DECE37E9DCC294F20DAE6406F1EC
SHA1:	E5885354B4BF0442C7DAE4FA68D2F8F8B5AF9460
SHA-256:	6F0BC9A343B06576F5FBC28027D47D0E3532ABAC05BEAB7E73E17D5865F9BFC2
SHA-512:	574D3D8E4111CC734DF3DD5095480045DA06B2412245B4B461042E4ADF07638DF607F6F2939570AA2676DE079EEB9A0EC748BCEB090FF670B2926001007CBD90
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....sH..S......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I>X`.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V>Xp.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V>Xp.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V>Xp............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V>Xr............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........5..N.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.012030731079507
Encrypted:	false
SSDEEP:	48:8eOdbTE7+6jHe0idAKZdA14tIeh7sFiZUkmgqeh7s9kJy+BX:8eKkrnjYy
MD5:	DBF557456D79134E6D2F397F178BBB12
SHA1:	9EA9B7970A0B2A8E4E24ADFCBDF2161183F324F5
SHA-256:	457B6C814CB2F0753359088713A19AFD446CA9A613AB24500E7C4690C2DC4D3C
SHA-512:	8330EE40D8EE4EB705FE949568EE00CB7383979036EEFED06BB31393B359CF5D09CB219AC93018B2CEC31C9B3F3C098874F3B65F999B5C2DCCC6A7CD69F1778F
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I>X`.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V>Xp.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V>Xp.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V>Xp............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........5..N.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 30 16:51:34 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.000157571191469
Encrypted:	false
SSDEEP:	48:8zOdbTE7+6i6He0idAKZdA1behDiZUkwqehLkJy+R:8zKkClYy
MD5:	36161EA0B8703E9D874DB35869481752
SHA1:	7F801D63730C027EEF8A79C354EA59454D5FE5D1
SHA-256:	139E18FD096D4950E031640971C325AAEA360614A7D3AD777B14B73102DB9A9E
SHA-512:	A9C01DADC951840FEEA5767CD40D0C3149DEED683F46CF141AAB3A790F9F2D7DFEDA7F41431122419A404EC789B411F9295DECE2350B5CE92FB3570326CD023D
Malicious:	false
Preview:	L..................F.@.. ...$+.,......B..S......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I>X`.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V>Xp.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V>Xp.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V>Xp............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V>Xr............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........5..N.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 30 16:51:34 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.986439437348038
Encrypted:	false
SSDEEP:	48:8FOdbTE7+6i6He0idAKZdA1VehBiZUk1W1qehRkJy+C:8FKkS9xYy
MD5:	7D3A444BB0B3716BA42094CF3F47DBA9
SHA1:	EAC5D1BA0B22FBB90B7B6DFB615A04BC396C8E63
SHA-256:	6123CDA2C48F3093D73EE34BF047F6C4B506FE7023F8C70DFF1B8806592F94A5
SHA-512:	457131A3B01F6ED6417CEC434D4EA2629CD7EFB64B981A5E437AB89A2AB51F7CDD50BE79D7CE7F38F66E7FBCCFA53AD63A8D0A6C884B91EA71890B4442E56017
Malicious:	false
Preview:	L..................F.@.. ...$+.,....1.N..S......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I>X`.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V>Xp.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V>Xp.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V>Xp............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V>Xr............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........5..N.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 30 16:51:34 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.002023840624968
Encrypted:	false
SSDEEP:	48:8YOdbTE7+6i6He0idAKZdA1duT6ehOuTbbiZUk5OjqehOuTbjkJy+yT+:8YKkwTTTbxWOvTbjYy7T
MD5:	8356167FBB9775F5B955C5E4C9550E8E
SHA1:	85AD8C195FED9AE385CE5BFED2D8BB0ABC1AFA46
SHA-256:	06FB676F36353443EC9356B58210C9D0C05F6C8A2344912FBD4EF00AFA1A4F31
SHA-512:	E773F4AB6F27E95EECF9F6C3A7B4C7BB191787B57F00445851CEA7A70C4F2CFAFFCC069C0F198CEB53B5290351DD46307F4F7D36BF46CA36DD76E68C7BE28CA4
Malicious:	false
Preview:	L..................F.@.. ...$+.,......8..S......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I>X`.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V>Xp.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V>Xp.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V>Xp............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V>Xr............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........5..N.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\7068c74f-67f6-4374-a493-185b4ad86778.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16057
Entropy (8bit):	6.2052430785788575
Encrypted:	false
SSDEEP:	192:UsmQDZxSb0t9rnRXsczUo3rjvHa+FeOdvZ1zSFHb6ClHQko6w1pbpEskSG8J/piQ:Us9XSb0tFhsLo3vl1EHb6CVTMr3J0Q
MD5:	876F3AA427D6E724E48428757FD35A53
SHA1:	DB385D27A02AFDB2E1BF28D90CF5700212EC0A25
SHA-256:	BEA347E6547471B0D1839B853B122C3E0D555CC7A6BDAE201096BB215DDF09CE
SHA-512:	0D4D8A60B47B2289B944DC18320EFB69111C00E3313AD04B0E56506D53ED86CDDC3E1C83060871D4A238C833E8F2E5A28276BFFA08E7A053DF08A9EB639F05E1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......->..i_.i_.i_..\|.d_.i_.._..\|..h_..\|.q_..\|.h_.Richi_.........PE..L...!.};............................^Z...............................................J...............................................................^...#...........................................................................................text............................... ..`.data...............................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\Unconfirmed 602765.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive
Category:	dropped
Size (bytes):	295320
Entropy (8bit):	7.749011498049896
Encrypted:	false
SSDEEP:	6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0
MD5:	2CBD6AD183914A0C554F0739069E77D7
SHA1:	7BF35F2AFCA666078DB35CA95130BEB2E3782212
SHA-256:	2CF71D098C608C56E07F4655855A886C3102553F648DF88458DF616B26FD612F
SHA-512:	FF1AF2D2A883865F2412DDDCD68006D1907A719FE833319C833F897C93EE750BAC494C0991170DC1CF726B3F0406707DAA361D06568CD610EEB4ED1D9C0FBB10
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......->..i_.i_.i_..\|.d_.i_.._..\|..h_..\|.q_..\|.h_.Richi_.........PE..L...!.};............................^Z...............................................J...............................................................^...#...........................................................................................text............................... ..`.data...............................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\dxwebsetup.exe (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive
Category:	dropped
Size (bytes):	295320
Entropy (8bit):	7.749011498049896
Encrypted:	false
SSDEEP:	6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0
MD5:	2CBD6AD183914A0C554F0739069E77D7
SHA1:	7BF35F2AFCA666078DB35CA95130BEB2E3782212
SHA-256:	2CF71D098C608C56E07F4655855A886C3102553F648DF88458DF616B26FD612F
SHA-512:	FF1AF2D2A883865F2412DDDCD68006D1907A719FE833319C833F897C93EE750BAC494C0991170DC1CF726B3F0406707DAA361D06568CD610EEB4ED1D9C0FBB10
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......->..i_.i_.i_..\|.d_.i_.._..\|..h_..\|.q_..\|.h_.Richi_.........PE..L...!.};............................^Z...............................................J...............................................................^...#...........................................................................................text............................... ..`.data...............................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Logs\DirectX.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44139
Entropy (8bit):	5.3428333056342865
Encrypted:	false
SSDEEP:	192:qBTSjs02doWvz0ynX2Fbxp+eLSzfY/EWftRUElVwyruXvm06i75MC5jijWqjuLOi:qdx
MD5:	8ED51587007A278A7C12362283FB8CF3
SHA1:	6A639998D13598C718E7DB6A91658BD3375CD394
SHA-256:	0A5EA0D9CFAB7C4EF4F862466C3AB2CA014C4748A564ADC0EE1563C0197E47ED
SHA-512:	129C9D1FC245C007EFDC9E7604A0C7784C3B2A37C26000E273AA150C4E52CDD78CF57F390F1A525CFF9EA6BE9612897FB7E37E2E1BB1FAAAF0FFDFE393438722
Malicious:	false
Preview:	01/30/24 18:52:09: DXWSetup: *** DXWSETUP ***..01/30/24 18:52:09: DXWSetup: WinMain()..01/30/24 18:52:09: DXWSetup: IsIA64(): not IA64...01/30/24 18:52:09: DXWSetup: Unable to get Version on target file C:\Windows\system32\directx\websetup\dsetup.dll..01/30/24 18:52:09: DXWSetup: Installed file C:\Windows\system32\directx\websetup\dsetup.dll..01/30/24 18:52:09: DXWSetup: Unable to get Version on target file C:\Windows\system32\directx\websetup\dsetup32.dll..01/30/24 18:52:09: DXWSetup: Installed file C:\Windows\system32\directx\websetup\dsetup32.dll..01/30/24 18:52:09: DXWSetup: GetDXVersion(): Unable to get RC string from registry...01/30/24 18:52:09: DXWSetup: DirectX Version: 4.09.00.0904.00..01/30/24 18:52:09: DXWSetup: Setup Version: 4.09.00.0904.00..01/30/24 18:52:09: DXWSetup: A newer version of DirectX have been installed already...01/30/24 18:52:16: DXWSetup: CDXWSetup::CDXWSetup()..01/30/24 18:52:17: DXWSetup: CDXWSetup::DownloadDXUpdate()..01/30/24 18:52:17: DXWSetup: On

C:\Windows\SysWOW64\directx\websetup\Apr2005_d3dx9_25_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1073002 bytes, 5 files, at 0x44 +A "d3dx9_25_x86.cat" +A "d3dx9_25.dll", flags 0x4, ID 6922, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1082170
Entropy (8bit):	7.999075135168916
Encrypted:	true
SSDEEP:	24576:i0BodqhH/OCy8M+j5lcB4ZfeXBXUd/QLML9bw6Uzc12:iUbffy/+lmBXF8Ioxw6Uo12
MD5:	9C5DCA423D9D68349D290DF291DDBEEF
SHA1:	D9F1CAE586470EA309CE9F115525B0504FFFAEA4
SHA-256:	5487ED4E969A822E5C481CEFB1D4DA3066B1D5EC8C55798B246915ECB58A8665
SHA-512:	9F50599321F45FB7451B0A1C0F1DCBD6B4A4E60EE27B0EF5AA29168C1BCE5B08F34329916EA2EA655CD632D0A19C81953C2A5F1277F6A96FB63AFC098236509D
Malicious:	true
Preview:	MSCF....j_......D...........................j_...#..............H...7.........r2. .d3dx9_25_x86.cat..#.7.....r2}. .d3dx9_25.dll.......#...r2,. .apr2005_d3dx9_25_x86.inf.......#...r2,. .d3dx9_25_w9x.inf.....k.#...r2,. .d3dx9_25_x86.inf.(.0.?..CK..\....'4.A..".+.@.%..C.4).b!@..$.....a..k.#..v.w.w.]xg...............9{......k....q....6.Z&Ey-.@.....a.0.T...9b......a...b....ilk.+c.5.af.o.vl..............<....s.z..V.7........fa\.G\$En..._..\|$.?9.O...!..H.<...#.,...!.^N.<.g"..=.V\|O.a..gwcw...t.c.......X..4(.).. .?.S..0k..._2{<%X.......m.....D&&..v.c ....Av...u.l. K2......R.0.&.XO8b..p."H@^..2..jbb...hg.&...>.>....u..x....2...@.~....9..u.a.M.X...S5d_..\|}z"h..1.....<...Z!...V).............}OO...n.2..Q....../.......R+[C..l..(...@......1........$..vs..K. m...e...b..\}u.+.....?..bg...P.......%.pRgTq.t.t.e<..t.Y._.X.?F.(../.......abb.G5.qkb.\..Z...g.....g..(.....f..Lz.8...h.e....t.R.fJ.iJNCv}:.V.:..m.B..JIQrlA..Z5..HR..)9-...:.......V.JP.)t*.....6m....

C:\Windows\SysWOW64\directx\websetup\Apr2006_d3dx9_30_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1109261 bytes, 5 files, at 0x44 +A "d3dx9_30_x86.cat" +A "d3dx9_30.dll", flags 0x4, ID 6903, number 1, extra bytes 20 in head, 74 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1118429
Entropy (8bit):	7.999050518080374
Encrypted:	true
SSDEEP:	24576:OreyPa6AC8e290lruGDhi3TSvHDh+ISNvRNhPmJ0RRuu:cNoeYEuTSvjh+R3WKRv
MD5:	B3D644A116C54AFDA42A61B0058BE112
SHA1:	9AF7DDC29EEF98810A1A2F85DB0B19B2EC771437
SHA-256:	CA7B9C6A49E986C350147F00A6C95C5B577847B5667B75681A1EE15E3A189106
SHA-512:	A2D2F12B7B37BD8F5C8465DD13AD31942DF11EE5ED5423DEEEB178E6B594587706D2C5116258BE1562CAA5ECA691358AF3CB83B77898D1012FF521017D199165
Malicious:	true
Preview:	MSCF............D................................#..............J..............44f .d3dx9_30_x86.cat..p$........4.e .d3dx9_30.dll......$....4.e .apr2006_d3dx9_30_x86.inf.....z.$....4.e .d3dx9_30_w9x.inf.....+.$....4.e .d3dx9_30_x86.inf.v..[>..CK..X.K..=.. ....+..MBI.. M@.n..QH0....#....c..b/..{.z....E..y.......N8?gg..{..=..{...W..;..:....IA.....a.`.......43GX..r..,.f...+FA..,.....2..a0..2......Z.ty.Ih...m0w..es0Ww.[/.n%q.Z.I...ho......#...G.....\.. 1.P6....;.s.cZ.......t.B...X...LL..X.C.......B.......~......@..!..8..O..O..!mR..fbb.0.8L.f..XO.R.-......Y...y...Q4."5JD...p..s.T.f.2z.6..~...........9VPR.f.BH=.bg.s,.T.!=......O..........B...\|\|}...X..5]R.0.....c.+.4..S....E.7.y...[....3...2$..:qt...7T......Q..@X..Ji...q.Z8.Ea(..@zS.D.3;.b..a.}L.;..PG/-....(...../vL_...@K....c..&....f..y.....3.8fW:.T:N7..W:..t.t...#(.FK.k..X..&...;_...Be.w.....b6.z<..za..}_7.afQ......O{,..Thu...).'+..0{:.V}kI.&Z.JU&&*...B..[.'..t.vK.9.`]..!.)Vht.8e.\.T.....i......I.

C:\Windows\SysWOW64\directx\websetup\Apr2006_xinput_x64.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 81141 bytes, 5 files, at 0x44 +A "xinput1_1_x64.cat" +A "xinput1_1.dll", flags 0x4, ID 7457, number 1, extra bytes 20 in head, 5 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	90309
Entropy (8bit):	7.986243949537019
Encrypted:	false
SSDEEP:	1536:/0CNqg1WzKHJUq/JSlvxToeSNOUp9BttldRL9zaMNez4fbI9YKztrIrm:/hIg1cEJUxvxlSNOUpfttldRL9zkzAI5
MD5:	B0669F7D395078BEE0087B089F0B45C5
SHA1:	30506FC3DCE9532EF0A8CB3973347EC9C3C9875F
SHA-256:	E63A67783EF7624559F95AB697BF8AFBDAB7ACE31200283EF840E6B94AA16E5A
SHA-512:	D7EFCFD85B3CB6CB9B1936B701A9D7D91A6094AA08D8C933EDF8493C6AD57BE05A579980A404B35E9721F71B45F4CAE28399FCA3FF5DF20A9A3138B90F86B94C
Malicious:	false
Preview:	MSCF.....<......D...............!............<...#.............................44f .xinput1_1_x64.cat..F.........4.d .xinput1_1.dll......e.....4.d .infinst.exe.V....l.....4.e .apr2006_xinput_x64.inf......o.....4.e .xinput1_1_x64.inf.. ...9..CK.{.XSI..MHh..AD.. .7t...4..H.TTB...$.."...,...v].{Y{...u..k.......w..pA..}......<.\.9s.w.9sf.x...}...y..L......j`.c2..6..>..L.i.......F.......QZ...X.p.}c.i.`.,^X/l.8...m._..Fv0.}pOO.................N..>....O 6......X..s....A.'.s0....X...c._0.\|...?... .....IM.Ln..e..&..$...6?...K.....f7../.A..2...@=..7.`..L&..u:...w.>...q.q'=&...Sf....'..,.S`R,..aJ..@.nO.6.....TEF+.K...4.-.$....<e........ob.^..\({@).F.A.../.'..I../.F>@}..N.f....h...........q\.7#.~...Rm.2...HO0...{...dx....d..00<.3.v..........d....o:.e...,.....I..^v&.t .O..)Y;.B.7\|Q.K....Oo...g.L..5.I.....;t.i.\Z.V..>../..G+.!....z5,.*....1.L..#....58..f....7.x..Va~....bY....\+..U.-M.D..H....d"n{..b.X..V...Lqz..k.h.5..I.d)E..x'.hc.dp.Dr.8E,.(.R..+..5.YZS.1.

C:\Windows\SysWOW64\directx\websetup\Apr2006_xinput_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 40050 bytes, 4 files, at 0x44 +A "xinput1_1_x86.cat" +A "xinput1_1.dll", flags 0x4, ID 6338, number 1, extra bytes 20 in head, 3 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	49218
Entropy (8bit):	7.962835058038329
Encrypted:	false
SSDEEP:	768:rrXN+lWp5tvn2v0JeuXfYYJDyRIvwde6hecBLdKd+d4RUJ6HwyQs34VvD4:3gl6tfTVXwcWuqe6htcaJyQW4VvD4
MD5:	E207FB904E641246F3F7234DB74121FC
SHA1:	1BE8C50C074699BDD9184714E9022B7A2F8BF928
SHA-256:	3FDF63211B0DD38069A9C1DF74D7BC42742DE003CEF72AD1486AAA92D74546FA
SHA-512:	ED95D53BC351C98C0322753265B0A21C98DF97D0E2FBBC58A6836BFF374B7540B0CEA21371CD4A7EAD654210A42E1F9809CAC6E4EAE2ECF0EF2B88E220DC37F7
Malicious:	false
Preview:	MSCF....r.......D...........................r....#.............................46f .xinput1_1_x86.cat............4.d .xinput1_1.dll............4.e .apr2006_xinput_x86.inf.....R......4.e .xinput1_1_x86.inf...G..>..CK..\SG.8\|....&l....-n.6....(Z........"PH..,...+.G.V..b..V....Zm.Z..Xm..ZQ..E.{.......}....&L.g.9s....Jz?tp..N.;.]Y....!...b......t.c..'D%v[...8.8..........F.spf2y,.Gpe.w.......d...o.vs.........G...).bQ....cE%....."..GH.`"....D..B!..i.1..... ..0.. ..K# ...@*...C!M....R....SDq.c...b....#!6....b.....(/.`.....Q....(.!.pE....lB.a....L.M..[..E.........\|...;.H!..".P.j........9..<.t.l....]5w.;...R.9qQx...@x..8.........$.1.az!.Z..?.rDP+...c..)U'J..E.H..j....%.......w.;..x.O...>........`0.A4..d.....dT...Q.3..y0.."..].x"...\|.C.bs.,...`..h..#D..y.v..OM.1u{..C .X.N......+0....f2...3;...@...P......Z.......H.x.E<....A.-.4OA.Vi.f......."n\....b\...\M+.e.....k.N.q.`....%.@.../Q..V.e...s..."w.......KI........4.u.p..J^.V....D....t.0J...H.HMVg.d....B.v.]..)..

C:\Windows\SysWOW64\directx\websetup\Apr2007_d3dx10_33_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 689905 bytes, 6 files, at 0x44 +A "d3dx10_33_x86.cat" +A "d3dcompiler_33.dll", flags 0x4, ID 9049, number 1, extra bytes 20 in head, 49 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	699073
Entropy (8bit):	7.998968028413629
Encrypted:	true
SSDEEP:	12288:SHwziN1v34WzSc6IA6ajvY8ov8ZdReUTQ8Mr47JYCophIa9sNDn1QcILtw6:V01wWzCI3ajjls4NpAsNDnMw6
MD5:	F784B8A0FD84C8AC3F218A9842D8DA56
SHA1:	FB7B4B0F81CD5F1C6A900C71BFD4524AF9A79ECE
SHA-256:	949068035CE57BBB3658217EC04F8DE7A122C6E7857B6F8B0CA002EB573DF553
SHA-512:	01B818AA5188CDE3504E289AEDCA2D31A6C5AED479B18A2C78271828AE04BEBCD4082051B7F4EECA8A31E8EE5ADBA158420ECDCB21371C735E4781EE5F661DBF
Malicious:	true
Preview:	MSCF...........D...............Y#..............#..............1....).........6{. .d3dx10_33_x86.cat.p%...)....l6O. .d3dcompiler_33.dll.h...2O....o6=. .d3dx10_33.dll............6E. .apr2007_d3dx10_33_x86.inf.I...7......6E. .d3dx10_33_x86.inf.i..........6E. .d3dx10_33_x86_xp.inf..j"(.2..CK.y<...........l.al..)e.!a.&...l3.-.h....j.,."D.R..O...%W).gFn........}.z5..<s..s>.s>..\|...U*x...Z..!..E..U...<$.....y0.sPH)....<..<.4.M.@...U.......\).@..6.'.Yi.!.....R.@.&..X..i..z..Y....`...C...).Cz...p.9H$...t@....I.s....;.[.C+A"..<.7.w3..A..u...s8$....ma.Y5.3.e C.e.yAAP ...@L..8.,?..h.a..E2=..9=.......e5\|a./3B"q....Zh.P...6P.."....k....:.w..:.h%.....H.0u......+..D.+!..-...9.sD...O...QZ.a..8v#......Q..N..l%....c..?P..........>.....~......0.F.VB!1ii..v5.4.R.R.....LX.X.........w.8.'.~..p.8.......A......6w.\...~..[.B.E.!..h....uQR..q.....O.....R......Cth-.....$z..B..00.l.Uo.. '..m..fB..}...ij....<..RX._......k .k1.xH......A3y.<~V>.s^gV.8+.;+...CP..+. &.....PH..).UA{...E..

C:\Windows\SysWOW64\directx\websetup\Apr2007_d3dx9_33_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1600079 bytes, 5 files, at 0x44 +A "d3dx9_33_x86.cat" +A "d3dx9_33.dll", flags 0x4, ID 7180, number 1, extra bytes 20 in head, 108 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1609247
Entropy (8bit):	7.999284261824255
Encrypted:	true
SSDEEP:	24576:4cQY0tIpwa5ydxGuruluTsRWo1Iq9e5m98yiN9/0rjVH60mPxr/1MQK:4cIIi+G9rul8uooec98yi//0rjoDZrCF
MD5:	A5915EC0BE93D7EEBE8800CE761EE6DC
SHA1:	E8BBC21C2B5F0E5801286F07E3DA09DBC67C3961
SHA-256:	EFA2E6DE548401376A575E83A79DE019AA38F191D63FDEF3BD2B07D8CB33E3D7
SHA-512:	02259FF3C8478CBA134A8F8408AA624B7165CED97C0AED8C9626034599DD5439F84D1AF9EEFC4191898B0A524E5FFAFB9875EC00E740CEBE97EAC4C2DD0E31AA
Malicious:	true
Preview:	MSCF....Oj......D...........................Oj...#..............l....(.........6{. .d3dx9_33_x86.cat.hW5..(....l6O. .d3dx9_33.dll.\.....5....6B. .apr2007_d3dx9_33_x86.inf.....\.5....6B. .d3dx9_33_x86.inf.,...g.5....6B. .d3dx9_33_x86_xp.inf.6^]Z.;..CK.y<.....Y.[.J..".<3..K.AJ.CQa.&a..-.L.vE...")[e..!E)e...(q.W).g..t...?.....Ws^...\|.9...9.=.3..L.XN.U.&... ...L.p.b ..,....$.BJp@0.....@#.x^D...T.`~N./J~... ..A6..Tj.....s.....a...A.....#YV..`&B.m...!"....O.h.x.....!M ..e. k@...$C.7..F...7.%...............C".Xk..V..Y.....9...B>.n......J..<......{..w.MORA....v...H..l%.....`...;l.:..T@'Y]..9,H.`.,....A.....u..p.a.....D./!..VZ..1P..I......C..........9..4..1.z......h....W...~.}"hK.m..sA..}<;..w...,8.[a.y.!X...HM....qf.!....i.~.m`.O5...T&......2?...,%#.YCTh......H....@.a........?....7..}.+.c.S.\...-.%`.......1...5......24..........5.....yy-v..R.......{.C..@"....n..C.I.`.ZX....@.MH..+9Q[.\|.rD.j ...A.(.Vb.ZZx.f......F..}h..X....~[.Cs.S\|....RV9JT.k.....c....C...

C:\Windows\SysWOW64\directx\websetup\Apr2007_xinput_x64.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 90857 bytes, 6 files, at 0x44 +A "xinput1_3_x64.cat" +A "xinput1_3.dll", flags 0x4, ID 9350, number 1, extra bytes 20 in head, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	100025
Entropy (8bit):	7.988437274786544
Encrypted:	false
SSDEEP:	3072:Mt5OSvuXSf2rbZu4Kmsr4eLRwPC5B9y7q:MTOBXSSpFI4/PM/ye
MD5:	FAE84E0773A74F367124C6D871516B7B
SHA1:	CAF8B9D7D4AF965BF445D052D1E835B680D6BBC3
SHA-256:	86EE073C199B5080FE4F5BE6AC24BB1117FEA42E4BBCD828B4F0EC26C669B22C
SHA-512:	CAF1381CAE7417B57FAEF56D0023BF90C90406748F8813AB85C687DDB81E2498D2F1D5F4BC154903FD5A19836E6F245CD6F5D3927A383F1ACC3BCC41B58FD09B
Malicious:	false
Preview:	MSCF.....b......D................$...........b...#...................(.........6+. .xinput1_3_x64.cat.h....(.....6. .xinput1_3.dll.h..........6.. .infinst.exe.\...h......6H. .apr2007_xinput_x64.inf............6G. .xinput1_3_x64.inf.....a......6H. .xinput1_3_x64_xp.inf...<.6..CK.\.\S.?....H3`@....B.....t.....D!.! " ].{..`AW........b.k/(....fNN ..z.}...g..of.7...\|3#.]4.j...."V.;u.".,..t....... o.!G4.G.<........!.I.P.'..t-B..T.N5...U.......2..S.....:....Ju.S.Q..v"D%..y.KR..B...a (.4.....7......x!L.\..u@.@...B.-G0......A..g...Dj8.j..L.X.."0."...^...kP.&@.}.....PP..k.p..\|.`..P..D"... .H.1.h.^.G...#...+Ls..7..!qH."@..."..;,....Iz;u.t....>..Ki.y.~.5M`)SR(..$....&P:........-F...@....-..C.&V....N...Z..!....~.....{X"eo.5.D6.u...Y.9...8.......pg8....g....4....j@.S..T..C.H..7..ID...!.HP}.....7U..@?1".yMi....aA.....[..&.M.0A..'L,.q. 6`..DZ...i2.t..(Sw...e..X..6 ..y$...>....D.&R......>....~..U.Z...X.B.5:HAn.IU..[ ..MH...8..Tgg'.H.G$H.$........)a...E b.y.>........t.....dF.

C:\Windows\SysWOW64\directx\websetup\Apr2007_xinput_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 47342 bytes, 5 files, at 0x44 +A "xinput1_3_x86.cat" +A "xinput1_3.dll", flags 0x4, ID 8235, number 1, extra bytes 20 in head, 3 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	56510
Entropy (8bit):	7.973777529821975
Encrypted:	false
SSDEEP:	1536:BcnwcwzHEdb27WH2SfZDNu75ddnVR+ZFaNk0ZKn4:4wb+2eZonQwt
MD5:	B362EC93463D8B6381A864D35D38C512
SHA1:	7CE47EBCEDA117D8B9748B5B2D3A6AE99FC239DF
SHA-256:	B6C1166C57D91AFEEEAA745238D0D6465FF2084F0606FD29FAF1BFA9E008A6C5
SHA-512:	CC57733912E2A296A11CD078372C3B43F1256A93EC5BECD0D1B520EB210FCE60938AA1CAA6DBBCA03292A05495B5ECD212EE5F77E3EBABB11EF31F1975B2D09E
Malicious:	false
Preview:	MSCF...........D...............+ ..............#...................(.........6{. .xinput1_3_x86.cat.h?...(.....6.. .xinput1_3.dll......h.....6G. .apr2007_xinput_x86.inf......m.....6G. .xinput1_3_x86.inf./....p.....6G. .xinput1_3_x86_xp.inf.i...T5..CK.y<.....Y.d..H.<3.1....=...`,cbB.f...RkB..V..E...,.[$I.R(~g..n........}....<....y>.9.s.....f&.s)E.F..Cp ..Q...D 0<0.;....R.....3.\...4...F.1QI...........@..O....2.f....I\...a...c4.0.....,...0.!..6.. M...@..:..ocp.A.K6......... .F..!...[....+..,...0n...<..@cl`+Xe^.X.t.$.;{X@.P....@d..N=.....Z..g....&...#...%]....~.........C. #..u...h(.4^.4.... a.a...#.Z<....%.{..5..n$....P@[..C<01..Y...F.\..[.H.H.l..f.l.X.0...l.4.A....+B.~.\|.l.YO0..k}i>~V..O.f...M0n^.?..B..........a.......N.w/==J.{..D@0..Q.....%..@6..Z.\|......@@.4..a.....q......t....4v....dI.Ym..^...........[7.XH.8Y.nR..d.<.;O.."k...d.y2aV..4....D...5..B".H~.....+x_o.4....c.#.`..0...v.F4........I.Q$.....x....._..;]...O[....l....?..:.......Q._....2.;.~...NXz

C:\Windows\SysWOW64\directx\websetup\Aug2005_d3dx9_27_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1071684 bytes, 5 files, at 0x44 +A "d3dx9_27_x86.cat" +A "d3dx9_27.dll", flags 0x4, ID 6926, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1080852
Entropy (8bit):	7.999138982152864
Encrypted:	true
SSDEEP:	24576:sP2N00PXWcq4UsDMMlsOgDUaQFMBZ0To2xIG:sP2CuZQsVl96fQiZMo2xz
MD5:	3E91448A7481A78318DCE123790EE31A
SHA1:	AE5FE894790624BAD3E59234577E5CB009196FDF
SHA-256:	8C062B22DC2814D4F426827B4BF8CFD95989FD986FB3AAA23438A485EE748D6D
SHA-512:	F8318BD7CA4271FC328D19428E4688DA898B6D7FB56CC185AD661D4A18C8169392C63515D7DD2D0B65CBD1F23892D7A0A5D3D77A4CDA6230BA03B3B917E5C39A
Malicious:	true
Preview:	MSCF....DZ......D...........................DZ...#..............H...<..........2.. .d3dx9_27_x86.cat..d#.<......2b. .d3dx9_27.dll.......#....2.. .aug2005_d3dx9_27_x86.inf.......#....2.. .d3dx9_27_w9x.inf.....p.#....2.. .d3dx9_27_x86.inf.]Z...>..CK..X.[...C.)...1(v.).. 3."J.P.. @(.&.Y..v...].....{.cW.$("..w.....yN<?v.5k.......q.Y..0......Z&.9N.!.....f.0.X...9b......fF......iL..+c...ff.tx.f....no.II...2.LO6..arY...u..PZM..9.6f..H.<...._..G".K.1...R.I..\|......=!....\O}<[/E.#..>.......+...........v!..C..:..Q.$.....s....LD.Q.i....h....b..aB3c.a.b.W..c.151/,./r.rD>...(.i..%!.......\.......Sn.\|t.[{F..Mq..\..5.d......J....J.3&....jN../S_N...Qg...gA..3..:...T.0f7.k..&.a.{o.+.j....:..j.f.s..54..`.}..g......?h....bf...w.(......C)(...$.........gJ~..`.;..P>...e.......c.C..@K...d0.@M0(.YM$.y..78..U.Y...J........W......A.04)...&4..{?....Ce..W.;..0m..x.9......n....Io!.!.>...o.......],OQ..0.Q..[KR5QrU.2)I...m.kU."<^..S..3.Q.....".b.F..UF.uJ....:lZ...p.2.R.

C:\Windows\SysWOW64\directx\websetup\Aug2006_xinput_x64.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 81182 bytes, 5 files, at 0x44 +A "xinput1_2_x64.cat" +A "xinput1_2.dll", flags 0x4, ID 7454, number 1, extra bytes 20 in head, 5 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	90350
Entropy (8bit):	7.985841057262195
Encrypted:	false
SSDEEP:	1536:5lQFOMW9t2gGQtmxC4LbB8GXjgvW/j44krD+W2MLdk6v5yO1Ha6DB/4RPjz6ITda:rIOMWm+tmnbXjVkWW1lgO166cjz6z
MD5:	A9D582E44E46E36F37EDB7CBC761179D
SHA1:	ED1BEF64385E94CE89AFA704D38408E23B31FA79
SHA-256:	C26633D38E0A91B9BE70382E916A83D50E219609F7E05CFB2D27DFAFBE480B43
SHA-512:	20011BFB547DEDCE8E6FCEDA22C3A3A83DB140E8A20844F3B0E8741B4474C1FEA73D84708B801E83EAE3CD2D8A2D6C851C3F7CD0154C0382A78BC2C2DF6B01E5
Malicious:	false
Preview:	MSCF.....=......D............................=...#.............................4.R .xinput1_2_x64.cat..G.........4.K .xinput1_2.dll......f.....4.K .infinst.exe.V...'m.....4}R .aug2006_xinput_x64.inf.....}p.....4}R .xinput1_2_x64.inf....%p9..CK.[.\SI.....I..1`D...]A......A....D .)4........E]...`.....^VV.........{.\.]......~./w.9s...9sf.E..k.....l@...Y.......Cu4.....t......I.Q.<u)ey...k1...K0.)....u..+..{..&...Z....@=].X....'..$qD...y.kZ.+..O..x .....F.@..........A.wd..........;......<@i.. ..s(G..J..".q.#..c.u...=.H<"A.H..C..;.>....43V.4..1y.;..j.yK"F}.F..#.RY.h.u.2.....p.C...u...b.:..E1.?f........H@]..;..DfR.T.%..-.....h....@...;...Z=@..pGb.b... .........n.....b>...R~...J...X...0.?..P7..........p6."/=.Z mI.r..X..x...ey...m#.>Pi.ZY.".....Xi..B..S.....7....=P7k}L..."bB.....;.....)...;..L...`B.PG.8.d..q....e.E....D.T.$..H..X.A..,6..y.\|..4...x...K.....o...6`mB.T+.B..0..[..Q4MS.D?.9j.+...<..'.0.9"...5.l-S...8.#H..XF..puM5#.8.R..7..2.L.p..'....\../.....a....

C:\Windows\SysWOW64\directx\websetup\Aug2006_xinput_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 40098 bytes, 4 files, at 0x44 +A "xinput1_2_x86.cat" +A "xinput1_2.dll", flags 0x4, ID 6335, number 1, extra bytes 20 in head, 3 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	49266
Entropy (8bit):	7.9632460736333766
Encrypted:	false
SSDEEP:	768:OuG396sAA1wXXvVFc2755DkphtVmUkt/lnkvH0odpl/q1nk:vwQsAhFcSmpJ3kt/xcd7ek
MD5:	16B968CA0C435EE45E77A84C2D0364A9
SHA1:	90B17A60A34F6335787A6B2D489CBCD3A4EA98C8
SHA-256:	6DD7C0ABE37D3DF7AA6DB7BB352260F4A15DC965FF9D30AA32FE9595C1A18300
SHA-512:	3BBBFDF8B5673641EC066C3FB52E6B0D5CE0BC6ED6BFF17AB4AC3FA69A8628B09E5EC8322FC39D2A206974B54D297CAAFF9410197E26D090FE74F963CD535045
Malicious:	false
Preview:	MSCF............D................................#.............................4.R .xinput1_2_x86.cat............4.K .xinput1_2.dll............4}R .aug2006_xinput_x86.inf............4}R .xinput1_2_x86.inf.....>..CK.\|.\SG..M.. @...mTT.0.(..D..M...+K0 ..D.`...T.Zkk.Am.V..k...V[l...+....*Z4....P..........&w.3g.9..\.Kz<tp..N.;.]Y...%=.!...b.............%v_88.t`qXK.;......B..3..c.8...................a...aA..C..)t...FP.q.%......'.B...("...D0.(..Al(..BY.<..."...s.!...1....&."...a..;6;h.P.#.X...p.H....c..q,..1.'..^.CL..h.C..h.%......f...S.l.'h.p.p.E.......\..G..1..'.)D>.Cd.JB..u.....6..i..A.>...&.......]..J....C..h."........x.......4....0.H.?..P.=.Z"zEaJU...F./...Y.t...~.o.y9<..9.l..7=.9_..d...!.r.F0...4..c2...a.3..y0..B..nD<.K...s!d.9\|...p.0\|a.U.a.=x.v$.OM.1u{...qQ,..._.R....y..f"...33...@... ......[..1.a.....0.x8..@.N.`i..0...b..c.wYs.L>&..9..A.......UXL.n..8x.....z......W+..... o.'.v.r...$g....R...4.u.r..J.P+......./o:C...Sg.g.&.3r..^.vG.v^...I.s...9..

C:\Windows\SysWOW64\directx\websetup\Aug2007_d3dx10_35_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 790907 bytes, 6 files, at 0x44 +A "d3dx10_35_x86.cat" +A "d3dcompiler_35.dll", flags 0x4, ID 9055, number 1, extra bytes 20 in head, 56 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	800075
Entropy (8bit):	7.9986813742013325
Encrypted:	true
SSDEEP:	24576:iTo6mZ4UtaxS5hNsXjnUQEnnR62vSNE6xr8M6:iTdwtqAUXjU7nQaSNvxo
MD5:	DDC4AF0D53B477E5AF77942E7118B66E
SHA1:	81AD8201DCF653A6E977C4506A274D0BAC12643C
SHA-256:	9536166EE7CC1100CFE24E01532E8E4DEED6BAA838B4C025581F2CA046A25915
SHA-512:	1E082D7E7855BC0AF6EC09D4A69FD4A1B0A3A31E4DE8FAA52FA0BDCD601C501ADA6216DDDB83058F37AB4A371068E0F344BDF42F2551943BE19BD719D99BA93C
Malicious:	true
Preview:	MSCF....{.......D..............._#..........{....#..............8....).........6P. .d3dx10_35_x86.cat.p....).....6. .d3dcompiler_35.dll.h...2......6. .d3dx10_35.dll.c..........6F. .aug2007_d3dx10_35_x86.inf.I..........6F. .d3dx10_35_x86.inf.i...F......6F. .d3dx10_35_x86_xp.inf.. ......CK.y8............H.<3.1....=...`.&&[...m^...&D.l.%Z.TJ).....%.R..L...z.....{u]..<...y.....qn...e5\..1.1.....L.b.*D".x~....4....@0.....@#XD>D&.].T..........K..,.<(.81A.z.]..A....0.......Y.l......F[.C...R.`...8...$...A....2..8-..F..e.=j.J.ud..dM.I.........!.h..l.+..,....t9..r..!_h.D.. ..,3..hQsQnYE.+V.wL....;.....3#B"...Zh'...........2.Hx.....:2.%......:.&..'... .!.H.%.<..Tj......A3C.W..e....Dpe...]....!....&H.....I..~d...$C }.>.#...}3....X}.F..G!1....r6...WD.....L}.K..t.....)#...6.L.&...........)....9.!p.b....x.....{..f........s.a.U..^..,..3?.............Ck.....!.s.......`.oZk............K[i.g.....E7...f.7f...`.....3...F.....i.?K&.....d.,Yk.L...........,.L...D.Au..].8.

C:\Windows\SysWOW64\directx\websetup\Aug2007_d3dx9_35_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1702192 bytes, 5 files, at 0x44 +A "d3dx9_35_x86.cat" +A "d3dx9_35.dll", flags 0x4, ID 7184, number 1, extra bytes 20 in head, 115 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1711360
Entropy (8bit):	7.999186916403002
Encrypted:	true
SSDEEP:	24576:91jqFBu+YTN2MuQ4R6dPnknsGmQA+re+1ZGD+rCbaNHy196aqlF35RJT1q/P0a+8:9FyMTN57+MPO++rB44S1I/F35zhqFR
MD5:	3ED592E6CDAE66B1C0671D9EC417A738
SHA1:	9F083FFE00A8E5EABF282130CD16044B488B6E0D
SHA-256:	4914D2B5C3251B00C0CC236F51AFE469728D92B50C953C66D213F079AC928EAC
SHA-512:	0144DD9A83F953EABAAFF3C41F17A363100C9A2CCD932321A4AFE990D8FCB5A430E842DE9146C983409B6366CD974E318A535E6475B10839A6679844CB7D23B7
Malicious:	true
Preview:	MSCF....0.......D...........................0....#..............s....(.........6P. .d3dx9_35_x86.cat.h.8..(.....6. .d3dx9_35.dll.\.....9....6B. .aug2007_d3dx9_35_x86.inf.....\.9....6B. .d3dx9_35_x86.inf.,...g.9....6B. .d3dx9_35_x86_xp.inf..n_.;..CK.y<.....Y.[.J.f.d.;c..l...."a..2&&[..E.BEY.EZl.%Z.(..%.+%I....3.[}...q..s?..\|.w..=.s.s..y..2.S8y..........L.8.....0\| .'.. .....LD.'.2'..c.ya.L.a...........C.....C.....^...T..x,.j.X....\.......2a2H.<`.`.c@. BwM(a.#..P....&[R.... $.B.....{....\....5.<$...q.t..qp..c.Z..J...DK...d...A@.....:t...^...X.....K...zg>......U.A..#..1v....`'d..d......A.Bf.@y.$a.d.....,.2W.=."t..........".p8.%......C.0....l.F......X.Q......R.....]...c..Y.Y.<t.'...}.........gK....of...........8Gv6......O.....N!d.?...E...g3a....`...G.R2..-@.6@......\..`H$...4...&...g.6..M.........r2K.s.....FM(......}....hCJVC.T.y..@...C...d..Yk.L`....D..L....>d#.08\.h....&...&......ox...4.2......'K....R...(E...@..6RH..A..t.1 ......s........).T..\.G..........w...

C:\Windows\SysWOW64\directx\websetup\Aug2008_d3dx10_39_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 843207 bytes, 6 files, at 0x44 "d3dx10_39.dll" "D3DCompiler_39.dll", flags 0x4, ID 8952, number 1, extra bytes 20 in head, 61 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	852375
Entropy (8bit):	7.998886184584254
Encrypted:	true
SSDEEP:	24576:E6Ih4DqlkwAjhr1mB+uYgrCvCZNmJ9ndKo4XYbX:E664DQkwAj/oNCvCZIdN4ID
MD5:	5380053AC4C344BD38604022476B1C1D
SHA1:	043DC8F49BCA3BF0BD85E858F5C2EEDF68565C0D
SHA-256:	84800C55F773D5D6913E344E41BABA58CF07CEC2E6C7114CA3BF48E8F355419F
SHA-512:	F3CE2DEF6E2E8A1D2C07F627E3C437A1BBA0B2E456020A84121346472BE3D28E0FC69623BD408F35A2C639C83DD2787F998DEDFE42B7625DC71500824B035FEC
Malicious:	true
Preview:	MSCF............D................"...............#..............=....$.........8 X..d3dx10_39.dll......$.....8.X..D3DCompiler_39.dll.f(..(......8.2..d3dx10_39_x86.cat.I..........8.2..d3dx10_39_x86.inf.i..........8.2..d3dx10_39_x86_xp.inf.c...@......8.2..Aug2008_d3dx10_39_x86.inf.,"..%,..CK..\.....\./.R3...$...Hef.K0..D<....V..uvA4.J.yTx..YjvY..<.2.133.J.[...O.g.Q.J..gf.....r^.}..s~g..3...F..!...eB>$.e .~..Z.j@V....C]..-..-N.!.Dc.c2.lv..!0b......$&.n.....yH..cz./...\|...w.;y../+.......l.\|~...?...{..-<Us.(n..M.U...(Bz.I.WCc.q.I..uuu....2O.K}.~_x...P..B.D.P.].C-e..O..x.tJ.....Y....'o5%dE...+..../..".tp...Ap..i^.$.0W.....!...b../.W..y.B.....#.m.k}O.k..z...N........W.3.......S.F..].E..j,.;.xe..I`6p.V..._O..K`.H.C....f.....'..3@?@O..`...@&p..P...W..>HO.....,..CA........0...m.....D....0.....x.S...l.....'....`.....%....{....1y.t...Qp.t..{..A.0c.......k.....@!x......RA/.....@c......}...n.......`.x.L.cA...A ...P..S....2}{%".,....d8..^.K..p.xGE...+..\`:X.>.G.o.Y

C:\Windows\SysWOW64\directx\websetup\Aug2008_d3dx9_39_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1458712 bytes, 5 files, at 0x44 "d3dx9_39.dll" "d3dx9_39_x86.cat", flags 0x4, ID 7173, number 1, extra bytes 20 in head, 118 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1467880
Entropy (8bit):	7.999682997096517
Encrypted:	true
SSDEEP:	24576:ztDuVYfr3zZ3dHi+rHI8lVs1WutNXBoY4RbifcKly/kNwSh1mMbS8X/9Wv8PiL:JDnr3zZ31lVsgENSsfcKaZAFF88+
MD5:	4379902C4180A9A6BF40B847372CEC5A
SHA1:	C7FC8184D5620154B9BFD6FBC8820A78C4EEE592
SHA-256:	61E703E8D231412F135B4ABA629122D9CB69AC9EE39FA3CBBE6B95DE05097A8B
SHA-512:	9269F49A5CA90143C50B817E9F5AEC0FC4C32BA1B6D3A21CC5448CAD21A16A902540C8CFC1825B124CE39E0BDC479ADE4354B6BE15B2067E3033E04998E0710A
Malicious:	true
Preview:	MSCF.....B......D............................B...#..............v.....:........8.X..d3dx9_39.dll.<'....:....8.2..d3dx9_39_x86.cat.....D.:....8.2..d3dx9_39_x86.inf.,...O.:....8.2..d3dx9_39_x86_xp.inf.\...{.:....8.2..Aug2008_d3dx9_39_x86.inf....$:..[.... .1......$Q.f...<....B..we..]w.QR..B.).V..i.k..Z........=......d.. .....2..cLfl..A..w4[..VBs.{...^...S..a..]Z...%vh...9..Ro...K..r.}..ZP......".i..5P..."..............."......I.c.on..F...&..K @T.=...C..a ..!..q...Pb.=........hY.b..i`AY..<xwqvlx,t......Yg..R....g1fG..i..4.o.......S_...V..N.K.N..qQ.....Etr.1...E..:..\|..../e..<...9.s.....%.RT. .M!.$(2b[X.NT.B...HT.?.!.<\|4~.?........Si.Xe...l}....J.J\|LN...R.o..@W!.y.8..t'....%A.!I..U.A>..~..........u....2SR.[...9Te.?..U....y*.M.yxnx...z.J..V...(.....X.\|...f.h.....?.LGt..UT...o.7.0..h[.P..`...`../$LED..'.E. \|.A-.w...6.+.\;.h...H...........8...A...0.n....9- p..M. r.V.!...W...r.Y......BO.d...{4.. ....U..A ).....9f.e............`P..w[.......$..o.L1.~.R.M@\AC....W.%..

C:\Windows\SysWOW64\directx\websetup\Aug2009_D3DCompiler_42_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 894638 bytes, 5 files, at 0x44 "D3DCompiler_42.dll" "D3DCompiler_42_x86.cat", flags 0x4, ID 10010, number 1, extra bytes 20 in head, 61 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	903806
Entropy (8bit):	7.998441664012848
Encrypted:	true
SSDEEP:	24576:kWl8lkb28nNHiYNk9tb59zmj000KFiBudeBsbgy:No8NHi7/pAJioEy
MD5:	87BDAE64FD47A75F867A290EC7B8A4B7
SHA1:	DD9E69E1815E8BC161E8EB89A0F2A296074BB95D
SHA-256:	6BD32337826F5A5141FC06391919A249E984150905C2546DC8BFC33D41A24E82
SHA-512:	C8F7A490722741DF4E03823880C6D623FF16AB648A40C1B1C8F7BF26C92499EB34C4596BF239337CD23A57974757958AD9A30D42A4141DC0E7522F998ED3893A
Malicious:	true
Preview:	MSCF............D................'...............#..............=...X!........$;....D3DCompiler_42.dll.....X!....$;...D3DCompiler_42_x86.cat.!....;....$;...D3DCompiler_42_x86.inf.<....>....$;...D3DCompiler_42_x86_xp.inf.....4A....$;...AUG2009_D3DCompiler_42_x86.inf. ..$..CK.Zyx...?..P....%i..@.mh...,e.Y...5...&.!K).Pe.........;..zq.j... ./..s./dR...=.}.....y.o....93I;.+X.c,.....-Ln..o.)z.<.m..F..e...s.\|a....!w@...A=..jj(.T}A.j.j@.j..=...c...=...m.....m...m...6.h.o...[....m.h.k+...s<./F.R.'.<..7Vs...f.......]..M...O6.NVD....o.{v...-.ub..........5..q."....V6..m..B._l..w...mI....j.S...mdlG.c..0.*U.p.. ..?.;"ZS..}?b\\|...=.<...q...Wb.s..9..:.VG(......ExM.w.Mp.4.N..g...Vjg..7./\nG....Wyn..l.."..;..6...v....S....b1.Y...^..Sk..P....vRl.x..!.u..)Z(B.u.gQL.(...R0..../)>.x...<..d.3(..h.h.XE...."......}T.....(.S<O.(....(n......\|......b&.....E.y....),.m{ml7.7..S.G.....[(.S..XE.L..Hc.L...6.w(vR\|C...."......y.........M....o..-.....[.h.b....V4.I9...D.As..]h....).]

C:\Windows\SysWOW64\directx\websetup\Aug2009_d3dcsx_42_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 3313780 bytes, 5 files, at 0x44 "d3dcsx_42.dll" "d3dcsx_42_x86.cat", flags 0x4, ID 7865, number 1, extra bytes 20 in head, 169 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	3322948
Entropy (8bit):	7.9992960947448655
Encrypted:	true
SSDEEP:	98304:hd4ZyuDJf9oMm+hWh3ZHD8VZQCbsY/ny66RHX:BuD8b2WUZQCg+ny/
MD5:	73BA11CE0E936726FC9FCB882F8B91EA
SHA1:	4A4BABE3AC751E60AE6B5B0D69C93FA53D7FCD21
SHA-256:	A9A704B73531D6BF59A421AB5C046C19A16D2B0B07F09816DBE9DA4550A24B17
SHA-512:	9A198EB93D5623651D2981A277EAB4C345C08161254D0127D90C97344450AC1A7FD5C8AC840048A43A347E3296B286B646EA0FBA88F0C7BCE1CEED1484112D56
Malicious:	true
Preview:	MSCF....t.2.....D...........................t.2..#..................`.S.......$;....d3dcsx_42.dll.....`.S...$;...d3dcsx_42_x86.cat.......T...$;...d3dcsx_42_x86.inf.(.....T...$;...d3dcsx_42_x86_xp.inf.c.....T...$;...AUG2009_d3dcsx_42_x86.inf.?b5B.]..CK.w\T..7.Mnb.QA..E..Q .B...AD..X.q.JS.H..&&.....HS... .a.n.((..J/....!R.a.y..g0......<....9.}.^{.....do3.sb........PL....V......_.\|)V..w.a.d.>.#~k.......Z.t.......e.o...#.k.,..x.8.(/\.......5.4....?.Z.B;.9;t/....@..^&..C...m.........f.....#N..._e.c(&f....].-\|.....>X..?>..S.#&..!..v.BLl1*b.^.&....},..r\|4...}Dy...@....\,.^..R....#v....Gl..j%v..w.k...^.....(...........l..m..,............k..J ..?.o.FL.{e........Cj.{..=.-&.oe_?_'8's....~..k.o.}]<}.a.^jnb.....j...........U..3p.....]pl.C..)8.....#V.G..Yp\.#....0.C..q8...#6.G+..p..:...)....#..G8...H.#..z8..x..8._.;Rp......8.....A8hp..#..Sp\.#..Ox....8..0.c3.RpLk.<.x..-8R.#....q..x..~.?}]Jz.bU8L...........j..z.K...6.{Cl..6.sVsV.Z.....sGUrE;..'..a.#>.._Q.U}....sb.\....}-A.

C:\Windows\SysWOW64\directx\websetup\Aug2009_d3dx10_42_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 186171 bytes, 5 files, at 0x44 "d3dx10_42.dll" "d3dx10_42_x86.cat", flags 0x4, ID 7280, number 1, extra bytes 20 in head, 15 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	195339
Entropy (8bit):	7.996178589789764
Encrypted:	true
SSDEEP:	3072:/hxMUzbnbaWbX0JkFvs5aQnkW6sJ/Fw395/lfLxBQLgGlekmQI84HAGujR7j:5CEbiqvs5aQnkW6A/8jlzxBw0/Erd1X
MD5:	F264AF5A36B889B4F17EB4D4F9680B4F
SHA1:	1DF087EA99D321EC96D0D2F1C66BEE94883D6F08
SHA-256:	BB46189EB8CB7769EB7BE00CFBC35902072FA9408313EF53F423E5AE5C728F61
SHA-512:	73AE1CF3CAFBA148F4E5B4D8AC12A7AA41F6ECAC86C139C6A7714F90F3DC61C444DC152A3AD3C2CA800C1A1F4955A2B508735F8490666B57D1420FB7A7BFC269
Malicious:	true
Preview:	MSCF....;.......D...............p...........;....#..................P.........$;....d3dx10_42.dll.....P.....$;...d3dx10_42_x86.cat...........$;...d3dx10_42_x86.inf.(.........$;...d3dx10_42_x86_xp.inf.c.........$;...AUG2009_d3dx10_42_x86.inf.\|..f.0..CK..T.I....8....e0.JVT`..Q......A..a@..i.k..........b.bN......fE.]...y...s._W..~.......9.6.0:../....^.._..F{.3......7.NHL.....T......Z.....Sd.)2W. Y.2Na....^.lk....+......V.J...j.W.vI.Xj.V....Y..^$....&.&....9..azKt..6....2..e..).,..6...0,......Z.a...R...k........(..V.E.....2..C....p>r..Y.].sR&....)....i.0.....W..#(.....j.p5.ZvR.!..:.jd..e............7:(..\....kZ..b^...s4W).. L.%......:g......./..5.......eW).....t.2..].... ..X.,.. ~80...v..k.#.1.2.....0..PF.....z.]......\.\.N.E.J`6....p.....@_..;...p.8........x.....y.6.(p.x..XJ..@O........E.v.0p...m4.8.,.6.%...P.lh.. ...B.g..0.....>v.....S.A......E@...0.P..@8....v.9..h....xc*e....'..`..._...........M.lg..P..-.!......L...@$0.........j5..m.{ .H.f.[...C@

C:\Windows\SysWOW64\directx\websetup\Aug2009_d3dx11_42_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 99084 bytes, 5 files, at 0x44 "d3dx11_42.dll" "d3dx11_42_x86.cat", flags 0x4, ID 7285, number 1, extra bytes 20 in head, 8 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	108252
Entropy (8bit):	7.991332626956763
Encrypted:	true
SSDEEP:	1536:MI9cI4N24813fwIsfQqzjoroJ1OL79D+0sFGmNjFRchFxLvk5yswFa8D+0qlt6s1:Pah8Vo/1uLJoGmZEFxLvcwM8DZcZxb
MD5:	DD47F1E6DC19405F467DD41924267AD0
SHA1:	85636EE0C4AF61C44D0B4634D8A25476CF203AE9
SHA-256:	39FF69BA9161D376C035D31023D2FDEECB9148A2439ABE3AFD8F608F7E05E09B
SHA-512:	F77C4CEF5CB7E927948F75C23A190E73D6C75B4F55915859046533A10AA3C5ABAC77D8BEF71A79368C499C85009213E542094B85B94B69E62AA66B60616777C3
Malicious:	true
Preview:	MSCF............D...............u................#..................P.........$;....d3dx11_42.dll.....P.....$;...d3dx11_42_x86.cat..........$;...d3dx11_42_x86.inf.(........$;...d3dx11_42_x86_xp.inf.c.........$;...AUG2009_d3dx11_42_x86.inf.ix..@ ..CK.[.X.G.....<..: .QQ.9...S@..A.......p..D._M<.A7&F.q.f]c..xD..Wc.....F7..H..b.._.]=T.tbo.......\|O}..[U_.U]o.L......(%..V..Nq.(.....=v........R..3.K.......2c....Zm,..+k.%.....2k.e........s3Xx...C....~..P.X..o..~..[....../A.?...\Rl.QRX.g.sz<E....g..s..[/s.(5..T..>/.(.9F&;.c\|..).k....6y.7+P..d...U.J.H7(.x.E.B}.1`..Z. .C....lTP...C7....._^h7F..t....T[.V.r.J.....&?F...Pd.6#..H\|....).<.....U...g...5..5..RjE.=.sc:...x1..[..w..p...8."..Y8.....AV...E".A..p...%d."..5d.!..l4..d}..#.A...#;.l.....!.....Xd...!3"...G...d_"...^do![.l..i.& ..,...d}.9#S.....IA.C......E.6..![...dS..#+@6..@.....m..:......v!{..Zd. [.l&..-.....9..C9...}.x..Y9=.F...k.Z^.^...!{...........R...d.._...~2z_O.mXG.._...XkYEI.....^iA.p.....=...wa;...N.6.2

C:\Windows\SysWOW64\directx\websetup\Aug2009_d3dx9_42_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 722496 bytes, 5 files, at 0x44 "d3dx9_42.dll" "d3dx9_42_x86.cat", flags 0x4, ID 7080, number 1, extra bytes 20 in head, 59 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	731664
Entropy (8bit):	7.999475174279291
Encrypted:	true
SSDEEP:	12288:IDTg2rIyRKFAtmsFp1UChyax+LFl9NiHEpMH5Vfe8PIqEqnyA6F56J2:M02fKYVFvhKLFl9NikiH5V28PXyA6GJ2
MD5:	9BC8213933598D050827D20A4573486C
SHA1:	E6F9BA62756A00C53746419DEA221881AEB336CF
SHA-256:	9C96B6FC4DF5C0EFCA9F0D653976772B2B964243214F99066E4CA4AA6DF791DD
SHA-512:	A1920D042963CDDA41DF44044DE5B94B4CEE6EFA102F633214E384918D93D2D6A31EB388BDBD00C7E9C199281E3B71CAA5242E9A42E7F0BE27EDF90A3CF6890C
Malicious:	true
Preview:	MSCF....@.......D...........................@....#..............;...X.........$;....d3dx9_42.dll.....X.....$;...d3dx9_42_x86.cat...........$;...d3dx9_42_x86.inf.,.........$;...d3dx9_42_x86_xp.inf.\.........$;...AUG2009_d3dx9_42_x86.inf.....::..[.... .......5!.P..wO.n..pOc....7...l.c.n..slmk]....]...B..W..D..UJ...P........C.......l8..y^.S.N.I..7%.....].n...d...>.#....zT{6+..X.UB. AA......u7{0...n. ....d..R....=...D...F.......n..n..~U.]..U.EX, .......A^;...(...<.@#0/..O.!...i.#.C....D...D.cwC.v.y.<+.....g.l....f.k...W...[..I&...M..W.&Z..^..MB...:.LyQv.l.U.=Y..%....8Ls.......-..".U.....s.f.YVvX...-..8T..m...=..9.CN!89....f.2.G.....:s.G...>.......c^.Z..=h.l..Q..w..yc.\i.Z.^...$cw.T.".d`.jhL;.ZqB.L.{...Z....h{=s.....a.4.1../..`....\|;I...;...$.m!l'.g..pa.).b0..:.tT...T..{..<..T.....z.....!....,..\|.@.../..A.....q.......@.....................\|..5...[..p.6....FE.../.609$.....+.Q.f.N3.....L; ..6./.j.4.a.E2....(G0,...x..5...IBS.._......9.....%0.....

C:\Windows\SysWOW64\directx\websetup\Dec2005_d3dx9_28_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1073496 bytes, 5 files, at 0x44 +A "d3dx9_28_x86.cat" +A "d3dx9_28.dll", flags 0x4, ID 6914, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1082664
Entropy (8bit):	7.999121865147412
Encrypted:	true
SSDEEP:	24576:Wa0lNxqf7fg42FhNffA/Lj41q7+YeSFfSKidHVmTJwagz8u:WHXx652fNffm0oleSt3Fwa3u
MD5:	B1CCAAFF46FE022439F7DE5EB9EC226F
SHA1:	8BB7225DF13E6B449D318E2649AEB45A5F24DAF7
SHA-256:	645F8D90B07C69330A8C7C8912D70538411C9A6B2813048DA8AD3C3119487F93
SHA-512:	2B59C07584D45705273A975A0223E4443DB190675558AB89D92E1572DE4843BE3D0D1267818B19185E4E438A8BCFA2AF5FB5EF2A119DA270BE4540576FD78C77
Malicious:	true
Preview:	MSCF....Xa......D...........................Xa...#..............H..............3g. .d3dx9_28_x86.cat..t#........3). .d3dx9_28.dll......#....38. .d3dx9_28_w9x.inf.....x.#....38. .d3dx9_28_x86.inf.......#....38. .dec2005_d3dx9_28_x86.inf...a.>..CK..X.[...C.)...1X..S.I...(M@A.......Pm..;......,.`...=.#v.$("..w.{...yN<?..=k.^..=s...o.jw..et.=..YA..=H.eF..l...,;.17kj....+.jw..Y.ry6..\.Y.4.igecJ...,.g.yp.F.yc.....X...e...L6.....SI..j......."6."...2.... ..+..O$B,..6l. ..B1l.`.....A..rN2..ggf..g..... ..H..Dp$.1..h..X.O..Pi...[LC.L..!d.\....fff................lknfYP@_..\|...Q4.!.JBJ..0...Ri[4.=..r<...b.3M/F].._S.J.."......"...P%@...`..l..J./.!.3.M.....y.l...TI.d~8.0fwf.J)M.C.U....<n7......./..&..P.R0...Q.JU..2.`...2.ri....vp:.Lg.:(.....7.H2.p.!....N.).A...bg......$..6.M5Nj.e.U..-9..P..L.5...G5.......A.P.6..6..v.i..6..6........-....`.........&3nN..K.&w.g-c....4K.9..}...U}.."VCf}*b]..B..+.j.D..d5`..k...j...4UR..... ..Ux."].d5g6..l.70&.%J.^...Q.U.5...9..~

C:\Windows\SysWOW64\directx\websetup\Dec2006_d3dx10_00_x64.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 206847 bytes, 5 files, at 0x44 +A "d3dx10_00_x64.cat" +A "d3dx10.dll", flags 0x4, ID 6580, number 1, extra bytes 20 in head, 17 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	216015
Entropy (8bit):	7.996946294916653
Encrypted:	true
SSDEEP:	3072:SGo145qtWQt9fL4bBHlKqDfaqaGm3+vqm9/Xx0b6POnzED/RIxeqTk0T:SGo145qtbt1LaeB36/xc6PkV
MD5:	681407075E9B19E5EF2218832F6FAD71
SHA1:	E4F4D292A36CD9A3034007EF9D2005694307EB52
SHA-256:	F9BD5BB083BD55D1D2A690BC66D6D9DA0B1A8B49F09E811E788C030669121118
SHA-512:	E983E7DD3F40510816FF3AE836600A186DBA827B484B0C346C20E43E229189A86D4CB5CF219C1FC35B77AB0668866446F6E9206B279931C927D4ED66AD3625F1
Malicious:	true
Preview:	MSCF.....'......D............................'...#.............................5#a .d3dx10_00_x64.cat..)........}5.h .d3dx10.dll......H.....5T_ .infinst.exe......O.....5.` .d3dx10_00_x64.inf......Q.....5.` .dec2006_d3dx10_00_x64.inf......:..[.... .Vm.....%A.P...?..,..".._.R.&.F.J.J.K.^.^...".U.!. ...BvJ...G......(.........C~.b...V...i.Z..O.<.%. .C...@l....a........XBq..Q.]g..2;..+d.[T[.Q..(ji..J...........T%.E.5.o3w.;.x.p.+@...JH...JA%.`.F..^....z..B......D.....S. \.3....."A%'n..h.f%.E.Ue.T..61....i.....m.X.......Wu...pf.a...............G.B...........$..%....R...`K.x....U,/...aH........S..^..2....h.E.6....B.K.A..........4!@7..........2...].}...".2..Z...!V.......-.6..<...{}..............o.~.ST.}.O.H.,....U.N.;..g{j.~a...^..7.n#.......SJ....~3}I9.\s.o....u.c;.../...RT....O~.R......L>C....W...K....P..z..........f%........::...vr.hC.Z.5...75+^...........evQ...8....v..)...W{..O/..<$....t...;. t..,&F.]&@.R..3e._.KZ.....C\|../...^.p&..`\SVd.......ge..E.

C:\Windows\SysWOW64\directx\websetup\Dec2006_d3dx10_00_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 185760 bytes, 4 files, at 0x44 +A "d3dx10_00_x86.cat" +A "d3dx10.dll", flags 0x4, ID 5461, number 1, extra bytes 20 in head, 14 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	194952
Entropy (8bit):	7.9966042762544145
Encrypted:	true
SSDEEP:	3072:x4mJ4SadBGg8IZrdosr2nqOwY7l43gRDlcGgp6VMslgVwxikcBmEi21wx8MqX+dN:xJJ4VWgzZptAqOf6wRD5g0VlgVwxL21I
MD5:	75C33157D8A1B123D01B2EAC91573C98
SHA1:	E3E65896CE0520413979C0143C3AA9BD3A6A27D3
SHA-256:	02DAA8B5AC3752F76C3BFD9A505EBF22B1B4B41E44EB92CE2799033B2330D186
SHA-512:	F0F1F1DEA5938E1C7FF2ADF7C8D421C2E68E6D3A8CDF18D0F2F3FE1C6837A4F37B367D2D974C35832D1D85A619948DD0F250C7D6DC4AE39F618F5A2893EAC7DD
Malicious:	true
Preview:	MSCF............D...............U................#.............................5.a .d3dx10_00_x86.cat...........}5.h .d3dx10.dll............5.` .d3dx10_00_x86.inf............5.` .dec2006_d3dx10_00_x86.inf....9.>..CK..\.K...C..DEA.P.$.......$...%.A.....0 F.Y.s.1#...#..f.......y...}....ZU..jU......SP.=.gB..GQ....>.5.p8.*<%.y3uY.....Xv.....G.S..)/...A.x....@U.GN.....{,.0nI..@.......d.......R..S....s..B.........B...H. ;.. 9..<...nL.5..!..4=.>.o....A..u.i^...dd..x!.....p...@Jn.;H.L...d......&$. ..\|<&/;.O...!.A..%##C.RZ...YG....Z.h..ee........+..D...D&.F.....?.a...Io..hg.5..blP..I.......B....`..,.....u..=A...<.%!.8.,.0....b...v.O..a....#.._J....3o.........F..Z {".t\..H..eo..1h.m.0.a....1....Bc..s.^..V..Bq.x...D(.E....@...&......<._..xv......OB....6L......y.. ....$3.....AB.&.cC8C".p.9.,[..mZ...C+....J.....A.04...rY.....7.y..!^....>j.+yj-#.#...h23.e..)....f....k.:@.-..3...,...O..Vl..#....MIK.Yk@j...^!,96O".....T...\.H,IIL....dfXw.u..e.w.F...C...Y).I\....&.[.4.

C:\Windows\SysWOW64\directx\websetup\Dec2006_d3dx9_32_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1568416 bytes, 4 files, at 0x44 +A "d3dx9_32_x86.cat" +A "d3dx9_32.dll", flags 0x4, ID 5512, number 1, extra bytes 20 in head, 105 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1577608
Entropy (8bit):	7.999092247669469
Encrypted:	true
SSDEEP:	49152:VKo9fY3tlVm3JjPueurZ8zQbC88LHhpu97Sm:V13BFurZ8U18uSm
MD5:	A5BEAD938AFDC63ADFECC1DAF5049D7F
SHA1:	B3D5BF56F6B9BF87C33009A088BA7785B6363B4E
SHA-256:	A1CC7603302EE53D54F4353C223D95E223706924D99B864220B13814EF93EEFB
SHA-512:	C9244BBCFE60F347EC8785B1A41B6E243153624EA73B16DB4D624239A69FA76D2DF2E54039D8F4D2C495890AC17B676E390F796118B4E16D9F03683247190362
Malicious:	true
Preview:	MSCF............D................................#..............i..............5.a .d3dx9_32_x86.cat..G4.......}5.h .d3dx9_32.dll......f4....5.` .d3dx9_32_x86.inf.M....i4....5.` .dec2006_d3dx9_32_x86.inf.4.$G.@..CK..\.K..?.........7...a....4.... @..LB. `..b..;......{/.;.g7A......}......uv.3.....9X....:.G...`.eT..p...X,..V..C]c.....3^aV......n..3..N.0K3s..%.eb...e../...7..$.~.e#+...<....=..U...R...<..I8..H.D..L.. 1.!........np..\...a...D.'....@(:./.A..{...H.e...b...4Y.c.<..P...H..............].;gl.$q.........}..%,.g.....X.C...HAUZQ1..C.PM.v.\q...T.0Y.3.a.#.\!...O........A)...K....\....PF.X..te...P...B....).).V.(]Jt...A}.S.t\|1S#z....\}./.....\..............(..0....'}..N.]......y,..~.R....f.P.E.T....d#.k.b..`P.../..0W.K&....!.!........M......EL&..bBA.b....q.H.Q.5..5..u....{.ka.k.s.PA^.e.5....c#......d...2..).V.e....2.^.;.....L.....s.`.iK...Q..N.Q.%.T......k..M...U...d...H.W..f.I......kF;X..;.%..N.....j.....6......L.T.).JU"["..`....1..........D.QO,..

C:\Windows\SysWOW64\directx\websetup\Feb2005_d3dx9_24_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1007265 bytes, 4 files, at 0x44 +A "d3dx9_24_x86.cat" +A "d3dx9_24.dll", flags 0x4, ID 4987, number 1, extra bytes 20 in head, 69 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1016433
Entropy (8bit):	7.998972724711677
Encrypted:	true
SSDEEP:	24576:T/HUK+hlSM4jwe8WpmQUrxiUyULWoF/V++TYrjVdLa1:bHURewe8W4VN8uF/VhMr5s1
MD5:	7029866BA46EC477449510BEEE74F473
SHA1:	D2F2C21EAB1C277C930A0D2839903ECC55A9B3E8
SHA-256:	3D4E48874BDDCD739CF79BF2B3FD195D7C3E861F738DC2EAB19F347545F83068
SHA-512:	B8D709775C8D7CA246D0E52FF33017EE9A718B6C97C008181CD0C43DB7E60023D30D2F99A4930EBA124AF2F80452CBF27836D5B87E2968FB0F594ECA1EBF78DD
Malicious:	true
Preview:	MSCF.....^......D...............{............^...#..............E...7.........E2.. .d3dx9_24_x86.cat...!.7.....E2.. .d3dx9_24.dll......."...92.. .d3dx9_24_w9x.inf......."...92.. .d3dx9_24_x86.inf.(~m.?..CK..\.Y..O..........H.$@..(M..X.. R.I...6...#.^.......{w..}&............{.3..gf.e.....0*`..kFm.......i.`p....X..Y-..7]n^..9...e.(.7..^..V.FO+...v.,e.^..l(i~w...M...l...s...z..U.7.c5.b.3..........#1.I.'.F2.C.@.......'Hx /..K.~.`g.).0..".8y....0.8...N.\|..v.u@...P...H.R......c;W....yg..x....s...2..\...}..%21.D..... ...q.....E,.....q.Ee..$...66...pGr}.. +..!&&&PK..f.r...x.'..<.. ....kH..@....~l....\....@fD...+y..:UC.%...zy1.........~j..v..{%..v[S.ZEE...5....i;..1.(...&.x._.......R+[A..l..z(.e. .k..jbf.@.336T.[...'...J/-..uHc.u.....6..U.....).l...&.".9.X..H\.N...d.V.g...^...Jv..PQ~#?....V.......j:..p.....k.R.......0o.~..F..70.).4b7......+.:.&.)Qd(9...i....J35q.....T%..b._....,..........)Qjt.DU.B.R.s..-.`.......4HE...JObJDlG.4x......lb..<..C..sHD.

C:\Windows\SysWOW64\directx\websetup\Feb2006_d3dx9_29_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1078760 bytes, 5 files, at 0x44 +A "d3dx9_29_x86.cat" +A "d3dx9_29.dll", flags 0x4, ID 6921, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1087928
Entropy (8bit):	7.99922866964108
Encrypted:	true
SSDEEP:	24576:MWlF24ngnZPhX4ciAwvVHgK6SgHY6OmSfLV+:MWls4gnZTmHx6SgnPCY
MD5:	F6CC1C08D0F569B5F59108D39CE3508B
SHA1:	E9CF7EDC8C9C4B57A9BADD8386A2117EC5785AAB
SHA-256:	4114E76799AF3DA9DB3DAE51305DAD70A05B757E506E4A327092D536CCA7EE75
SHA-512:	86DF72D5B15396ACB504C1AC9DE7FF5C0CC9C95A90FDD82DAEDC55BAAD490CC47A71CB511571D37E25DD9BC1EE9652B9723E33879BC1756A7881A8E61EBC59ED
Malicious:	true
Preview:	MSCF.....u......D............................u...#..............H.............C4.F .d3dx9_29_x86.cat..#.......C4hE .d3dx9_29.dll......#...C4hF .d3dx9_29_w9x.inf.....x.#...C4hF .d3dx9_29_x86.inf.......#...C4iF .feb2006_d3dx9_29_x86.inf.w.6..>..CK..X.[...C.Q...1XQ.N..........T,..D .$....c.]......#..{.z..]..E....}...?......f.=..=.g.....v..]F.Y3j...8...&....V..S=S.f...1]aQ......a...1..Q...V.....m..e........s..m.[c.....yl.{/.^%q.Z.I ..hg..DH..........$..........AB.....!N.w=!F.g. .s.p.B...X...LL..X.c ....z.B...........b.81...>:/b.......511A..[.&.3vo.'.V)..kgjb...\..\|..!(.i..%#...8..9Um..]_.E...c.o.{....\|j..r4..CN..2....K..].t.E..CH.2b}I.A_.D...5s.e....K..&...n.K....a..p.$29...o.HN..[..k...d......1V.....P..9..e.....p9...c=..RQ .7.H61.e ......I~.v.....p}:.1.:r.i....qb..@K.......AM.(.QM....%.p....+.9....~.J~.J~.J~.....-....`.0LLl...3nL.....t.f/...x.9......n....I/!.!V..X........S,OU..`.tt..u$i...]...`.6...o..(..).-..tD.....L.B.S.+c.:.Z.n......od<..

C:\Windows\SysWOW64\directx\websetup\Jun2005_d3dx9_26_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1058965 bytes, 5 files, at 0x44 +A "d3dx9_26_x86.cat" +A "d3dx9_26.dll", flags 0x4, ID 6937, number 1, extra bytes 20 in head, 71 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1068133
Entropy (8bit):	7.999040217820951
Encrypted:	true
SSDEEP:	24576:NxFMsUF1MmwONoWu85w6SFBu+vveJ0sut3z2A1s9z/D8gigA:V3dm3NoW+9FBhuJ9ut36A1s9z78giP
MD5:	029359EBCA4BA5945282E0C021B26102
SHA1:	6107919F51E1B952CA600F832A6F86CBBED064B5
SHA-256:	C44EABF5BE3B87CD845950670C27F6A1E5D92B7758BA7C39C7849B1EE1C649C0
SHA-512:	FA007F257F5267119B247EC4ED368E51FD73E6AEA3097E2FC4E78078C063AF34D161FD1BDCAF3097BB575D2614DBA226A624D060009EE4F7BEDA697EFCF42BB7
Malicious:	true
Preview:	MSCF.....(......D............................(...#..............G...7..........2b} .d3dx9_26_x86.cat...#.7......2Z\| .d3dx9_26.dll......,#....2.} .d3dx9_26_w9x.inf......-#....2.} .d3dx9_26_x86.inf......0#....2.} .jun2005_d3dx9_26_x86.inf...N..>..CK..X....'.. ..P.....&!. .%.A........`.....;v..WTd..........w......{.{..<'...3..;}....=Xv3.e.vc:.yg.i.....1.....V.F.:.fMj ,.\|.e.....F..5#?.\|6.M.j[Z..k3.....g.f.B(..=v......a<.7..a.=.:...h.f.X6.."..I..I......Od:.!9......~1.H..q.....'....y..\...E..u.S\|K.a...:c..B..8g:!?._..E:.A.H...N.a..j..~pI.....V.k.l.W.....X..........`4.2(.....e.>...0...!L..>p.....2d..r<...afffPK.6..t0.V.'HA.....j.o...5B+. .....hy...... M..5t...K.<>..@.G........~h..Xw.B.....F~>.?l..7..].}Xp.m.!......x~6.aY_.rmH..sr.."Q..]..d3.{.bXX`P....io...AZ.i..$..1....Gl.....d..AM:6.......p./(..Q.1..1..q....O.c~.c........04...\|s3...}..x..I.r..).m.K1.o#.Q.Fa...X7.baY......G{......Z5S.HU..c.tp.z6.4m.B=P...d.6...g.....W..aM...z...L.R.W%...z.F.n.5....54EG.R

C:\Windows\SysWOW64\directx\websetup\Jun2007_d3dx10_34_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 692512 bytes, 6 files, at 0x44 +A "d3dx10_34_x86.cat" +A "d3dcompiler_34.dll", flags 0x4, ID 9065, number 1, extra bytes 20 in head, 49 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	701680
Entropy (8bit):	7.9989902264021255
Encrypted:	true
SSDEEP:	12288:SuBBWP1krfKO0BZwB6ux8hBXsRbD3RazqgwLdJPMqHy7qdXCyhUW3zE:DBTrZ0BZwV8fXsprRaxsDBHyWdXg5
MD5:	19383CBADA5DF3662303271CC9882314
SHA1:	123C97C33F7EF2BA345B220450F181D440412E6B
SHA-256:	8EC971C91040618338AC2369188F3E5D7C85A5B1E3B9FC8E752DD845D295CDBA
SHA-512:	A4C6ACC9FF656E05D75AE0081C65C200B584209C99FD001494C4D206F2CE8A78D2DD3644E51018574928F3B9E9373BF7EC8C5147A3590B54D1C6D50E61342853
Malicious:	true
Preview:	MSCF.... .......D...............i#.......... ....#..............1....).........6.. .d3dx10_34_x86.cat.p)...).....6.. .d3dcompiler_34.dll.h...2S.....6.. .d3dx10_34.dll.I..........6.. .d3dx10_34_x86.inf.i..........6.. .d3dx10_34_x86_xp.inf.c...L......6.. .jun2007_d3dx10_34_x86.inf.....{5..CK.\|.\|......m:..s66...$.\.-K2...B....-.%..\...zI....-.@...!@..<Z(.@..B..@.?..'.k.......f.67;;;;3..gQi....O.7..F....J.m........".z.=.;9.s.D........P...PV.\.U.D......M...3.{K.k>...[z.u#Q...D,..%.%.$j,@wDT..D..]................8\.S.....X......$....q..pP>.0.8.(q.IQ..;GGq.H.@...z.F...~(...=............W...9....._A.qtt.D:[.......7D...&..N..ee.J....H..LeS,e...CY....K m..9..\....._.e....E..@R..J)p..~e...I......uA..8<>).X.#....P..O.BN...a9#I})RW..J4P./.i.'..v.Po..5.+K...[..+K..2... `]....@............q.($. <B$...8@..b<." ...b.y..,.<..OK.."..t..q...{^..5..l........J.(Q.o.Yn.]z.:x6.T..J.Z..zG........ .W..-..l.....2.\O..f/.......TJ&W"S$.2.@.2.a.....C.......A...{..!.\|. ....UVJ7.#.\T..k..

C:\Windows\SysWOW64\directx\websetup\Jun2007_d3dx9_34_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1601326 bytes, 5 files, at 0x44 +A "d3dx9_34_x86.cat" +A "d3dx9_34.dll", flags 0x4, ID 7195, number 1, extra bytes 20 in head, 108 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1610494
Entropy (8bit):	7.999066428256981
Encrypted:	true
SSDEEP:	24576:ZBdkB3TM+mIf4qyM0iJRy3QvQDxPYKhatPJZcg9QwJeYX34eq2F37kRVeLbdiL3q:ZPU3TMXxDVI3vQ2KSBP4YH4aAELbdK3q
MD5:	FE8FEB215FAE59866DCD68C1604D97AA
SHA1:	CEDACA678D15E78AA458B965ABB467E8964A1FAB
SHA-256:	1C1E1C6F68BA556A0AF09A38C32EB421C543A4848C4B42D25867C98DAB3B3A50
SHA-512:	9955336B561E4FD3BA3DA7FC086643E811048A25A7E68344D2CC5CAB091980BAAE1C04CE41328B59C896662E2875886B78EC869852B2D1DAAA46AF38C894A3F2
Malicious:	true
Preview:	MSCF.....o......D............................o...#..............l....(.........6.. .d3dx9_34_x86.cat.h_5..(.....6.. .d3dx9_34.dll.......5....6.. .d3dx9_34_x86.inf.,.....5....6.. .d3dx9_34_x86_xp.inf.\...7.5....6.. .jun2007_d3dx9_34_x86.inf.A.".l>..CK..\...;T.D...1.(.`...2CH..........`.UD.....b.;va.;6...w.{.f.l..9.....w?..=k....=.;..........Zh.....<m--.....^..:.z.#_g.~.>.Z.Z..C..\|...5..J.P..JKK.(.0...>+.G..~.hy{c....b2.,..!..?E.&.j.1.u.=.1.B...q...p..>...q.Y....x..\6.uB......>........A..A.f.1..{v.Z...F.F.\|:.[.Z!..@$.IA.H""ET.J.c.........d..G.....\...xco.#.G......`k?d..E..s...B,........O.0(?..r.......TD..y.W..FkkkC+i...&..!@... ..xP_>(#!...b.O.>,P.8d......lM>..R-t...[.lm2.WS\|.u..._.K/.3.3.~.1a....+....q....o.M.O>o..Y...O/..B.y_...V..5..5..$#~.+.H..5.B.tu...../.......\|.[.(5q.YT5...II..@K._.d0.@M (.U.p...J.!Q_....5.....O....?].k.)..3.u.an}.....6A. .]].....rg....Z.0...}...u.....P$geq..]t/......e.JE."VE.(...LhNu..(...L!g.0...:m:...V(T4~.^...2...y

C:\Windows\SysWOW64\directx\websetup\Jun2008_d3dx10_38_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 843959 bytes, 6 files, at 0x44 "d3dx10_38.dll" "D3DCompiler_38.dll", flags 0x4, ID 8962, number 1, extra bytes 20 in head, 61 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	853127
Entropy (8bit):	7.998980130768887
Encrypted:	true
SSDEEP:	24576:IKcIh4DqtGLRndZKm4zZTQb4BJ+gfG07QyGeZH:IKc64DgG9dIZTQb4L+GGIGeZH
MD5:	B0E2B612DAF28B145B197A4DB0A9B721
SHA1:	F69266E4AF3D2DE31A2A2E416F10B0F44737739A
SHA-256:	E8DC1063C9434EED8D633741B19CDFA1889581041E2214B87B5159E3EA087F3C
SHA-512:	6E31F18CB75CE69D291D0ABD15EDADF02C0693033351DFB2F435312A47540AA223C8176209725C14A05FA6494153A3E191B2FB7CB8C5CEE11FB42371CE67392B
Malicious:	true
Preview:	MSCF............D................#...............#..............=....$.........8wq..d3dx10_38.dll......$.....8wq..D3DCompiler_38.dll.f(..(......8.r..d3dx10_38_x86.cat.I..........8.r..d3dx10_38_x86.inf.i..........8.r..d3dx10_38_x86_xp.inf.c...@......8.r..Jun2008_d3dx10_38_x86.inf...E7%,..CK..\.....\./BS3...$.......p.&..x"........h....J.,5.,._.e....y..-y...#.......YXPP+..y.......y....o*.&..........\....i...YQcs..u.77K.8..h......h..]L...y6.bc..S.\.Y..]..aM.iyo.Xr..2....w...^V.Y.v)..s..w..;..z...........S..WY.b...!....q..W............y.~.x...P..!z.S.....2..{W.x.tJ.....Y....'o5"dE...(...\|o.U'.tpJ....8..4.j.vT.+TrVWy.`.P..{![...O.<.!...F...V.........C.k.E.h._..AM..+...E.jG.U.R.F:.].E...Xvw.?....'..,....................A-p...l.[.J....4.. .$.,...`2X.W.c..=Y.>........i.....A-p.?.....`.8..qp.`...A.....P_1.....? ]O....A?P.&........%..c. ..v...,h.=...AK0........k......d..... ....A{....... .\|o......&..\|......0........d.....[m......X...%C.D.2X.....'&.4..@o......98.~..c

C:\Windows\SysWOW64\directx\websetup\Jun2008_d3dx9_38_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1457918 bytes, 5 files, at 0x44 "d3dx9_38.dll" "d3dx9_38_x86.cat", flags 0x4, ID 7184, number 1, extra bytes 20 in head, 118 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1467086
Entropy (8bit):	7.999726422350297
Encrypted:	true
SSDEEP:	24576:HGIly6o6H1kEznWRpKpx5A0SBF/VnjmkC8nAMzh08qF4QH5/RSzsExkqv4Q9hHi0:Hh46Tn/UXVjmiJlO4sVRSzdk5uhCbOka
MD5:	E2FB2E37C342983493C776BD81943978
SHA1:	2A8F3C45CF979966D4D4D42A4D34F05C72C7E29E
SHA-256:	57E57A6348E55AAACA6BED5E27BBDD0A4BD0DDE69C77F4D26C805BE6384BE927
SHA-512:	2D297F607C5A098A3D2B19E7F88AA12F720AF3C23FE6DDCE7D4659A9184D1CF8F8A76F35B8ACB639B48CDAD8998C919215A03B89207E2BB1829EA3D8A9EFB95A
Malicious:	true
Preview:	MSCF.....>......D............................>...#..............v.....:........8wq..d3dx9_38.dll.<'....:....8.r..d3dx9_38_x86.cat.....D.:....8.r..d3dx9_38_x86.inf.,...O.:....8.r..d3dx9_38_x86_xp.inf.\...{.:....8.r..Jun2008_d3dx9_38_x86.inf. .,:..[.... .,......$Q.f...<....B..W...WWRT%.,..6mZ....k.!H}_.aAkk..C..............Z...1.5.!....S.-.Uy....# ...g....3...q.u.N..Nz.2Zq..D..+r."S9..ZT$.QD...UM..4......P....@...f.h...}..l7.{l.e7..#.b.$_...Q_...#......CC@)@......@......1...`....D.$m....wgg...B...n..E..{x,u.{.VK.;:.7.M$IO3v.u..v.p.%...N.X/.:Q..E...(/n..%Y...."..X.)}U.5...9F\.C>.....9..L.1.T.....4I.$R...5.L'.e.H.`.....H.._....9...XQS....r..>H.Gw..I.}.I...S.M.#Q....a[.....C.o...HR6\|..#....Ccu.^....=...f.N..LH.nMzk.k.....k..V..S..^.^,BdOQ.E..^.q..y.z.A{x..g8....i.....l.....f...a,..\xzC...r.@...C~....\.....!8..)....ZU ..%.e.xG..<.i.....yVH.AA......M.F....Ph..,.Uap.....9...-...v.V.... \|..*......X...6....P...,.K.O.Qe...).]`..C..............,..+.q.........w...

C:\Windows\SysWOW64\directx\websetup\Jun2010_d3dx10_43_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 191323 bytes, 5 files, at 0x44 "d3dx10_43.dll" "d3dx10_43_x86.cat", flags 0x4, ID 7293, number 1, extra bytes 20 in head, 15 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	200491
Entropy (8bit):	7.9966634458730566
Encrypted:	true
SSDEEP:	3072:kD2Fju8h1xkWCD/5e8U2LK1aQAMxVz2aoOxoY4+ApyP0EwMGvFas+8QJgdBvCD7D:kwbCleyYagxVCaoV+ApcnG9aKQJaw/
MD5:	591A61BD06C73C70F93DAC5AF2D8E924
SHA1:	C9D36AC5E2ACAC31A7413D22ED1C09C71CC96FFB
SHA-256:	F0BC06CEB484D97CF01526F9223DF7B4357D166C4391869F2E7D514DC1FE769B
SHA-512:	3E2E3318A700A6ED82A21018403CA99728C8A56B7DF81F99A5D705B586CEE1141586DBF19A01EF1F1A72DDC8F45DDB51BA5769AE4634B02233EF1AC4E0FBA5D4
Malicious:	true
Preview:	MSCF....[.......D...............}...........[....#..................`/.........<!]..d3dx10_43.dll.....`/.....<B'..d3dx10_43_x86.cat......I.....<.&..d3dx10_43_x86.inf.(....L.....<.&..d3dx10_43_x86_xp.inf.c....O.....<.&..JUN2010_d3dx10_43_x86.inf..=.h`1..CK..T.I....8....ePQP....SENJ..1 q....a@EE.a]E.5....F.t...s.v.iM._W7+..:..........oW.NMM....e...1.+.f.#..2.....7.S..V..\|..O.yX.2]..Q'jbReq1.Z+.U.4..R%........6....<./...gU.g.)...u.y....dj.....UJ'j....[/.../E....e\.._...^..Gb..}....37..2L..a..q...../.\|...z.#e$.ZU7...vnkmh?W....-..L^...h.0.....>.Y._....f.......vpO#.1..6_U.o.......h.#.`.d....j.F.0.6.1..>.H...`'J..A.%6.tM.\.:<.......F...!.K......?t.:...../...2..=...2....&e^...I.M`........H."........@&0.X...%.1..p.h3L(..V....K...5....X........x.]..@}.F.8.......%.T`.....=...!...x`40...v.g...k..6...@. .......wh.@ .......F..+..#`.....p_-e*.3...^`+....&..@.......o....:.... ....c.&p.8.....6.K..@......e~....H.w..R..........`.0.X....G..`)k.8...-0.....n.....R......f..

C:\Windows\SysWOW64\directx\websetup\Jun2010_d3dx11_43_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 103485 bytes, 5 files, at 0x44 "d3dx11_43.dll" "d3dx11_43_x86.cat", flags 0x4, ID 7298, number 1, extra bytes 20 in head, 8 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	112653
Entropy (8bit):	7.991810619702373
Encrypted:	true
SSDEEP:	3072:tXMVzDTlrM28bEHSqgik2ono4DQQ/7cuBFbb9aD4:tXMxNjG4gikye5FBtBr
MD5:	061BBA3836B3FFCBB01B150467BBE951
SHA1:	00D8FBCD4068B3199D3D393BB4B86BF82985480D
SHA-256:	B80DB68CD82CAF8BEDAEE62808171B20C546A76499C3AD53014E3BD2FBD2918D
SHA-512:	AEC8327E1CCC0B33B3E32D66A5EE25C4B70A227B708D10F61EBAD2D998F3BE68145FA85C50BAA16A21EE766B336B1432FBEC02C75D698793092015C832B6FC26
Malicious:	true
Preview:	MSCF....=.......D...........................=....#..................`..........<!]..d3dx11_43.dll.....`......<B'..d3dx11_43_x86.cat............<.&..d3dx11_43_x86.inf.(..........<.&..d3dx11_43_x86_xp.inf.c..........<.&..JUN2010_d3dx11_43_x86.inf.kK.. ..CK.\|.\.U........:(.....;.........\.".+...K......a....f.eZVZf../M.2M1M35.bj..%~gf.,gv.........~>..<..{.y.93.{fv.c..(%EQd......?...?...z.i.^u=.g.b..>.%......s...\Qa..'[.U5....c\|Z...Zl.....m....\u....s....\|.....2...s...rE^ Wn..J..j\|.$...2....mO.ul.E.V..c.7R...E..+t...2p....@>.V`..<.).Rp.._UrI{h.../Z..0\|...sQJACQ..J.....F%..W.T......E.{P.....1..A..U.6...2.J..\|^a\|.....Zl....\|.>.tT.P.x..=C.......V..b'^..K....}.s...op.....?..'=...2T>.l).....l.2Od?E.S.....V .GV.l<.Q. .Bv.]7......d...MB..,..72Od..WR...D.6.M.V!{...d%..B...@.L..j..:..(.=.G....b..BV.l...d....B........p%u....F.....l.!.G..l.2.,.. d...\|..Qm.v....G..L...).C..c.#.Ih...................ee.......VPL....8X...H1.=A1...q....2.E!.l..M.E..jTw.z.y..*d....m...Y.

C:\Windows\SysWOW64\directx\websetup\Jun2010_d3dx9_43_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 762076 bytes, 5 files, at 0x44 "d3dx9_43.dll" "d3dx9_43_x86.cat", flags 0x4, ID 7093, number 1, extra bytes 20 in head, 62 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	771244
Entropy (8bit):	7.999380380890997
Encrypted:	true
SSDEEP:	12288:E0b5pTUIVIRxV+yb+HJFnXQRGr85UpzQ3VztxmHN8DMFy0BJ1lSIug3SqHAlzJYf:l51NVO+XVLs3VztQHmYjBJb931I1NYI0
MD5:	BF124B64FC3774F61D30DE0A405F0C6C
SHA1:	2F8A8BABFA4E51555FCF125E8373D9C5F7F7434A
SHA-256:	457C5CE48EAA0FE551B46DFFC1E4DCA985D261686D8D4E6BCED533EE1F682FCE
SHA-512:	935922CE74BD399E8358693562F86C9B4B6308A6E33586A5DD61924F8B6B2CFD6CB2E472FD082B9EA32C0ABB9A799A0BA9103B4C316342F8072A7A3782C2116C
Malicious:	true
Preview:	MSCF...........D...............................#..............>...X}.........<!]..d3dx9_43.dll.....X}.....<C'..d3dx9_43_x86.cat...........<.&..d3dx9_43_x86.inf.,.........<.&..d3dx9_43_x86_xp.inf.\..........<.&..JUN2010_d3dx9_43_x86.inf.[.'.":..[.... .......5!.P..wOnf..O..........9vm..o..f.6.....+I).H]..t.....T...v.!..M.......>>.{..._..t....g...:..jh.N....K...vJ.r.. ....;J.zq.........H....'....d.=...{O.4.xIBC..L7..2....... ..E5`5`........<s...9..(.b3. .."t....M\.;...0.........H....K.5$...L.Ha....%..e..V........{.t....#3kk.sR6.....I.u.Em....b.Dl'.E.[.D.N....m53%...'.m;.>..yf.6..pN..N.y...-.5Y...f.......-.B#.......;.D]......G.8.5...G.......x..}...!.GwT.......WwKuT...Y.l[f..}ji...{.h{...x.u.....>..1....k..v.D."W..ZA..<...7=c2QN.Y.......v..k&aHudg.W...`HbV{.Q..CJk..nLpw..#.&5.%S...G.&.`....]...EpFY...(....P\..+/`..&..ap....S....BR..'....s..c........p..B..j....c..D....mU.x....N.r..QfEz`...}.._...........8..$..........!.G...i.@..P...."c..d.L00...QX.B0.

C:\Windows\SysWOW64\directx\websetup\Mar2008_d3dx10_37_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 812300 bytes, 6 files, at 0x44 "d3dx10_37.dll" "D3DCompiler_37.dll", flags 0x4, ID 8943, number 1, extra bytes 20 in head, 58 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	821468
Entropy (8bit):	7.9989494569533655
Encrypted:	true
SSDEEP:	12288:k8Yjgk28yEYvDLX3XmZcLHo9yLvTJqnrT+LprnNjjjGM6pdKi814DYnciABrI55V:1Yjp/yEcfLI9y4rORNYdKibxBrIS6
MD5:	8234B9B90BCBB5077E1B5FAA0B66D1A9
SHA1:	E9207C572FDEC592B7C17A7F9C6F875C8A55B1F0
SHA-256:	6A2727269E6CAC7C4D2E316333D29BAC0DC1CD7F51C36C0C08B0388203DEDAD2
SHA-512:	74C94A6E092D7C828FC1E3FAEE4B21917AFC3CACEC04F260754190D0533F93A58289763AC620E5A577F7865902023B30548CDA4D9E968C90EE13050AD6D1E8C5
Malicious:	true
Preview:	MSCF.....e......D................"...........e...#..............:.............E8...d3dx10_37.dll...........e8....D3DCompiler_37.dll.f(..(.....e8K...d3dx10_37_x86.cat.I.........e8....d3dx10_37_x86.inf.i.........e8....d3dx10_37_x86_xp.inf.c...@.....e8....Mar2008_d3dx10_37_x86.inf...-..,..CK..\TU........[fz.,P..0}Q.a.L...T..`.f.;........i..io{n....ej.i.Yb........;w....r.....s...9.<g.%f.4.F.q...F."_zr.........6.4}..I.8.;o..9L..j.9.43..Z.....M`rl&..A.....n.b..Q.....;..).).MK{J...!...1..T'....:..&...,*O.k\.!}4.d.vH/5.0.....x-!.....{.c..@......Dm53SG.W..A..5..MK..P.?ZK64'd..%.4p......'..v.a-..3!...iYM...Jc.B.i..^.4.;.....b....:..i..'Ui{2.$m.t(w..w...Km..ZrM:..7g.p.w.m$..k..`..n..7JK.`...%..O..d..`....@2h.j.s.ZR.V....?..p-i.:../...@.X.&..:RK..y`"p.. ...a..\.@Y..l...<0.lB\|6.d...Ac..N..=`.(..@.._.....)...`(....\..\|....@.~i..-....z}.........]..'.........<0...d...A.h......e..@...6....,.....D0..A....A8...@K.a..6/.\.&t.$/.V.I.....f.".....t.$.....H..X.6....$

C:\Windows\SysWOW64\directx\websetup\Mar2008_d3dx9_37_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1437322 bytes, 5 files, at 0x44 "d3dx9_37.dll" "d3dx9_37_x86.cat", flags 0x4, ID 7166, number 1, extra bytes 20 in head, 116 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1446490
Entropy (8bit):	7.99972380205062
Encrypted:	true
SSDEEP:	24576:vFs/gTzoeHhwLMLDjl5XbCzgxt0Q98wWz35UM0vE03yYCmPI7ik:veKTHhbLDbDP0Q5UUtBC2PAz
MD5:	8ED75E3205C2B989FF2B5A7D2F0BA2DF
SHA1:	88846203588464C0BA19907C126C72F7D683B793
SHA-256:	91A50D9EFCDFBCDF22A91D6FBB0F50D3C2AA75F926D05CC166020BF7AAF30E28
SHA-512:	D0CF0E3AAD9C8C43A927D1BBBD253B9FE4C97B638AD9A56F671EBEDA68FC9BC17CC980D93095FBB248DD61DC11B7E46C22D72CEE848B150F7A13EAD9E08A7891
Malicious:	true
Preview:	MSCF............D................................#..............t.....9.......e8....d3dx9_37.dll.<'....9...e8I...d3dx9_37_x86.cat.....D.9...e8....d3dx9_37_x86.inf.,...O.9...e8....d3dx9_37_x86_xp.inf.\...{.9...e8....Mar2008_d3dx9_37_x86.inf..$.0:..[.... 92......$Q.f...>J...h.].W...uWL.I...W]J.X..V..{..Z........X.G{<..033.4..P..........ek \|.b./..gFB'S...K.....fe.5.u..T<{..H....XG84QbDR.8X.Hf.H..46...H"0 ..HH.S.............(_ ..w...H.....Q..P..vT.t@.G+...1...YH... V..Y4H..P..1R$l/..20!ls'...;....;..kmttyu...x.s....q.....q$.C..5k....(....B.r..y..<.6...Fz..hn..-.....Q.3Z...@.1.V..S?...a\|....(6.......D. ....)Ej....GJ%.5 ........G.w>......p...i}..<.\|..b.&!..7E.yU.O-.D......O.UC..yIA.Aj.._..D...VOc....{.f]J.<...r.)o.\|-...>.PWF.....;.;..vb....4..QV'f.$......:S.hi...~...}3k......\...}a.......L5..e....\|.....1..n...T...t......[....Z.].e....d.A......'..\|.V.2.\|Ax..W..........B.>...x.. ..\|.`...L.h..H.i.....@-.aa...7...K ...../..l.x....r...0>x..@/X...W..L..

C:\Windows\SysWOW64\directx\websetup\Mar2009_d3dx10_41_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1034785 bytes, 6 files, at 0x44 "d3dx10_41.dll" "D3DCompiler_41.dll", flags 0x4, ID 8914, number 1, extra bytes 20 in head, 71 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1043953
Entropy (8bit):	7.998757160305283
Encrypted:	true
SSDEEP:	24576:JAEjuCeK6JgAkPBJoBgsqDP8FbGACV0L/sW0G+vv2:JFuCeVJqyxqDUFb9CV8r
MD5:	45E83CBA5710A1DE7D3990A288122E85
SHA1:	23C4BFBDDCFB11ACB7C47C409825F039AF7EB908
SHA-256:	B7DA29103CDF374DE0C09713CB985035EAC45FB8B394D3B8157D8A7562A89899
SHA-512:	8C56D376D349AA00948E1F3C6168DADE76AC9A26ADE1AAC5A385DCF0253602F5A2973483D083425195DB6AD7717494FD3CF674F5549774AC608CEFA2A88BF0A7
Malicious:	true
Preview:	MSCF....!.......D................"..........!....#..............G...P.........i:k{..d3dx10_41.dll.h-..P.....i:k{..D3DCompiler_41.dll.......#...p:.r..d3dx10_41_x86.cat.I...a4#...p:.r..d3dx10_41_x86.inf.i....7#...p:.r..d3dx10_41_x86_xp.inf.c....:#...p:.r..Mar2009_d3dx10_41_x86.inf.Nn.>.0..CK.wT.I..{.G.C.QQ.#(I.T`..Q.........0.b..5`Xs..bD.@..f1.9..x....Yw..{...s..U...[.kjj.....h3...TV2.nFx92?~=....m.l.[n.[..(81)]..R&..Sd...J.,F!Se..Re..A..e..~}..b.e[.fd.np.+..[......R;.z.....v....N.~...ibx.h.S.....W...7..-.a.8...`...$u..A.0K....j1..g..A.^k1...Pj.]bm.ym..~t...+d..`..LG}..X...#.J.....;'e.Z.-.2..m.0....[W..#......j.05.Z.R.!..:.jd..e.........O..7:...\....k..bY...s4W).. ..%.......:g............p..Z...... ..<5.2..].... ..X.,..!~.0...v..k.c.1.2..V.10.L.#.R.x.=.S.9.....27.S@.....d. .p.l.d......}.\...;.e./.0 ...&.~...8.\...:.L;.'....R..."`;p.....>...........BhW6.I&..D.!.3`...M...>u.....S.A......E@...0.P..@8....v.9....X@..."e....'..`c...(...^..R.'p...4....{ ...f...2....h

C:\Windows\SysWOW64\directx\websetup\Mar2009_d3dx9_41_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1606486 bytes, 5 files, at 0x44 "d3dx9_41.dll" "d3dx9_41_x86.cat", flags 0x4, ID 7142, number 1, extra bytes 20 in head, 128 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1615654
Entropy (8bit):	7.999772423092358
Encrypted:	true
SSDEEP:	24576:xFtN95ew18Yl4WTrZnZSibmmq18Whxp9pWISiIz9cXwowwenm2AB4qDA2mV7Q:newRFZ8ib6T3p9pW9/Z4bM/XkA+
MD5:	901567428D8C82756D7BF5A406441BD7
SHA1:	6E3C22147F3DA77AC8F20D615CA32B5EF2A0ED28
SHA-256:	32356344AEDDF709C9D5302D8F3FCC1FF1BE2E82D8D17833A2086400AF248794
SHA-512:	6FD4C429E32480BDFF4E58BA8BC0D28FE97C9FF5EF1FABBB856230EFA669246A354F99B723E7483D548B74C121AC8BA9CBA2B5BC3C18F35EE828302D392CF6ED
Malicious:	true
Preview:	MSCF....V.......D...........................V....#..................X.?.......i:k{..d3dx9_41.dll.....X.?...p:.r..d3dx9_41_x86.cat.......?...p:.r..d3dx9_41_x86.inf.,.....?...p:.r..d3dx9_41_x86_xp.inf.\.....?...p:.r..Mar2009_d3dx9_41_x86.inf.x..#.9..[.... .3......$Q.f...<...!..vW]....]eJ.Uaq....a.Zk....}_..=hk..C.=...."......?1<..izt.`Y.._ .....H.`...uI35.:.,L.....I.;...........&...B......I....!@.A...A....a......................#..&.E....J..%. ......!..Q0..P.F......$.!...q..yXf..d....7,v......Y.....Q......EI.&..Rm....d.I....D........WJ...`.u..WK..K........yQo...2...W.U\.C.m...a.k.kpq.U..C.5.Hh).......<R.s.l.+.......);........%.g.g.....i..I.U.).H......l./._...<.C....a....U8.'.,.0GR....=.5....E.......jln..MKiliw..Q......,.2{..k...\.X$.......Q4..??...ns...?....t.\|.8U..>WJ./.>S..Vp.....0...3 ....'!....,R........Ph..#.t.7=.?p....D.....hX..H....J.`...Z.......$7t.......a...\|S....(..G. ...V+`...,.X.P..lZ`...X>Bt....E*aM..(`..0......BA3..p.%..OE.c``.BU....).P5

C:\Windows\SysWOW64\directx\websetup\Nov2007_d3dx10_36_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 797924 bytes, 6 files, at 0x44 +A "d3dx10_36_x86.cat" +A "d3dcompiler_36.dll", flags 0x4, ID 9083, number 1, extra bytes 20 in head, 56 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	807092
Entropy (8bit):	7.998858073625772
Encrypted:	true
SSDEEP:	24576:EL+Y8gC2xQcaINcDDHwNXjNOl93uN850V7ZcR0SEDR3l3M:vD2xaINcDHIzhs0Vwz6c
MD5:	3D9A0C59156D03DA0F19C2440E695637
SHA1:	55B050991CB17410C75ADC3913066BAEDB482ED0
SHA-256:	BDF7FB01C02783A4F8C9F5E7911F5CAE3E2A7CBC425B90B36F9EA6EEF2C27DE3
SHA-512:	E9A662498C43865E917F0778B772D6964517E41289CBF5A0B8A4E44D8C4B4E9A5049C76F2ECBE4ACC7E9CFCC3F1D87A75C3F8703E66804CE758969814BA14FDA
Malicious:	true
Preview:	MSCF.....,......D...............{#...........,...#..............8...h(........V7.. .d3dx10_36_x86.cat.....h(....L7.y .d3dcompiler_36.dll.h.... ....B7.O .d3dx10_36.dll.I.........V7P. .d3dx10_36_x86.inf.i...1.....V7P. .d3dx10_36_x86_xp.inf.c.........V7P. .nov2007_d3dx10_36_x86.inf..d.....CK..8.....Y..^(4cK.......H....0..F.]1..$.(W...P.-..J.).[.%Q....M.v......>Os.c.......=.\|.}..d.r.5....q.s.J..*k8....y89....e...D...Q.!aL./,..l...@~N..J~..)...=..].)......o.@.... ......,R...".@&L.i..........Z.6`..C.......]6.Z.._V..J T.B......l......,..t.6.....md.p..5...l.....B...aI,.F.mU..<T...@Hf.......d{..... ..1.0$.....j.AE..#'..'.%..%....4..p..P.g%..(.H..d..........R#..L..H. mXq..c......6tU$....cii.e............1dA...f.... .........U.B..b.....Fj.z;x...f2. gY.....9.u24. .O&....!E-.....R.d+...5.b..![.dG.....""{U.C...........9p.M....Y\|.\f......E....).J...d..0.l.A......0$.....}....e......t..^W..LM(.$,... +.....A..K...f.p..dD...,..E2n..2/k-...d.E2.-.@.S...1.........pA..H..

C:\Windows\SysWOW64\directx\websetup\Nov2007_d3dx9_36_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1703400 bytes, 5 files, at 0x44 +A "d3dx9_36_x86.cat" +A "d3dx9_36.dll", flags 0x4, ID 7211, number 1, extra bytes 20 in head, 115 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1712568
Entropy (8bit):	7.999078652914364
Encrypted:	true
SSDEEP:	24576:fMb9V3TN8vuaBYlFhEbpdjRsI+CpoUjrn++qWYxhiUX21LVpmI9P2BZbcNU7YBP1:kJEvlmFMpdj/Npocz++q3X2tnLAcm0Bt
MD5:	C5E127067EE6CACDD2F8962E6005542E
SHA1:	22C571E4DA75A6E5DFE02E3E3587F40C2939C745
SHA-256:	F52CC1304B533083B3FC5553C49433C0E4E46D66D567B9DE0B558CA518DB1544
SHA-512:	E70DF11AF8CB5D51C3111B8327371EA40292580F06D7D265F2449B89A4941C4740BDE904367FBCB4158512939BBD7C7A3DC20D3642475789FC075A2AE8E27860
Malicious:	true
Preview:	MSCF............D...............+................#..............s...>'........V7.. .d3dx9_36_x86.cat...8.>'....L7.y .d3dx9_36.dll.....F#9...V7O. .d3dx9_36_x86.inf.,...Q&9...V7O. .d3dx9_36_x86_xp.inf.\...}(9...V7O. .nov2007_d3dx9_36_x86.inf..*G~.;..CK..TS..._....E..)...!4...iR.....Z."] .."......K..T@.B.....]....\|...w......y...w.3w..7..//s..R3...H.N{/..F.Yj..J..@..a^.........,.a.^M....".!.,T>......T. .h..-..]./.8.^..../%..q0....x..',4.....Y.9...2..!+...!]Pp.J.`...=.B.W<(.........d.d.l/.Xq,9}9> ..l.}....@......R.dY.x.8@.(..C!.?...)....f.-a.l.+6..U..vbO.q.%]s.....H...$g.... .=...l8. X2.I@.b....Y.V"...[..f5{.$`K.e3.....PE;.Nx`@.f..$....r...i>[..$]`A.:.....jv~.gg...Y....M.....x7...H..'.J.y..oV......j.aU...fc....U..i.....B.q..N>...`........`H9XVN.r..![.+..!H...B..i.-....r...f`l....V.?{.z..H.Ym../.o...Q...p....<d..,....9.7O..c....d.<.`.L..!..{...b .>.QH..)..B.........,...Hx..$a8N.^.rE.+Z..c#h...Xu..,.D"b.h..z$=....G./...l....z./.F..)..v....v':..5....G...... ...p

C:\Windows\SysWOW64\directx\websetup\Nov2008_d3dx10_40_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 959461 bytes, 6 files, at 0x44 "d3dx10_40.dll" "D3DCompiler_40.dll", flags 0x4, ID 8926, number 1, extra bytes 20 in head, 77 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	968629
Entropy (8bit):	7.999011847061652
Encrypted:	true
SSDEEP:	24576:JKTxCzc8gSDnU8Hz10a0s65QckarHGlImJtXn+QbtU0sHsqzn:mxCzs29r0WQma69nBbtU0sjzn
MD5:	5DFEB46E60795266DA03F2D0A67E7ACD
SHA1:	A77758873E5544E8AD22ACF469C4A0FD0C944A88
SHA-256:	EC52B075A3E9C7FE468B317E0FF977964B1003D560065128741F4392BF47C49A
SHA-512:	6EC058811AC017BE3CD3A46559CD73126666F41B0FA58D92C1168CF2A2E0E2357B19F65531C786EC81A438975DBECE440C5E7B6C653AFA5428CE6C444179AF6C
Malicious:	true
Preview:	MSCF...........D................"..............#..............M...X.........O9.2..d3dx10_40.dll.`...X.....O9.2..D3DCompiler_40.dll.......%...O9p:..d3dx10_40_x86.cat.I...g.&...O9h8..d3dx10_40_x86.inf.i.....&...O9h8..d3dx10_40_x86_xp.inf.c.... &...O9h8..Nov2008_d3dx10_40_x86.inf....X.0..CK..T...{..J........D...$.....$.2.....&L+...u..Q.5#f...W].9cN...w..Qd...y.......9~.}..]u+tOMM...r.].a.O..f7#.\........m.l._a.[..,4Q.&KU...c.eq1)).,V!S...)2...Y.^a.Q..b........y_x.W..Q^J^.j..P..gB...<w....E_).$j..q.\|y..{.'....1V-..N.bt..%...A.0K....u...O...K.u.F.H(u>.X.vbd.......)..Ltg)c.a..J..\|.V).N.F`G.Lxk..Rf.-.<1b...0..y...y!.g..F1Z.v..T..o......i.............!Jku.:..i...e.....Z.HR.0...6.....zk1..._.-.L....a).Gx.).........@6...........P.\....?`.....f...\|.r......L9......S.T ........o:J.'.E`?..x..?...$........z.......,.<.'..D.j .....G...3...G;.......p...&@W...;....^........R .X.....L ............-...........'.r`7........)........=......r..j,e..j.)..........uX)..p.B...

C:\Windows\SysWOW64\directx\websetup\Nov2008_d3dx9_40_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1544836 bytes, 5 files, at 0x44 "d3dx9_40.dll" "d3dx9_40_x86.cat", flags 0x4, ID 7155, number 1, extra bytes 20 in head, 134 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1554004
Entropy (8bit):	7.999645278979612
Encrypted:	true
SSDEEP:	24576:K3tdQkdeoPJLiej+pb7Q15LwQrpLeWvYMWbPBmcnILz+0Byna:2dvdeAweSBQPLwgpCWvYMQ5mcnIH+m
MD5:	75556D89FDD442967A23993C9111D997
SHA1:	003DE53653C0CC84F8C3D617D1F76FB475F1A7CB
SHA-256:	863AC3438F57158D4F53900C6924BFDC132AB43A5AF57D4658E65842836B4FA1
SHA-512:	6086114500DBBF4DB9D0A9C3F72732995BB9A3AB5C135EAD53143749B95651B37B64BE7A52CA09388DE90216FD00486FDFCFBC87D42D77FAC469F82B5290E06D
Malicious:	true
Preview:	MSCF............D................................#..................P.B.......O9.2..d3dx9_40.dll.....P.B...O9n:..d3dx9_40_x86.cat.......B...O9h8..d3dx9_40_x86.inf.,.....B...O9h8..d3dx9_40_x86_xp.inf.\.....B...O9h8..Nov2008_d3dx9_40_x86.inf..=.:.:..[.... .2......$Q.f...<....!Z.J.+...ea..U.q....ha.x.y...........=.h!............X.{.<,.....?..b.):.[J{....^=mv:.i.e..}9s............F.QN.^+.).p...!9.4L..B.k ....F.}..R.. ..D%P4@...'2.$C..EU..:_... ..=.....2...Q...H\|..2.hi....H3..%JA.O...s.n-..<.<..9;7p.wnxw,\|\|.....du.......)..$3CN.'.)j..\|...x.w..>..4.D..."..I.'.=.....$.7..m...J..F....0..F.XD..v....."*\|2...A.H.R..b.()! .\|..Hh`....Q.K...NH..9../^...\|[!.)k...8._C/~D.W..K4.}.B.T.b.Kw..si..6.E.#6w......_.,.>6{r$X&:....s.w......k....h'5......3...0XOG.^.=..j....sFg.jO. t..?.S.l5?.t...s....`...]......'$LJ.........Z]h.. ..h.l.5b....F..0......m.....P.....n....Z.... <..7.@...,`@..#.i.r....... ......@....\|....e/.pa...@Q.A..'.EL..7H..?^..C.........]i p..N7....:i.P.........

C:\Windows\SysWOW64\directx\websetup\Oct2006_d3dx9_31_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1121257 bytes, 5 files, at 0x44 +A "d3dx9_31_x86.cat" +A "d3dx9_31.dll", flags 0x4, ID 6911, number 1, extra bytes 20 in head, 75 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1130449
Entropy (8bit):	7.9990817245216945
Encrypted:	true
SSDEEP:	24576:fd5gyP75nbAgKdWsTLSCs3BZnH50ve35Jxroo6DS:F5fP75nbt0STRZn9nxrb5
MD5:	F778928C9EB950EF493857F76A5811AD
SHA1:	EA82D97077534751297AE0848FB1672E8F21E51E
SHA-256:	4891E2DEA9D1798F6A89308E58C61A38E612F8433301EA2376AE14C3DFCB3021
SHA-512:	1F382A287FC6763B8E8D66825E8256DFB7D0DEAD6B6A6B51DD7C4A5C86D536CC7EF4128BE0CE495FE17C859018750072DC7B43E3476D1BA435F209CC4EB6D43F
Malicious:	true
Preview:	MSCF............D................................#..............K.............<5m. .d3dx9_31_x86.cat...$.......<5.. .d3dx9_31.dll.......$...<5.. .d3dx9_31_w9x.inf.......$...<5.. .d3dx9_31_x86.inf.......$...<5.. .oct2006_d3dx9_31_x86.inf.j5o.s>..CK..\....oh"....Fl..'.......i.vC..... `..w...6.....`.....;..E..........l.w.3....Y,..+......yg.a.....$.`0...6...XZ4.FX..J...l.V..o;F^..lH....3'.f0..G.m..P.[>...G..j..c^....p.<OAO.N.q.Z.E...hk..H...'@../.B.....q`K...y"..-9.r.'.9...x.O.R.8.......c....`Gc..C....>......X.......\|0c..tz......./....-.faa.0..<,.V.^X..B......:/...y...3...X.GZ..T......Bi[.KY.x..A...3.[...s..l..J..U..h.../2Z"7......k....yB.E^.r....T........K.....,...X..)..C...z4.....b......o..yv5.!5...CD`&.\.<0..P.y9..e..`{m8..K.:(.....w..la..@.++.N... .y6.m.......,.c...[lc....d..AM.6........ .P...uD.........m...........m.e.`9t..+..aa..@5.y}r.\..rJ.={9f...3...fO4.u.V6u-z.....t.n...A..0%.T....L'.[K...Uh....Ul....vum.........N.U..).)Q...x.RaPk5..X3z.e...

C:\Windows\SysWOW64\directx\websetup\SET147D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95576
Entropy (8bit):	6.500059286855779
Encrypted:	false
SSDEEP:	1536:BG8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHM:BptQv1iyODswNLmqxY3AMV71Ev54EAxa
MD5:	984CAD22FA542A08C5D22941B888D8DC
SHA1:	3E3522E7F3AF329F2235B0F0850D664D5377B3CD
SHA-256:	57BC22850BB8E0BCC511A9B54CD3DA18EEC61F3088940C07D63B9B74E7FE2308
SHA-512:	8EF171218B331F0591A4B2A5E68DCBAE98F5891518CE877F1D8D1769C59C0F4DDAE43CC43DA6606975078F889C832F0666484DB9E047782E7A0AE4A2D41F5BEF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........xx...+...+...+..+...+...+F..+.6k+...+.6x+...+.6{+...+...+...+...+...+...+...+...+...+Rich...+................PE..L......M...........!........N.......k.......@.......................................Z....@..........................5..y...........p..h............^..X.......H...0................................6..@............................................text...)(.......*.................. ..`.data..../...@......................@....rsrc...h....p.......@..............@..@.reloc...............H..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\directx\websetup\SET148E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1566040
Entropy (8bit):	6.387345800194587
Encrypted:	false
SSDEEP:	24576:GIQ+ddddddddddddddxOOOOOOOOOOOOOO2iWeXiWeXiWeXiWeXiWeXiWeXiWeXig:GIQsOOOOOOOOOOOOOO2iWeXiWeXiWeXV
MD5:	A5412A144F63D639B47FCC1BA68CB029
SHA1:	81BD5F1C99B22C0266F3F59959DFB4EA023BE47E
SHA-256:	8A011DA043A4B81E2B3D41A332E0FF23A65D546BD7636E8BC74885E8746927D6
SHA-512:	2679A4CB690E8D709CB5E57B59315D22F69F91EFA6C4EE841943751C882B0C0457FD4A3376AC3832C757C6DFAFFB7D844909C5665B86A95339AF586097EE0405
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^..?...?...?...G6..?...?..U?.......?.......?.......?...I>..?...I...?...I...?...I?..?...I8..?..Rich.?..........................PE..L......M...........!................c........................................ ............@.................................$...........P...............X............................................^..@...............h............................text............................... ..`.data....4..........................@....rsrc...P...........................@..@.reloc..D).......*..................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\directx\websetup\dsetup.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95576
Entropy (8bit):	6.500059286855779
Encrypted:	false
SSDEEP:	1536:BG8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHM:BptQv1iyODswNLmqxY3AMV71Ev54EAxa
MD5:	984CAD22FA542A08C5D22941B888D8DC
SHA1:	3E3522E7F3AF329F2235B0F0850D664D5377B3CD
SHA-256:	57BC22850BB8E0BCC511A9B54CD3DA18EEC61F3088940C07D63B9B74E7FE2308
SHA-512:	8EF171218B331F0591A4B2A5E68DCBAE98F5891518CE877F1D8D1769C59C0F4DDAE43CC43DA6606975078F889C832F0666484DB9E047782E7A0AE4A2D41F5BEF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........xx...+...+...+..+...+...+F..+.6k+...+.6x+...+.6{+...+...+...+...+...+...+...+...+...+Rich...+................PE..L......M...........!........N.......k.......@.......................................Z....@..........................5..y...........p..h............^..X.......H...0................................6..@............................................text...)(.......*.................. ..`.data..../...@......................@....rsrc...h....p.......@..............@..@.reloc...............H..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\directx\websetup\dsetup32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1566040
Entropy (8bit):	6.387345800194587
Encrypted:	false
SSDEEP:	24576:GIQ+ddddddddddddddxOOOOOOOOOOOOOO2iWeXiWeXiWeXiWeXiWeXiWeXiWeXig:GIQsOOOOOOOOOOOOOO2iWeXiWeXiWeXV
MD5:	A5412A144F63D639B47FCC1BA68CB029
SHA1:	81BD5F1C99B22C0266F3F59959DFB4EA023BE47E
SHA-256:	8A011DA043A4B81E2B3D41A332E0FF23A65D546BD7636E8BC74885E8746927D6
SHA-512:	2679A4CB690E8D709CB5E57B59315D22F69F91EFA6C4EE841943751C882B0C0457FD4A3376AC3832C757C6DFAFFB7D844909C5665B86A95339AF586097EE0405
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^..?...?...?...G6..?...?..U?.......?.......?.......?...I>..?...I...?...I...?...I?..?...I8..?..Rich.?..........................PE..L......M...........!................c........................................ ............@.................................$...........P...............X............................................^..@...............h............................text............................... ..`.data....4..........................@....rsrc...P...........................@..@.reloc..D).......*..................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\directx\websetup\dxupdate.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 91192 bytes, 3 files, at 0x44 "dxupdate.dll" "dxupdate.inf", flags 0x4, ID 3666, number 1, extra bytes 20 in head, 8 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	100360
Entropy (8bit):	7.9900557178400815
Encrypted:	true
SSDEEP:	3072:lvknxJpNYAzRstaRkz0BwwnNbSa+vp5647S:FkZNXsERk6wwBSa+vnl2
MD5:	4AFD7F5C0574A0EFD163740ECB142011
SHA1:	3EBCA5343804FE94D50026DA91647442DA084302
SHA-256:	6E39B3FDB6722EA8AA0DC8F46AE0D8BD6496DD0F5F56BAC618A0A7DD22D6CFB2
SHA-512:	6F974ACEC7D6C1B6A423B28810B0840E77A9F9C1F9632C5CBA875BD895E076C7E03112285635CF633C2FA9A4D4E2F4A57437AE8DF88A7882184FF6685EE15F3F
Malicious:	true
Preview:	MSCF....8d......D...............R...........8d...#............................~>.%..dxupdate.dll.02........h=...dxupdate.inf.1...0.....~>.%..dxupdate.cif.T....'..CK.Z}.$.U....;..@.e!.#....G===.=+".?..+.s..l8....o.{....;.+..(...d,..HVd..,......(..[&H.........Y.Y..~..{.gv.vW.'.....^......^...}...1v....2.*.~.......y...a_.....^Z..V?H.Q..bo(..0.Ra...q(..`o....W.....4~...q.?...F.............].....~c...O7^..W..x.?...l.=.~$......'..o;.._.....'u.aK......=..X.........g........~.].[..+..\b._........p.=.....w...%..@.o-.....O2..w...~sn..D_:....G).../e.Q_/....=Y.x........p.0..^....w...A}..'..... ...P.7....3.av...?...Kl.......>t...O`..b.]....x..Y....._...x..}....@.....1.9.o....[.?.......)...g..'.1.i../.^.\|..=........x...L.6`...>..,...K./....6...........A.#.?.8.\|....?.\|......w%K.>@..(.I...9.../....].....%v7.>.....-@.p....E........6...Kc..p?@.....8.\|.p/..xg...7...^.(..7..X~?..........#...w...q..U....f.... ..?<.\...}.K.Z.,]+...../..-......e...aO....a9Y......Wg.

C:\Windows\SysWOW64\directx\websetup\filelist.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Generic INItialization configuration [DXUpdate]
Category:	dropped
Size (bytes):	6325
Entropy (8bit):	5.301560393381188
Encrypted:	false
SSDEEP:	192:9NV2ety7h+IZpt1eJ9NWzfxRaTwzxlWINXWgQ83HSbsO6ctIQbjQQZRJi:9r2et2h+IZpt1eJ9NWjx4MzxlWINXWg3
MD5:	DCDC87F973CE93B52A9ABF63900A6707
SHA1:	C74E01E6D26ACA7B4E210C40D86AE580E97431A3
SHA-256:	B98F09F236C81887FAE916A329600477CF13F52E4A57F0D4A21E7C38AC2C915D
SHA-512:	2FDF72015E8624BF99486969820AEA2C39DA5A2A755BC6AF102D6DC3B6679593BC31E4D55FB504ECF93DC7F2D942A4D119EF3180176FFDFF28357B2B67144B2B
Malicious:	false
Preview:	[General]..Version=1..[DXUpdate]..Version=9,29,1974,0..Locale=en..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL0=100360,dxupdate.cab..[DXUpdate_Apr2006_xinput_x86]..Version=4,9,0,904..Locale=en..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL0=49218,Apr2006_xinput_x86.cab..[DXUpdate_Apr2006_xinput_x64]..Version=4,9,0,904..Locale=en..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL0=90309,Apr2006_xinput_x64.cab..[DXUpdate_Aug2006_xinput_x86]..Version=4,9,0,904..Locale=en..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL0=49266,Aug2006_xinput_x86.cab..[DXUpdate_Aug2006_xinput_x64]..Version=4,9,0,904..Locale=en..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL0=90350,Aug2006_xinput_x64.cab..[DXUpdate_Dec2006_d3dx10_x86]..Version=4,9,0,904..Locale=en..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL0=194952,Dec2006_d3dx10_00_x86.cab..[DXUpdate_Dec2006_d3dx10_x64]..Version=4,9,0,904..Locale=en..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL0=216015,Dec2006_d3dx10_00_x64.cab..[DXUpdate

C:\Windows\msdownld.tmp\AS463294.tmp\dxupdate.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 91192 bytes, 3 files, at 0x44 "dxupdate.dll" "dxupdate.inf", flags 0x4, ID 3666, number 1, extra bytes 20 in head, 8 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	100360
Entropy (8bit):	7.9900557178400815
Encrypted:	true
SSDEEP:	3072:lvknxJpNYAzRstaRkz0BwwnNbSa+vp5647S:FkZNXsERk6wwBSa+vnl2
MD5:	4AFD7F5C0574A0EFD163740ECB142011
SHA1:	3EBCA5343804FE94D50026DA91647442DA084302
SHA-256:	6E39B3FDB6722EA8AA0DC8F46AE0D8BD6496DD0F5F56BAC618A0A7DD22D6CFB2
SHA-512:	6F974ACEC7D6C1B6A423B28810B0840E77A9F9C1F9632C5CBA875BD895E076C7E03112285635CF633C2FA9A4D4E2F4A57437AE8DF88A7882184FF6685EE15F3F
Malicious:	true
Preview:	MSCF....8d......D...............R...........8d...#............................~>.%..dxupdate.dll.02........h=...dxupdate.inf.1...0.....~>.%..dxupdate.cif.T....'..CK.Z}.$.U....;..@.e!.#....G===.=+".?..+.s..l8....o.{....;.+..(...d,..HVd..,......(..[&H.........Y.Y..~..{.gv.vW.'.....^......^...}...1v....2.*.~.......y...a_.....^Z..V?H.Q..bo(..0.Ra...q(..`o....W.....4~...q.?...F.............].....~c...O7^..W..x.?...l.=.~$......'..o;.._.....'u.aK......=..X.........g........~.].[..+..\b._........p.=.....w...%..@.o-.....O2..w...~sn..D_:....G).../e.Q_/....=Y.x........p.0..^....w...A}..'..... ...P.7....3.av...?...Kl.......>t...O`..b.]....x..Y....._...x..}....@.....1.9.o....[.?.......)...g..'.1.i../.^.\|..=........x...L.6`...>..,...K./....6...........A.#.?.8.\|....?.\|......w%K.>@..(.I...9.../....].....%v7.>.....-@.p....E........6...Kc..p?@.....8.\|.p/..xg...7...^.(..7..X~?..........#...w...q..U....f.... ..?<.\...}.K.Z.,]+...../..-......e...aO....a9Y......Wg.

C:\Windows\msdownld.tmp\AS46584D.tmp\Apr2006_xinput_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 40050 bytes, 4 files, at 0x44 +A "xinput1_1_x86.cat" +A "xinput1_1.dll", flags 0x4, ID 6338, number 1, extra bytes 20 in head, 3 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	49218
Entropy (8bit):	7.962835058038329
Encrypted:	false
SSDEEP:	768:rrXN+lWp5tvn2v0JeuXfYYJDyRIvwde6hecBLdKd+d4RUJ6HwyQs34VvD4:3gl6tfTVXwcWuqe6htcaJyQW4VvD4
MD5:	E207FB904E641246F3F7234DB74121FC
SHA1:	1BE8C50C074699BDD9184714E9022B7A2F8BF928
SHA-256:	3FDF63211B0DD38069A9C1DF74D7BC42742DE003CEF72AD1486AAA92D74546FA
SHA-512:	ED95D53BC351C98C0322753265B0A21C98DF97D0E2FBBC58A6836BFF374B7540B0CEA21371CD4A7EAD654210A42E1F9809CAC6E4EAE2ECF0EF2B88E220DC37F7
Malicious:	false
Preview:	MSCF....r.......D...........................r....#.............................46f .xinput1_1_x86.cat............4.d .xinput1_1.dll............4.e .apr2006_xinput_x86.inf.....R......4.e .xinput1_1_x86.inf...G..>..CK..\SG.8\|....&l....-n.6....(Z........"PH..,...+.G.V..b..V....Zm.Z..Xm..ZQ..E.{.......}....&L.g.9s....Jz?tp..N.;.]Y....!...b......t.c..'D%v[...8.8..........F.spf2y,.Gpe.w.......d...o.vs.........G...).bQ....cE%....."..GH.`"....D..B!..i.1..... ..0.. ..K# ...@*...C!M....R....SDq.c...b....#!6....b.....(/.`.....Q....(.!.pE....lB.a....L.M..[..E.........\|...;.H!..".P.j........9..<.t.l....]5w.;...R.9qQx...@x..8.........$.1.az!.Z..?.rDP+...c..)U'J..E.H..j....%.......w.;..x.O...>........`0.A4..d.....dT...Q.3..y0.."..].x"...\|.C.bs.,...`..h..#D..y.v..OM.1u{..C .X.N......+0....f2...3;...@...P......Z.......H.x.E<....A.-.4OA.Vi.f......."n\....b\...\M+.e.....k.N.q.`....%.@.../Q..V.e...s..."w.......KI........4.u.p..J^.V....D....t.0J...H.HMVg.d....B.v.]..)..

C:\Windows\msdownld.tmp\AS465C06.tmp\Apr2006_xinput_x64.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 81141 bytes, 5 files, at 0x44 +A "xinput1_1_x64.cat" +A "xinput1_1.dll", flags 0x4, ID 7457, number 1, extra bytes 20 in head, 5 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	90309
Entropy (8bit):	7.986243949537019
Encrypted:	false
SSDEEP:	1536:/0CNqg1WzKHJUq/JSlvxToeSNOUp9BttldRL9zaMNez4fbI9YKztrIrm:/hIg1cEJUxvxlSNOUpfttldRL9zkzAI5
MD5:	B0669F7D395078BEE0087B089F0B45C5
SHA1:	30506FC3DCE9532EF0A8CB3973347EC9C3C9875F
SHA-256:	E63A67783EF7624559F95AB697BF8AFBDAB7ACE31200283EF840E6B94AA16E5A
SHA-512:	D7EFCFD85B3CB6CB9B1936B701A9D7D91A6094AA08D8C933EDF8493C6AD57BE05A579980A404B35E9721F71B45F4CAE28399FCA3FF5DF20A9A3138B90F86B94C
Malicious:	false
Preview:	MSCF.....<......D...............!............<...#.............................44f .xinput1_1_x64.cat..F.........4.d .xinput1_1.dll......e.....4.d .infinst.exe.V....l.....4.e .apr2006_xinput_x64.inf......o.....4.e .xinput1_1_x64.inf.. ...9..CK.{.XSI..MHh..AD.. .7t...4..H.TTB...$.."...,...v].{Y{...u..k.......w..pA..}......<.\.9s.w.9sf.x...}...y..L......j`.c2..6..>..L.i.......F.......QZ...X.p.}c.i.`.,^X/l.8...m._..Fv0.}pOO.................N..>....O 6......X..s....A.'.s0....X...c._0.\|...?... .....IM.Ln..e..&..$...6?...K.....f7../.A..2...@=..7.`..L&..u:...w.>...q.q'=&...Sf....'..,.S`R,..aJ..@.nO.6.....TEF+.K...4.-.$....<e........ob.^..\({@).F.A.../.'..I../.F>@}..N.f....h...........q\.7#.~...Rm.2...HO0...{...dx....d..00<.3.v..........d....o:.e...,.....I..^v&.t .O..)Y;.B.7\|Q.K....Oo...g.L..5.I.....;t.i.\Z.V..>../..G+.!....z5,.*....1.L..#....58..f....7.x..Va~....bY....\+..U.-M.D..H....d"n{..b.X..V...Lqz..k.h.5..I.d)E..x'.hc.dp.Dr.8E,.(.R..+..5.YZS.1.

C:\Windows\msdownld.tmp\AS465F80.tmp\Aug2006_xinput_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 40098 bytes, 4 files, at 0x44 +A "xinput1_2_x86.cat" +A "xinput1_2.dll", flags 0x4, ID 6335, number 1, extra bytes 20 in head, 3 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	49266
Entropy (8bit):	7.9632460736333766
Encrypted:	false
SSDEEP:	768:OuG396sAA1wXXvVFc2755DkphtVmUkt/lnkvH0odpl/q1nk:vwQsAhFcSmpJ3kt/xcd7ek
MD5:	16B968CA0C435EE45E77A84C2D0364A9
SHA1:	90B17A60A34F6335787A6B2D489CBCD3A4EA98C8
SHA-256:	6DD7C0ABE37D3DF7AA6DB7BB352260F4A15DC965FF9D30AA32FE9595C1A18300
SHA-512:	3BBBFDF8B5673641EC066C3FB52E6B0D5CE0BC6ED6BFF17AB4AC3FA69A8628B09E5EC8322FC39D2A206974B54D297CAAFF9410197E26D090FE74F963CD535045
Malicious:	false
Preview:	MSCF............D................................#.............................4.R .xinput1_2_x86.cat............4.K .xinput1_2.dll............4}R .aug2006_xinput_x86.inf............4}R .xinput1_2_x86.inf.....>..CK.\|.\SG..M.. @...mTT.0.(..D..M...+K0 ..D.`...T.Zkk.Am.V..k...V[l...+....*Z4....P..........&w.3g.9..\.Kz<tp..N.;.]Y...%=.!...b.............%v_88.t`qXK.;......B..3..c.8...................a...aA..C..)t...FP.q.%......'.B...("...D0.(..Al(..BY.<..."...s.!...1....&."...a..;6;h.P.#.X...p.H....c..q,..1.'..^.CL..h.C..h.%......f...S.l.'h.p.p.E.......\..G..1..'.)D>.Cd.JB..u.....6..i..A.>...&.......]..J....C..h."........x.......4....0.H.?..P.=.Z"zEaJU...F./...Y.t...~.o.y9<..9.l..7=.9_..d...!.r.F0...4..c2...a.3..y0..B..nD<.K...s!d.9\|...p.0\|a.U.a.=x.v$.OM.1u{...qQ,..._.R....y..f"...33...@... ......[..1.a.....0.x8..@.N.`i..0...b..c.wYs.L>&..9..A.......UXL.n..8x.....z......W+..... o.'.v.r...$g....R...4.u.r..J.P+......./o:C...Sg.g.&.3r..^.vG.v^...I.s...9..

C:\Windows\msdownld.tmp\AS46626E.tmp\Aug2006_xinput_x64.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 81182 bytes, 5 files, at 0x44 +A "xinput1_2_x64.cat" +A "xinput1_2.dll", flags 0x4, ID 7454, number 1, extra bytes 20 in head, 5 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	90350
Entropy (8bit):	7.985841057262195
Encrypted:	false
SSDEEP:	1536:5lQFOMW9t2gGQtmxC4LbB8GXjgvW/j44krD+W2MLdk6v5yO1Ha6DB/4RPjz6ITda:rIOMWm+tmnbXjVkWW1lgO166cjz6z
MD5:	A9D582E44E46E36F37EDB7CBC761179D
SHA1:	ED1BEF64385E94CE89AFA704D38408E23B31FA79
SHA-256:	C26633D38E0A91B9BE70382E916A83D50E219609F7E05CFB2D27DFAFBE480B43
SHA-512:	20011BFB547DEDCE8E6FCEDA22C3A3A83DB140E8A20844F3B0E8741B4474C1FEA73D84708B801E83EAE3CD2D8A2D6C851C3F7CD0154C0382A78BC2C2DF6B01E5
Malicious:	false
Preview:	MSCF.....=......D............................=...#.............................4.R .xinput1_2_x64.cat..G.........4.K .xinput1_2.dll......f.....4.K .infinst.exe.V...'m.....4}R .aug2006_xinput_x64.inf.....}p.....4}R .xinput1_2_x64.inf....%p9..CK.[.\SI.....I..1`D...]A......A....D .)4........E]...`.....^VV.........{.\.]......~./w.9s...9sf.E..k.....l@...Y.......Cu4.....t......I.Q.<u)ey...k1...K0.)....u..+..{..&...Z....@=].X....'..$qD...y.kZ.+..O..x .....F.@..........A.wd..........;......<@i.. ..s(G..J..".q.#..c.u...=.H<"A.H..C..;.>....43V.4..1y.;..j.yK"F}.F..#.RY.h.u.2.....p.C...u...b.:..E1.?f........H@]..;..DfR.T.%..-.....h....@...;...Z=@..pGb.b... .........n.....b>...R~...J...X...0.?..P7..........p6."/=.Z mI.r..X..x...ey...m#.>Pi.ZY.".....Xi..B..S.....7....=P7k}L..."bB.....;.....)...;..L...`B.PG.8.d..q....e.E....D.T.$..H..X.A..,6..y.\|..4...x...K.....o...6`mB.T+.B..0..[..Q4MS.D?.9j.+...<..'.0.9"...5.l-S...8.#H..XF..puM5#.8.R..7..2.L.p..'....\../.....a....

C:\Windows\msdownld.tmp\AS4665F9.tmp\Dec2006_d3dx10_00_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 185760 bytes, 4 files, at 0x44 +A "d3dx10_00_x86.cat" +A "d3dx10.dll", flags 0x4, ID 5461, number 1, extra bytes 20 in head, 14 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	194952
Entropy (8bit):	7.9966042762544145
Encrypted:	true
SSDEEP:	3072:x4mJ4SadBGg8IZrdosr2nqOwY7l43gRDlcGgp6VMslgVwxikcBmEi21wx8MqX+dN:xJJ4VWgzZptAqOf6wRD5g0VlgVwxL21I
MD5:	75C33157D8A1B123D01B2EAC91573C98
SHA1:	E3E65896CE0520413979C0143C3AA9BD3A6A27D3
SHA-256:	02DAA8B5AC3752F76C3BFD9A505EBF22B1B4B41E44EB92CE2799033B2330D186
SHA-512:	F0F1F1DEA5938E1C7FF2ADF7C8D421C2E68E6D3A8CDF18D0F2F3FE1C6837A4F37B367D2D974C35832D1D85A619948DD0F250C7D6DC4AE39F618F5A2893EAC7DD
Malicious:	true
Preview:	MSCF............D...............U................#.............................5.a .d3dx10_00_x86.cat...........}5.h .d3dx10.dll............5.` .d3dx10_00_x86.inf............5.` .dec2006_d3dx10_00_x86.inf....9.>..CK..\.K...C..DEA.P.$.......$...%.A.....0 F.Y.s.1#...#..f.......y...}....ZU..jU......SP.=.gB..GQ....>.5.p8.*<%.y3uY.....Xv.....G.S..)/...A.x....@U.GN.....{,.0nI..@.......d.......R..S....s..B.........B...H. ;.. 9..<...nL.5..!..4=.>.o....A..u.i^...dd..x!.....p...@Jn.;H.L...d......&$. ..\|<&/;.O...!.A..%##C.RZ...YG....Z.h..ee........+..D...D&.F.....?.a...Io..hg.5..blP..I.......B....`..,.....u..=A...<.%!.8.,.0....b...v.O..a....#.._J....3o.........F..Z {".t\..H..eo..1h.m.0.a....1....Bc..s.^..V..Bq.x...D(.E....@...&......<._..xv......OB....6L......y.. ....$3.....AB.&.cC8C".p.9.,[..mZ...C+....J.....A.04...rY.....7.y..!^....>j.+yj-#.#...h23.e..)....f....k.:@.-..3...,...O..Vl..#....MIK.Yk@j...^!,96O".....T...\.H,IIL....dfXw.u..e.w.F...C...Y).I\....&.[.4.

C:\Windows\msdownld.tmp\AS466A3E.tmp\Dec2006_d3dx10_00_x64.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 206847 bytes, 5 files, at 0x44 +A "d3dx10_00_x64.cat" +A "d3dx10.dll", flags 0x4, ID 6580, number 1, extra bytes 20 in head, 17 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	216015
Entropy (8bit):	7.996946294916653
Encrypted:	true
SSDEEP:	3072:SGo145qtWQt9fL4bBHlKqDfaqaGm3+vqm9/Xx0b6POnzED/RIxeqTk0T:SGo145qtbt1LaeB36/xc6PkV
MD5:	681407075E9B19E5EF2218832F6FAD71
SHA1:	E4F4D292A36CD9A3034007EF9D2005694307EB52
SHA-256:	F9BD5BB083BD55D1D2A690BC66D6D9DA0B1A8B49F09E811E788C030669121118
SHA-512:	E983E7DD3F40510816FF3AE836600A186DBA827B484B0C346C20E43E229189A86D4CB5CF219C1FC35B77AB0668866446F6E9206B279931C927D4ED66AD3625F1
Malicious:	true
Preview:	MSCF.....'......D............................'...#.............................5#a .d3dx10_00_x64.cat..)........}5.h .d3dx10.dll......H.....5T_ .infinst.exe......O.....5.` .d3dx10_00_x64.inf......Q.....5.` .dec2006_d3dx10_00_x64.inf......:..[.... .Vm.....%A.P...?..,..".._.R.&.F.J.J.K.^.^...".U.!. ...BvJ...G......(.........C~.b...V...i.Z..O.<.%. .C...@l....a........XBq..Q.]g..2;..+d.[T[.Q..(ji..J...........T%.E.5.o3w.;.x.p.+@...JH...JA%.`.F..^....z..B......D.....S. \.3....."A%'n..h.f%.E.Ue.T..61....i.....m.X.......Wu...pf.a...............G.B...........$..%....R...`K.x....U,/...aH........S..^..2....h.E.6....B.K.A..........4!@7..........2...].}...".2..Z...!V.......-.6..<...{}..............o.~.ST.}.O.H.,....U.N.;..g{j.~a...^..7.n#.......SJ....~3}I9.\s.o....u.c;.../...RT....O~.R......L>C....W...K....P..z..........f%........::...vr.hC.Z.5...75+^...........evQ...8....v..)...W{..O/..<$....t...;. t..,&F.]&@.R..3e._.KZ.....C\|../...^.p&..`\SVd.......ge..E.

C:\Windows\msdownld.tmp\AS466E36.tmp\Apr2007_xinput_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 47342 bytes, 5 files, at 0x44 +A "xinput1_3_x86.cat" +A "xinput1_3.dll", flags 0x4, ID 8235, number 1, extra bytes 20 in head, 3 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	56510
Entropy (8bit):	7.973777529821975
Encrypted:	false
SSDEEP:	1536:BcnwcwzHEdb27WH2SfZDNu75ddnVR+ZFaNk0ZKn4:4wb+2eZonQwt
MD5:	B362EC93463D8B6381A864D35D38C512
SHA1:	7CE47EBCEDA117D8B9748B5B2D3A6AE99FC239DF
SHA-256:	B6C1166C57D91AFEEEAA745238D0D6465FF2084F0606FD29FAF1BFA9E008A6C5
SHA-512:	CC57733912E2A296A11CD078372C3B43F1256A93EC5BECD0D1B520EB210FCE60938AA1CAA6DBBCA03292A05495B5ECD212EE5F77E3EBABB11EF31F1975B2D09E
Malicious:	false
Preview:	MSCF...........D...............+ ..............#...................(.........6{. .xinput1_3_x86.cat.h?...(.....6.. .xinput1_3.dll......h.....6G. .apr2007_xinput_x86.inf......m.....6G. .xinput1_3_x86.inf./....p.....6G. .xinput1_3_x86_xp.inf.i...T5..CK.y<.....Y.d..H.<3.1....=...`,cbB.f...RkB..V..E...,.[$I.R(~g..n........}....<....y>.9.s.....f&.s)E.F..Cp ..Q...D 0<0.;....R.....3.\...4...F.1QI...........@..O....2.f....I\...a...c4.0.....,...0.!..6.. M...@..:..ocp.A.K6......... .F..!...[....+..,...0n...<..@cl`+Xe^.X.t.$.;{X@.P....@d..N=.....Z..g....&...#...%]....~.........C. #..u...h(.4^.4.... a.a...#.Z<....%.{..5..n$....P@[..C<01..Y...F.\..[.H.H.l..f.l.X.0...l.4.A....+B.~.\|.l.YO0..k}i>~V..O.f...M0n^.?..B..........a.......N.w/==J.{..D@0..Q.....%..@6..Z.\|......@@.4..a.....q......t....4v....dI.Ym..^...........[7.XH.8Y.nR..d.<.;O.."k...d.y2aV..4....D...5..B".H~.....+x_o.4....c.#.`..0...v.F4........I.Q$.....x....._..;]...O[....l....?..:.......Q._....2.;.~...NXz

C:\Windows\msdownld.tmp\AS4671D0.tmp\Apr2007_xinput_x64.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 90857 bytes, 6 files, at 0x44 +A "xinput1_3_x64.cat" +A "xinput1_3.dll", flags 0x4, ID 9350, number 1, extra bytes 20 in head, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	100025
Entropy (8bit):	7.988437274786544
Encrypted:	false
SSDEEP:	3072:Mt5OSvuXSf2rbZu4Kmsr4eLRwPC5B9y7q:MTOBXSSpFI4/PM/ye
MD5:	FAE84E0773A74F367124C6D871516B7B
SHA1:	CAF8B9D7D4AF965BF445D052D1E835B680D6BBC3
SHA-256:	86EE073C199B5080FE4F5BE6AC24BB1117FEA42E4BBCD828B4F0EC26C669B22C
SHA-512:	CAF1381CAE7417B57FAEF56D0023BF90C90406748F8813AB85C687DDB81E2498D2F1D5F4BC154903FD5A19836E6F245CD6F5D3927A383F1ACC3BCC41B58FD09B
Malicious:	false
Preview:	MSCF.....b......D................$...........b...#...................(.........6+. .xinput1_3_x64.cat.h....(.....6. .xinput1_3.dll.h..........6.. .infinst.exe.\...h......6H. .apr2007_xinput_x64.inf............6G. .xinput1_3_x64.inf.....a......6H. .xinput1_3_x64_xp.inf...<.6..CK.\.\S.?....H3`@....B.....t.....D!.! " ].{..`AW........b.k/(....fNN ..z.}...g..of.7...\|3#.]4.j...."V.;u.".,..t....... o.!G4.G.<........!.I.P.'..t-B..T.N5...U.......2..S.....:....Ju.S.Q..v"D%..y.KR..B...a (.4.....7......x!L.\..u@.@...B.-G0......A..g...Dj8.j..L.X.."0."...^...kP.&@.}.....PP..k.p..\|.`..P..D"... .H.1.h.^.G...#...+Ls..7..!qH."@..."..;,....Iz;u.t....>..Ki.y.~.5M`)SR(..$....&P:........-F...@....-..C.&V....N...Z..!....~.....{X"eo.5.D6.u...Y.9...8.......pg8....g....4....j@.S..T..C.H..7..ID...!.HP}.....7U..@?1".yMi....aA.....[..&.M.0A..'L,.q. 6`..DZ...i2.t..(Sw...e..X..6 ..y$...>....D.&R......>....~..U.Z...X.B.5:HAn.IU..[ ..MH...8..Tgg'.H.G$H.$........)a...E b.y.>........t.....dF.

C:\Windows\msdownld.tmp\AS46755A.tmp\Feb2005_d3dx9_24_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1007265 bytes, 4 files, at 0x44 +A "d3dx9_24_x86.cat" +A "d3dx9_24.dll", flags 0x4, ID 4987, number 1, extra bytes 20 in head, 69 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1016433
Entropy (8bit):	7.998972724711677
Encrypted:	true
SSDEEP:	24576:T/HUK+hlSM4jwe8WpmQUrxiUyULWoF/V++TYrjVdLa1:bHURewe8W4VN8uF/VhMr5s1
MD5:	7029866BA46EC477449510BEEE74F473
SHA1:	D2F2C21EAB1C277C930A0D2839903ECC55A9B3E8
SHA-256:	3D4E48874BDDCD739CF79BF2B3FD195D7C3E861F738DC2EAB19F347545F83068
SHA-512:	B8D709775C8D7CA246D0E52FF33017EE9A718B6C97C008181CD0C43DB7E60023D30D2F99A4930EBA124AF2F80452CBF27836D5B87E2968FB0F594ECA1EBF78DD
Malicious:	true
Preview:	MSCF.....^......D...............{............^...#..............E...7.........E2.. .d3dx9_24_x86.cat...!.7.....E2.. .d3dx9_24.dll......."...92.. .d3dx9_24_w9x.inf......."...92.. .d3dx9_24_x86.inf.(~m.?..CK..\.Y..O..........H.$@..(M..X.. R.I...6...#.^.......{w..}&............{.3..gf.e.....0*`..kFm.......i.`p....X..Y-..7]n^..9...e.(.7..^..V.FO+...v.,e.^..l(i~w...M...l...s...z..U.7.c5.b.3..........#1.I.'.F2.C.@.......'Hx /..K.~.`g.).0..".8y....0.8...N.\|..v.u@...P...H.R......c;W....yg..x....s...2..\...}..%21.D..... ...q.....E,.....q.Ee..$...66...pGr}.. +..!&&&PK..f.r...x.'..<.. ....kH..@....~l....\....@fD...+y..:UC.%...zy1.........~j..v..{%..v[S.ZEE...5....i;..1.(...&.x._.......R+[A..l..z(.e. .k..jbf.@.336T.[...'...J/-..uHc.u.....6..U.....).l...&.".9.X..H\.N...d.V.g...^...Jv..PQ~#?....V.......j:..p.....k.R.......0o.~..F..70.).4b7......+.:.&.)Qd(9...i....J35q.....T%..b._....,..........)Qjt.DU.B.R.s..-.`.......4HE...JObJDlG.4x......lb..<..C..sHD.

C:\Windows\msdownld.tmp\AS467A7B.tmp\Apr2005_d3dx9_25_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1073002 bytes, 5 files, at 0x44 +A "d3dx9_25_x86.cat" +A "d3dx9_25.dll", flags 0x4, ID 6922, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1082170
Entropy (8bit):	7.999075135168916
Encrypted:	true
SSDEEP:	24576:i0BodqhH/OCy8M+j5lcB4ZfeXBXUd/QLML9bw6Uzc12:iUbffy/+lmBXF8Ioxw6Uo12
MD5:	9C5DCA423D9D68349D290DF291DDBEEF
SHA1:	D9F1CAE586470EA309CE9F115525B0504FFFAEA4
SHA-256:	5487ED4E969A822E5C481CEFB1D4DA3066B1D5EC8C55798B246915ECB58A8665
SHA-512:	9F50599321F45FB7451B0A1C0F1DCBD6B4A4E60EE27B0EF5AA29168C1BCE5B08F34329916EA2EA655CD632D0A19C81953C2A5F1277F6A96FB63AFC098236509D
Malicious:	true
Preview:	MSCF....j_......D...........................j_...#..............H...7.........r2. .d3dx9_25_x86.cat..#.7.....r2}. .d3dx9_25.dll.......#...r2,. .apr2005_d3dx9_25_x86.inf.......#...r2,. .d3dx9_25_w9x.inf.....k.#...r2,. .d3dx9_25_x86.inf.(.0.?..CK..\....'4.A..".+.@.%..C.4).b!@..$.....a..k.#..v.w.w.]xg...............9{......k....q....6.Z&Ey-.@.....a.0.T...9b......a...b....ilk.+c.5.af.o.vl..............<....s.z..V.7........fa\.G\$En..._..\|$.?9.O...!..H.<...#.,...!.^N.<.g"..=.V\|O.a..gwcw...t.c.......X..4(.).. .?.S..0k..._2{<%X.......m.....D&&..v.c ....Av...u.l. K2......R.0.&.XO8b..p."H@^..2..jbb...hg.&...>.>....u..x....2...@.~....9..u.a.M.X...S5d_..\|}z"h..1.....<...Z!...V).............}OO...n.2..Q....../.......R+[C..l..(...@......1........$..vs..K. m...e...b..\}u.+.....?..bg...P.......%.pRgTq.t.t.e<..t.Y._.X.?F.(../.......abb.G5.qkb.\..Z...g.....g..(.....f..Lz.8...h.e....t.R.fJ.iJNCv}:.V.:..m.B..JIQrlA..Z5..HR..)9-...:.......V.JP.)t*.....6m....

C:\Windows\msdownld.tmp\AS467FCA.tmp\Jun2005_d3dx9_26_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1058965 bytes, 5 files, at 0x44 +A "d3dx9_26_x86.cat" +A "d3dx9_26.dll", flags 0x4, ID 6937, number 1, extra bytes 20 in head, 71 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1068133
Entropy (8bit):	7.999040217820951
Encrypted:	true
SSDEEP:	24576:NxFMsUF1MmwONoWu85w6SFBu+vveJ0sut3z2A1s9z/D8gigA:V3dm3NoW+9FBhuJ9ut36A1s9z78giP
MD5:	029359EBCA4BA5945282E0C021B26102
SHA1:	6107919F51E1B952CA600F832A6F86CBBED064B5
SHA-256:	C44EABF5BE3B87CD845950670C27F6A1E5D92B7758BA7C39C7849B1EE1C649C0
SHA-512:	FA007F257F5267119B247EC4ED368E51FD73E6AEA3097E2FC4E78078C063AF34D161FD1BDCAF3097BB575D2614DBA226A624D060009EE4F7BEDA697EFCF42BB7
Malicious:	true
Preview:	MSCF.....(......D............................(...#..............G...7..........2b} .d3dx9_26_x86.cat...#.7......2Z\| .d3dx9_26.dll......,#....2.} .d3dx9_26_w9x.inf......-#....2.} .d3dx9_26_x86.inf......0#....2.} .jun2005_d3dx9_26_x86.inf...N..>..CK..X....'.. ..P.....&!. .%.A........`.....;v..WTd..........w......{.{..<'...3..;}....=Xv3.e.vc:.yg.i.....1.....V.F.:.fMj ,.\|.e.....F..5#?.\|6.M.j[Z..k3.....g.f.B(..=v......a<.7..a.=.:...h.f.X6.."..I..I......Od:.!9......~1.H..q.....'....y..\...E..u.S\|K.a...:c..B..8g:!?._..E:.A.H...N.a..j..~pI.....V.k.l.W.....X..........`4.2(.....e.>...0...!L..>p.....2d..r<...afffPK.6..t0.V.'HA.....j.o...5B+. .....hy...... M..5t...K.<>..@.G........~h..Xw.B.....F~>.?l..7..].}Xp.m.!......x~6.aY_.rmH..sr.."Q..]..d3.{.bXX`P....io...AZ.i..$..1....Gl.....d..AM:6.......p./(..Q.1..1..q....O.c~.c........04...\|s3...}..x..I.r..).m.K1.o#.Q.Fa...X7.baY......G{......Z5S.HU..c.tp.z6.4m.B=P...d.6...g.....W..aM...z...L.R.W%...z.F.n.5....54EG.R

C:\Windows\msdownld.tmp\AS4684FA.tmp\Aug2005_d3dx9_27_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1071684 bytes, 5 files, at 0x44 +A "d3dx9_27_x86.cat" +A "d3dx9_27.dll", flags 0x4, ID 6926, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1080852
Entropy (8bit):	7.999138982152864
Encrypted:	true
SSDEEP:	24576:sP2N00PXWcq4UsDMMlsOgDUaQFMBZ0To2xIG:sP2CuZQsVl96fQiZMo2xz
MD5:	3E91448A7481A78318DCE123790EE31A
SHA1:	AE5FE894790624BAD3E59234577E5CB009196FDF
SHA-256:	8C062B22DC2814D4F426827B4BF8CFD95989FD986FB3AAA23438A485EE748D6D
SHA-512:	F8318BD7CA4271FC328D19428E4688DA898B6D7FB56CC185AD661D4A18C8169392C63515D7DD2D0B65CBD1F23892D7A0A5D3D77A4CDA6230BA03B3B917E5C39A
Malicious:	true
Preview:	MSCF....DZ......D...........................DZ...#..............H...<..........2.. .d3dx9_27_x86.cat..d#.<......2b. .d3dx9_27.dll.......#....2.. .aug2005_d3dx9_27_x86.inf.......#....2.. .d3dx9_27_w9x.inf.....p.#....2.. .d3dx9_27_x86.inf.]Z...>..CK..X.[...C.)...1(v.).. 3."J.P.. @(.&.Y..v...].....{.cW.$("..w.....yN<?v.5k.......q.Y..0......Z&.9N.!.....f.0.X...9b......fF......iL..+c...ff.tx.f....no.II...2.LO6..arY...u..PZM..9.6f..H.<...._..G".K.1...R.I..\|......=!....\O}<[/E.#..>.......+...........v!..C..:..Q.$.....s....LD.Q.i....h....b..aB3c.a.b.W..c.151/,./r.rD>...(.i..%!.......\.......Sn.\|t.[{F..Mq..\..5.d......J....J.3&....jN../S_N...Qg...gA..3..:...T.0f7.k..&.a.{o.+.j....:..j.f.s..54..`.}..g......?h....bf...w.(......C)(...$.........gJ~..`.;..P>...e.......c.C..@K...d0.@M0(.YM$.y..78..U.Y...J........W......A.04)...&4..{?....Ce..W.;..0m..x.9......n....Io!.!.>...o.......],OQ..0.Q..[KR5QrU.2)I...m.kU."<^..S..3.Q.....".b.F..UF.uJ....:lZ...p.2.R.

C:\Windows\msdownld.tmp\AS4689FB.tmp\Dec2005_d3dx9_28_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1073496 bytes, 5 files, at 0x44 +A "d3dx9_28_x86.cat" +A "d3dx9_28.dll", flags 0x4, ID 6914, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1082664
Entropy (8bit):	7.999121865147412
Encrypted:	true
SSDEEP:	24576:Wa0lNxqf7fg42FhNffA/Lj41q7+YeSFfSKidHVmTJwagz8u:WHXx652fNffm0oleSt3Fwa3u
MD5:	B1CCAAFF46FE022439F7DE5EB9EC226F
SHA1:	8BB7225DF13E6B449D318E2649AEB45A5F24DAF7
SHA-256:	645F8D90B07C69330A8C7C8912D70538411C9A6B2813048DA8AD3C3119487F93
SHA-512:	2B59C07584D45705273A975A0223E4443DB190675558AB89D92E1572DE4843BE3D0D1267818B19185E4E438A8BCFA2AF5FB5EF2A119DA270BE4540576FD78C77
Malicious:	true
Preview:	MSCF....Xa......D...........................Xa...#..............H..............3g. .d3dx9_28_x86.cat..t#........3). .d3dx9_28.dll......#....38. .d3dx9_28_w9x.inf.....x.#....38. .d3dx9_28_x86.inf.......#....38. .dec2005_d3dx9_28_x86.inf...a.>..CK..X.[...C.)...1X..S.I...(M@A.......Pm..;......,.`...=.#v.$("..w.{...yN<?..=k.^..=s...o.jw..et.=..YA..=H.eF..l...,;.17kj....+.jw..Y.ry6..\.Y.4.igecJ...,.g.yp.F.yc.....X...e...L6.....SI..j......."6."...2.... ..+..O$B,..6l. ..B1l.`.....A..rN2..ggf..g..... ..H..Dp$.1..h..X.O..Pi...[LC.L..!d.\....fff................lknfYP@_..\|...Q4.!.JBJ..0...Ri[4.=..r<...b.3M/F].._S.J.."......"...P%@...`..l..J./.!.3.M.....y.l...TI.d~8.0fwf.J)M.C.U....<n7......./..&..P.R0...Q.JU..2.`...2.ri....vp:.Lg.:(.....7.H2.p.!....N.).A...bg......$..6.M5Nj.e.U..-9..P..L.5...G5.......A.P.6..6..v.i..6..6........-....`.........&3nN..K.&w.g-c....4K.9..}...U}.."VCf}*b]..B..+.j.D..d5`..k...j...4UR..... ..Ux."].d5g6..l.70&.%J.^...Q.U.5...9..~

C:\Windows\msdownld.tmp\AS468EFD.tmp\Feb2006_d3dx9_29_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1078760 bytes, 5 files, at 0x44 +A "d3dx9_29_x86.cat" +A "d3dx9_29.dll", flags 0x4, ID 6921, number 1, extra bytes 20 in head, 72 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1087928
Entropy (8bit):	7.99922866964108
Encrypted:	true
SSDEEP:	24576:MWlF24ngnZPhX4ciAwvVHgK6SgHY6OmSfLV+:MWls4gnZTmHx6SgnPCY
MD5:	F6CC1C08D0F569B5F59108D39CE3508B
SHA1:	E9CF7EDC8C9C4B57A9BADD8386A2117EC5785AAB
SHA-256:	4114E76799AF3DA9DB3DAE51305DAD70A05B757E506E4A327092D536CCA7EE75
SHA-512:	86DF72D5B15396ACB504C1AC9DE7FF5C0CC9C95A90FDD82DAEDC55BAAD490CC47A71CB511571D37E25DD9BC1EE9652B9723E33879BC1756A7881A8E61EBC59ED
Malicious:	true
Preview:	MSCF.....u......D............................u...#..............H.............C4.F .d3dx9_29_x86.cat..#.......C4hE .d3dx9_29.dll......#...C4hF .d3dx9_29_w9x.inf.....x.#...C4hF .d3dx9_29_x86.inf.......#...C4iF .feb2006_d3dx9_29_x86.inf.w.6..>..CK..X.[...C.Q...1XQ.N..........T,..D .$....c.]......#..{.z..]..E....}...?......f.=..=.g.....v..]F.Y3j...8...&....V..S=S.f...1]aQ......a...1..Q...V.....m..e........s..m.[c.....yl.{/.^%q.Z.I ..hg..DH..........$..........AB.....!N.w=!F.g. .s.p.B...X...LL..X.c ....z.B...........b.81...>:/b.......511A..[.&.3vo.'.V)..kgjb...\..\|..!(.i..%#...8..9Um..]_.E...c.o.{....\|j..r4..CN..2....K..].t.E..CH.2b}I.A_.D...5s.e....K..&...n.K....a..p.$29...o.HN..[..k...d......1V.....P..9..e.....p9...c=..RQ .7.H61.e ......I~.v.....p}:.1.:r.i....qb..@K.......AM.(.QM....%.p....+.9....~.J~.J~.J~.....-....`.0LLl...3nL.....t.f/...x.9......n....I/!.!V..X........S,OU..`.tt..u$i...]...`.6...o..(..).-..tD.....L.B.S.+c.:.Z.n......od<..

C:\Windows\msdownld.tmp\AS46947B.tmp\Apr2006_d3dx9_30_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1109261 bytes, 5 files, at 0x44 +A "d3dx9_30_x86.cat" +A "d3dx9_30.dll", flags 0x4, ID 6903, number 1, extra bytes 20 in head, 74 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1118429
Entropy (8bit):	7.999050518080374
Encrypted:	true
SSDEEP:	24576:OreyPa6AC8e290lruGDhi3TSvHDh+ISNvRNhPmJ0RRuu:cNoeYEuTSvjh+R3WKRv
MD5:	B3D644A116C54AFDA42A61B0058BE112
SHA1:	9AF7DDC29EEF98810A1A2F85DB0B19B2EC771437
SHA-256:	CA7B9C6A49E986C350147F00A6C95C5B577847B5667B75681A1EE15E3A189106
SHA-512:	A2D2F12B7B37BD8F5C8465DD13AD31942DF11EE5ED5423DEEEB178E6B594587706D2C5116258BE1562CAA5ECA691358AF3CB83B77898D1012FF521017D199165
Malicious:	true
Preview:	MSCF............D................................#..............J..............44f .d3dx9_30_x86.cat..p$........4.e .d3dx9_30.dll......$....4.e .apr2006_d3dx9_30_x86.inf.....z.$....4.e .d3dx9_30_w9x.inf.....+.$....4.e .d3dx9_30_x86.inf.v..[>..CK..X.K..=.. ....+..MBI.. M@.n..QH0....#....c..b/..{.z....E..y.......N8?gg..{..=..{...W..;..:....IA.....a.`.......43GX..r..,.f...+FA..,.....2..a0..2......Z.ty.Ih...m0w..es0Ww.[/.n%q.Z.I...ho......#...G.....\.. 1.P6....;.s.cZ.......t.B...X...LL..X.C.......B.......~......@..!..8..O..O..!mR..fbb.0.8L.f..XO.R.-......Y...y...Q4."5JD...p..s.T.f.2z.6..~...........9VPR.f.BH=.bg.s,.T.!=......O..........B...\|\|}...X..5]R.0.....c.+.4..S....E.7.y...[....3...2$..:qt...7T......Q..@X..Ji...q.Z8.Ea(..@zS.D.3;.b..a.}L.;..PG/-....(...../vL_...@K....c..&....f..y.....3.8fW:.T:N7..W:..t.t...#(.FK.k..X..&...;_...Be.w.....b6.z<..za..}_7.afQ......O{,..Thu...).'+..0{:.V}kI.&Z.JU&&*...B..[.'..t.vK.9.`]..!.)Vht.8e.\.T.....i......I.

C:\Windows\msdownld.tmp\AS46998C.tmp\Oct2006_d3dx9_31_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1121257 bytes, 5 files, at 0x44 +A "d3dx9_31_x86.cat" +A "d3dx9_31.dll", flags 0x4, ID 6911, number 1, extra bytes 20 in head, 75 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1130449
Entropy (8bit):	7.9990817245216945
Encrypted:	true
SSDEEP:	24576:fd5gyP75nbAgKdWsTLSCs3BZnH50ve35Jxroo6DS:F5fP75nbt0STRZn9nxrb5
MD5:	F778928C9EB950EF493857F76A5811AD
SHA1:	EA82D97077534751297AE0848FB1672E8F21E51E
SHA-256:	4891E2DEA9D1798F6A89308E58C61A38E612F8433301EA2376AE14C3DFCB3021
SHA-512:	1F382A287FC6763B8E8D66825E8256DFB7D0DEAD6B6A6B51DD7C4A5C86D536CC7EF4128BE0CE495FE17C859018750072DC7B43E3476D1BA435F209CC4EB6D43F
Malicious:	true
Preview:	MSCF............D................................#..............K.............<5m. .d3dx9_31_x86.cat...$.......<5.. .d3dx9_31.dll.......$...<5.. .d3dx9_31_w9x.inf.......$...<5.. .d3dx9_31_x86.inf.......$...<5.. .oct2006_d3dx9_31_x86.inf.j5o.s>..CK..\....oh"....Fl..'.......i.vC..... `..w...6.....`.....;..E..........l.w.3....Y,..+......yg.a.....$.`0...6...XZ4.FX..J...l.V..o;F^..lH....3'.f0..G.m..P.[>...G..j..c^....p.<OAO.N.q.Z.E...hk..H...'@../.B.....q`K...y"..-9.r.'.9...x.O.R.8.......c....`Gc..C....>......X.......\|0c..tz......./....-.faa.0..<,.V.^X..B......:/...y...3...X.GZ..T......Bi[.KY.x..A...3.[...s..l..J..U..h.../2Z"7......k....yB.E^.r....T........K.....,...X..)..C...z4.....b......o..yv5.!5...CD`&.\.<0..P.y9..e..`{m8..K.:(.....w..la..@.++.N... .y6.m.......,.c...[lc....d..AM.6........ .P...uD.........m...........m.e.`9t..+..aa..@5.y}r.\..rJ.={9f...3...fO4.u.V6u-z.....t.n...A..0%.T....L'.[K...Uh....Ul....vum.........N.U..).)Q...x.RaPk5..X3z.e...

C:\Windows\msdownld.tmp\AS469ECB.tmp\Dec2006_d3dx9_32_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1568416 bytes, 4 files, at 0x44 +A "d3dx9_32_x86.cat" +A "d3dx9_32.dll", flags 0x4, ID 5512, number 1, extra bytes 20 in head, 105 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1577608
Entropy (8bit):	7.999092247669469
Encrypted:	true
SSDEEP:	49152:VKo9fY3tlVm3JjPueurZ8zQbC88LHhpu97Sm:V13BFurZ8U18uSm
MD5:	A5BEAD938AFDC63ADFECC1DAF5049D7F
SHA1:	B3D5BF56F6B9BF87C33009A088BA7785B6363B4E
SHA-256:	A1CC7603302EE53D54F4353C223D95E223706924D99B864220B13814EF93EEFB
SHA-512:	C9244BBCFE60F347EC8785B1A41B6E243153624EA73B16DB4D624239A69FA76D2DF2E54039D8F4D2C495890AC17B676E390F796118B4E16D9F03683247190362
Malicious:	true
Preview:	MSCF............D................................#..............i..............5.a .d3dx9_32_x86.cat..G4.......}5.h .d3dx9_32.dll......f4....5.` .d3dx9_32_x86.inf.M....i4....5.` .dec2006_d3dx9_32_x86.inf.4.$G.@..CK..\.K..?.........7...a....4.... @..LB. `..b..;......{/.;.g7A......}......uv.3.....9X....:.G...`.eT..p...X,..V..C]c.....3^aV......n..3..N.0K3s..%.eb...e../...7..$.~.e#+...<....=..U...R...<..I8..H.D..L.. 1.!........np..\...a...D.'....@(:./.A..{...H.e...b...4Y.c.<..P...H..............].;gl.$q.........}..%,.g.....X.C...HAUZQ1..C.PM.v.\q...T.0Y.3.a.#.\!...O........A)...K....\....PF.X..te...P...B....).).V.(]Jt...A}.S.t\|1S#z....\}./.....\..............(..0....'}..N.]......y,..~.R....f.P.E.T....d#.k.b..`P.../..0W.K&....!.!........M......EL&..bBA.b....q.H.Q.5..5..u....{.ka.k.s.PA^.e.5....c#......d...2..).V.e....2.^.;.....L.....s.`.iK...Q..N.Q.%.T......k..M...U...d...H.W..f.I......kF;X..;.%..N.....j.....6......L.T.).JU"["..`....1..........D.QO,..

C:\Windows\msdownld.tmp\AS46A4A7.tmp\Apr2007_d3dx9_33_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1600079 bytes, 5 files, at 0x44 +A "d3dx9_33_x86.cat" +A "d3dx9_33.dll", flags 0x4, ID 7180, number 1, extra bytes 20 in head, 108 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1609247
Entropy (8bit):	7.999284261824255
Encrypted:	true
SSDEEP:	24576:4cQY0tIpwa5ydxGuruluTsRWo1Iq9e5m98yiN9/0rjVH60mPxr/1MQK:4cIIi+G9rul8uooec98yi//0rjoDZrCF
MD5:	A5915EC0BE93D7EEBE8800CE761EE6DC
SHA1:	E8BBC21C2B5F0E5801286F07E3DA09DBC67C3961
SHA-256:	EFA2E6DE548401376A575E83A79DE019AA38F191D63FDEF3BD2B07D8CB33E3D7
SHA-512:	02259FF3C8478CBA134A8F8408AA624B7165CED97C0AED8C9626034599DD5439F84D1AF9EEFC4191898B0A524E5FFAFB9875EC00E740CEBE97EAC4C2DD0E31AA
Malicious:	true
Preview:	MSCF....Oj......D...........................Oj...#..............l....(.........6{. .d3dx9_33_x86.cat.hW5..(....l6O. .d3dx9_33.dll.\.....5....6B. .apr2007_d3dx9_33_x86.inf.....\.5....6B. .d3dx9_33_x86.inf.,...g.5....6B. .d3dx9_33_x86_xp.inf.6^]Z.;..CK.y<.....Y.[.J..".<3..K.AJ.CQa.&a..-.L.vE...")[e..!E)e...(q.W).g..t...?.....Ws^...\|.9...9.=.3..L.XN.U.&... ...L.p.b ..,....$.BJp@0.....@#.x^D...T.`~N./J~... ..A6..Tj.....s.....a...A.....#YV..`&B.m...!"....O.h.x.....!M ..e. k@...$C.7..F...7.%...............C".Xk..V..Y.....9...B>.n......J..<......{..w.MORA....v...H..l%.....`...;l.:..T@'Y]..9,H.`.,....A.....u..p.a.....D./!..VZ..1P..I......C..........9..4..1.z......h....W...~.}"hK.m..sA..}<;..w...,8.[a.y.!X...HM....qf.!....i.~.m`.O5...T&......2?...,%#.YCTh......H....@.a........?....7..}.+.c.S.\...-.%`.......1...5......24..........5.....yy-v..R.......{.C..@"....n..C.I.`.ZX....@.MH..+9Q[.\|.rD.j ...A.(.Vb.ZZx.f......F..}h..X....~[.Cs.S\|....RV9JT.k.....c....C...

C:\Windows\msdownld.tmp\AS46AAB2.tmp\Apr2007_d3dx10_33_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 689905 bytes, 6 files, at 0x44 +A "d3dx10_33_x86.cat" +A "d3dcompiler_33.dll", flags 0x4, ID 9049, number 1, extra bytes 20 in head, 49 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	699073
Entropy (8bit):	7.998968028413629
Encrypted:	true
SSDEEP:	12288:SHwziN1v34WzSc6IA6ajvY8ov8ZdReUTQ8Mr47JYCophIa9sNDn1QcILtw6:V01wWzCI3ajjls4NpAsNDnMw6
MD5:	F784B8A0FD84C8AC3F218A9842D8DA56
SHA1:	FB7B4B0F81CD5F1C6A900C71BFD4524AF9A79ECE
SHA-256:	949068035CE57BBB3658217EC04F8DE7A122C6E7857B6F8B0CA002EB573DF553
SHA-512:	01B818AA5188CDE3504E289AEDCA2D31A6C5AED479B18A2C78271828AE04BEBCD4082051B7F4EECA8A31E8EE5ADBA158420ECDCB21371C735E4781EE5F661DBF
Malicious:	true
Preview:	MSCF...........D...............Y#..............#..............1....).........6{. .d3dx10_33_x86.cat.p%...)....l6O. .d3dcompiler_33.dll.h...2O....o6=. .d3dx10_33.dll............6E. .apr2007_d3dx10_33_x86.inf.I...7......6E. .d3dx10_33_x86.inf.i..........6E. .d3dx10_33_x86_xp.inf..j"(.2..CK.y<...........l.al..)e.!a.&...l3.-.h....j.,."D.R..O...%W).gFn........}.z5..<s..s>.s>..\|...U*x...Z..!..E..U...<$.....y0.sPH)....<..<.4.M.@...U.......\).@..6.'.Yi.!.....R.@.&..X..i..z..Y....`...C...).Cz...p.9H$...t@....I.s....;.[.C+A"..<.7.w3..A..u...s8$....ma.Y5.3.e C.e.yAAP ...@L..8.,?..h.a..E2=..9=.......e5\|a./3B"q....Zh.P...6P.."....k....:.w..:.h%.....H.0u......+..D.+!..-...9.sD...O...QZ.a..8v#......Q..N..l%....c..?P..........>.....~......0.F.VB!1ii..v5.4.R.R.....LX.X.........w.8.'.~..p.8.......A......6w.\...~..[.B.E.!..h....uQR..q.....O.....R......Cth-.....$z..B..00.l.Uo.. '..m..fB..}...ij....<..RX._......k .k1.xH......A3y.<~V>.s^gV.8+.;+...CP..+. &.....PH..).UA{...E..

C:\Windows\msdownld.tmp\AS46AF94.tmp\Jun2007_d3dx9_34_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1601326 bytes, 5 files, at 0x44 +A "d3dx9_34_x86.cat" +A "d3dx9_34.dll", flags 0x4, ID 7195, number 1, extra bytes 20 in head, 108 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1610494
Entropy (8bit):	7.999066428256981
Encrypted:	true
SSDEEP:	24576:ZBdkB3TM+mIf4qyM0iJRy3QvQDxPYKhatPJZcg9QwJeYX34eq2F37kRVeLbdiL3q:ZPU3TMXxDVI3vQ2KSBP4YH4aAELbdK3q
MD5:	FE8FEB215FAE59866DCD68C1604D97AA
SHA1:	CEDACA678D15E78AA458B965ABB467E8964A1FAB
SHA-256:	1C1E1C6F68BA556A0AF09A38C32EB421C543A4848C4B42D25867C98DAB3B3A50
SHA-512:	9955336B561E4FD3BA3DA7FC086643E811048A25A7E68344D2CC5CAB091980BAAE1C04CE41328B59C896662E2875886B78EC869852B2D1DAAA46AF38C894A3F2
Malicious:	true
Preview:	MSCF.....o......D............................o...#..............l....(.........6.. .d3dx9_34_x86.cat.h_5..(.....6.. .d3dx9_34.dll.......5....6.. .d3dx9_34_x86.inf.,.....5....6.. .d3dx9_34_x86_xp.inf.\...7.5....6.. .jun2007_d3dx9_34_x86.inf.A.".l>..CK..\...;T.D...1.(.`...2CH..........`.UD.....b.;va.;6...w.{.f.l..9.....w?..=k....=.;..........Zh.....<m--.....^..:.z.#_g.~.>.Z.Z..C..\|...5..J.P..JKK.(.0...>+.G..~.hy{c....b2.,..!..?E.&.j.1.u.=.1.B...q...p..>...q.Y....x..\6.uB......>........A..A.f.1..{v.Z...F.F.\|:.[.Z!..@$.IA.H""ET.J.c.........d..G.....\...xco.#.G......`k?d..E..s...B,........O.0(?..r.......TD..y.W..FkkkC+i...&..!@... ..xP_>(#!...b.O.>,P.8d......lM>..R-t...[.lm2.WS\|.u..._.K/.3.3.~.1a....+....q....o.M.O>o..Y...O/..B.y_...V..5..5..$#~.+.H..5.B.tu...../.......\|.[.(5q.YT5...II..@K._.d0.@M (.U.p...J.!Q_....5.....O....?].k.)..3.u.an}.....6A. .]].....rg....Z.0...}...u.....P$geq..]t/......e.JE."VE.(...LhNu..(...L!g.0...:m:...V(T4~.^...2...y

C:\Windows\msdownld.tmp\AS46B513.tmp\Jun2007_d3dx10_34_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 692512 bytes, 6 files, at 0x44 +A "d3dx10_34_x86.cat" +A "d3dcompiler_34.dll", flags 0x4, ID 9065, number 1, extra bytes 20 in head, 49 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	701680
Entropy (8bit):	7.9989902264021255
Encrypted:	true
SSDEEP:	12288:SuBBWP1krfKO0BZwB6ux8hBXsRbD3RazqgwLdJPMqHy7qdXCyhUW3zE:DBTrZ0BZwV8fXsprRaxsDBHyWdXg5
MD5:	19383CBADA5DF3662303271CC9882314
SHA1:	123C97C33F7EF2BA345B220450F181D440412E6B
SHA-256:	8EC971C91040618338AC2369188F3E5D7C85A5B1E3B9FC8E752DD845D295CDBA
SHA-512:	A4C6ACC9FF656E05D75AE0081C65C200B584209C99FD001494C4D206F2CE8A78D2DD3644E51018574928F3B9E9373BF7EC8C5147A3590B54D1C6D50E61342853
Malicious:	true
Preview:	MSCF.... .......D...............i#.......... ....#..............1....).........6.. .d3dx10_34_x86.cat.p)...).....6.. .d3dcompiler_34.dll.h...2S.....6.. .d3dx10_34.dll.I..........6.. .d3dx10_34_x86.inf.i..........6.. .d3dx10_34_x86_xp.inf.c...L......6.. .jun2007_d3dx10_34_x86.inf.....{5..CK.\|.\|......m:..s66...$.\.-K2...B....-.%..\...zI....-.@...!@..<Z(.@..B..@.?..'.k.......f.67;;;;3..gQi....O.7..F....J.m........".z.=.;9.s.D........P...PV.\.U.D......M...3.{K.k>...[z.u#Q...D,..%.%.$j,@wDT..D..]................8\.S.....X......$....q..pP>.0.8.(q.IQ..;GGq.H.@...z.F...~(...=............W...9....._A.qtt.D:[.......7D...&..N..ee.J....H..LeS,e...CY....K m..9..\....._.e....E..@R..J)p..~e...I......uA..8<>).X.#....P..O.BN...a9#I})RW..J4P./.i.'..v.Po..5.+K...[..+K..2... `]....@............q.($. <B$...8@..b<." ...b.y..,.<..OK.."..t..q...{^..5..l........J.(Q.o.Yn.]z.:x6.T..J.Z..zG........ .W..-..l.....2.\O..f/.......TJ&W"S$.2.@.2.a.....C.......A...{..!.\|. ....UVJ7.#.\T..k..

C:\Windows\msdownld.tmp\AS46B9F5.tmp\Aug2007_d3dx9_35_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1702192 bytes, 5 files, at 0x44 +A "d3dx9_35_x86.cat" +A "d3dx9_35.dll", flags 0x4, ID 7184, number 1, extra bytes 20 in head, 115 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1711360
Entropy (8bit):	7.999186916403002
Encrypted:	true
SSDEEP:	24576:91jqFBu+YTN2MuQ4R6dPnknsGmQA+re+1ZGD+rCbaNHy196aqlF35RJT1q/P0a+8:9FyMTN57+MPO++rB44S1I/F35zhqFR
MD5:	3ED592E6CDAE66B1C0671D9EC417A738
SHA1:	9F083FFE00A8E5EABF282130CD16044B488B6E0D
SHA-256:	4914D2B5C3251B00C0CC236F51AFE469728D92B50C953C66D213F079AC928EAC
SHA-512:	0144DD9A83F953EABAAFF3C41F17A363100C9A2CCD932321A4AFE990D8FCB5A430E842DE9146C983409B6366CD974E318A535E6475B10839A6679844CB7D23B7
Malicious:	true
Preview:	MSCF....0.......D...........................0....#..............s....(.........6P. .d3dx9_35_x86.cat.h.8..(.....6. .d3dx9_35.dll.\.....9....6B. .aug2007_d3dx9_35_x86.inf.....\.9....6B. .d3dx9_35_x86.inf.,...g.9....6B. .d3dx9_35_x86_xp.inf..n_.;..CK.y<.....Y.[.J.f.d.;c..l...."a..2&&[..E.BEY.EZl.%Z.(..%.+%I....3.[}...q..s?..\|.w..=.s.s..y..2.S8y..........L.8.....0\| .'.. .....LD.'.2'..c.ya.L.a...........C.....C.....^...T..x,.j.X....\.......2a2H.<`.`.c@. BwM(a.#..P....&[R.... $.B.....{....\....5.<$...q.t..qp..c.Z..J...DK...d...A@.....:t...^...X.....K...zg>......U.A..#..1v....`'d..d......A.Bf.@y.$a.d.....,.2W.=."t..........".p8.%......C.0....l.F......X.Q......R.....]...c..Y.Y.<t.'...}.........gK....of...........8Gv6......O.....N!d.?...E...g3a....`...G.R2..-@.6@......\..`H$...4...&...g.6..M.........r2K.s.....FM(......}....hCJVC.T.y..@...C...d..Yk.L`....D..L....>d#.08\.h....&...&......ox...4.2......'K....R...(E...@..6RH..A..t.1 ......s........).T..\.G..........w...

C:\Windows\msdownld.tmp\AS46BF92.tmp\Aug2007_d3dx10_35_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 790907 bytes, 6 files, at 0x44 +A "d3dx10_35_x86.cat" +A "d3dcompiler_35.dll", flags 0x4, ID 9055, number 1, extra bytes 20 in head, 56 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	800075
Entropy (8bit):	7.9986813742013325
Encrypted:	true
SSDEEP:	24576:iTo6mZ4UtaxS5hNsXjnUQEnnR62vSNE6xr8M6:iTdwtqAUXjU7nQaSNvxo
MD5:	DDC4AF0D53B477E5AF77942E7118B66E
SHA1:	81AD8201DCF653A6E977C4506A274D0BAC12643C
SHA-256:	9536166EE7CC1100CFE24E01532E8E4DEED6BAA838B4C025581F2CA046A25915
SHA-512:	1E082D7E7855BC0AF6EC09D4A69FD4A1B0A3A31E4DE8FAA52FA0BDCD601C501ADA6216DDDB83058F37AB4A371068E0F344BDF42F2551943BE19BD719D99BA93C
Malicious:	true
Preview:	MSCF....{.......D..............._#..........{....#..............8....).........6P. .d3dx10_35_x86.cat.p....).....6. .d3dcompiler_35.dll.h...2......6. .d3dx10_35.dll.c..........6F. .aug2007_d3dx10_35_x86.inf.I..........6F. .d3dx10_35_x86.inf.i...F......6F. .d3dx10_35_x86_xp.inf.. ......CK.y8............H.<3.1....=...`.&&[...m^...&D.l.%Z.TJ).....%.R..L...z.....{u]..<...y.....qn...e5\..1.1.....L.b.*D".x~....4....@0.....@#XD>D&.].T..........K..,.<(.81A.z.]..A....0.......Y.l......F[.C...R.`...8...$...A....2..8-..F..e.=j.J.ud..dM.I.........!.h..l.+..,....t9..r..!_h.D.. ..,3..hQsQnYE.+V.wL....;.....3#B"...Zh'...........2.Hx.....:2.%......:.&..'... .!.H.%.<..Tj......A3C.W..e....Dpe...]....!....&H.....I..~d...$C }.>.#...}3....X}.F..G!1....r6...WD.....L}.K..t.....)#...6.L.&...........)....9.!p.b....x.....{..f........s.a.U..^..,..3?.............Ck.....!.s.......`.oZk............K[i.g.....E7...f.7f...`.....3...F.....i.?K&.....d.,Yk.L...........,.L...D.Au..].8.

C:\Windows\msdownld.tmp\AS46C4F1.tmp\Nov2007_d3dx9_36_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1703400 bytes, 5 files, at 0x44 +A "d3dx9_36_x86.cat" +A "d3dx9_36.dll", flags 0x4, ID 7211, number 1, extra bytes 20 in head, 115 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1712568
Entropy (8bit):	7.999078652914364
Encrypted:	true
SSDEEP:	24576:fMb9V3TN8vuaBYlFhEbpdjRsI+CpoUjrn++qWYxhiUX21LVpmI9P2BZbcNU7YBP1:kJEvlmFMpdj/Npocz++q3X2tnLAcm0Bt
MD5:	C5E127067EE6CACDD2F8962E6005542E
SHA1:	22C571E4DA75A6E5DFE02E3E3587F40C2939C745
SHA-256:	F52CC1304B533083B3FC5553C49433C0E4E46D66D567B9DE0B558CA518DB1544
SHA-512:	E70DF11AF8CB5D51C3111B8327371EA40292580F06D7D265F2449B89A4941C4740BDE904367FBCB4158512939BBD7C7A3DC20D3642475789FC075A2AE8E27860
Malicious:	true
Preview:	MSCF............D...............+................#..............s...>'........V7.. .d3dx9_36_x86.cat...8.>'....L7.y .d3dx9_36.dll.....F#9...V7O. .d3dx9_36_x86.inf.,...Q&9...V7O. .d3dx9_36_x86_xp.inf.\...}(9...V7O. .nov2007_d3dx9_36_x86.inf..*G~.;..CK..TS..._....E..)...!4...iR.....Z."] .."......K..T@.B.....]....\|...w......y...w.3w..7..//s..R3...H.N{/..F.Yj..J..@..a^.........,.a.^M....".!.,T>......T. .h..-..]./.8.^..../%..q0....x..',4.....Y.9...2..!+...!]Pp.J.`...=.B.W<(.........d.d.l/.Xq,9}9> ..l.}....@......R.dY.x.8@.(..C!.?...)....f.-a.l.+6..U..vbO.q.%]s.....H...$g.... .=...l8. X2.I@.b....Y.V"...[..f5{.$`K.e3.....PE;.Nx`@.f..$....r...i>[..$]`A.:.....jv~.gg...Y....M.....x7...H..'.J.y..oV......j.aU...fc....U..i.....B.q..N>...`........`H9XVN.r..![.+..!H...B..i.-....r...f`l....V.?{.z..H.Ym../.o...Q...p....<d..,....9.7O..c....d.<.`.L..!..{...b .>.QH..)..B.........,...Hx..$a8N.^.rE.+Z..c#h...Xu..,.D"b.h..z$=....G./...l....z./.F..)..v....v':..5....G...... ...p

C:\Windows\msdownld.tmp\AS46CA7F.tmp\Nov2007_d3dx10_36_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 797924 bytes, 6 files, at 0x44 +A "d3dx10_36_x86.cat" +A "d3dcompiler_36.dll", flags 0x4, ID 9083, number 1, extra bytes 20 in head, 56 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	807092
Entropy (8bit):	7.998858073625772
Encrypted:	true
SSDEEP:	24576:EL+Y8gC2xQcaINcDDHwNXjNOl93uN850V7ZcR0SEDR3l3M:vD2xaINcDHIzhs0Vwz6c
MD5:	3D9A0C59156D03DA0F19C2440E695637
SHA1:	55B050991CB17410C75ADC3913066BAEDB482ED0
SHA-256:	BDF7FB01C02783A4F8C9F5E7911F5CAE3E2A7CBC425B90B36F9EA6EEF2C27DE3
SHA-512:	E9A662498C43865E917F0778B772D6964517E41289CBF5A0B8A4E44D8C4B4E9A5049C76F2ECBE4ACC7E9CFCC3F1D87A75C3F8703E66804CE758969814BA14FDA
Malicious:	true
Preview:	MSCF.....,......D...............{#...........,...#..............8...h(........V7.. .d3dx10_36_x86.cat.....h(....L7.y .d3dcompiler_36.dll.h.... ....B7.O .d3dx10_36.dll.I.........V7P. .d3dx10_36_x86.inf.i...1.....V7P. .d3dx10_36_x86_xp.inf.c.........V7P. .nov2007_d3dx10_36_x86.inf..d.....CK..8.....Y..^(4cK.......H....0..F.]1..$.(W...P.-..J.).[.%Q....M.v......>Os.c.......=.\|.}..d.r.5....q.s.J..*k8....y89....e...D...Q.!aL./,..l...@~N..J~..)...=..].)......o.@.... ......,R...".@&L.i..........Z.6`..C.......]6.Z.._V..J T.B......l......,..t.6.....md.p..5...l.....B...aI,.F.mU..<T...@Hf.......d{..... ..1.0$.....j.AE..#'..'.%..%....4..p..P.g%..(.H..d..........R#..L..H. mXq..c......6tU$....cii.e............1dA...f.... .........U.B..b.....Fj.z;x...f2. gY.....9.u24. .O&....!E-.....R.d+...5.b..![.dG.....""{U.C...........9p.M....Y\|.\f......E....).J...d..0.l.A......0$.....}....e......t..^W..LM(.$,... +.....A..K...f.p..dD...,..E2n..2/k-...d.E2.-.@.S...1.........pA..H..

C:\Windows\msdownld.tmp\AS46CFDE.tmp\Mar2008_d3dx9_37_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1437322 bytes, 5 files, at 0x44 "d3dx9_37.dll" "d3dx9_37_x86.cat", flags 0x4, ID 7166, number 1, extra bytes 20 in head, 116 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1446490
Entropy (8bit):	7.99972380205062
Encrypted:	true
SSDEEP:	24576:vFs/gTzoeHhwLMLDjl5XbCzgxt0Q98wWz35UM0vE03yYCmPI7ik:veKTHhbLDbDP0Q5UUtBC2PAz
MD5:	8ED75E3205C2B989FF2B5A7D2F0BA2DF
SHA1:	88846203588464C0BA19907C126C72F7D683B793
SHA-256:	91A50D9EFCDFBCDF22A91D6FBB0F50D3C2AA75F926D05CC166020BF7AAF30E28
SHA-512:	D0CF0E3AAD9C8C43A927D1BBBD253B9FE4C97B638AD9A56F671EBEDA68FC9BC17CC980D93095FBB248DD61DC11B7E46C22D72CEE848B150F7A13EAD9E08A7891
Malicious:	true
Preview:	MSCF............D................................#..............t.....9.......e8....d3dx9_37.dll.<'....9...e8I...d3dx9_37_x86.cat.....D.9...e8....d3dx9_37_x86.inf.,...O.9...e8....d3dx9_37_x86_xp.inf.\...{.9...e8....Mar2008_d3dx9_37_x86.inf..$.0:..[.... 92......$Q.f...>J...h.].W...uWL.I...W]J.X..V..{..Z........X.G{<..033.4..P..........ek \|.b./..gFB'S...K.....fe.5.u..T<{..H....XG84QbDR.8X.Hf.H..46...H"0 ..HH.S.............(_ ..w...H.....Q..P..vT.t@.G+...1...YH... V..Y4H..P..1R$l/..20!ls'...;....;..kmttyu...x.s....q.....q$.C..5k....(....B.r..y..<.6...Fz..hn..-.....Q.3Z...@.1.V..S?...a\|....(6.......D. ....)Ej....GJ%.5 ........G.w>......p...i}..<.\|..b.&!..7E.yU.O-.D......O.UC..yIA.Aj.._..D...VOc....{.f]J.<...r.)o.\|-...>.PWF.....;.;..vb....4..QV'f.$......:S.hi...~...}3k......\...}a.......L5..e....\|.....1..n...T...t......[....Z.].e....d.A......'..\|.V.2.\|Ax..W..........B.>...x.. ..\|.`...L.h..H.i.....@-.aa...7...K ...../..l.x....r...0>x..@/X...W..L..

C:\Windows\msdownld.tmp\AS46D57B.tmp\Mar2008_d3dx10_37_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 812300 bytes, 6 files, at 0x44 "d3dx10_37.dll" "D3DCompiler_37.dll", flags 0x4, ID 8943, number 1, extra bytes 20 in head, 58 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	821468
Entropy (8bit):	7.9989494569533655
Encrypted:	true
SSDEEP:	12288:k8Yjgk28yEYvDLX3XmZcLHo9yLvTJqnrT+LprnNjjjGM6pdKi814DYnciABrI55V:1Yjp/yEcfLI9y4rORNYdKibxBrIS6
MD5:	8234B9B90BCBB5077E1B5FAA0B66D1A9
SHA1:	E9207C572FDEC592B7C17A7F9C6F875C8A55B1F0
SHA-256:	6A2727269E6CAC7C4D2E316333D29BAC0DC1CD7F51C36C0C08B0388203DEDAD2
SHA-512:	74C94A6E092D7C828FC1E3FAEE4B21917AFC3CACEC04F260754190D0533F93A58289763AC620E5A577F7865902023B30548CDA4D9E968C90EE13050AD6D1E8C5
Malicious:	true
Preview:	MSCF.....e......D................"...........e...#..............:.............E8...d3dx10_37.dll...........e8....D3DCompiler_37.dll.f(..(.....e8K...d3dx10_37_x86.cat.I.........e8....d3dx10_37_x86.inf.i.........e8....d3dx10_37_x86_xp.inf.c...@.....e8....Mar2008_d3dx10_37_x86.inf...-..,..CK..\TU........[fz.,P..0}Q.a.L...T..`.f.;........i..io{n....ej.i.Yb........;w....r.....s...9.<g.%f.4.F.q...F."_zr.........6.4}..I.8.;o..9L..j.9.43..Z.....M`rl&..A.....n.b..Q.....;..).).MK{J...!...1..T'....:..&...,*O.k\.!}4.d.vH/5.0.....x-!.....{.c..@......Dm53SG.W..A..5..MK..P.?ZK64'd..%.4p......'..v.a-..3!...iYM...Jc.B.i..^.4.;.....b....:..i..'Ui{2.$m.t(w..w...Km..ZrM:..7g.p.w.m$..k..`..n..7JK.`...%..O..d..`....@2h.j.s.ZR.V....?..p-i.:../...@.X.&..:RK..y`"p.. ...a..\.@Y..l...<0.lB\|6.d...Ac..N..=`.(..@.._.....)...`(....\..\|....@.~i..-....z}.........]..'.........<0...d...A.h......e..@...6....,.....D0..A....A8...@K.a..6/.\.&t.$/.V.I.....f.".....t.$.....H..X.6....$

C:\Windows\msdownld.tmp\AS46DA6D.tmp\Jun2008_d3dx9_38_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1457918 bytes, 5 files, at 0x44 "d3dx9_38.dll" "d3dx9_38_x86.cat", flags 0x4, ID 7184, number 1, extra bytes 20 in head, 118 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1467086
Entropy (8bit):	7.999726422350297
Encrypted:	true
SSDEEP:	24576:HGIly6o6H1kEznWRpKpx5A0SBF/VnjmkC8nAMzh08qF4QH5/RSzsExkqv4Q9hHi0:Hh46Tn/UXVjmiJlO4sVRSzdk5uhCbOka
MD5:	E2FB2E37C342983493C776BD81943978
SHA1:	2A8F3C45CF979966D4D4D42A4D34F05C72C7E29E
SHA-256:	57E57A6348E55AAACA6BED5E27BBDD0A4BD0DDE69C77F4D26C805BE6384BE927
SHA-512:	2D297F607C5A098A3D2B19E7F88AA12F720AF3C23FE6DDCE7D4659A9184D1CF8F8A76F35B8ACB639B48CDAD8998C919215A03B89207E2BB1829EA3D8A9EFB95A
Malicious:	true
Preview:	MSCF.....>......D............................>...#..............v.....:........8wq..d3dx9_38.dll.<'....:....8.r..d3dx9_38_x86.cat.....D.:....8.r..d3dx9_38_x86.inf.,...O.:....8.r..d3dx9_38_x86_xp.inf.\...{.:....8.r..Jun2008_d3dx9_38_x86.inf. .,:..[.... .,......$Q.f...<....B..W...WWRT%.,..6mZ....k.!H}_.aAkk..C..............Z...1.5.!....S.-.Uy....# ...g....3...q.u.N..Nz.2Zq..D..+r."S9..ZT$.QD...UM..4......P....@...f.h...}..l7.{l.e7..#.b.$_...Q_...#......CC@)@......@......1...`....D.$m....wgg...B...n..E..{x,u.{.VK.;:.7.M$IO3v.u..v.p.%...N.X/.:Q..E...(/n..%Y...."..X.)}U.5...9F\.C>.....9..L.1.T.....4I.$R...5.L'.e.H.`.....H.._....9...XQS....r..>H.Gw..I.}.I...S.M.#Q....a[.....C.o...HR6\|..#....Ccu.^....=...f.N..LH.nMzk.k.....k..V..S..^.^,BdOQ.E..^.q..y.z.A{x..g8....i.....l.....f...a,..\xzC...r.@...C~....\.....!8..)....ZU ..%.e.xG..<.i.....yVH.AA......M.F....Ph..,.Uap.....9...-...v.V.... \|..*......X...6....P...,.K.O.Qe...).]`..C..............,..+.q.........w...

C:\Windows\msdownld.tmp\AS46DFFB.tmp\Jun2008_d3dx10_38_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 843959 bytes, 6 files, at 0x44 "d3dx10_38.dll" "D3DCompiler_38.dll", flags 0x4, ID 8962, number 1, extra bytes 20 in head, 61 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	853127
Entropy (8bit):	7.998980130768887
Encrypted:	true
SSDEEP:	24576:IKcIh4DqtGLRndZKm4zZTQb4BJ+gfG07QyGeZH:IKc64DgG9dIZTQb4L+GGIGeZH
MD5:	B0E2B612DAF28B145B197A4DB0A9B721
SHA1:	F69266E4AF3D2DE31A2A2E416F10B0F44737739A
SHA-256:	E8DC1063C9434EED8D633741B19CDFA1889581041E2214B87B5159E3EA087F3C
SHA-512:	6E31F18CB75CE69D291D0ABD15EDADF02C0693033351DFB2F435312A47540AA223C8176209725C14A05FA6494153A3E191B2FB7CB8C5CEE11FB42371CE67392B
Malicious:	true
Preview:	MSCF............D................#...............#..............=....$.........8wq..d3dx10_38.dll......$.....8wq..D3DCompiler_38.dll.f(..(......8.r..d3dx10_38_x86.cat.I..........8.r..d3dx10_38_x86.inf.i..........8.r..d3dx10_38_x86_xp.inf.c...@......8.r..Jun2008_d3dx10_38_x86.inf...E7%,..CK..\.....\./BS3...$.......p.&..x"........h....J.,5.,._.e....y..-y...#.......YXPP+..y.......y....o*.&..........\....i...YQcs..u.77K.8..h......h..]L...y6.bc..S.\.Y..]..aM.iyo.Xr..2....w...^V.Y.v)..s..w..;..z...........S..WY.b...!....q..W............y.~.x...P..!z.S.....2..{W.x.tJ.....Y....'o5"dE...(...\|o.U'.tpJ....8..4.j.vT.+TrVWy.`.P..{![...O.<.!...F...V.........C.k.E.h._..AM..+...E.jG.U.R.F:.].E...Xvw.?....'..,....................A-p...l.[.J....4.. .$.,...`2X.W.c..=Y.>........i.....A-p.?.....`.8..qp.`...A.....P_1.....? ]O....A?P.&........%..c. ..v...,h.=...AK0........k......d..... ....A{....... .\|o......&..\|......0........d.....[m......X...%C.D.2X.....'&.4..@o......98.~..c

C:\Windows\msdownld.tmp\AS46E4FC.tmp\Aug2008_d3dx9_39_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1458712 bytes, 5 files, at 0x44 "d3dx9_39.dll" "d3dx9_39_x86.cat", flags 0x4, ID 7173, number 1, extra bytes 20 in head, 118 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1467880
Entropy (8bit):	7.999682997096517
Encrypted:	true
SSDEEP:	24576:ztDuVYfr3zZ3dHi+rHI8lVs1WutNXBoY4RbifcKly/kNwSh1mMbS8X/9Wv8PiL:JDnr3zZ31lVsgENSsfcKaZAFF88+
MD5:	4379902C4180A9A6BF40B847372CEC5A
SHA1:	C7FC8184D5620154B9BFD6FBC8820A78C4EEE592
SHA-256:	61E703E8D231412F135B4ABA629122D9CB69AC9EE39FA3CBBE6B95DE05097A8B
SHA-512:	9269F49A5CA90143C50B817E9F5AEC0FC4C32BA1B6D3A21CC5448CAD21A16A902540C8CFC1825B124CE39E0BDC479ADE4354B6BE15B2067E3033E04998E0710A
Malicious:	true
Preview:	MSCF.....B......D............................B...#..............v.....:........8.X..d3dx9_39.dll.<'....:....8.2..d3dx9_39_x86.cat.....D.:....8.2..d3dx9_39_x86.inf.,...O.:....8.2..d3dx9_39_x86_xp.inf.\...{.:....8.2..Aug2008_d3dx9_39_x86.inf....$:..[.... .1......$Q.f...<....B..we..]w.QR..B.).V..i.k..Z........=......d.. .....2..cLfl..A..w4[..VBs.{...^...S..a..]Z...%vh...9..Ro...K..r.}..ZP......".i..5P..."..............."......I.c.on..F...&..K @T.=...C..a ..!..q...Pb.=........hY.b..i`AY..<xwqvlx,t......Yg..R....g1fG..i..4.o.......S_...V..N.K.N..qQ.....Etr.1...E..:..\|..../e..<...9.s.....%.RT. .M!.$(2b[X.NT.B...HT.?.!.<\|4~.?........Si.Xe...l}....J.J\|LN...R.o..@W!.y.8..t'....%A.!I..U.A>..~..........u....2SR.[...9Te.?..U....y*.M.yxnx...z.J..V...(.....X.\|...f.h.....?.LGt..UT...o.7.0..h[.P..`...`../$LED..'.E. \|.A-.w...6.+.\;.h...H...........8...A...0.n....9- p..M. r.V.!...W...r.Y......BO.d...{4.. ....U..A ).....9f.e............`P..w[.......$..o.L1.~.R.M@\AC....W.%..

C:\Windows\msdownld.tmp\AS46EA4C.tmp\Aug2008_d3dx10_39_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 843207 bytes, 6 files, at 0x44 "d3dx10_39.dll" "D3DCompiler_39.dll", flags 0x4, ID 8952, number 1, extra bytes 20 in head, 61 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	852375
Entropy (8bit):	7.998886184584254
Encrypted:	true
SSDEEP:	24576:E6Ih4DqlkwAjhr1mB+uYgrCvCZNmJ9ndKo4XYbX:E664DQkwAj/oNCvCZIdN4ID
MD5:	5380053AC4C344BD38604022476B1C1D
SHA1:	043DC8F49BCA3BF0BD85E858F5C2EEDF68565C0D
SHA-256:	84800C55F773D5D6913E344E41BABA58CF07CEC2E6C7114CA3BF48E8F355419F
SHA-512:	F3CE2DEF6E2E8A1D2C07F627E3C437A1BBA0B2E456020A84121346472BE3D28E0FC69623BD408F35A2C639C83DD2787F998DEDFE42B7625DC71500824B035FEC
Malicious:	true
Preview:	MSCF............D................"...............#..............=....$.........8 X..d3dx10_39.dll......$.....8.X..D3DCompiler_39.dll.f(..(......8.2..d3dx10_39_x86.cat.I..........8.2..d3dx10_39_x86.inf.i..........8.2..d3dx10_39_x86_xp.inf.c...@......8.2..Aug2008_d3dx10_39_x86.inf.,"..%,..CK..\.....\./.R3...$...Hef.K0..D<....V..uvA4.J.yTx..YjvY..<.2.133.J.[...O.g.Q.J..gf.....r^.}..s~g..3...F..!...eB>$.e .~..Z.j@V....C]..-..-N.!.Dc.c2.lv..!0b......$&.n.....yH..cz./...\|...w.;y../+.......l.\|~...?...{..-<Us.(n..M.U...(Bz.I.WCc.q.I..uuu....2O.K}.~_x...P..B.D.P.].C-e..O..x.tJ.....Y....'o5%dE...+..../..".tp...Ap..i^.$.0W.....!...b../.W..y.B.....#.m.k}O.k..z...N........W.3.......S.F..].E..j,.;.xe..I`6p.V..._O..K`.H.C....f.....'..3@?@O..`...@&p..P...W..>HO.....,..CA........0...m.....D....0.....x.S...l.....'....`.....%....{....1y.t...Qp.t..{..A.0c.......k.....@!x......RA/.....@c......}...n.......`.x.L.cA...A ...P..S....2}{%".,....d8..^.K..p.xGE...+..\`:X.>.G.o.Y

C:\Windows\msdownld.tmp\AS46EF7C.tmp\Nov2008_d3dx9_40_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1544836 bytes, 5 files, at 0x44 "d3dx9_40.dll" "d3dx9_40_x86.cat", flags 0x4, ID 7155, number 1, extra bytes 20 in head, 134 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1554004
Entropy (8bit):	7.999645278979612
Encrypted:	true
SSDEEP:	24576:K3tdQkdeoPJLiej+pb7Q15LwQrpLeWvYMWbPBmcnILz+0Byna:2dvdeAweSBQPLwgpCWvYMQ5mcnIH+m
MD5:	75556D89FDD442967A23993C9111D997
SHA1:	003DE53653C0CC84F8C3D617D1F76FB475F1A7CB
SHA-256:	863AC3438F57158D4F53900C6924BFDC132AB43A5AF57D4658E65842836B4FA1
SHA-512:	6086114500DBBF4DB9D0A9C3F72732995BB9A3AB5C135EAD53143749B95651B37B64BE7A52CA09388DE90216FD00486FDFCFBC87D42D77FAC469F82B5290E06D
Malicious:	true
Preview:	MSCF............D................................#..................P.B.......O9.2..d3dx9_40.dll.....P.B...O9n:..d3dx9_40_x86.cat.......B...O9h8..d3dx9_40_x86.inf.,.....B...O9h8..d3dx9_40_x86_xp.inf.\.....B...O9h8..Nov2008_d3dx9_40_x86.inf..=.:.:..[.... .2......$Q.f...<....!Z.J.+...ea..U.q....ha.x.y...........=.h!............X.{.<,.....?..b.):.[J{....^=mv:.i.e..}9s............F.QN.^+.).p...!9.4L..B.k ....F.}..R.. ..D%P4@...'2.$C..EU..:_... ..=.....2...Q...H\|..2.hi....H3..%JA.O...s.n-..<.<..9;7p.wnxw,\|\|.....du.......)..$3CN.'.)j..\|...x.w..>..4.D..."..I.'.=.....$.7..m...J..F....0..F.XD..v....."*\|2...A.H.R..b.()! .\|..Hh`....Q.K...NH..9../^...\|[!.)k...8._C/~D.W..K4.}.B.T.b.Kw..si..6.E.#6w......_.,.>6{r$X&:....s.w......k....h'5......3...0XOG.^.=..j....sFg.jO. t..?.S.l5?.t...s....`...]......'$LJ.........Z]h.. ..h.l.5b....F..0......m.....P.....n....Z.... <..7.@...,`@..#.i.r....... ......@....\|....e/.pa...@Q.A..'.EL..7H..?^..C.........]i p..N7....:i.P.........

C:\Windows\msdownld.tmp\AS46F4FA.tmp\Nov2008_d3dx10_40_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 959461 bytes, 6 files, at 0x44 "d3dx10_40.dll" "D3DCompiler_40.dll", flags 0x4, ID 8926, number 1, extra bytes 20 in head, 77 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	968629
Entropy (8bit):	7.999011847061652
Encrypted:	true
SSDEEP:	24576:JKTxCzc8gSDnU8Hz10a0s65QckarHGlImJtXn+QbtU0sHsqzn:mxCzs29r0WQma69nBbtU0sjzn
MD5:	5DFEB46E60795266DA03F2D0A67E7ACD
SHA1:	A77758873E5544E8AD22ACF469C4A0FD0C944A88
SHA-256:	EC52B075A3E9C7FE468B317E0FF977964B1003D560065128741F4392BF47C49A
SHA-512:	6EC058811AC017BE3CD3A46559CD73126666F41B0FA58D92C1168CF2A2E0E2357B19F65531C786EC81A438975DBECE440C5E7B6C653AFA5428CE6C444179AF6C
Malicious:	true
Preview:	MSCF...........D................"..............#..............M...X.........O9.2..d3dx10_40.dll.`...X.....O9.2..D3DCompiler_40.dll.......%...O9p:..d3dx10_40_x86.cat.I...g.&...O9h8..d3dx10_40_x86.inf.i.....&...O9h8..d3dx10_40_x86_xp.inf.c.... &...O9h8..Nov2008_d3dx10_40_x86.inf....X.0..CK..T...{..J........D...$.....$.2.....&L+...u..Q.5#f...W].9cN...w..Qd...y.......9~.}..]u+tOMM...r.].a.O..f7#.\........m.l._a.[..,4Q.&KU...c.eq1)).,V!S...)2...Y.^a.Q..b........y_x.W..Q^J^.j..P..gB...<w....E_).$j..q.\|y..{.'....1V-..N.bt..%...A.0K....u...O...K.u.F.H(u>.X.vbd.......)..Ltg)c.a..J..\|.V).N.F`G.Lxk..Rf.-.<1b...0..y...y!.g..F1Z.v..T..o......i.............!Jku.:..i...e.....Z.HR.0...6.....zk1..._.-.L....a).Gx.).........@6...........P.\....?`.....f...\|.r......L9......S.T ........o:J.'.E`?..x..?...$........z.......,.<.'..D.j .....G...3...G;.......p...&@W...;....^........R .X.....L ............-...........'.r`7........)........=......r..j,e..j.)..........uX)..p.B...

C:\Windows\msdownld.tmp\AS46FA1A.tmp\Mar2009_d3dx9_41_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1606486 bytes, 5 files, at 0x44 "d3dx9_41.dll" "d3dx9_41_x86.cat", flags 0x4, ID 7142, number 1, extra bytes 20 in head, 128 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1615654
Entropy (8bit):	7.999772423092358
Encrypted:	true
SSDEEP:	24576:xFtN95ew18Yl4WTrZnZSibmmq18Whxp9pWISiIz9cXwowwenm2AB4qDA2mV7Q:newRFZ8ib6T3p9pW9/Z4bM/XkA+
MD5:	901567428D8C82756D7BF5A406441BD7
SHA1:	6E3C22147F3DA77AC8F20D615CA32B5EF2A0ED28
SHA-256:	32356344AEDDF709C9D5302D8F3FCC1FF1BE2E82D8D17833A2086400AF248794
SHA-512:	6FD4C429E32480BDFF4E58BA8BC0D28FE97C9FF5EF1FABBB856230EFA669246A354F99B723E7483D548B74C121AC8BA9CBA2B5BC3C18F35EE828302D392CF6ED
Malicious:	true
Preview:	MSCF....V.......D...........................V....#..................X.?.......i:k{..d3dx9_41.dll.....X.?...p:.r..d3dx9_41_x86.cat.......?...p:.r..d3dx9_41_x86.inf.,.....?...p:.r..d3dx9_41_x86_xp.inf.\.....?...p:.r..Mar2009_d3dx9_41_x86.inf.x..#.9..[.... .3......$Q.f...<...!..vW]....]eJ.Uaq....a.Zk....}_..=hk..C.=...."......?1<..izt.`Y.._ .....H.`...uI35.:.,L.....I.;...........&...B......I....!@.A...A....a......................#..&.E....J..%. ......!..Q0..P.F......$.!...q..yXf..d....7,v......Y.....Q......EI.&..Rm....d.I....D........WJ...`.u..WK..K........yQo...2...W.U\.C.m...a.k.kpq.U..C.5.Hh).......<R.s.l.+.......);........%.g.g.....i..I.U.).H......l./._...<.C....a....U8.'.,.0GR....=.5....E.......jln..MKiliw..Q......,.2{..k...\.X$.......Q4..??...ns...?....t.\|.8U..>WJ./.>S..Vp.....0...3 ....'!....,R........Ph..#.t.7=.?p....D.....hX..H....J.`...Z.......$7t.......a...\|S....(..G. ...V+`...,.X.P..lZ`...X>Bt....E*aM..(`..0......BA3..p.%..OE.c``.BU....).P5

C:\Windows\msdownld.tmp\AS46FFB8.tmp\Mar2009_d3dx10_41_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 1034785 bytes, 6 files, at 0x44 "d3dx10_41.dll" "D3DCompiler_41.dll", flags 0x4, ID 8914, number 1, extra bytes 20 in head, 71 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1043953
Entropy (8bit):	7.998757160305283
Encrypted:	true
SSDEEP:	24576:JAEjuCeK6JgAkPBJoBgsqDP8FbGACV0L/sW0G+vv2:JFuCeVJqyxqDUFb9CV8r
MD5:	45E83CBA5710A1DE7D3990A288122E85
SHA1:	23C4BFBDDCFB11ACB7C47C409825F039AF7EB908
SHA-256:	B7DA29103CDF374DE0C09713CB985035EAC45FB8B394D3B8157D8A7562A89899
SHA-512:	8C56D376D349AA00948E1F3C6168DADE76AC9A26ADE1AAC5A385DCF0253602F5A2973483D083425195DB6AD7717494FD3CF674F5549774AC608CEFA2A88BF0A7
Malicious:	true
Preview:	MSCF....!.......D................"..........!....#..............G...P.........i:k{..d3dx10_41.dll.h-..P.....i:k{..D3DCompiler_41.dll.......#...p:.r..d3dx10_41_x86.cat.I...a4#...p:.r..d3dx10_41_x86.inf.i....7#...p:.r..d3dx10_41_x86_xp.inf.c....:#...p:.r..Mar2009_d3dx10_41_x86.inf.Nn.>.0..CK.wT.I..{.G.C.QQ.#(I.T`..Q.........0.b..5`Xs..bD.@..f1.9..x....Yw..{...s..U...[.kjj.....h3...TV2.nFx92?~=....m.l.[n.[..(81)]..R&..Sd...J.,F!Se..Re..A..e..~}..b.e[.fd.np.+..[......R;.z.....v....N.~...ibx.h.S.....W...7..-.a.8...`...$u..A.0K....j1..g..A.^k1...Pj.]bm.ym..~t...+d..`..LG}..X...#.J.....;'e.Z.-.2..m.0....[W..#......j.05.Z.R.!..:.jd..e.........O..7:...\....k..bY...s4W).. ..%.......:g............p..Z...... ..<5.2..].... ..X.,..!~.0...v..k.c.1.2..V.10.L.#.R.x.=.S.9.....27.S@.....d. .p.l.d......}.\...;.e./.0 ...&.~...8.\...:.L;.'....R..."`;p.....>...........BhW6.I&..D.!.3`...M...>u.....S.A......E@...0.P..@8....v.9....X@..."e....'..`c...(...^..R.'p...4....{ ...f...2....h

C:\Windows\msdownld.tmp\AS4704F8.tmp\Aug2009_d3dx9_42_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 722496 bytes, 5 files, at 0x44 "d3dx9_42.dll" "d3dx9_42_x86.cat", flags 0x4, ID 7080, number 1, extra bytes 20 in head, 59 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	731664
Entropy (8bit):	7.999475174279291
Encrypted:	true
SSDEEP:	12288:IDTg2rIyRKFAtmsFp1UChyax+LFl9NiHEpMH5Vfe8PIqEqnyA6F56J2:M02fKYVFvhKLFl9NikiH5V28PXyA6GJ2
MD5:	9BC8213933598D050827D20A4573486C
SHA1:	E6F9BA62756A00C53746419DEA221881AEB336CF
SHA-256:	9C96B6FC4DF5C0EFCA9F0D653976772B2B964243214F99066E4CA4AA6DF791DD
SHA-512:	A1920D042963CDDA41DF44044DE5B94B4CEE6EFA102F633214E384918D93D2D6A31EB388BDBD00C7E9C199281E3B71CAA5242E9A42E7F0BE27EDF90A3CF6890C
Malicious:	true
Preview:	MSCF....@.......D...........................@....#..............;...X.........$;....d3dx9_42.dll.....X.....$;...d3dx9_42_x86.cat...........$;...d3dx9_42_x86.inf.,.........$;...d3dx9_42_x86_xp.inf.\.........$;...AUG2009_d3dx9_42_x86.inf.....::..[.... .......5!.P..wO.n..pOc....7...l.c.n..slmk]....]...B..W..D..UJ...P........C.......l8..y^.S.N.I..7%.....].n...d...>.#....zT{6+..X.UB. AA......u7{0...n. ....d..R....=...D...F.......n..n..~U.]..U.EX, .......A^;...(...<.@#0/..O.!...i.#.C....D...D.cwC.v.y.<+.....g.l....f.k...W...[..I&...M..W.&Z..^..MB...:.LyQv.l.U.=Y..%....8Ls.......-..".U.....s.f.YVvX...-..8T..m...=..9.CN!89....f.2.G.....:s.G...>.......c^.Z..=h.l..Q..w..yc.\i.Z.^...$cw.T.".d`.jhL;.ZqB.L.{...Z....h{=s.....a.4.1../..`....\|;I...;...$.m!l'.g..pa.).b0..:.tT...T..{..<..T.....z.....!....,..\|.@.../..A.....q.......@.....................\|..5...[..p.6....FE.../.609$.....+.Q.f.N3.....L; ..6./.j.4.a.E2....(G0,...x..5...IBS.._......9.....%0.....

C:\Windows\msdownld.tmp\AS4709F9.tmp\Aug2009_d3dx10_42_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 186171 bytes, 5 files, at 0x44 "d3dx10_42.dll" "d3dx10_42_x86.cat", flags 0x4, ID 7280, number 1, extra bytes 20 in head, 15 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	195339
Entropy (8bit):	7.996178589789764
Encrypted:	true
SSDEEP:	3072:/hxMUzbnbaWbX0JkFvs5aQnkW6sJ/Fw395/lfLxBQLgGlekmQI84HAGujR7j:5CEbiqvs5aQnkW6A/8jlzxBw0/Erd1X
MD5:	F264AF5A36B889B4F17EB4D4F9680B4F
SHA1:	1DF087EA99D321EC96D0D2F1C66BEE94883D6F08
SHA-256:	BB46189EB8CB7769EB7BE00CFBC35902072FA9408313EF53F423E5AE5C728F61
SHA-512:	73AE1CF3CAFBA148F4E5B4D8AC12A7AA41F6ECAC86C139C6A7714F90F3DC61C444DC152A3AD3C2CA800C1A1F4955A2B508735F8490666B57D1420FB7A7BFC269
Malicious:	true
Preview:	MSCF....;.......D...............p...........;....#..................P.........$;....d3dx10_42.dll.....P.....$;...d3dx10_42_x86.cat...........$;...d3dx10_42_x86.inf.(.........$;...d3dx10_42_x86_xp.inf.c.........$;...AUG2009_d3dx10_42_x86.inf.\|..f.0..CK..T.I....8....e0.JVT`..Q......A..a@..i.k..........b.bN......fE.]...y...s._W..~.......9.6.0:../....^.._..F{.3......7.NHL.....T......Z.....Sd.)2W. Y.2Na....^.lk....+......V.J...j.W.vI.Xj.V....Y..^$....&.&....9..azKt..6....2..e..).,..6...0,......Z.a...R...k........(..V.E.....2..C....p>r..Y.].sR&....)....i.0.....W..#(.....j.p5.ZvR.!..:.jd..e............7:(..\....kZ..b^...s4W).. L.%......:g......./..5.......eW).....t.2..].... ..X.,.. ~80...v..k.#.1.2.....0..PF.....z.]......\.\.N.E.J`6....p.....@_..;...p.8........x.....y.6.(p.x..XJ..@O........E.v.0p...m4.8.,.6.%...P.lh.. ...B.g..0.....>v.....S.A......E@...0.P..@8....v.9..h....xc*e....'..`..._...........M.lg..P..-.!......L...@$0.........j5..m.{ .H.f.[...C@

C:\Windows\msdownld.tmp\AS470DC2.tmp\Aug2009_d3dx11_42_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 99084 bytes, 5 files, at 0x44 "d3dx11_42.dll" "d3dx11_42_x86.cat", flags 0x4, ID 7285, number 1, extra bytes 20 in head, 8 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	108252
Entropy (8bit):	7.991332626956763
Encrypted:	true
SSDEEP:	1536:MI9cI4N24813fwIsfQqzjoroJ1OL79D+0sFGmNjFRchFxLvk5yswFa8D+0qlt6s1:Pah8Vo/1uLJoGmZEFxLvcwM8DZcZxb
MD5:	DD47F1E6DC19405F467DD41924267AD0
SHA1:	85636EE0C4AF61C44D0B4634D8A25476CF203AE9
SHA-256:	39FF69BA9161D376C035D31023D2FDEECB9148A2439ABE3AFD8F608F7E05E09B
SHA-512:	F77C4CEF5CB7E927948F75C23A190E73D6C75B4F55915859046533A10AA3C5ABAC77D8BEF71A79368C499C85009213E542094B85B94B69E62AA66B60616777C3
Malicious:	true
Preview:	MSCF............D...............u................#..................P.........$;....d3dx11_42.dll.....P.....$;...d3dx11_42_x86.cat..........$;...d3dx11_42_x86.inf.(........$;...d3dx11_42_x86_xp.inf.c.........$;...AUG2009_d3dx11_42_x86.inf.ix..@ ..CK.[.X.G.....<..: .QQ.9...S@..A.......p..D._M<.A7&F.q.f]c..xD..Wc.....F7..H..b.._.]=T.tbo.......\|O}..[U_.U]o.L......(%..V..Nq.(.....=v........R..3.K.......2c....Zm,..+k.%.....2k.e........s3Xx...C....~..P.X..o..~..[....../A.?...\Rl.QRX.g.sz<E....g..s..[/s.(5..T..>/.(.9F&;.c\|..).k....6y.7+P..d...U.J.H7(.x.E.B}.1`..Z. .C....lTP...C7....._^h7F..t....T[.V.r.J.....&?F...Pd.6#..H\|....).<.....U...g...5..5..RjE.=.sc:...x1..[..w..p...8."..Y8.....AV...E".A..p...%d."..5d.!..l4..d}..#.A...#;.l.....!.....Xd...!3"...G...d_"...^do![.l..i.& ..,...d}.9#S.....IA.C......E.6..![...dS..#+@6..@.....m..:......v!{..Zd. [.l&..-.....9..C9...}.x..Y9=.F...k.Z^.^...!{...........R...d.._...~2z_O.mXG.._...XkYEI.....^iA.p.....=...wa;...N.6.2

C:\Windows\msdownld.tmp\AS47116B.tmp\Aug2009_d3dcsx_42_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 3313780 bytes, 5 files, at 0x44 "d3dcsx_42.dll" "d3dcsx_42_x86.cat", flags 0x4, ID 7865, number 1, extra bytes 20 in head, 169 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	3322948
Entropy (8bit):	7.9992960947448655
Encrypted:	true
SSDEEP:	98304:hd4ZyuDJf9oMm+hWh3ZHD8VZQCbsY/ny66RHX:BuD8b2WUZQCg+ny/
MD5:	73BA11CE0E936726FC9FCB882F8B91EA
SHA1:	4A4BABE3AC751E60AE6B5B0D69C93FA53D7FCD21
SHA-256:	A9A704B73531D6BF59A421AB5C046C19A16D2B0B07F09816DBE9DA4550A24B17
SHA-512:	9A198EB93D5623651D2981A277EAB4C345C08161254D0127D90C97344450AC1A7FD5C8AC840048A43A347E3296B286B646EA0FBA88F0C7BCE1CEED1484112D56
Malicious:	true
Preview:	MSCF....t.2.....D...........................t.2..#..................`.S.......$;....d3dcsx_42.dll.....`.S...$;...d3dcsx_42_x86.cat.......T...$;...d3dcsx_42_x86.inf.(.....T...$;...d3dcsx_42_x86_xp.inf.c.....T...$;...AUG2009_d3dcsx_42_x86.inf.?b5B.]..CK.w\T..7.Mnb.QA..E..Q .B...AD..X.q.JS.H..&&.....HS... .a.n.((..J/....!R.a.y..g0......<....9.}.^{.....do3.sb........PL....V......_.\|)V..w.a.d.>.#~k.......Z.t.......e.o...#.k.,..x.8.(/\.......5.4....?.Z.B;.9;t/....@..^&..C...m.........f.....#N..._e.c(&f....].-\|.....>X..?>..S.#&..!..v.BLl1*b.^.&....},..r\|4...}Dy...@....\,.^..R....#v....Gl..j%v..w.k...^.....(...........l..m..,............k..J ..?.o.FL.{e........Cj.{..=.-&.oe_?_'8's....~..k.o.}]<}.a.^jnb.....j...........U..3p.....]pl.C..)8.....#V.G..Yp\.#....0.C..q8...#6.G+..p..:...)....#..G8...H.#..z8..x..8._.;Rp......8.....A8hp..#..Sp\.#..Ox....8..0.c3.RpLk.<.x..-8R.#....q..x..~.?}]Jz.bU8L...........j..z.K...6.{Cl..6.sVsV.Z.....sGUrE;..'..a.#>.._Q.U}....sb.\....}-A.

C:\Windows\msdownld.tmp\AS4718CE.tmp\Aug2009_D3DCompiler_42_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 894638 bytes, 5 files, at 0x44 "D3DCompiler_42.dll" "D3DCompiler_42_x86.cat", flags 0x4, ID 10010, number 1, extra bytes 20 in head, 61 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	903806
Entropy (8bit):	7.998441664012848
Encrypted:	true
SSDEEP:	24576:kWl8lkb28nNHiYNk9tb59zmj000KFiBudeBsbgy:No8NHi7/pAJioEy
MD5:	87BDAE64FD47A75F867A290EC7B8A4B7
SHA1:	DD9E69E1815E8BC161E8EB89A0F2A296074BB95D
SHA-256:	6BD32337826F5A5141FC06391919A249E984150905C2546DC8BFC33D41A24E82
SHA-512:	C8F7A490722741DF4E03823880C6D623FF16AB648A40C1B1C8F7BF26C92499EB34C4596BF239337CD23A57974757958AD9A30D42A4141DC0E7522F998ED3893A
Malicious:	true
Preview:	MSCF............D................'...............#..............=...X!........$;....D3DCompiler_42.dll.....X!....$;...D3DCompiler_42_x86.cat.!....;....$;...D3DCompiler_42_x86.inf.<....>....$;...D3DCompiler_42_x86_xp.inf.....4A....$;...AUG2009_D3DCompiler_42_x86.inf. ..$..CK.Zyx...?..P....%i..@.mh...,e.Y...5...&.!K).Pe.........;..zq.j... ./..s./dR...=.}.....y.o....93I;.+X.c,.....-Ln..o.)z.<.m..F..e...s.\|a....!w@...A=..jj(.T}A.j.j@.j..=...c...=...m.....m...m...6.h.o...[....m.h.k+...s<./F.R.'.<..7Vs...f.......]..M...O6.NVD....o.{v...-.ub..........5..q."....V6..m..B._l..w...mI....j.S...mdlG.c..0.*U.p.. ..?.;"ZS..}?b\\|...=.<...q...Wb.s..9..:.VG(......ExM.w.Mp.4.N..g...Vjg..7./\nG....Wyn..l.."..;..6...v....S....b1.Y...^..Sk..P....vRl.x..!.u..)Z(B.u.gQL.(...R0..../)>.x...<..d.3(..h.h.XE...."......}T.....(.S<O.(....(n......\|......b&.....E.y....),.m{ml7.7..S.G.....[(.S..XE.L..Hc.L...6.w(vR\|C...."......y.........M....o..-.....[.h.b....V4.I9...D.As..]h....).]

C:\Windows\msdownld.tmp\AS471DDF.tmp\Jun2010_d3dx9_43_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 762076 bytes, 5 files, at 0x44 "d3dx9_43.dll" "d3dx9_43_x86.cat", flags 0x4, ID 7093, number 1, extra bytes 20 in head, 62 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	771244
Entropy (8bit):	7.999380380890997
Encrypted:	true
SSDEEP:	12288:E0b5pTUIVIRxV+yb+HJFnXQRGr85UpzQ3VztxmHN8DMFy0BJ1lSIug3SqHAlzJYf:l51NVO+XVLs3VztQHmYjBJb931I1NYI0
MD5:	BF124B64FC3774F61D30DE0A405F0C6C
SHA1:	2F8A8BABFA4E51555FCF125E8373D9C5F7F7434A
SHA-256:	457C5CE48EAA0FE551B46DFFC1E4DCA985D261686D8D4E6BCED533EE1F682FCE
SHA-512:	935922CE74BD399E8358693562F86C9B4B6308A6E33586A5DD61924F8B6B2CFD6CB2E472FD082B9EA32C0ABB9A799A0BA9103B4C316342F8072A7A3782C2116C
Malicious:	true
Preview:	MSCF...........D...............................#..............>...X}.........<!]..d3dx9_43.dll.....X}.....<C'..d3dx9_43_x86.cat...........<.&..d3dx9_43_x86.inf.,.........<.&..d3dx9_43_x86_xp.inf.\..........<.&..JUN2010_d3dx9_43_x86.inf.[.'.":..[.... .......5!.P..wOnf..O..........9vm..o..f.6.....+I).H]..t.....T...v.!..M.......>>.{..._..t....g...:..jh.N....K...vJ.r.. ....;J.zq.........H....'....d.=...{O.4.xIBC..L7..2....... ..E5`5`........<s...9..(.b3. .."t....M\.;...0.........H....K.5$...L.Ha....%..e..V........{.t....#3kk.sR6.....I.u.Em....b.Dl'.E.[.D.N....m53%...'.m;.>..yf.6..pN..N.y...-.5Y...f.......-.B#.......;.D]......G.8.5...G.......x..}...!.GwT.......WwKuT...Y.l[f..}ji...{.h{...x.u.....>..1....k..v.D."W..ZA..<...7=c2QN.Y.......v..k&aHudg.W...`HbV{.Q..CJk..nLpw..#.&5.%S...G.&.`....]...EpFY...(....P\..+/`..&..ap....S....BR..'....s..c........p..B..j....c..D....mU.x....N.r..QfEz`...}.._...........8..$..........!.G...i.@..P...."c..d.L00...QX.B0.

C:\Windows\msdownld.tmp\AS47231E.tmp\Jun2010_d3dx10_43_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 191323 bytes, 5 files, at 0x44 "d3dx10_43.dll" "d3dx10_43_x86.cat", flags 0x4, ID 7293, number 1, extra bytes 20 in head, 15 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	200491
Entropy (8bit):	7.9966634458730566
Encrypted:	true
SSDEEP:	3072:kD2Fju8h1xkWCD/5e8U2LK1aQAMxVz2aoOxoY4+ApyP0EwMGvFas+8QJgdBvCD7D:kwbCleyYagxVCaoV+ApcnG9aKQJaw/
MD5:	591A61BD06C73C70F93DAC5AF2D8E924
SHA1:	C9D36AC5E2ACAC31A7413D22ED1C09C71CC96FFB
SHA-256:	F0BC06CEB484D97CF01526F9223DF7B4357D166C4391869F2E7D514DC1FE769B
SHA-512:	3E2E3318A700A6ED82A21018403CA99728C8A56B7DF81F99A5D705B586CEE1141586DBF19A01EF1F1A72DDC8F45DDB51BA5769AE4634B02233EF1AC4E0FBA5D4
Malicious:	true
Preview:	MSCF....[.......D...............}...........[....#..................`/.........<!]..d3dx10_43.dll.....`/.....<B'..d3dx10_43_x86.cat......I.....<.&..d3dx10_43_x86.inf.(....L.....<.&..d3dx10_43_x86_xp.inf.c....O.....<.&..JUN2010_d3dx10_43_x86.inf..=.h`1..CK..T.I....8....ePQP....SENJ..1 q....a@EE.a]E.5....F.t...s.v.iM._W7+..:..........oW.NMM....e...1.+.f.#..2.....7.S..V..\|..O.yX.2]..Q'jbReq1.Z+.U.4..R%........6....<./...gU.g.)...u.y....dj.....UJ'j....[/.../E....e\.._...^..Gb..}....37..2L..a..q...../.\|...z.#e$.ZU7...vnkmh?W....-..L^...h.0.....>.Y._....f.......vpO#.1..6_U.o.......h.#.`.d....j.F.0.6.1..>.H...`'J..A.%6.tM.\.:<.......F...!.K......?t.:...../...2..=...2....&e^...I.M`........H."........@&0.X...%.1..p.h3L(..V....K...5....X........x.]..@}.F.8.......%.T`.....=...!...x`40...v.g...k..6...@. .......wh.@ .......F..+..#`.....p_-e*.3...^`+....&..@.......o....:.... ....c.&p.8.....6.K..@......e~....H.w..R..........`.0.X....G..`)k.8...-0.....n.....R......f..

C:\Windows\msdownld.tmp\AS4726E7.tmp\Jun2010_d3dx11_43_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 103485 bytes, 5 files, at 0x44 "d3dx11_43.dll" "d3dx11_43_x86.cat", flags 0x4, ID 7298, number 1, extra bytes 20 in head, 8 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	112653
Entropy (8bit):	7.991810619702373
Encrypted:	true
SSDEEP:	3072:tXMVzDTlrM28bEHSqgik2ono4DQQ/7cuBFbb9aD4:tXMxNjG4gikye5FBtBr
MD5:	061BBA3836B3FFCBB01B150467BBE951
SHA1:	00D8FBCD4068B3199D3D393BB4B86BF82985480D
SHA-256:	B80DB68CD82CAF8BEDAEE62808171B20C546A76499C3AD53014E3BD2FBD2918D
SHA-512:	AEC8327E1CCC0B33B3E32D66A5EE25C4B70A227B708D10F61EBAD2D998F3BE68145FA85C50BAA16A21EE766B336B1432FBEC02C75D698793092015C832B6FC26
Malicious:	true
Preview:	MSCF....=.......D...........................=....#..................`..........<!]..d3dx11_43.dll.....`......<B'..d3dx11_43_x86.cat............<.&..d3dx11_43_x86.inf.(..........<.&..d3dx11_43_x86_xp.inf.c..........<.&..JUN2010_d3dx11_43_x86.inf.kK.. ..CK.\|.\.U........:(.....;.........\.".+...K......a....f.eZVZf../M.2M1M35.bj..%~gf.,gv.........~>..<..{.y.93.{fv.c..(%EQd......?...?...z.i.^u=.g.b..>.%......s...\Qa..'[.U5....c\|Z...Zl.....m....\u....s....\|.....2...s...rE^ Wn..J..j\|.$...2....mO.ul.E.V..c.7R...E..+t...2p....@>.V`..<.).Rp.._UrI{h.../Z..0\|...sQJACQ..J.....F%..W.T......E.{P.....1..A..U.6...2.J..\|^a\|.....Zl....\|.>.tT.P.x..=C.......V..b'^..K....}.s...op.....?..'=...2T>.l).....l.2Od?E.S.....V .GV.l<.Q. .Bv.]7......d...MB..,..72Od..WR...D.6.M.V!{...d%..B...@.L..j..:..(.=.G....b..BV.l...d....B........p%u....F.....l.!.G..l.2.,.. d...\|..Qm.v....G..L...).C..c.#.Ih...................ee.......VPL....8X...H1.=A1...q....2.E!.l..M.E..jTw.z.y..*d....m...Y.

C:\Windows\msdownld.tmp\AS472A52.tmp\Jun2010_d3dcsx_43_x86.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
File Type:	Microsoft Cabinet archive data, many, 756228 bytes, 5 files, at 0x44 "d3dcsx_43.dll" "d3dcsx_43_x86.cat", flags 0x4, ID 7878, number 1, extra bytes 20 in head, 58 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	763804
Entropy (8bit):	7.996955192623658
Encrypted:	true
SSDEEP:	12288:C8Dx0/99rEneJVyrxcsaWmeUEEBTJNCK/FcZZXlewc3/2tqCyrIUl3z82ItDwh2y:XDO19AVrRfEHNZWZrs3+ICyco3MDIST8
MD5:	2D33BBEB3543776FAB1F4DC8C63E0260
SHA1:	93C401E98FD4B15F120939BD679A957BBFEDBBA1
SHA-256:	38F2CF85CA70E8D45B8DC593A28D983F422D402C648BE66E95E483FB9FD0E3BA
SHA-512:	FBE461706D0DE5685E4F619A24696D3A533DAF6A5486EB0ADF4CA5DDC4FD688C418FD13581FDB94ACFFA60EC6FD0A659E7694F60469A0952BA07C7321AA6D504
Malicious:	true
Preview:	MSCF............D................................#..............:...`..........<!]..d3dcsx_43.dll.....`......<B'..d3dcsx_43_x86.cat...........<.&..d3dcsx_43_x86.inf.(..........<.&..d3dcsx_43_x86_xp.inf.c..........<.&..JUN2010_d3dcsx_43_x86.inf.UR.....CK.{t.e.....6.I.Zp....a/.v.U#.Hi.%..V.f......&[(. .R..l.Tm4VA..."..-JA.Z.@....J.....x.....$.\|..y\|....fv7..._..wf.-.N.QJ..z.......Q.....<aG....=5.K...,......^.....]]....`..`GWp.9........S..c...>9kG.P.M...\......^O..[:.7.5..s.....\|.........#.\|.....TS.Xu0.....W.5.J...G....{.....8.E...J.:B..l...9...........E..Q..'8j.....u.a.V.T.$Y.....O.V..?.HW.._..........rMiA..g.;r....M'.Iy>9Z...!Y.sF.'......<.}..<......X....o;5..T.,..g.3\|.....\....QOK.#5 .Vj....3."R'J...z.Q......n..R}R.K.J.:Ej...uHj..CR;.6K...>...QWK.Im..U.A.g...'.N..J.,..j.:Kj.....R.H]..Nj.TV~6#.Tj.T.T...R.R..;j...R.H.H....\|.5..'.d...z.kU.eR....z..d.......PO.6..J....ZT...t8T..d...D8.ji2.Lf$..lGw....7^s............k.j.q/...\.f..}ek'....

Chrome Cache Entry: 382

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1505)
Category:	downloaded
Size (bytes):	121630
Entropy (8bit):	5.496341822184716
Encrypted:	false
SSDEEP:	3072:Blqyv+KyDRr0AQHNvaN53HytLNTIG99sdo0v0W:yyqr0RPtzOS0v0W
MD5:	EC9A3858B2C06B17C4811845C37209C4
SHA1:	2DF320AD9DAF33DD31E6381906F7FDCB598EF312
SHA-256:	421319127DE46E1AB3F62CCC60459A5C53A5AD462E5BD62051CF5E346AE26231
SHA-512:	A8AC445F151E4A56D1870E7D0A0B3940672A4B6A2B4A1426E6764F8B2DDBB61427B275FD2797373834D10076B50E06E50F509E2B8EE1FB02CF4A936B7E611B49
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.GsbA68hXs80.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo899t-H8Lxb3OqzMDuPn6TV_i36ag/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);.var ea,fa,na,pa,sa,va,wa,Ca;_.da=function(a){return function(){return _.ba[a].apply(this,arguments)}};_.ba=[];ea=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};fa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.na=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.oa=na(this);pa=function(a,b){if(b)a:{var c=_.oa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&fa(c,a,

Chrome Cache Entry: 383

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2664), with CRLF line terminators
Category:	downloaded
Size (bytes):	2785
Entropy (8bit):	5.684343951230212
Encrypted:	false
SSDEEP:	48:t1XXw+kOhX/BxVgnK/Q6GiuGq9juwbae13NhcKBLd4uN7JWKKKUnsT5UIIQoNfk:H9W3iuV96wDrHBZ4uN7wXsT5ln/
MD5:	8EA5C2281F2667FEC8571DF1AD091797
SHA1:	89AB959D6938B8A184E309A7B3C2DAE7F3EC7FA9
SHA-256:	18A693EEDC0C971347FD57B44631966E7C391232DBF99EBEAFA28FD47C11302C
SHA-512:	94B1A432D76AB5816A363275184D799EE65694B2D24181C0712FD0C749884A464996BC2DDACDA6BCC2038ACF5D763F5C770CCC8042ADB123DDF8F57EAABF35F9
Malicious:	false
URL:	https://fpt2.microsoft.com/Clear.HTML?ctx=Ls1.0&wl=False&session_id=11d42113-0b12-4ced-876b-cae8e5e51bf9&id=bf64e475-9827-4166-b375-abec1b76dcac&w=8DC21BC28AE863B&tkt=H3ihr9e92IdW6yd1ZgQ9SxNMSL5fwIGS0iyEDx6kB4%252bdSb45qNgKwTJfQYQaCchWv80obhIrY%252f4vcyS%252fMgt%252bXFZqTY6V47WS5xaSKUe0V0U4ERxFI4EUl4zG%252fJlB3twhWUjhmX2PE5cHVSlQkbdjMYBGZEY7%252fMfZATmiASpYqpOKFhywHBnKYKBHm2Maj%252b5qE3WRpDrwhx81mDj5kiAju49vvzyeBoRPuqy2Y423ih0SGCPPbx8ghF6EHtvy%252fMttaYgw1DfO6AMHx7owVYv8c9Cx5wnkhw3dF1zCUuvyPVVre1WQR4HNrY1IfgYp5x49&CustomerId=02C58649-E822-405B-B6C3-17A7509D2FCC
Preview:	<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. <title></title>..</head>..<script>function BaseStamp() { this.GetStorageQsInfo = function () { if (window.localStorage) { var n = window.localStorage.getItem(lsKey); var lsupd = "False"; if (lsupd === "true" && n) { var xhr = new XMLHttpRequest(), method = "GET", url = target + "updatels.html?ofid=" + n + "&session_id=" + sid + "&CustomerId=" + cid; xhr.open(method, url, true); xhr.onreadystatechange = function () { if (xhr.readyState === XMLHttpRequest.DONE && xhr.status === 200) { var update = xhr.responseText; if (update && update.toLowerCase() === "true") { window.localStorage.setItem(lsKey, id); } } }; xhr.send(); } if (n && n != null && n != "" \|\| (window.localStorage.setItem(lsKey, id), n = id), id != n) return "session_id=" + sid + "&CustomerId=" + cid + "&fid=" + id + "&ofid=" + n + "&w=" + ticks + "&auth=" + encodeURIComponent(authKey) } return "" }; this.newXMLHttp = function () { var n = null; return

Chrome Cache Entry: 384

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (23098), with CRLF line terminators
Category:	downloaded
Size (bytes):	23562
Entropy (8bit):	5.766924882739192
Encrypted:	false
SSDEEP:	384:HW6biIEsQdsQvZxyF1Aw8XGqvxedHyNDBHDTLLb2M/zvyMEZWp1:2pH9yF1IXqd4dHF/2dC
MD5:	407F6AF9DD1D905C81CDC2B168A8960C
SHA1:	D1E32BE31F4B08971F7B0FEE6A7DF2627B7A199A
SHA-256:	54F84BA66F64186C80B0CFEA6E8DD9142C6D3A805D0FE94C1533AF2CD60106D2
SHA-512:	14821AB2ACA2513858E8423CD095F56DE766965C72775AC7791C90238191D1AB03E7B08F8A4794A0299D990F11F02DFCB0460BDA11D509F64369AA9F08979D64
Malicious:	false
URL:	https://fpt.microsoft.com/tags?session_id=11d42113-0b12-4ced-876b-cae8e5e51bf9
Preview:	<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. <title></title>.. <script>var localTarget='https://fpt.microsoft.com/',target='https://fpt2.microsoft.com/Clear.HTML?ctx=Ls1.0&wl=False&',txnId='11d42113-0b12-4ced-876b-cae8e5e51bf9',ticks='8DC21BC28AE863B',rid='bf64e475-9827-4166-b375-abec1b76dcac',authKey='H3ihr9e92IdW6yd1ZgQ9SxNMSL5fwIGS0iyEDx6kB4%252bdSb45qNgKwTJfQYQaCchWv80obhIrY%252f4vcyS%252fMgt%252bXFZqTY6V47WS5xaSKUe0V0U4ERxFI4EUl4zG%252fJlB3twhWUjhmX2PE5cHVSlQkbdjMYBGZEY7%252fMfZATmiASpYqpOKFhywHBnKYKBHm2Maj%252b5qE3WRpDrwhx81mDj5kiAju49vvzyeBoRPuqy2Y423ih0SGCPPbx8ghF6EHtvy%252fMttaYgw1DfO6AMHx7owVYv8c9Cx5wnkhw3dF1zCUuvyPVVre1WQR4HNrY1IfgYp5x49',cid='02C58649-E822-405B-B6C3-17A7509D2FCC',assessment='',waitresponse=false,bbwait=false,commonquery='',lsInfo=true,splitFonts=false,noFonts=false,UCH=true,PTO=100,rticks=1706637119986,txnKey='session_id',ridKey='id',lskey='MUID';(function(){function p(){var i=0,n;return t&&t.length&&(i=t.length),n="",window.

Chrome Cache Entry: 385

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (524)
Category:	downloaded
Size (bytes):	980
Entropy (8bit):	5.221020544248936
Encrypted:	false
SSDEEP:	24:ckGytSvuT/y67L/nV9jViHwukcglwYVTYVu:catwuby67pLRuxmwCTCu
MD5:	EC8AED9DF755A7B27E52317DCF532DF8
SHA1:	60F03B5BF43D1682D1CDB7DAF5A5A37FCD29D4E8
SHA-256:	C152DD3ED8493299EA2712FFC15A0043F417FEDCF4159B2C993A006501D82AC4
SHA-512:	16890D243CE2236AA2CD01C3C85D7B0AA1DB3DC8BF8B9CFE97AD18889F4030A0B6511C9F82C62F2BDA5F1029AFF4E12A9E35B0E182FC3B2B8B677618A589F5CF
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/content/socialfollow/v1/socialfollow/clientlibs/site.min.ACSHASHec8aed9df755a7b27e52317dcf532df8.js
Preview:	'use strict';$(document).ready(function(){var a=window.matchMedia("(prefers-color-scheme: dark)");a.addEventListener("change",function(k){{const d=document.querySelectorAll(".socialfollow .socialfollow-li img");if(d)for(var e=0;e<d.length;e++){var b=d[e].getAttribute("src"),g=d[e].getAttribute("data-src");b&&(k.matches?(-1<b.indexOf("\x26fmt\x3dpng-alpha")&&(b=b.replace("\x26fmt\x3dpng-alpha",""),d[e].setAttribute("src",b)),-1<b.indexOf("?fmt\x3dpng-alpha")&&(b=b.replace("?fmt\x3dpng-alpha",""),d[e].setAttribute("src",.b))):g&&d[e].setAttribute("src",g))}}});if(a.matches&&(a=document.querySelectorAll(".socialfollow .socialfollow-li img")))for(var f=0;f<a.length;f++){var c=a[f].getAttribute("src"),h=a[f].getAttribute("data-src");c&&(-1<c.indexOf("\x26fmt\x3dpng-alpha")?(c=c.replace("\x26fmt\x3dpng-alpha",""),a[f].setAttribute("src",c)):-1<c.indexOf("?fmt\x3dpng-alpha")?(c=c.replace("?fmt\x3dpng-alpha",""),a[f].setAttribute("src",c)):h&&a[f].setAttribute("src",h))}});

Chrome Cache Entry: 386

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1143)
Category:	downloaded
Size (bytes):	4272
Entropy (8bit):	5.407649241930215
Encrypted:	false
SSDEEP:	96:bVcC0LhyRs71268NYZOAx/rfuNfnAZe5PwGNHW:B3qhpRByNPx54GN2
MD5:	B427175FA1078775EB792756E7B6D1E7
SHA1:	4C55C0233D3D9002B3449C025F97821F8BB8900D
SHA-256:	EE147E859AD0F09AA50367974E38AB53E7C7054C4A51D400A7F45B0EB251454F
SHA-512:	AF8D384188363378BC99C2E51523E74E1D18BA77D51BFF7647A377A117499421F9E94477E09907925E46DAD0A908B799A616D0B4855FFFF064BA6350815063D3
Malicious:	false
URL:	https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.'use strict';var l=function(){var a=h,b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},m=this\|\|self,n=/^[\w+/_-]+[=]{0,2}$/,p=null,q=function(a){return(a=a.querySelector&&a.querySelector("script[nonce]"))&&(a=a.nonce\|\|a.getAttribute("nonce"))&&n.test(a)?a:""},r=function(a,b){function e(){}e.prototype=b.prototype;a.i=b.prototype;a.prototype=new e;a.prototype.constructor=a;a.h=function(c,g,k){for(var f=Array(arguments.length-2),d=2;d<arguments.length;d++)f[d-2]=arguments[d];.return b.prototype[g].apply(c,f)}},t=function(a){return a};function u(a){if(Error.captureStackTrace)Error.captureStackTrace(this,u);else{var b=Error().stack;b&&(this.stack=b)}a&&(this.message=String(a))}r(u,Error);u.prototype.name="CustomError";var v=function(a,b){a=a.split("%s");for(var e="",c=a.length-1,g=0;g<c;g++)e+=a[g]+(g<b.length?b[g]:"%s");u.call(this,e+a[c])};r(v,u);v.prototype.name="Asse

Chrome Cache Entry: 387

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	367709
Entropy (8bit):	5.2124715598591065
Encrypted:	false
SSDEEP:	1536:sci8ZHMKKtkSgVIUI9ILJPptpJKztM6oyi+MOn4y2Ox5juDEnXrDJc7MsByZ54c6:sci8ZXSg/IESoyJufmJ3c/IoNN
MD5:	B21FC2A7F2E2D83E814156DA4B2C35FB
SHA1:	4E8ECC57131FF052A31D5CA3B0A3D382D232629A
SHA-256:	7D7DFD5386BCA8B7045AD883D877772BC7CB96D90B7269021C94D95E806AFCB3
SHA-512:	D28E5E61E37EBE0825ED54B122302571629ECAD80B8254186CC406FBB838EF73887A357D05AEA5C55348A07EF22B1214539C07F014EBC7C8090CE6828B428CD2
Malicious:	false
URL:	https://www.youtube.com/s/player/6ee8f9ce/www-player.css
Preview:	@charset "UTF-8";.html5-video-player{position:relative;width:100%;height:100%;overflow:hidden;z-index:0;outline:0;font-family:"YouTube Noto",Roboto,Arial,Helvetica,sans-serif;color:#eee;text-align:left;direction:ltr;font-size:11px;line-height:1.3;-webkit-font-smoothing:antialiased;-webkit-tap-highlight-color:rgba(0,0,0,0);touch-action:manipulation;-ms-high-contrast-adjust:none;forced-color-adjust:none}.html5-video-player:not(.ytp-transparent),.html5-video-player.unstarted-mode,.html5-video-player.ad-showing,.html5-video-player.ended-mode{background-color:#000}.ytp-big-mode{font-size:17px}.ytp-autohide{cursor:none}.html5-video-player a{color:inherit;text-decoration:none;-webkit-transition:color .1s cubic-bezier(0,0,.2,1);transition:color .1s cubic-bezier(0,0,.2,1);outline:0}.html5-video-player a:hover{color:#fff;-webkit-transition:color .1s cubic-bezier(.4,0,1,1);transition:color .1s cubic-bezier(.4,0,1,1)}.ytp-probably-keyboard-focus a:focus{-webkit-box-shadow:inset 0 0 0 2px rgba(27,1

Chrome Cache Entry: 388

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32653)
Category:	downloaded
Size (bytes):	327201
Entropy (8bit):	5.580949998719782
Encrypted:	false
SSDEEP:	1536:t9+xOL1qkrVJk5aRyMs2HrXsoniTYNK6FUYgzzxPix4X6ToneJ47BFwr15TEj+JC:bQ2yTYH+AA6WnwkIbvO0NQidGw2
MD5:	69A5E78CAD396CA7E754947759E56877
SHA1:	8445D057EAF111B1D5FC672491201E44CAE43223
SHA-256:	40FEAEA049CE7219534D140684ADAEFE5C89137C5D0E8B2F7482001C4C307F1B
SHA-512:	EF1388A52120E703A4CB7A694F6FB3823C0B87956929BD2683E2735F3F35D1F11D1760A10DD9EA8F7615816188F04C75F105F786AA3522F1DEC5243FA4B2ACB5
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/clientlibs/clientlib-thirdparty/v43.js
Preview:	// For license information, see `http://img-prod-cms-rt-microsoft-com.akamaized.net/launch/store/launch-ENf7805d09fd1b455883333cdf34ee4ca2.js`..window._satellite=window._satellite\|\|{},window._satellite.container={buildInfo:{minified:!0,buildDate:"2024-01-08T18:59:18Z",turbineBuildDate:"2023-02-22T20:37:26Z",turbineVersion:"27.5.0"},environment:{id:"ENf7805d09fd1b455883333cdf34ee4ca2",stage:"production"},dataElements:{isSurfacePDP:{modulePath:"core/src/lib/dataElements/customCode.js",settings:{source:function(){var t=new RegExp("/d/surface"),e=new RegExp("/p/surface");return t.test(window.location.pathname.toLowerCase())\|\|e.test(window.location.pathname.toLowerCase())}}},isSurfaceCategory:{modulePath:"core/src/lib/dataElements/cookie.js",settings:{name:"test"}},isSurfaceBusiness:{modulePath:"core/src/lib/dataElements/customCode.js",settings:{source:function(){return new RegExp("store/b/surfaceforbusiness").test(window.location.pathname.toLowerCase())}}},PageInfo:{modulePath:"core/src/li

Chrome Cache Entry: 389

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (578)
Category:	downloaded
Size (bytes):	3369
Entropy (8bit):	5.407239613237824
Encrypted:	false
SSDEEP:	96:yjXZ9sAK618PFA5H12sy1sv29sfsTYxYwd9Tf:yjXPT2S1Y1sv0axYwd9z
MD5:	C343DFB005AC8C14AE0DD22DD17FB2FC
SHA1:	6C3C4F71156EBD4549E4A461BF5B995B3287D7E8
SHA-256:	C3BFBD629D284635AD35313D8C90449964A470186B876CC5BA6C9FE201C6FDA7
SHA-512:	7983CFC7AF069704C6F10E89905142F86023753A12834459A1BC714257B540B315F1B1EBEB250E706284A1ACC7567FB4EAD4F1C3B6F40EEE4C1E873C11CDDC9F
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/clientlibs/exp-cookiecomp/v1.min.ACSHASHc343dfb005ac8c14ae0dd22dd17fb2fc.js
Preview:	'use strict';window.ExpConsentUtils=window.ExpConsentUtils\|\|{};window.ExpConsentUtils=function(){return{waitForObj:function(f){return new Promise(function(d,c){var h=0,k=setInterval(function(){100>h?"visitor"==f&&"object"===typeof visitor&&visitor\|\|"consent"==f&&"undefined"!==typeof WcpConsent&&WcpConsent&&"undefined"!==typeof WcpConsent.siteConsent&&WcpConsent.siteConsent&&"undefined"!==typeof GPC_DataSharingOptIn&&null!=GPC_DataSharingOptIn?(clearInterval(k),d()):h++:(clearInterval(k),c())},50)})}}}();.var ExpConsentHandler=function(){function f(){window.ExpConsentUtils.waitForObj("visitor").then(function(){visitor.getVisitorValues(function(a){adobe.target.trackEvent({mbox:"personalizationConsent"})})}).catch(function(a){console.log(a)})}function d(){return WcpConsent&&WcpConsent.siteConsent&&void 0!==WcpConsent.siteConsent.isConsentRequired&&null!==WcpConsent.siteConsent.isConsentRequired?WcpConsent.siteConsent.isConsentRequired:!0}function c(){var a=WcpConsent&&WcpConsent.siteConse

Chrome Cache Entry: 390

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (584)
Category:	downloaded
Size (bytes):	6796
Entropy (8bit):	5.383071747945536
Encrypted:	false
SSDEEP:	192:n+ocdo4VYgB9G/0y/qhNJ5k4iflBDHndCjOGGW0:n+ocdo4B7G/0yyNSflhndCjOGGN
MD5:	D01B887060EEDA8457A067614F5353BB
SHA1:	4AA696871978773F1401A5DBC10252AC896AC854
SHA-256:	859DE799B95BD146A69A1C2F3D22C3E0218D3489B978C56CAA396E640F1DAACA
SHA-512:	0181FF3A5169506A285421A1010811CA23147BBCD312E08FDE8618A158FF7BD7D0344CA6C363700A7C1441876BE951C155260DC11BF510D74285BADD99AE5822
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/content/universalheader/v1/universalheader/clientlibs/site.min.ACSHASHd01b887060eeda8457a067614f5353bb.js
Preview:	'use strict';(()=>{function m(f){var e=G[f];if(void 0!==e)return e.exports;e=G[f]={exports:{}};return I[f](e,e.exports,m),e.exports}var I={623:()=>{$(function(){function f(){-1!==document.cookie.indexOf("".concat("Cascade.AuthSSO","\x3d"))&&(document.cookie="".concat("Cascade.AuthSSO","\x3d; expires\x3dThu, 01 Jan 1970 00:00:00 UTC;"))}function e(){var a=function(){var d=document.cookie.match(/(^\|;\s)(Cascade.AuthSSO)=([^;])/);return d?(d=parseInt(decodeURIComponent(d[3])),!isNaN(d)&&d>n.DefaultAttempted?.n.SharedStateAttempted:n.DefaultAttempted):n.NotAttempted}(),c=!(!window.msauthRpsShare\|\|b.accountConstraint===w.AAD);if(a===n.NotAttempted\|\|c&&a!==n.SharedStateAttempted)!function(d){$("#".concat("cascadeauthsso")).remove();var g=document.createElement("iframe");g.src=d;g.setAttribute("width","0");g.setAttribute("height","0");g.setAttribute("border","0");g.setAttribute("frameborder","0");g.setAttribute("style","display: none");g.id="cascadeauthsso";document.body.appendChild(g)}("".

Chrome Cache Entry: 391

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (517)
Category:	downloaded
Size (bytes):	1613
Entropy (8bit):	5.082827880507625
Encrypted:	false
SSDEEP:	48:cyDvwreaxxzZ77DWqstabe02NqkQqsuVAe7O:TDsD5s8j6sAO
MD5:	DF31C97130106CDDB71542614A39C1BC
SHA1:	3135D7D5F3370EC605D08ABA37F323C136AF7F26
SHA-256:	92E4BCF8E2CCB418B3C569A9740AAD24AA671226DAE2DDE16BDE8146B47883C6
SHA-512:	99BA1F53DCE7F792C6C9C5C2B7CD3711376B84BA63698ACB66C41D5E958B172457A515EFB1093C5CDA3455BF2BC3F128DA1192DDC38EFC9A0C420C334CDC2E40
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/structure/page/clientlibs/embed-thirdparty.min.ACSHASHdf31c97130106cddb71542614a39c1bc.js
Preview:	'use strict';$(document).ready(function(){function c(){if("undefined"!==typeof window.partnerScripts&&"undefined"!==typeof window.partnerScripts.contentSquare){var a=document.createElement("script");a.type="text/javascript";a.setAttribute("src",window.partnerScripts.contentSquare.entryFile);a.setAttribute("id","content-square");(document.body\|\|document.getElementByTagName("body")[0]).appendChild(a)}}function e(){if(null!=WcpConsent&&"undefined"!=typeof WcpConsent.siteConsent&&null!=WcpConsent.siteConsent){var a=.WcpConsent.siteConsent.getConsent();if(null!=a&&a.Advertising&&a.Analytics&&a.SocialMedia&&GPC_DataSharingOptIn){if("undefined"!==typeof window.partnerScripts&&"undefined"!==typeof window.partnerScripts.meta){a="/etc.clientlibs/microsoft/components/structure/page/clientlibs/embed-partnerscripts."+window.partnerScripts.meta.partnerJsHash+".min.js";var b=document.body\|\|document.getElementByTagName("body")[0];if(0<a.indexOf("ACSHASH")){var d=document.createElement("script");d.type

Chrome Cache Entry: 392

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, truncated
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	4.199873730859799
Encrypted:	false
SSDEEP:	3:FttVQfPltSj:XtqPU
MD5:	D317C25EBCF619DCAD17963A91904BC1
SHA1:	749A0A568BEF62730A278854033B5D83AC81519C
SHA-256:	F5AF56B41CA2466246D1648A3BE8FE236C4F123E3FA8589C10A72F1C68ABBE8F
SHA-512:	4055D9D3917796222A49B8BFB48D60E9A804D4CEBFE9958EAEEE9E7BABE153FEEB6C7C11577F1494E37BB91F89F5FAB6BC204B1A7AF11F32A6043D57B5A4A237
Malicious:	false
URL:	https://www.google.com/compressiontest/gzip.html
Preview:	...........QL.O..,HU.(....H.....

Chrome Cache Entry: 393

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.0314906788435274
Encrypted:	false
SSDEEP:	3:CUkwltxlHh/:P/
MD5:	325472601571F31E1BF00674C368D335
SHA1:	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A
SHA-256:	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
SHA-512:	717EA0FF7F3F624C268ECCB244E24EC1305AB21557ABB3D6F1A7E183FF68A2D28F13D1D2AF926C9EF6D1FB16DD8CBE34CD98CACF79091DDDC7874DCEE21ECFDC
Malicious:	false
URL:	https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Zbk3QwAAAGzR0xva&C=1
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 394

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	270
Entropy (8bit):	6.885200623416636
Encrypted:	false
SSDEEP:	6:6v/lhP13QH2o17VrNgR5JvymjzByBnur2eDjUM009GH5ip:6v/79302gV5krvXjzBmScC
MD5:	B5538C29DF1C8CA0E55AF79295015612
SHA1:	F5C610EDDFF6A3544FB20F3AFC882447C703726F
SHA-256:	4BE55E7CC78829CD033B6055E14DDFD58FE3D6B54EAB0D5FDDA9106CA584D95F
SHA-512:	81508AAD679D84DEB19237D8C3B28545D45E95F0636B0A2F078D77B0D548FBD3DA816BBAEF787F0F9599142CD13AB16397FFAF648B3A62E53325782DC7852860
Malicious:	false
URL:	https://www.gstatic.com/kpui/social/fb_32x32.png
Preview:	.PNG........IHDR... ... ............IDATx.c...KS4.-...7mi.....\;q....;vs.K..&bn..O..~..-.........G..b..x......r...K..m.uy....D....\|.7...[......@.O..C.O....>....@.2u...7....W.!K.>r...$[0w.).q......ih..=Whk...!...{.N.#d.O]..,.^.q...Q.F-..`....4..m......IEND.B`.

Chrome Cache Entry: 395

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (682)
Category:	downloaded
Size (bytes):	326162
Entropy (8bit):	5.5899898730111826
Encrypted:	false
SSDEEP:	3072:dssVOPtVaSOK0ornJt22OFn/CiUNgIA6FC0fs3AJm5xMnXzgHi:CPb30ornJsF6iUN3A6FC0f2ApZ
MD5:	0D7A64C9F5B118E5842FA5D6B9D766D4
SHA1:	F523C6C7B2C5BB7FB6E23F5A56F08101254BF1A9
SHA-256:	45061676B383D710F4C08B17E6567189E844CD706C6D9EAEF30B48E60F863B15
SHA-512:	6F656C078AF10FF61E5216183479DD3F648392AB76C20A65137AB0E3C1224FD4C00C3A7CD8F8B0F4F076F40579835E2791458FC657743C9614905DF276E85269
Malicious:	false
URL:	https://www.youtube.com/s/player/6ee8f9ce/www-embed-player.vflset/www-embed-player.js
Preview:	(function(){'use strict';var m;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ca(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var da=ca(this);function u(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.u("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}.function c(f,g){this.h=f;ba(this,"description",{configurable:!0,writable:!0,va

Chrome Cache Entry: 396

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (505)
Category:	downloaded
Size (bytes):	1418
Entropy (8bit):	5.418786110345074
Encrypted:	false
SSDEEP:	24:gkWndJbDZVHGCGH0199EYCDNQNFHOS91AqCCoW40HJtmz2Xw+mlu4oFU5kveTOwD:gkw9ZVHG3HEuvNQNFv16XW1HJEkmEhUh
MD5:	20AAFDF6904D3DC5DB0E0E33ABBFC1A4
SHA1:	CC1A639FF69FE0D8A8F1EFEE7FCB04941E7B57C8
SHA-256:	EE4E620F350907CE3867454B2BD45984BE949EB46B113183D4B8B403032DA14D
SHA-512:	91B0BD81FCD2D3D040D9FC1DB74F5CA916EF88E7887D2868530BF1319EAF5462CC54421AB80FC97B258B569B9AF40F2B9FD1B6D417C9A4561BBA22EDF785D905
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/cascade.component.authoring/clientlibs/clientlib-jquery-cookie.min.ACSHASH20aafdf6904d3dc5db0e0e33abbfc1a4.js
Preview:	/. jQuery Cookie Plugin v1.4.1. https://github.com/carhartl/jquery-cookie.. Copyright 2013 Klaus Hartl. Released under the MIT license./.'use strict';(function(d){"function"===typeof define&&define.amd?define(["jquery"],d):"object"===typeof exports?d(require("jquery")):d(jQuery)})(function(d){function l(a,c){if(e.raw)var b=a;else a:{0===a.indexOf('"')&&(a=a.slice(1,-1).replace(/\\"/g,'"').replace(/\\\\/g,"\\"));try{a=decodeURIComponent(a.replace(m," "));b=e.json?JSON.parse(a):a;break a}catch(h){}b=void 0}return d.isFunction(c)?c(b):b}var m=/\+/g,e=d.cookie=function(a,c,b){if(void 0!==c&&!d.isFunction(c)){b=d.extend({},e.defaults,b);.if("number"===typeof b.expires){var h=b.expires,g=b.expires=new Date;g.setTime(+g+864E5*h)}a=e.raw?a:encodeURIComponent(a);c=e.json?JSON.stringify(c):String(c);c=e.raw?c:encodeURIComponent(c);return document.cookie=[a,"\x3d",c,b.expires?"; expires\x3d"+b.expires.toUTCString():"",b.path?"; path\x3d"+b.path:"",b.domain?"; domain\x3d"+b.domain:"",b.secure?";

Chrome Cache Entry: 397

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46413)
Category:	downloaded
Size (bytes):	764044
Entropy (8bit):	5.7462340016974895
Encrypted:	false
SSDEEP:	12288:+9PZuyumepia7UmjXp7xuWspdgFo7JTvj:+9PZuyumepia7UmjXjSpSFo7JTvj
MD5:	476EB419ED3D309B2FC5AAD6CDB7504E
SHA1:	24F4399CD7E962A82DCD792E3286B10EE0DFCD7D
SHA-256:	60C3593B18AC78C7C7536FEB82E57398B7E879D503C532F96CB56450A1E13422
SHA-512:	8DA2DB8B29EE30FFC197B5FA387602FE370FA289103FE52115D49E7EA21C1683ED1E7E7CE79F14D6436BE97C26E0C1EB5E9DB8AA638068A9E492B3BD8D375D13
Malicious:	false
URL:	"https://www.google.com/xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/excm=ABxRVc,AD6AIb,B0xr7b,CTwd8,CWOfE,CX5LId,CdOg1,D1J6He,FmnE6b,FuQWyc,GRJ32c,GXyz1,JxE93,KiXlnd,MRb7nf,NmR9jd,NsEUGe,Oa7Qpb,Ok4XMd,PE728b,PoJj8d,PvSBGf,QNvmne,RSlfle,TO0csb,TnXlGd,Trirbc,TurKxc,U3Ovcc,U6nlJe,UQpTU,UiPhkb,Uznx4d,VZLyBe,WxJ6g,XDlt7d,XHo6qe,XTkmZd,XbupY,YuNOCb,ZGLUZ,ZrXR8b,Zudxcb,a3cZoc,adn7N,ak946,bXyZdf,cKV22c,du3Q4e,eTv59e,f26on,fNMhz,hfJ9hb,jJtSzc,jkRPje,kCkfUb,kOSi0d,mL4hG,oXRDzc,pIseB,pMwOEe,pQk1fc,qngJBf,r24bR,rL2AR,sU6eaf,tlA71,tzTB5,vJPFse,vhpQNc,y25qZb,yChgtb,yfH2Bd,yn9Ffd,ypVg7e,yuQBec,zjNhL,zs9f9d/ed=1/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=uKlGbf,sy1wl,sy3ap,DpX64d,sy3aq,EufiNb,sytm,P10Owf,synl,synv,gSZvdb,sy57c,vTw9Fc,sy1th,sy5de,SC7lYd,eTVOC,Pq506,kpAr,AjRVIe,tE6Rzd,phecbc,q28gvc,g0Ekse,jtFQAf,rKbWof,bIMMof,ARtdse,sy1wv,sy1ww,p2I2Je,z2eFcc,QzraZb,I9JIjc,nzu4Ud,gGYzg,FjjTod,tDA9G,UX8qee,tW711b,R6UkWb,xMHx5e,TnJGKb,SnmExf,synh,syr4,syhf,syih,sywz,syyf,syyg,Mbif2,syi3,syiy,sykd,syke,syk5,sykf,sykg,sysd,syhm,syhq,syi7,syiv,sy1al,syii,sy1am,sy1h7,sy1cg,sy1hb,sy1jd,sy1jc,sy1jq,sy1jr,sy1k0,sy1ms,sy1pd,sy1ou,sy1om,sy1p8,sy1p1,sy1p9,sy1pa,sy1pe,sy1pf,sy1ox,sy1pb,sy1px,sy1pw,sy1t3,sy1t4,sy1t5,sy1t9,sy1t8,sy1t6,sy1tr,sy1wo,sy1wx,syhc,sy1x2,sy1z1,syht,sy1z5,sy1wy,sy1x0,sy1x1,sy1x3,sy1x6,sy1x5,sy1wz,sy1x7,sy1x8,sy1x9,sy1xa,syi0,syim,sy1xe,sy1xf,sy1xg,syjw,syhs,syju,syjx,syrx,sy1xb,sy1xd,sy1xc,syh5,syh6,syi5,syi9,syis,syjn,syjo,syjq,syjs,sy1xj,sy1xk,sy1xi,sy1xl,sy1xm,syk4,sykq,sykr,syks,sykt,syku,sykv,sykw,sykx,syky,sykz,syl0,syl1,syl2,syl3,syl4,syl5,syl6,syl7,syl8,syl9,syla,sylb,sylc,syld,syle,sylf,sylg,sylh,sygq,syli,sylj,sylk,syll,sylm,syln,sy1xp,sy1xo,sy1xn,sy1xq,sy1xr,syk1,sy1xt,syk2,syk6,syk8,syka,sy1xu,sy1xv,sy1xw,syi4,sym9,syma,sy1xx,sy1bu,sy1wq,sy1xz,sy1y0,sy1y1,sy1y2,sy1y3,syho,syy5,syy2,syy6,syhk,syy7,syxh,syy8,syy9,sy1y6,sy1y7,sym7,sy1y5,sy1y8,sy1y9,sy1y4,sy1xy,sy1ya,sy1ea,sy1yi,syhd,syi8,syiu,syxz,syy0,syiw,sylz,symn,syy1,syy3,syz8,sy1e4,sy1e5,sy1eb,sy1ed,sy1ee,sy1xh,sy1yf,sy1yh,sy1yj,sy1ym,sy1yl,sy1yn,sy1yo,sy1yk,sy1yp,sy1yq,sy1yr,sy1ys,syjf,syjh,syjb,syjj,syjm,syr1,syr3,sy1yt,sy1yu,sykj,sykk,sykh,syki,syng,sy1yw,sy1yv,sy1yx,sykm,sykn,sykp,syso,sy1yz,sy1yy,sy1z0,sy1z2,sy1z3,sy1z4,sy1z6,sy1bp,sy1bq,syh8,syhu,sy1br,sy1bs,sy1bt,sy1w5,sy1w4,sy1w7,sy1x4,syxl,syxm,syxn,syxo,syxp,syxq,syxs,syxt,syxu,syxv,syxw,syxx,sy1yb,syj1,syxk,sy1yc,sy1yd,sy1ye,sy1z8,sy1z9,sy1z7,symb,sy1xs,sy1yg,sy1zb,sy1zc,sy1za,sy1zd,sy1ze,sy1zf,sy1zg,sy1zh,sy1zi,sy1zk,sy1zj,sy1zl,sy1ow,sy1p5,sy1zm,sy1zn,syij,sy1zo,sy1zp,syj6,sy1zq,sy1zr,sy1zs,syxy,sy1zt,sy1zu,exgaYe,sy1k3,sy3ph,bpec7b,sy1j8,sy20o,rhe7Pb,synf,synj,synk,DPreE,sy4u1,sy6vg,FH3rkc,sy3b0,sy3b1,qcH9Lc,sy2pr,sy3b3,YFicMc?xjs=s3"
Preview:	_F_installCss(".S3PB2d{margin:auto}.X3BRhe{margin-left:auto;margin-right:auto}.TBC9ub{margin-left:0px;margin-right:0px}.VCOFK{margin-left:8px;margin-right:8px}.Qlb37c{margin-left:2px;margin-right:2px}.HbX59e{margin-left:0px}.FIfWIe{margin-left:4px}.OhScic{margin:0px}.FbkHNd{margin-top:24px}.GmoL0c{margin-right:12px}.U56OG{margin-right:8px}.xTWltf{margin-right:24px}.OZ5bRd{margin-bottom:auto;margin-top:auto}.p50bId{margin-bottom:12px;margin-top:12px}.r2fjmd{margin-bottom:0px;margin-top:0px}.tzM4td{margin-bottom:8px;margin-top:8px}.GUHazd{padding-bottom:12px}.zUdppc{padding-bottom:4px}.G0vQrb{padding-bottom:2px}.ouy7Mc{padding-left:16px;padding-right:16px}.Wt5Tfe{padding-left:0px;padding-right:0px}.gTewb{padding-left:8px;padding-right:8px}.YJiZxe{padding-left:20px;padding-right:20px}.zsYMMe{padding:0px}.bvSTKc{padding:8px}.cB4NFc{padding-top:16px}.OdBhM{padding-top:8px}.InI2pf{padding-bottom:16px;padding-top:16px}.s8bAkb{padding-bottom:0px;padding-top:0px}.eJtrMc{padding-bottom:8px;paddi

Chrome Cache Entry: 398

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	140469
Entropy (8bit):	5.592249387312441
Encrypted:	false
SSDEEP:	3072:JOe03o4PwjWGXwMr1JCJX0yRNbQYzGhE4:JBWKwMru0SlUE4
MD5:	136CD2DA923EB08E267A477639328B1A
SHA1:	EA87FD53981D1A5C9A0687EE19EEF9A0F59FFA5B
SHA-256:	A758246F43DF5CF0F88A3C46A95CB7E962EC2E16327F7FC6B70D2150981B86DF
SHA-512:	7FF1FAE843A170022550B2586C0D545A7670DED6A54913A06FDD3DC152F5BB713854D8AF810DD9EBF0F78C17DA3874231CF9719F8741782A6200D280760602EB
Malicious:	false
URL:	https://analytics.tiktok.com/i18n/pixel/static/identify_0a875.js
Preview:	(window["webpackJsonp.TiktTokAnalytics"]=window["webpackJsonp.TiktTokAnalytics"]\|\|[]).push([[1],{"6rls":function(d,t,e){"use strict";e.r(t),e.d(t,"getAllTopics",function(){return mt}),e.d(t,"isHash",function(){return lt.c}),e.d(t,"sha256",function(){return n.sha256}),e.d(t,"parsePhoneNumberFromString",function(){return $t}),e.d(t,"validatePhoneNumberLength",function(){return ut}),e.d(t,"checkEmailFormat",function(){return lt.a}),e.d(t,"checkMDNEmailFormat",function(){return lt.b}),e.d(t,"genIdentifierLabelByUserProperties",function(){return Ut});var n=e("bCcq"),r={version:4,country_calling_codes:{1:["US","AG","AI","AS","BB","BM","BS","CA","DM","DO","GD","GU","JM","KN","KY","LC","MP","MS","PR","SX","TC","TT","VC","VG","VI"],7:["RU","KZ"],20:["EG"],27:["ZA"],30:["GR"],31:["NL"],32:["BE"],33:["FR"],34:["ES"],36:["HU"],39:["IT","VA"],40:["RO"],41:["CH"],43:["AT"],44:["GB","GG","IM","JE"],45:["DK"],46:["SE"],47:["NO","SJ"],48:["PL"],49:["DE"],51:["PE"],52:["MX"],53:["CU"],54:["AR"],55:["BR"

Chrome Cache Entry: 399

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (880)
Category:	downloaded
Size (bytes):	17091
Entropy (8bit):	5.430560844193102
Encrypted:	false
SSDEEP:	384:ZAfRCOaMXo3rxUvTABlgEKgIuPPljZ9Aeo7DLlF3VWqd77uRO4XAOnFA0Oa18HOo:ZACOaMXo3rxUylJKg5PPyxDxF3gafuR+
MD5:	0BBF67B71C3C8CB7C8AF4EC771647562
SHA1:	85C8AB22ACDF3AD2F0A4585AEC9F2F639B5D4861
SHA-256:	BE51F7AB9C92303D67F81AB1385BD2828F561E8C49B4E328CB63724D0587D915
SHA-512:	B1155998C34312D7B2E3D2EAC18D61D23B80304874021EFE7CEE4854F24C45BAC38F7B5C876056110AAFC6DC7361CABCEA21351CE8D1001EB011F3B295B24947
Malicious:	false
URL:	"https://www.google.com/xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=sy3av,sy3qf,w4UyN,sy1j6,QKZgZd,sy1jf,sy1jg,Qj0suc,JXS8fb,sy1je,sy1ji,sy1jl,sy1jm,sy1jn,sy1jo,sy1jp,sy1js,Wct42,sysh,LiBxPe,sy46v,sy6kg,J9Q59e,sy46w,a6Sgfb?xjs=s3"
Preview:	this._s=this._s\|\|{};(function(_){var window=this;.try{._.SZi=_.I("Lhx8ef");.}catch(e){_._DumpException(e)}.try{._.Voj=_.z("w4UyN",[]);.}catch(e){_._DumpException(e)}.try{._.x("w4UyN");.var kht=function(a){_.D.call(this,a.Ka);this.ka=!1;this.oa=_.fd("elPddd");this.rootElement=this.getRoot().el()};_.F(kht,_.D);kht.Ga=_.D.Ga;kht.prototype.wa=function(){if(""===_.v.getStyle(this.oa,"transform")){if(_.ru(this.rootElement),_.sf(document,_.SZi),!this.ka){var a=_.cC(new _.XB,_.YB(new _.dC,134634));_.sf(document,_.eC,{wA:a});this.ka=!0}}else _.v.setStyle(this.oa,"transform","");this.ob("suEOdc").setStyle("visibility","hidden")};.kht.prototype.showTooltip=function(){this.ob("suEOdc").setStyle("visibility","inherit")};kht.prototype.Dl=function(){this.ob("suEOdc").setStyle("visibility","hidden")};_.J(kht.prototype,"LfDNce",function(){return this.Dl});_.J(kht.prototype,"eGiyHb",function(){return this.showTooltip});_.J(kht.prototype,"HfCvm",function(){return this.wa});_.To(_.Voj,kht);._.y();.}catch(

Chrome Cache Entry: 400

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 401

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (555)
Category:	downloaded
Size (bytes):	2484713
Entropy (8bit):	5.665847543462907
Encrypted:	false
SSDEEP:	49152:TCh2kywSPqMMC6bAtxShkidF6JTPdpBvoT:pkTEw
MD5:	9E8DA034A9FF4194B42A57803EE582C0
SHA1:	F172E431734824A4CFAC61F47C7DFB2D815170E8
SHA-256:	3EB64D914BB9AF71C255770BD7C55BA9666CF9B387BAEFAE90E14D5271353CDC
SHA-512:	62BB0C9D813E07D6121885110127AA6AAC3B43140436DB85398CCF7FB63D99BE240B9F6C0CE3640D6A44A96EF39AE66CB552D6D45EBC74CC0A1C298D5820512F
Malicious:	false
URL:	https://www.youtube.com/s/player/6ee8f9ce/player_ias.vflset/en_US/base.js
Preview:	var _yt_player={};(function(g){var window=this;/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././*.. (The MIT License).. Copyright (C) 2014 by Vitaly Puzrin.. Permission is hereby granted, free of charge, to any person obtaining a copy. of this software and associated documentation files (the "Software"), to deal. in the Software without restriction, including without limitation the rights. to use, copy, modify, merge, publish, distribute, sublicense, and/or sell. copies of the Software, and to permit persons to whom the Software is. furnished to do so, subject to the following conditions:.. The above copyright notice and this permission notice shall be included in. all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR. IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,. FITNESS FOR A PARTICULAR PURPOSE AND NONIN

Chrome Cache Entry: 402

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 34052, version 0.0
Category:	downloaded
Size (bytes):	34052
Entropy (8bit):	7.994131533337155
Encrypted:	true
SSDEEP:	768:WHH8jjaseVFXnmQ8njOkV5c4d7DOgx1J89JzHNBbFOlsy0kQ6lhe:kH8jj3uWxKe5c4xz69hNalP0kQ6lhe
MD5:	36397A3BC139C6E9F81D383F060F080A
SHA1:	3F4F86C10920D4ED345F4858B6CDE9F93E1AEB81
SHA-256:	4F7F4AFE26E71FA9CA1DAC4A43B557A554A46F53251D849F07ED08A04829D74B
SHA-512:	7FFF4870E9142E6E1921F8DD78E3B049547EC1D540EFE573C2938F8B855DB61BA908FA9D3C8DA1BB2AAE6D95217A586D256B9EA2BD8A8F706B1DB75BC21F2CB9
Malicious:	false
URL:	https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2
Preview:	wOF2.............................................`....."..\.....D..D.6.$........ .. . ..@.S.5x.q..m.5.7Q..2......6..R....v.j.......".c..@.Z.B..G.Y.\S.AtT.iTJt.....l.>..=+z...1.pP..[.+.S..`...c.1.u1...)......`............9.8.......+..4...;..[W.v..p0..qg..=..+...1...\|R..qM..\|/...%..!C.....G:.;7...Z..^P...o..q.B'....a....M.l3k....=&.'.'..8.....K..k........}.?w.i[..q.,...,.0,.....?...o.y..@..U5.:T..E..B..%......YU.....Z..4T..5....m/..,.$.w..`O.s.c.{...;a;..T...9../.......,....BDf.S).ola._e../..z%.:....r..d;.t.....7....jI!-.....{..l.T..H%8.p.*=!.z8.7.k..L...WUW...0.0.....7Q.0.J..Q.\|~P..'Q... m.a..(..p..q...B.:.....e.B...g..<O(..z..o.G...U.x.Tw...^t.._.t..}....q....*K....".UP...Te...<.....f.....{.....I..V...p.+...-<..%.+..?M.A!.ob.9p...7..B. ..R....."4..%M.6..'...!.S.........?.`w.....l@..R.AJ&@..h/H{.(n..I.8..6.4 ..i{..5.I....l...rJ.....N{.^..6..^.V.&..)?Bc.&.u.......fd.H..X.5Fq(c....6...w(O..K...F.......ohh.....Gk...l.2q.t.h..........U9%.n....%...

Chrome Cache Entry: 403

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (34235), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	100769
Entropy (8bit):	5.246112939487446
Encrypted:	false
SSDEEP:	3072:nmwNxXC4Pn+lnTKxKdzW7I1m7H+8l9ut+EVe/EdnoEnsJ:mwFwTXqwe/EdnoEnsJ
MD5:	6FE3DD83A0D98BC1977F57EA33C37693
SHA1:	8DF606F40E4CC8C07CE929D5A82FD5304EAF4EB7
SHA-256:	A5268A183F2A091D2D17773997E89A25FC45CBD60E586EDF61F544FB85D6F6A8
SHA-512:	B81C2EB3BFA8ECF1FFCBB24E4A776CD2B083460A0AC53213EAF48997AC27BB20F49CEFF3A098AEBA33B3AD4F74CA86B5018AFE6689A260F011DF4249029CE78B
Malicious:	false
URL:	https://mem.gfx.ms/scripts/me/MeControl/10.23347.2/en-US/meCore.min.js
Preview:	MeControlDefine("meCore",["exports","@mecontrol/web-inline","@mecontrol/web-boot"],function(e,f,h){"use strict";var r=function(e,t){return(r=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var n in t)t.hasOwnProperty(n)&&(e[n]=t[n])})(e,t)};function t(e,t){function n(){this.constructor=e}r(e,t),e.prototype=null===t?Object.create(t):(n.prototype=t.prototype,new n)}var d=function(){return(d=Object.assign\|\|function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var o in t=arguments[n])Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o]);return e}).apply(this,arguments)},s=function(){},i={},u=[],l=[];function v(e,t){var n,r,o,i,a=l;for(i=arguments.length;2<i--;)u.push(arguments[i]);for(t&&null!=t.children&&(u.length\|\|u.push(t.children),delete t.children);u.length;)if((r=u.pop())&&void 0!==r.pop)for(i=r.length;i--;)u.push(r[i]);else"boolean"==typeof r&&(r=null),(o="function"!=typeof e)&&(null==r?r="":"number"==typeof r?r=String(r):"s

Chrome Cache Entry: 404

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2121)
Category:	downloaded
Size (bytes):	213789
Entropy (8bit):	5.520080267201723
Encrypted:	false
SSDEEP:	6144:GGM8Mc12cQzfO1M2fSFBOsmprj8ZYvK4mR0oQI4poXQbTVV9/boDFV:R3Mc12cQzfO1MsSFBOsmproZYvK4mR0s
MD5:	0DD73F10DAB655D7F60AD6C7B61150BF
SHA1:	A8E5C5180EE9A240140AA7C487E25B393556E361
SHA-256:	6A7D202BD9095256FF74729F769F9D52402E8984CC7223C33597BC14705E0D3A
SHA-512:	0DB53526E1D8B7F84D26D24C9C1AD7651A8EE293574634CF19345818D61209FD7F04D3AE7CCEFAADB2DE6B4EA058E4282BBA23F52CA1BB7D50B26B11B6EB2C7D
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.ZEEp2pdSHOQ.2019.O/rt=j/m=qabr,q_dnp,qcwid,qapid,q_dg/exm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/rs=AA2YrTvRRKYp7I5vTn-AtFvme6Qlo6hq9Q"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.le=function(a){return _.wb(a)&&1==a.nodeType};_.me=function(a,b){if("textContent"in a)a.textContent=b;else if(3==a.nodeType)a.data=String(b);else if(a.firstChild&&3==a.firstChild.nodeType){for(;a.lastChild!=a.firstChild;)a.removeChild(a.lastChild);a.firstChild.data=String(b)}else _.je(a),a.appendChild(_.ke(a).createTextNode(String(b)))};var ne;_.oe=function(a,b){b?a.setAttribute("role",b):a.removeAttribute("role")};_.pe=function(a,b,c){Array.isArray(c)&&(c=c.join(" "));var d="aria-"+b;""===c\|\|void 0==c?(ne\|\|(ne={atomic:!1,autocomplete:"none",dropeffect:"none",haspopup:!1,live:"off",multiline:!1,multiselectable:!1,orientation:"vertical",readonly:!1,relevant:"additions text",required:!1,sort:"none",busy:!1,disabled:!1,hidden:!1,invalid:"false"}),c=ne,b in c?a.setAttribute(d,c[b]):a.removeAttribute(d)):a.setAttribute(d,c)};var te;_.se=function(a,b,c,d,e,f){if(_.Ob&&e)return _.qe(a);if(e&&!d)return!1;if(!_.Mb){"number"===typeof

Chrome Cache Entry: 405

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 31275
Category:	downloaded
Size (bytes):	8974
Entropy (8bit):	7.977228968177532
Encrypted:	false
SSDEEP:	192:Dsqzyf1ir4E3WACiquk4iTb2tadsxqp0V7zWFIrMthB75hmRz5dm:DL+s5JQTbndsxqpyeIwjUg
MD5:	622F24308EAF40BF90BA625E020082D3
SHA1:	9EA502E081CC1500A9979FBB89AC603CDA2B7B84
SHA-256:	D7008B742CA57DEBD201122F38B7D82E416384FE1F4ECA498D9AD63AB6BF6D2C
SHA-512:	61404413C8847A960091439777918A5A44A081C3174DD232939D44F1E571C24D6700FEC4690AD7669B2D79C842AD990765C8A8BB1F1AE7D4B588F521897E9838
Malicious:	false
URL:	https://cdnssl.clicktale.net/ptc/05d32363-d534-4d93-9b65-cde674775e71.js
Preview:	...........=kW....9....^l.Y~@.......B`........mk.%.$.x..}..!...!.......]]]]]]]U......."t..Xk7.o..f{K;.\..oyD;......s+&~....q....~x5w}'.....^pgyZW+.xz.....r=..2R.L.D..^....PR.,J.3#;t'q.(&r.)i.H....(..y.w4..t.!..r.j5._#...mcN...z.Uw.lm........7u.!o.m.{...kA...d...1.. .....5&....+"._.oZ..KVu..#....c..NM{......5'.w..n..Z4!....ml.5.......v..n...il.....n.R..L..G..l..6...P..i-HkAZ..Z....[ dm..U.{f..m....?..h...^..........nm...=..a..j..........ko..ug.....~...?..n..........o......ow6.v}....v....~C..d.S 7.y8....n.a.......H?...^.....0...FVg5d...wM%....y^0'.HR.U.....v..}.\|.?.FG..s...\|q..\\|...O./..........n.G......yqyu9.D..C.....e.o._N...=....MO,.px.^.C"O;...\|........(A;....x..:.r>.2.^.Y.y.......B.....?.E...9..R.f..'..G..b.+`......:.-.O{_.....}....g.......y.....+......j.){u..._Y...'..W_~.].......j><..M....)e.Y&*D..Y.6H.?..y.S...T.y.&.%..T........lN. ........\.t....x.....q.....C..a....OT...a.0.0.......X...d.]...I.T....lj...Jv....(...

Chrome Cache Entry: 406

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (35889)
Category:	downloaded
Size (bytes):	635951
Entropy (8bit):	5.980365128502927
Encrypted:	false
SSDEEP:	6144:zcLEI6EHjzfFRpe5tS/BGNgCcNaGjXo0j0QgULM9C4Pt4IHenpNydC0cS2:4LEI6EI5siQgm4Pt4IeNyU0cS2
MD5:	C07B82AF62975C671DB84C21637367AB
SHA1:	D8173B503EC4C6932DA627771F8984109A82B135
SHA-256:	14894CCA622796840120C76F5BBB54E0698990F34A5846E385B942A5A26D87DD
SHA-512:	4EE3086300000607698C09D2A7514B65734058F05C05B7115E9D95622F880DAD9EADE29653E701262749AA74F08EED54300D0B33F3C1A91B52533BF04E235154
Malicious:	false
URL:	https://www.google.com/search?q=directx+runtime&oq=directx&gs_lcrp=EgZjaHJvbWUqDQgBEAAYgwEYsQMYgAQyDwgAEEUYORiDARixAxiABDINCAEQABiDARixAxiABDINCAIQABiDARixAxiABDIKCAMQABixAxiABDIKCAQQABixAxiABDIHCAUQABiABDINCAYQABiDARixAxiABDIHCAcQABiABDINCAgQABiDARixAxiABDINCAkQABiDARixAxiABNIBCDQwNjFqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8
Preview:	<!doctype html><html itemscope="" itemtype="http://schema.org/SearchResultsPage" lang="en"><head><meta charset="UTF-8"><meta content="origin" name="referrer"><meta content="AjoCq8Zg5PcXgfl/SoTikc1e/dzQCdxW0fvo8FxmdXtMpTHFSPThDszr2GTn4aDO9n/lpkW3Zv/js+E6AktuqgkAAABveyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkxvbmdBbmltYXRpb25GcmFtZVRpbWluZyIsImV4cGlyeSI6MTcwOTY4MzE5OSwiaXNTdWJkb21haW4iOnRydWV9" http-equiv="origin-trial"><meta content="/images/branding/googleg/1x/googleg_standard_color_128dp.png" itemprop="image"><title>directx runtime - Google Search</title><script nonce="GhlIM3-Vn8MZTzZdrVZ-yw">(function(){var b=window.addEventListener;window.addEventListener=function(a,c,d){"unload"!==a&&b(a,c,d)};}).call(this);(function(){var _g={kEI:'Kze5ZY_EKtunqtsPm7mdiAw',kEXPI:'31',kBL:'LAHw',kOPI:89978449};(function(){var a;(null==(a=window.google)?0:a.stvsc)?google.kEI=_g.kEI:window.google=_g;}).call(this);})();(function(){google.sn='web';google.kHL='en';})();(function(){.var

Chrome Cache Entry: 407

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (59832)
Category:	downloaded
Size (bytes):	99505
Entropy (8bit):	5.20600737523251
Encrypted:	false
SSDEEP:	1536:ixTfTfE8PWCgGDbn5lHij6D4/55p2/y+XlkpttBJjm:ixTfTfE8uCPIJkSm
MD5:	895E2A12062F1EE44D7D72D266904BDE
SHA1:	896B8B40961C524472FB84C4760160267A3B89A6
SHA-256:	D2AEA4BA12C00A853C03EB8EA9575338D1A21D15314B39B9A7AA039016E6FC93
SHA-512:	5673B54ECFF13BB7263EA98A554B8DEB04C5C2151B164F0A3A1411D9BB624C0395147D618C7C3381F263EAF5EECAA0E7EDC479DB9ABDC1A611110C2DC4610D2A
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/structure/page/clientlibs/experimentation.ACSHASH895e2a12062f1ee44d7d72d266904bde.min.js
Preview:	// *************************************.// config file for at.js lib.//************************************************************************.// SET TARGET PROPERTY HERE:.const at_property = window.cas.exp.target.propertyToken; // Workspace Name.// *************************************************************************.! function () {. window.tt_getCookie = function (t) {. var e = RegExp(t + "[^;]+").exec(document.cookie);. return decodeURIComponent(e ? e.toString().replace(/^[^=]+./, "") : ""). }. var t = tt_getCookie("MC1"),. e = tt_getCookie("MSFPC");. function o(t) {. return t.split("=")[1].slice(0, 32). }. var n = "";. if ("" != t) n = o(t);. else if ("" != e) n = o(e);. if (n.length > 0) var r = n;. if (n.length > 0 && at_property != "") {. window.targetPageParams = function () {. return {. "mbox3rdPartyId": r,. "at_property": at_property,. ...(win

Chrome Cache Entry: 408

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
Category:	downloaded
Size (bytes):	15552
Entropy (8bit):	7.983966851275127
Encrypted:	false
SSDEEP:	384:HDKhlQ8AGL0dgUoEGBQTc7r6QYMkyr/iobA2E4/jKcJZI7lhzi:jslQ+LhUoTB0Qr6Qjkg/DmcJufzi
MD5:	285467176F7FE6BB6A9C6873B3DAD2CC
SHA1:	EA04E4FF5142DDD69307C183DEF721A160E0A64E
SHA-256:	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
SHA-512:	5F9BB763406EA8CE978EC675BD51A0263E9547021EA71188DBD62F0212EB00C1421B750D3B94550B50425BEBFF5F881C41299F6A33BBFA12FB1FF18C12BC7FF1
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......<...........<Z.........................d..z..J.`..L.\..<.....<.....^...x.6.$..6. .... ..S..}%.......\|....x..[j.E...d..-A...]=sjf$X.o.5......V....i?}.\...;...V......5..mO=,[.B..d'..=..M...q...8..U'..N..G...[..8....Jp..xP...'.?....}.-.1F.C.....%z..#...Q...~.~..3.............r.Xk..v..7t.+bw...f..b...q.W..'E.....O..a..HI.....Y.B..i.K.0.:.d.E.Lw....Q..~.6.}B...bT.F.,<./....Qu....\|...H....Fk.-..H..p4.$......{.2.....".T'..........Va.6+.9uv....RW..U$8...p...........H5...B..N..V...{.1....5}p.q6..T...U.P.N...U...!.w..?..mI..8q.}.... >.Z.K.....tq..}.><Ok..w.. ..v....W...{....o...."+#+,..vdt...p.WKK:.p1...3`. 3.......Q.].V.$}.......:.S..bb!I...c.of.2uq.n.MaJ..Cf.......w.$.9C...sj.=...=.Z7...h.w M.D..A.t.....]..GVpL...U(.+.)m..e)..H.}i.o.L...S.r..m..Ko....i..M..J..84.=............S..@......Z.V.E..b...0.....@h>...."$.?....../..?.....?.J.a,..\|..d...\|`.m5..b..LWc...L...?.G.].i...Q..1.:..LJV.J...bU.2.:\.kt.......t.....k....B..i.z+...........A.....

Chrome Cache Entry: 409

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (793)
Category:	downloaded
Size (bytes):	798
Entropy (8bit):	4.840710092597515
Encrypted:	false
SSDEEP:	24:IW/2NhwN/2NhJ/2NhV/2Nhx/2Nha/2NhM5/kNS/2NhPNS/2Nh//aFZNv0hS/amo7:I1NhjNhMNhwNhUNhRNh7pNhlpNhKFPvG
MD5:	F8EC880992BF2DE9C65B8A2C6B777C1B
SHA1:	1A96EE2405C40A7FB1A77EEF91AEF75672355E1D
SHA-256:	7FADE62EDF55226B9DF2F02DB5DC039A9E9BB0C6AD4BA57D9D88E186AF99A308
SHA-512:	D4FB61CC3A83D3899EB6606868842BDDB035123CF8729C7D8EA9B6CE15E7177ADC5CA3D0F57AAAED0E6AC44B5EC364DECEE8B043664BFF66A256837759BBAF95
Malicious:	false
URL:	https://www.google.com/complete/search?q=directx%20runtime&cp=0&client=desktop-gws-wiz-on-focus-serp&xssi=t&gs_pcrt=3&hl=en&authuser=0&pq=directx%20runtime&psi=Kze5ZY_EKtunqtsPm7mdiAw.1706637100809&dpr=1&ofp=EAEYmt2AsYTlt4qZARiPudHq0c6fql4YgaO3xcKSu56sARjkytS0h6-x9-4BGLipu9fGg9r-KjLkAQoaChhkaXJlY3R4IHJ1bnRpbWUgdmFsb3JhbnQKDAoKZGlyZWN0eCAxMgofCh1kaXJlY3R4IHJ1bnRpbWUgZnJlZSBkb3dubG9hZAolCiNkaXJlY3R4IHJ1bnRpbWUgZG93bmxvYWQgd2luZG93cyAxMAoMCgpkaXJlY3R4IDExChUKE2RpcmVjdHggMTIgZG93bmxvYWQKLAoqZGlyZWN0eCBlbmQtdXNlciBydW50aW1lIG9mZmxpbmUgaW5zdGFsbGVyChsKGWRpcmVjdHggb2ZmbGluZSBpbnN0YWxsZXIQRw
Preview:	)]}'.[[["directx runtime\u003cb\u003e valorant\u003c\/b\u003e",0,[71,598,432]],["directx\u003cb\u003e 12\u003c\/b\u003e",0,[71,598,432]],["directx runtime\u003cb\u003e free download\u003c\/b\u003e",0,[71,598,432]],["directx runtime\u003cb\u003e download windows 10\u003c\/b\u003e",0,[71,598,432]],["directx\u003cb\u003e 11\u003c\/b\u003e",0,[71,598,432]],["directx\u003cb\u003e 12 download\u003c\/b\u003e",0,[71,598,432]],["directx\u003cb\u003e end-user\u003c\/b\u003e runtime\u003cb\u003e offline installer\u003c\/b\u003e",0,[71,598,432]],["directx\u003cb\u003e offline installer\u003c\/b\u003e",0,[71,598,432]],["directx runtime\u003cb\u003e download\u003c\/b\u003e",0,[512,650,67,432]],["\u003cb\u003emicrosoft visual c++\u003c\/b\u003e",0,[512,650,67,432]]],{"q":"eIkzPialZzn79glqb-1mrrs-Wpw"}]

Chrome Cache Entry: 410

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUkrllHh/:qJ/
MD5:	C2196DE8BA412C60C22AB491AF7B1409
SHA1:	5FBD472222FEB8A22CF5B8AA5DC5B8E13AF88E2B
SHA-256:	6ADC3D4C1056996E4E8B765A62604C78B1F867CCEB3B15D0B9BEDB7C4857F992
SHA-512:	84E24A70B78E9DE9C9D0DFEB49F3F4247DBC1C715D8844471EE40669270682E199D48F5FBEC62BD984C9C0270534B407C4D2561DD6C05ADEC3C83C1534F32D5C
Malicious:	false
URL:	https://bttrack.com/dmp/adobe/user?dd_uuid=35050774984483340004567475019318048768
Preview:	GIF89a.............,...........D..;

Chrome Cache Entry: 411

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4773)
Category:	downloaded
Size (bytes):	4778
Entropy (8bit):	5.801118837470418
Encrypted:	false
SSDEEP:	96:r4DlidkH6666uZR/JsahD4c9iU4Fd66666+UFEkOYAwoYZQq1gChN+fffQo:r45pH6666mfF4Fd66666+UFETxWyqaCQ
MD5:	AEAA2E16005A82D4A6B2110B1FD5032F
SHA1:	75CE15B9594C9E2CBB7B6E2045A775114811A733
SHA-256:	88F102614028DC65B22F9B5D8391F6520A41341F4CACFB98C4914A452B808221
SHA-512:	BBE2B25F73C5B520134EDDAE1172D97BF22DC06FC93867CD595D0E9FBA257BF400B09C6DAC1E62CD504E44489C6C2F0BAE140EF059CB557E567CC5736ECE9040
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["jorge polanco minnesota twins","philips cpap machines","metazoo games shuts down","season 9 overwatch patch notes","tekken 8 tier list","jeff goodman college basketball","royal caribbean largest cruise ship","iphone new emojis 2024"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"CgovbS8wemJjel8zEi5Kb3JnZSBQb2xhbmNvIOKAlCBEb21pbmljYW4gYmFzZWJhbGwgaW5maWVsZGVyMrMIZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFDOEFRQU1CSWdBQ0VRRURFUUgveEFBYkFBQUJCUUVCQUFBQUFBQUFBQUFBQUFBQUF3VUdCd2dFQWYvRUFDd1FBQUlCQXdNREFnUUhBQUFBQUFBQUFBRUNBd0FFRVFVU0lRWXhRVkZoRXlPQjhBY1ZNak5DY1hML3hBQVlBUUVBQ

Chrome Cache Entry: 412

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 23699
Category:	downloaded
Size (bytes):	8475
Entropy (8bit):	7.976047132029867
Encrypted:	false
SSDEEP:	192:kwfONBDOiBSMufJfjpQDwVyk9Yu99X/ZQ6n9RmDYId9ScuQqGbd:kriiBYAEVjmwhZ1nLm0Id8cWg
MD5:	EDECE269E6F9D5647CB3D02A5B55C732
SHA1:	23BBFEE35A55D1A82400E54FC33F1D422D9CA076
SHA-256:	A5B862B3213DA46C20F2D8ED4728EEC7180D1356A348EEDFE7A644FC730EF247
SHA-512:	433CAE1865844F0001D598DAE1783571C2A8E00002E17B970651219FF127BF9EA66A3D6ACE719D2239D5B7265F1DD524A9406FCD8F82F0B9EE6755DA66B0F32E
Malicious:	false
URL:	https://cdnssl.clicktale.net/pcc/05d32363-d534-4d93-9b65-cde674775e71.js?DeploymentConfigName=Release_20230511&Version=2
Preview:	...........\iw.F..<:'..B.Q.......a.#S.-G[$y.%..4ID$.....\|.....J...y.P@....ZnU7.j).`..z.a.l..?6..[.Jo.97.l...m...s....S.?.n.;.w..fV..(..H....f3.qn..;.q........wk..6=...8m..0rBo.G...'..Kj4..(.......I.O}'.._.t....P......a.a0r........cT}.l.....<...h.7/:K..L&ap.....Mx.`...........M.<.....N.T..Z./..Z...vh...y....v..E<..~..1&.Y..h)K+.<..5....=\|.r.<.....[0k.CC...;7....l.'.G..g.(y..)..^_..Bw.X..r...HV.K.......e).S..}...^x@.h..@...:)...K=4...+..8..A...P.+..FUC.Wh..X.2_...\|y.%.jz...E....J.../..`....Y.....T.y...9...^.u...,..&.....i....e}kz...uK].]%.E.Z...5..(.g#L.0p.`...t{.........e>.;c....d.V.L.i.sI...5G..........i`.....z.z.I....\..,5.F..D9O...7....s..[U....`.m8....e.!{h.3...:..,i.......y......c`\|..G0.Y.j :....w1..Z-.6..TS.K.&..?..._....3.s:...B-]...f.n.er,...^8...$.jY.....C. e/...c......&c)...)V.e.x.cj..q.3b.`...N2..~Z..MF^..M..R.Z7...i......^W..qX...u;.....X.%.......]..ek.n..[....h.k5.i.......7.......w....R2.>..a&.y.B.r.h.\|2b....

Chrome Cache Entry: 413

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3391)
Category:	downloaded
Size (bytes):	54875
Entropy (8bit):	5.575792868234819
Encrypted:	false
SSDEEP:	768:qx+1I9g0BVtvbZWK9QkqiUfg+ia0LQq8Y/rIb/ONdwQal5n:qL9xzFlfQcPOS/r0Cyn
MD5:	9E66933C55ACF0D6D09FC22EFCAB40AA
SHA1:	EBF4E03B393A2E577E497A749BD9D76A6749CC50
SHA-256:	4144837CC86147F6A2D6CC23D54734CE688FD0823A372C2C53E2E330EB1EF0EE
SHA-512:	3E9B0FA574FAFC8E2D4F75E70B06BB46B4B25824163C0DC2FD87B3DAB7976B9EBA45BE2EE38BF8E5204EC0487B36ECAFC1E37506954F74D0ADBFD1F0D7F5253A
Malicious:	false
URL:	https://www.youtube.com/s/player/6ee8f9ce/player_ias.vflset/en_US/embed.js
Preview:	(function(g){var window=this;/. SPDX-License-Identifier: Apache-2.0 /./.. Copyright Google LLC All Rights Reserved... Use of this source code is governed by an MIT-style license that can be. found in the LICENSE file at https://angular.io/license././.. Copyright 2017 Google LLC. SPDX-License-Identifier: BSD-3-Clause./.'use strict';var Oob=function(a){a.mutedAutoplay=!1;a.endSeconds=NaN;a.limitedPlaybackDurationInSeconds=NaN;g.uT(a)},Pob=function(){return{I:"svg",.Y:{height:"100%",version:"1.1",viewBox:"0 0 110 26",width:"100%"},V:[{I:"path",Ec:!0,S:"ytp-svg-fill",Y:{d:"M 16.68,.99 C 13.55,1.03 7.02,1.16 4.99,1.68 c -1.49,.4 -2.59,1.6 -2.99,3 -0.69,2.7 -0.68,8.31 -0.68,8.31 0,0 -0.01,5.61 .68,8.31 .39,1.5 1.59,2.6 2.99,3 2.69,.7 13.40,.68 13.40,.68 0,0 10.70,.01 13.40,-0.68 1.5,-0.4 2.59,-1.6 2.99,-3 .69,-2.7 .68,-8.31 .68,-8.31 0,0 .11,-5.61 -0.68,-8.31 -0.4,-1.5 -1.59,-2.6 -2.99,-3 C 29.11,.98 18.40,.99 18.40,.99 c 0,0 -0.67,-0.01 -1.71,0 z m 72.21,.90 0,21.28 2.78,0 .31,-1.37 .

Chrome Cache Entry: 414

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	249779
Entropy (8bit):	5.263880396625408
Encrypted:	false
SSDEEP:	6144:hgz0YiZfbdrRzYCkSrHS/G1/s/Wv8ie/OTdmBzhpeCZx+8IHfrogGROY7:hy0YwfJrRzYCkS7S/G1U+v8ieGTgBzDV
MD5:	148BAE31B9517E0AC2D0CDF8DF872CB5
SHA1:	06C5902947C4D0A968657A637ADA0FB12847213F
SHA-256:	F8B858C249BB83471C6868C199FAF5E4407220D89647C0C535694D3C9C91568E
SHA-512:	B0DDD341571EDD962A31C8987A5B67640A63A964ADD4B4D5D61799D8DC7326A7610CBB8D49765E7FCF62EB7F0B903D4839EB262F6206BA28EA6C336CE036F24D
Malicious:	false
URL:	https://www.google.com/xjs/_/js/md=1/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w
Preview:	{"moduleGraph":"quantum/t7xgIe/ws9Tlc/cEt90b/qddgKe/yxTchf/sy75/sy76/sy77:6,7/sy78/xQtZb:5,8,9/sy79/R9YHJc:8,b/KUM7Z/wrzEXb/TxCJfd/WVDyKe/sy7a/Vj9hpd:g,h/tafPrf/dtl0hd/lLQWFe/Il1M4b/eHDfl/FONEdf:k/JiVLjd:k/FAUdW:k/Z1Rg0/dMZk3e:n/ofjVkb/qaS3gd/T9y5Dd/yiLg6e/Q7BaEe/tRaZif:v/F2pEhc/n73qwf/UUJqVe/MpJwZc/sy7b/nAFL3:13/sy7c/NTMZac:15/sy7d/sOXFj:17/sy7e/oGtAuc:19/sy7f/sy7g:1b/byfTOb:1c/sy7h/sy7i/sy7j/sy7k:1g/sy7l/sy7m/LEikZe:1c,1e,1f,1h,1i,1j/sy7n/xUdipf:1l/sy7p/sy7q:1n/sy7o:1l,1o/sy7s/sy7r:1p,1q/sy7t/NwH0H:1m,1r/sy7u:1j/sy7v/gychg:1k,1t,1u,1v/Ulmmrd:1w/rJmJrc:1b,1g/GHAeAc/Wt6vjf:1g/lsjVmc:1f/IZT63/Vgd6hb/sy7x/sy7y/sy7z:24,25/YNjGDd:26/iFQyKf/sy81/sy82:29/sy80:22,26,2a/PrPYRd:27,2b/sy83/vfuNJf:2d/sy84/hc6Ubd:28,2c,2e,2f/sy85:13,19/sy86:2a/sy87/q0xTif:14,15,17,1a,2c,2h,2i,2j/rLpdIf/w9hDv:1t/JNoxi:1x,2m/SNUn3/ZwDk9d:1l/RMhBfe/U0aPgd/io8t5d/sy88/KG2eXe:2r,2s,2t/Oj465e/sy89/FloWmf:2u,2w/Erl4fe/RuUrcf:2v/JsbNhc/Xd8iUd/sy8a/d7YSfd:6,7,30,32/sy8b/sP4Vbe:34/ul9GGd/kMFpHd/sy8c/sy8d/sy8e/sy8f:38,39,3a/

Chrome Cache Entry: 415

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3572), with no line terminators
Category:	downloaded
Size (bytes):	3572
Entropy (8bit):	5.150427128484097
Encrypted:	false
SSDEEP:	48:vZUJVKL8MJEcoh8KFRzZZUvGCUvGUzHgrOLRhnqhfUccCg8It8ubY8Dvw:yJYIco5qKgrOvQg8It8uk8Dvw
MD5:	D923D2CDDF399AAA316D07E3BF17FD57
SHA1:	2665E116E833D1320F802328FBD7F43BC67997F7
SHA-256:	6480AE45A1E662EE46BA6A1D305AB2AE1EC8E45AF9FA7C95D71CAEFA443E45CA
SHA-512:	5EBBE8FCE11F8E4FD8B30A4ED6FD22F9F634358FF45860ABA564D1FE2E91A3C61C5A57BEF59688917DD3F757DCEB58626DF05F3EF9F1EF652FE6F793606E3BE5
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.8RUPaHb7e5o.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTungzasoekTaLKrPFUaQFpakqDmnA"
Preview:	.gb_2e{background:rgba(60,64,67,.9);-webkit-border-radius:4px;border-radius:4px;color:#fff;font:500 12px "Roboto",arial,sans-serif;letter-spacing:.8px;line-height:16px;margin-top:4px;min-height:14px;padding:4px 8px;position:absolute;z-index:1000;-webkit-font-smoothing:antialiased}.gb_Dc{text-align:left}.gb_Dc>*{color:#bdc1c6;line-height:16px}.gb_Dc div:first-child{color:white}.gb_na{background:none;border:1px solid transparent;-webkit-border-radius:50%;border-radius:50%;-webkit-box-sizing:border-box;box-sizing:border-box;cursor:pointer;height:40px;margin:8px;outline:none;padding:1px;position:absolute;right:0;top:0;width:40px}.gb_na:hover{background-color:rgba(68,71,70,.08)}.gb_na:focus,.gb_na:active{background-color:rgba(68,71,70,.12)}.gb_na:focus-visible{border-color:#0b57d0;outline:1px solid transparent;outline-offset:-1px}.gb_i .gb_na:hover,.gb_i .gb_na:focus,.gb_i .gb_na:active{background-color:rgba(227,227,227,.08)}.gb_i .gb_na:focus-visible{border-color:#a8c7fa}.gb_oa{-webkit-box

Chrome Cache Entry: 416

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 17287
Category:	downloaded
Size (bytes):	6053
Entropy (8bit):	7.965159795721513
Encrypted:	false
SSDEEP:	96:HmVhDJ9WQrTRQ0cx/pjx2O5ZM/vZbh6LHx8oHNMVfjXEtmInnxA5gwDFfZENGS2D:H8DDWCRQ0cxBoO5ZM/Bh6KoGVbMnxArR
MD5:	1155384D5F5147F65B1AF4B53462001F
SHA1:	9EB3E27A2B430BC319F6AD66B0228121986F1F22
SHA-256:	7BE5DAB3CA105A155D746511F3154E5C2AEB5D8CBA0D19B7743B84DD09BD9996
SHA-512:	F2D855837CC8D3CD541AC8FFDB0366B6500AFFC1CF3E1868364FE201B9BC9F4C9CAFDDBF7968A48E11C5A4446CF4083EB85C6E3A98F16888D82D93AA182EF6F6
Malicious:	false
URL:	https://logincdn.msauth.net/16.000/content/js/MeControl_MhktgtiMAnSkSgiYU2_TkQ2.js
Preview:	...........;kw..........I.l.......-..KO.,+.[..........$[v........h^..).y.(M6..[.9.L..,.`.l.<....?....sA-.Z..9/.6s.r...y.1.v#J.%\....,cw.....HK..p..]..p.s.,.......y.E..$u...)..w....6k..'..1b..4.....G#{..9z...`....8JBq{2.........-."=NoDv.ra;.\|...-.;}..".....{;....").cQ.....wG!.X^.lc...k.$...O....HpH.'.8F.h:....-..3.i..<....%j.X......a..v......"..?....P...-.@..)\...H.n....f.p.8..=.L.B.m.V.][.`..Dd......wi]....Q...?..<.om............A....(..I..K...(.;....Z...Ot....\R...}9.Q..zY......Y..-.1pV..=q.0h......F....sIZ..b.yM.z..B..P..+?L..H0..(.l.......K.'.q.K?.7.'........q.~o0.T.<.w:R..<._ g...CD...=..L......0..]........g@b@..y..K....I..HM....MM.....<$jh.0.\\.Bw.......lY.."k_;......#?..G.`...(.`.(..`F.eutoI......D.R./........5..d. .q...v.M...x..f".I.....sxWa.....ypH_n./........f3."6.) ....mQ.oqxR..`.4...\PCc..Q......34....Anw.~.....6~..C...<..u.GA,...\|....t.Kc.8.`C.....Q>...{......h...J.........Q ..\.....eyf..D....X._Nk.p.m...<.J+.3

Chrome Cache Entry: 417

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 64x64, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	894
Entropy (8bit):	7.648721307268807
Encrypted:	false
SSDEEP:	24:Y0ak3HVQR/Q922GFwcByrv0xxyvtl5Aeu393Sn:YrkkY9aFFByLpvtUVN3S
MD5:	DE5AE51FA3823280AC95133776927739
SHA1:	A703861BB157C9B1879FA7CDEC9647B91324352C
SHA-256:	275CB645B678002017F2152774FDD9B0EFC8986D828B11BE5BA450E539D048DC
SHA-512:	68F9A0F92155C53FC1FC8AA093CA7F860D346B6AE818423DC11CE8D92CFC72884F55BF55697B1F9CDA9ABC6E6381CA8C17BF4B336D45CE1A922C892080F9C6B3
Malicious:	false
URL:	https://cdn-dynmedia-1.microsoft.com/is/image/microsoftcorp/icon-MSCOM-X-64x64?scl=1
Preview:	RIFFv...WEBPVP8 j...P....@.@.>...A.@......mK._....P...q...0....?.<.8..9.I...S.../..a....~3l..-.G..........e...F.......;.............r.....<....o..g.Z.x..xw....;.-..e.E6(d....g. <W.....0@.......Z.Y..G6..]Q.Q2+..Ab..C.i\...s,.%..XA..o.t.\|.M...`i[>......8d..........y...:...~3..........;iq...]\..VO.H7h...{....c.Q....<.`......s.P...UY...OFb{.0&h.w\|...p...x...5.-...+.o+.p .M..[....W1..m;....fy6.C^...........6..\.....J..b.........\6....E..;B..^;.E...f>..H;.....g.zr{~..K...i..4.`2R..~..U...F.i.).Xz.i.......P.'....E..3.....Ui...s.;o.C_.q.K...I......`..5%..Km.O~..%..0..=..X...-.x.@..j..g......i.Q.u{u...d._...fT`f..d2....J.....yJ...Di..q...,iC..9J@..z..x...,.....U3...:.h....!........g.-............\...\Gm.w.....r..F.@.\@\.u._O.......]?.s...'c..f.2......B7...W.%)....S.....Nw@.,.......(....q.."J_$...0....3a..y....s..;._.G..?.\$]........G.....[n....

Chrome Cache Entry: 418

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 419

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 148x83, components 3
Category:	downloaded
Size (bytes):	3850
Entropy (8bit):	7.888267443386447
Encrypted:	false
SSDEEP:	48:r8tO4JJwlKRf64w72X703LZoXUccHMX0VAb/pCGt0YyxkNtFfdXLvWGYPMcwbiUN:H0GmfHbaZoXUw0w/L/f9LyEHqE
MD5:	0731E29596C247CDB5892757D7724EE8
SHA1:	7C5E908475A543A7404D9B844B84EEE93271BFDA
SHA-256:	E624DB49E4FA45963A2F1E7FC66F3D440F168BD727864E45D77E18C1AE8DD2F6
SHA-512:	1E5955DCC50B4FE28E948F227161238A8B23A421B9B53BC55AF44CE057C8D8781764AEDFFFCA05073F769D0A48B667DD2B222F21760DF5AFE685894F1A4FB435
Malicious:	false
URL:	https://i.ytimg.com/vi/m5Xz14RNOEE/mqdefault.jpg?sqp=-oaymwEFCJQBEFM&rs=AMzJL3k77br3KKy0bjWbmhAEHJOrBx75iw
Preview:	......JFIF......................................... ."" ...$(4,$&1'..-=-157:::#+?D?8C49:7...........7%.%77777777777777777777777777777777777777777777777777......S....".......................................<.........................!.1.."AQa.#2Bq..5RSr...3b...$%c.................................1........................!1..Qq.3ARa..".......2.............?....3Y...q....f.b.G.f`....2M.QHnf.....dh.......r@.+,.h...t...YU..P3L...;.cy.g.eK.Y~.. {..Oj.&...T5.e.v..#..<.~.8<..A}...U;.o...3VQh......c'S.........~..z..$m"..Hr...1...p.v.@..6..!...o...f....\...I..#R...,...H..3.d...MN.J.Z..t.2.>..&.<..v..I}.0\:.~..U..j.o.j.,..!......(9#,.#.Eb....4f.S.%dF\..5...X .1.)E[c.p....Wf..(..RN.Keg.K...=......I...z..%.\%..P...{.j..........[..To..J.i..s..Z^%..!&u.:.#$}.H.>DV.D^....S......{..Y'...D^....S.../.......A.3S.......8.'.n....0.{...)./..H=.ZW..yY...`'...M.....;..+.y$s.TJ........F.{$.ZZ..v.m.2.D..c....y.....:.....>$..W.....7v.hdH..m.M ..q.F..*..P m..>^....x.....%X5.+..

Chrome Cache Entry: 420

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:HCYpY:iYpY
MD5:	5030B8DD100353DBECBEA12B494B8223
SHA1:	697F7637DB6E2505825AE786D77EC950D40B6FB2
SHA-256:	3A34E72278612B8E567A4529475F092D32436F32B438E54FEB7DF87B7083B32A
SHA-512:	AAD443C3B439863065C9AD7982608B377BB95920BA4BA4F2610D3EA0765ACB67C1732B10D36CD94DAE7303241E8FE4BC5D065A9DD094E09CC9D9E89298E14397
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAlL1An4iaKj4hIFDUqFnlI=?alt=proto
Preview:	CgkKBw1KhZ5SGgA=

Chrome Cache Entry: 421

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	70
Entropy (8bit):	3.577769619550495
Encrypted:	false
SSDEEP:	3:CUul/Re/FemxhkYltxlzeze:E07ize
MD5:	58A7930CD4577FC33C35828C271EAB8F
SHA1:	406E57F86DC101E10F3A57BE1E2F7B93C4580474
SHA-256:	8D70B3E6BADB6973663B398D297BB32EAEDD08826A1AF98D0A1CFCE5324FFCE0
SHA-512:	F7A5F748F4C0D3096A3CA972886FE9A9DFF5DCE7792779EC6FFC42FA880B3815E2E4C3BDEA452352F3844B81864C9BFB7861F66AC961CFA66CB9CB4FEBE568E8
Malicious:	false
URL:	https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&domain=www.microsoft.com&ttd_tpi=1
Preview:	GIF89a...................!..NETSCAPE2.0.....!.......,................;

Chrome Cache Entry: 422

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	4.142295219190901
Encrypted:	false
SSDEEP:	3:lZOwFQvn:lQw6n
MD5:	1FA71744DB23D0F8DF9CCE6719DEFCB7
SHA1:	E4BE9B7136697942A036F97CF26EBAF703AD2067
SHA-256:	EED0DC1FDB5D97ED188AE16FD5E1024A5BB744AF47340346BE2146300A6C54B9
SHA-512:	17FA262901B608368EB4B70910DA67E1F11B9CFB2C9DC81844F55BEE1DB3EC11F704D81AB20F2DDA973378F9C0DF56EAAD8111F34B92E4161A4D194BA902F82F
Malicious:	false
URL:	https://static.doubleclick.net/instream/ad_status.js
Preview:	window.google_ad_status = 1;.

Chrome Cache Entry: 423

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	159
Entropy (8bit):	4.661188988961239
Encrypted:	false
SSDEEP:	3:agWqLss4aXD5R20gJYRnd7HtOx1L5HQhLIzseX5LxfYLk21:QqPXD5bDRd7H8L5whLzeJSI21
MD5:	C22EA5B46F3FCAD90DA0ABCC0A3F73D4
SHA1:	2DB789C63AFB63D98932D7B55907DC3508E318B4
SHA-256:	8334DAA260516BB896407461E5F10E8E3041B06C56846BBB9D3435C6E77513AD
SHA-512:	A0359F8C25DC40CEFFD14A41BA81794717B99DABE78CBF8A8678F3E3EC57F317388CA0DC55B1CC6AD2D6C13D2B3CAEB5A64527BB2C646ED2D93775437DA646F1
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/structure/page/clientlibs/featurecontrol.min.ACSHASHc22ea5b46f3fcad90da0abcc0a3f73d4.js
Preview:	'use strict';function isFeatureEnabled(b){var a=document.getElementById("customFeatureControl").getAttribute("enabledFeatures");return null!=a&&a.includes(b)};

Chrome Cache Entry: 424

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (512)
Category:	downloaded
Size (bytes):	544
Entropy (8bit):	5.221040627274746
Encrypted:	false
SSDEEP:	12:Yz+uu8HDeNucEuKEZEuwdaXOVWMsk2lntX2F3/v2d7oyxCJNe:YauZStKa5nltX2Fvege
MD5:	383B23D12DF0D9265D7569A7102C2F96
SHA1:	B78FB17F58484F5CD29B3FE307936181E1B30B57
SHA-256:	BBF608E321107D6C4EEAF31A4A0EEB9DD8A9AB825F645FA963651688FD3D3914
SHA-512:	8CA27D482871CAFF41C2D86CA743F075ED97465C12624B1841396B423229A90AFB7E62211BB02DFC0211C45BBABFD12F82EFF8863E6FD3D176FCD99C84747F60
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/cascade.component.authoring/clientlibs/clientlib-greenid.min.ACSHASH383b23d12df0d9265d7569a7102c2f96.js
Preview:	'use strict';(function(){(function(b){var a=document.createElement("iframe");a.setAttribute("src","https://fpt.microsoft.com/tags?session_id\x3d"+b);a.style.width="100px";a.style.height="100px";a.style.cssText="display: none; color: rgb(0,0,0); float:left; position:absolute; top:-200px; left:-200px; border:0px";a.title="greenID";a.setAttribute("id","greenID");document.body.append(a)})(function(){return"10000000-1000-4000-8000-100000000000".replace(/[018]/g,b=>(b^crypto.getRandomValues(new Uint8Array(1))[0]&.15>>b/4).toString(16))}())})();

Chrome Cache Entry: 425

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 21464, version 1.0
Category:	downloaded
Size (bytes):	21464
Entropy (8bit):	7.991635778215233
Encrypted:	true
SSDEEP:	384:kNMw20ZcZdIR049weTGXkBXju/W4irYjhPC09oOtbMDa9HVZycTvwxNTGup:UaxmXXSdiQPCjMvyugNiup
MD5:	923A543CC619EA568F91B723D9FB1EF0
SHA1:	6F4ADE25559645C741D7327C6E16521E43D7E1F9
SHA-256:	BF7344209EDB1BE5A2886C425CF6334A102D76CBEA1471FD50171E2EE92877CD
SHA-512:	A4153751761CD67465374828B0514D7773B8C4ED37779D1ECFD4F19BE4FAA171585C8EE0B4DB59B556399D5D2B9809BA87E04D4715E9D090E1F488D02219D555
Malicious:	false
URL:	https://fonts.gstatic.com/s/googlesans/v14/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
Preview:	wOF2......S...........St.................................`..~..<..u.....H........6.$..\|. ..r..K..........V...@yF#b...>.[<;P..@.....OINd(...T...C..T.w.s.b..$.....6+. ....R8E$..o..f."MD.@T"...fH..fX..O....AA..F....+v.Q(KpXF..U"..x@...3\|l..E..<.O..~..5M}.".q.#Y9....c.o.s...M.Cr..Dt.,..CtI.O..{D......H...+>K..:.Y..-.l.v......'.....^.Y.k..E..c..~..S..P0.@.....<.!(.P.u.g.2....y..y..Z...v.^..lu.dC.a..o....{.o....h3A.K.I..-.O,..}.c>....Q1]....($..........s..b.X..........CJ.+..4.gE4T.S.{g......(^...bA,...~..R..p...<G."..y.G...k..*'...i.u....I..S....\.......e$..m.2...{K........V......{me.%.}...P3...{.T..i..Av...K..g.... ...R..n..{m....t@Z....1A.H.2...^..R5)..4}..(...T......=...Pg...Y....y..e.$...]U..0.....8..Fs.(..O.....&..f,g..5..1.yo9..:cy...e..A.......i...i...G..4`)..#j.<+..{ai..[..[~.(,......X......3.f.m+3...B......_D.F.X.i.Y#.X......}_.d..`.i..i......T...7v..A.......?..c..~..g..w.D.H)%..B.!.......:.....ZE{........m.FN.....k...0.X...

Chrome Cache Entry: 426

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (46103), with no line terminators
Category:	downloaded
Size (bytes):	46104
Entropy (8bit):	5.3053668132686145
Encrypted:	false
SSDEEP:	768:OaOFhhRDUHahpROfRys3LzQRo4TYYyDMFWPKQ:OaOFnRrRURtzQy4ISWiQ
MD5:	7F75F159026F3A2C8CCCDA487B43157B
SHA1:	021CF5C854DB063CD79BF0394C24EB994E095640
SHA-256:	5E319852607809336B2534FFEB96F6933F26994DD040F535302C84F59CC0A214
SHA-512:	88276152EE25891D16E7B3B28A9B42CBD48D97E1A7D94C1BF5354612603868D5D537D2BA01A4E2F184E6DC6A492B67619D6A7C02DA992AD604F7D0ABEF27A7A1
Malicious:	false
URL:	https://bat.bing.com/bat.js
Preview:	function UET(o){this.stringExists=function(n){return n&&n.length>0};this.domain="bat.bing.com";this.domainCl="bat.bing.net";this.URLLENGTHLIMIT=4096;this.pageLoadEvt="pageLoad";this.customEvt="custom";this.pageViewEvt="page_view";o.Ver=o.Ver!==undefined&&(o.Ver==="1"\|\|o.Ver===1)?1:2;this.uetConfig={};this.uetConfig.consent={enabled:!1,adStorageAllowed:!0,adStorageUpdated:!1,hasWaited:!1,waitForUpdate:0};this.uetConfig.tcf={enabled:!1,vendorId:1126,hasLoaded:!1,timeoutId:null,gdprApplies:undefined,adStorageAllowed:undefined,measurementAllowed:undefined,personalizationAllowed:undefined};this.beaconParams={};this.supportsCORS=this.supportsXDR=!1;this.paramValidations={string_currency:{type:"regex",regex:/^[a-zA-Z]{3}$/,error:"{p} value must be ISO standard currency code"},number:{type:"num",digits:3,max:999999999999},integer:{type:"num",digits:0,max:999999999999},hct_los:{type:"num",digits:0,max:30},date:{type:"regex",regex:/^\d{4}-\d{2}-\d{2}$/,error:"{p} value must be in YYYY-MM-DD date

Chrome Cache Entry: 427

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	175
Entropy (8bit):	4.68043398329258
Encrypted:	false
SSDEEP:	3:agWqLs3KOBmKL8ELDSzEfYZBAeOE8c/yCN9xGV9LH1CNILWAcELDlpKOBmKL8ELQ:QqtgLSH9xGf1OILWAfkgXe
MD5:	96F0C5B1219E39B8788028F5C17A5AD9
SHA1:	D6DCE0DE065B0D13905EAEDA0BA5C0DEA3D8F67C
SHA-256:	1FC2BCE2D46DF4565B8C488B22225CFE7ADB7C37CC9A542D4F85B61995B306CB
SHA-512:	057810FA0558506C6B8ABECB1A7A58FF61DA0609B3A5798BB42DE3A9B801CA0D8B20C4C1F9A250EE33D30492452CC5C4553332B16300408AA0C45B1515D4AF10
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/cascade.component.authoring/clientlibs/clientlib-cookieconsent.min.ACSHASH96f0c5b1219e39b8788028f5c17a5ad9.js
Preview:	'use strict';function AEMOnCookieConsentChangedCallback(a){}if("undefined"!=typeof WcpConsent&&null!=WcpConsent)WcpConsent.onConsentChanged(AEMOnCookieConsentChangedCallback);

Chrome Cache Entry: 428

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 184 x 60, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3831
Entropy (8bit):	7.925889412012612
Encrypted:	false
SSDEEP:	96:OMa+Lx3VhZ25tO+44s8NUH0Rdv4RzObT1koUpwGx+F:O5+1lP+44s814RidrrGx+F
MD5:	0877987D1BE23418318D595A3A297CE9
SHA1:	F69E2644E31165BD95311C2EF6D563CFEB1BCC13
SHA-256:	FD4D9D732E7A4AF52746EBABE6BB16941EE71AE3E919131AF700CF4E1228A16A
SHA-512:	780B8DB5E9FB5F27AE8E8AFF5FE710F2BDAB37692E8AF19E1F76CA169EDE7D988DB49CEDEC92C0FFF83A89B1539A2A7C2F6922A7E15979BDFB035F9F1F910641
Malicious:	false
URL:	https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_92x30dp.png
Preview:	.PNG........IHDR.......<.......p.....IDATx..]..\E.n...n.P.D.`.r.7.cp.Mb.X..C.3"w.....kgf.phE.!.....D.9...P...X$$ ..E.......^.;...f7............5........~..D..Xc.VO..3.....:..gc..@.].SF.......Z:..}.A..'+..CLBb.BO."....=...";m.}./.?.IH...)./......<..5L...~tnq...u...i. d -e..wG.....$x...Oc)3."..L..x.y..........u...+q3c..L&!.....L$...]R.R.N..+..B..e.y..X8E..S.....bi.u."v.k.1.I...]...'l.!.../.7m..-_>i~........6.o.....IH....w..6c\|..L..t....3.....6.....D..,7...#....0..[..... .$.$x.R`..P9nb....G`. ..3...$$...HK..r..}....D.C....\.`.%$.. .$>....I..a...Hpd....3.$$........&!Q..G...7...o..b...D.l\.$../...+.......#....BOs....Kv.LX...j...Z........o=-....e...\|..2.`{.V..Or...1.;mAn.r...(..M.^VW.k.....$..S4/.v..i......ShM.....+5\....#..4HE;.=..I.\|....7XhgK..2..4".......].b.5..?JA.^..].....q.g.3..M..P..7..Q.+..............Q. f..3r5.=1...D6.L.....7-...5a...R5....u.&...V.....8=.4.-..wb.&k.1'.....^L.=;..U4.y.........,x.\.%x:.NEYm.. ...vM..78..y?-.7...(.

Chrome Cache Entry: 429

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1514)
Category:	downloaded
Size (bytes):	179225
Entropy (8bit):	5.450471029115916
Encrypted:	false
SSDEEP:	1536:g5zvv7B7fUpamMUcdjh3a2ZKYXtUkIVhsY1mIsaWdDDtPpkFAQvVbymTNYPI:irVfUpAUAxa2ntUkIVhO/dDDTqAQnag
MD5:	1419F5653BED092B5477285A1432368A
SHA1:	2E4AF4EAB1DA759D8F565834A83E35B765578750
SHA-256:	D2579FE2A1CF4734CAED990AF7A4760B98AD345C897160D4AA370BD8AA8215F6
SHA-512:	B258D66C0926EC6AD4040D2F50343B2B5BA12CDE8B3673363B12927BAD8BE18B567A6FAEFEEFD471BF8E65DE85FD63657BFF7FDB2CDE805ED456EA4F9909B6D1
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/content/detailspage/v1/detailspage/clientlibs/clientlib.min.ACSHASH1419f5653bed092b5477285a1432368a.js
Preview:	/. React v16.9.0. react-dom-server.browser.production.min.js.. Copyright (c) Facebook, Inc. and its affiliates... This source code is licensed under the MIT license found in the. LICENSE file in the root directory of this source tree.. React v16.9.0. react.production.min.js.. Copyright (c) Facebook, Inc. and its affiliates... This source code is licensed under the MIT license found in the. LICENSE file in the root directory of this source tree.. React v16.9.0. react-dom.production.min.js.. Copyright (c) Facebook, Inc. and its affiliates... This source code is licensed under the MIT license found in the. LICENSE file in the root directory of this source tree.. React v0.15.0. scheduler.production.min.js.. Copyright (c) Facebook, Inc. and its affiliates... This source code is licensed under the MIT license found in the. LICENSE file in the root directory of this source tree../.'use strict';!function(ma){function z(t){if(K[t])return K[t].exports;var N=K[t]={i:t,l:!1,exports:{}};return ma

Chrome Cache Entry: 430

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15436, version 1.0
Category:	downloaded
Size (bytes):	15436
Entropy (8bit):	7.986311903040136
Encrypted:	false
SSDEEP:	384:uJ/qNyGt74AcZEG+69hFFHDJ1CggakKt0y:+q/kAc+ohFx9YgB2y
MD5:	037D830416495DEF72B7881024C14B7B
SHA1:	619389190B3CAFAFB5DB94113990350ACC8A0278
SHA-256:	1D5B7C64458F4AF91DCFEE0354BE47ADDE1F739B5ADED03A7AB6068A1BB6CA97
SHA-512:	C8D2808945A9BF2E6AD36C7749313467FF390F195448C326C4D4D7A4A635A11E2DDF4D0779BE2DB274F1D1D9D022B1F837294F1E12C9F87E3EAC8A95CFD8872F
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Preview:	wOF2......<L.......\|..;..........................d..z..J.`..L.H..<........e..^...x.6.$..6. ..~. ..).7{...K.. .k~....".v(...[...RE.$..K..C,.'..{BK.C&.....'L!...DZ........+6.r...K..._...<..0..].V..........e.r(RN.43k;g`...?<?.......b..c.`.. .6..p...5.$zd.R%.........h....";.^WU.....H........S.j..M:..=K..\B.6"f......z.........$...%w.?$-....9.:u....u.I..Tt..s........lY...J.6oN..y...1,I.Yx..lu..}.e...Og..d...Xv.. ...iF.]..x.N..#%,y.&..,$.^.n...\.K.P.J.x...H$..-.....p.....t.v...gD^....?..6o......e....,f.)..h...P...<.:.E...X..p....U.?.[m....l.Y.S..p..%..K.,U..3U.qFZo....U...3..3.]\.C.#..9T.8P`8......P...R;..r..J.*...u.j..^vnf.v.... .pw...Z.(.6%$U.[.\|....!mU\}./..i,..7D........:t'.a;.W(.."G....q.-.Z......;J..0.&/.5. .T......w..;...t...H.t.<y ..@xx .JA.U.t..;g....@..... .t......<.5(^.\|s..Ko.O.x.....!...........lHF............So{.%..V...7..aA$....C;,"(.J..EE..@.....vOB.,V..../....B#.r+./-t.(.N.S...R.Z$4...4i.c.}t...#3`.......s..;.O,.\|..W.A.f.w.

Chrome Cache Entry: 431

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13453)
Category:	downloaded
Size (bytes):	13458
Entropy (8bit):	6.1201884866435
Encrypted:	false
SSDEEP:	384:tvbGDFHFDFPcTcoNgKpWSF3Dihj0qAD6ClBWNGSil6r:kDVVhcT5kSchjFADPBVSiK
MD5:	30360866E5484EC579F83F391D2EB619
SHA1:	3E2E4EA06E1B34D53A78F6F26E9B7D43E3BD0001
SHA-256:	4BA20327C1714693A45118E5EBA1BA4BC8544C9C43E64F06905B43A8968C35A0
SHA-512:	0D107FA813438240A62CDC6B5E7D36EC8A75B10522F8B0B6EE6FEFE5BA34466D9A50668DD4961C24070CBD78F6F0B1C749C60C5FC28E508DEE8E8CCDD0039ACA
Malicious:	false
URL:	https://www.google.com/complete/search?q&cp=0&client=gws-wiz-serp&xssi=t&gs_pcrt=2&hl=en&authuser=0&pq=directx%20runtime&psi=Kze5ZY_EKtunqtsPm7mdiAw.1706637100809&dpr=1&ofp=GJrdgLGE5beKmQEYj7nR6tHOn6peGIGjt8XCkruerAEY5MrUtIevsffuARi4qbvXxoPa_io&nolsbt=1
Preview:	)]}'.[[["microsoft visual c++",0,[512,650,67,362,308],{"zl":90000}],["microsoft visual c++ runtime",0,[512,650,67,362,308],{"zl":90000}],["microsoft visual c++ runtime download",0,[512,650,67,362,308],{"zl":90000}],["c++ runtime",0,[512,650,67,362,308],{"zl":90000}],["directx runtime offline installer",0,[512,650,67,362,308],{"zl":90000}],["directx runtime windows 10",0,[512,650,67,362,308],{"zl":90000}],["directx runtime error",0,[512,650,67,362,308],{"zl":90000}],["directx runtime valorant download",0,[512,650,67,362,308],{"zl":90000}],["the following components are required directx runtime",0,[512,650,67,362,308],{"zl":90000}],["directx runtime download",0,[512,650,67,362,308],{"zl":90000}],["house sergeant at arms",0,[3,143,357,362,308,396],{"zf":33,"zl":90001,"zp":{"gs_ss":"1"}}],["february pokemon go raids",0,[3,143,357,362,308,396],{"zf":33,"zl":90001,"zp":{"gs_ss":"1"}}],["boeing 737 max",0,[3,143,357,362,308,396],{"zf":33,"zl":90001,"zp":{"gs_ss":"1"}}],["detroit lions nfc cha

Chrome Cache Entry: 432

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65298)
Category:	downloaded
Size (bytes):	365208
Entropy (8bit):	5.092793953339902
Encrypted:	false
SSDEEP:	6144:Ckx1b3b99G9gR7N1xf6imS1b3b99G9gR7N1xf6iIyt1b3b99G9gR7N1xf6imUsPv:oNUW5fohI
MD5:	256E94375FBE1F9D3ECD055A0BCAD71A
SHA1:	B7AB3D1F99A916329F6D564B38970FE695F3D7BA
SHA-256:	C725724BCBD91F25EE206DBE74256DDE35BF5DD41960261613F50B21D18FF04B
SHA-512:	A42C5E3C84ABA4E3B8B21B81F4A454EDE7E8459B810629549CC0EC06E60F938074E6930CB4C8664B6E1AA0C9FD1E1B7391CE96AF4197A6001B5EF0DF8268F8BD
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/clientlibs/clientlib-mwf-new/main-light.min.ACSHASH256e94375fbe1f9d3ecd055a0bcad71a.css
Preview:	@charset "UTF-8";/!. MWF (Moray) Extensions v2.10.0. * Copyright (c) Microsoft Corporation. All rights reserved.. * Copyright 2011-2022 The Bootstrap Authors and Twitter, Inc.. * Copyright .2022 W3C. (MIT, ERCIM, Keio, Beihang).. */@font-face{font-family:MWF-FLUENT-ICONS;src:url(resources/fonts/MWFFluentIcons.woff2) format("woff2"),url(resources/fonts/MWFFluentIcons.woff) format("woff"),url(resources/fonts/MWFFluentIcons.ttf) format("truetype")}@font-face{font-family:SegoeUI;src:local("Segoe UI"),url(//c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2) format("woff2"),url(//c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff) format("woff"),url(//c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.ttf) format("ttf");font-weight:400}@font-face{font-family:SegoeUI;src:local("Segoe UI"),url(//c.s-microsoft.com/static/fonts/segoe-ui/west-european/light/latest.woff2) format("woff2"),url(//c.s-microsoft.com/static/fonts/segoe-

Chrome Cache Entry: 433

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 30132, version 0.0
Category:	downloaded
Size (bytes):	30132
Entropy (8bit):	7.994040282339949
Encrypted:	true
SSDEEP:	768:oE6QnF5iqE+5HV38V+SnObhyTt0VyxVQoZaFjNpa5euFhfbwV:oE9nF5nE+JVMV+fAu2VQoZaROj0V
MD5:	4C38C2A78502AF8DFBFE0F71CC49A1AE
SHA1:	4B8C845263B3696E28CF3F313E0214E22688A750
SHA-256:	1232BBDBC5D205F3C5A40EFA5ED92839C79E7879D5168445CC47645BB93F7D1B
SHA-512:	E60FFEA855BBA4241DAF68AF6BD3C1967211A215EF281C7DAC8311756A0781D00F529FF0AC5CE789238A4215EB1540C6C61C69D650CB2027C3C72CD475DD7B9B
Malicious:	false
URL:	https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Bold/latest.woff2
Preview:	wOF2......u..........uZ.........................`........\.....$....6.$........ .... ..-.......ZAj.bf p..................."Q..vG.{..9h`..xD.j.VS.....Y.g.."..D,#.C1.\|.........2....V.-v............&~;.As.m....=.@....=...w....".q..A..~..pN.q...y8...Kw.\.:}''.'zjX..%V,0...Zmf.?......9.\.w...f..,.....ag..,..q..$..r....0..El......".....].J...D:I\|:9z)$.V......L...#..\s7._...@....i}..lY....-..N.;.DC..,`v9.VCw.u.3..>.......yY.!~..8..<..{...M.B....g@...K;.....].Z..Y..^g...A{<....i..n..C...4.<.b..J..d..x...@...}.f....U.( ...`...0eF.Sh/.1T..J.]W<..].>T....>..,wv....~....%.:..{`K..NR.O.a...pS..m....DS...Z>...T..T%........3...7...N.sl...wb..............$q0$E..@p.J"..v.........+G..$..@..o.%...v..S.\tn.un...wS......M..m1..D.d.#FD.3...........c..f...#R.......~....Q8@.......}(..Im....u......=......c.....',e3a.13.pc....0......p.N..._...O.a...../.0.. ,.:.\7.....Bg......4.-.P...(..%....de+O.Q......@.m.Lq..D..\|V...X{....X..!Ii.Q.M..8..G.3.~o.GS9.....~.?.

Chrome Cache Entry: 434

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	650
Entropy (8bit):	6.513730549311324
Encrypted:	false
SSDEEP:	12:+cK/gj6qWGaFBzC6lidT4qCSNjoZaeHtp2bSwQwAuOl8Fk1:+cKYj6L7zw1HCSUNYbSBa8
MD5:	6B4216CBCD3AA02CD68FDC80979C792E
SHA1:	BB21C83624FB463D7F0C4C3154A3E2CA8E3D7DC5
SHA-256:	B51B9243527353696243A6EA257F09EB367BD9AE2E5F913ADCA8A7CAF3A1668B
SHA-512:	9165043284D0673E6C30D276BABDA70583A952C6CC48884B7B05F8231F5AFDC9B44F35ADB284FEBACC5637AB04D68E9F7D751CCEAA39496D49B349A2155FF93C
Malicious:	false
URL:	https://cdn-dynmedia-1.microsoft.com/is/image/microsoftcorp/Facebook%202x?scl=1
Preview:	... ftypavif....avifmif1miafMA1B....meta.......(hdlr........pict............libavif.....pitm..........iloc....D................p...(iinf..........infe........av01Color....jiprp...Kipco....ispe.......@...@....pixi............av1C........colrnclx...........ipma..................xmdat.............2........b..;<\|.......'M..K>M....e.M..`zha.......C.:.)O....z<.M....9.TH...v...z..6.?...GVr...w-..r]...K<KU.b.K.;.....9.9&T.X.s......6..>...en.......v..[C......T.V[...2.8.:.{.VLis...O..wi........!...\`S..T.kS.X.q7.kFG...........xp..A.*.r. ..X.7.-.=/.D{. ...7.....U.\|N +q.%v.m#.~.2......jMn..W....z...n..aQ..,.l.%.g.:.V.R.WU..f.1..<9.....

Chrome Cache Entry: 435

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 436

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	611
Entropy (8bit):	4.918393991458898
Encrypted:	false
SSDEEP:	12:t47NWQFfelFQRbjYDq9mMG6AsLwUhMOLSmvfO14KAOKtjGSdi:t4AQfefQRbjvb8BOpM4KAZjGS4
MD5:	FDCCEBFA37374F47C7DB9D31714AD6BB
SHA1:	0020EF09D5BB52460B5D0239BEF9C2F2CF9EC9FA
SHA-256:	526AAAFB82827920E07B5CE784660FAB5F01FB62F3B63968EC34317AECAA5CCA
SHA-512:	D265EE577D64E9682698F021A5E2158CF5EA0A6C887E69A90F72C45E29B9F8A3ED436F2D4DA6B4F3436EF59FF306348EC57FFD7FEFDEC969909E089E03B59528
Malicious:	false
URL:	https://fonts.gstatic.com/s/i/productlogos/youtube/v9/192px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 192 192" height="192" viewBox="0 0 192 192" width="192"><rect fill="none" height="192" width="192"/><g><g><path d="M177.44,55.09c-1.96-7.31-7.72-13.08-15.03-15.03C149.17,36.5,96,36.5,96,36.5s-53.17,0-66.41,3.56 c-7.31,1.96-13.08,7.72-15.03,15.03C11,68.33,11,96,11,96s0,27.67,3.56,40.91c1.96,7.31,7.72,13.08,15.03,15.03 C42.83,155.5,96,155.5,96,155.5s53.17,0,66.41-3.56c7.31-1.96,13.08-7.72,15.03-15.03C181,123.67,181,96,181,96 S181,68.33,177.44,55.09z" fill="#FF0000"/><polygon fill="#FFFFFF" points="79,121.5 123.17,96 79,70.5"/></g></g></svg>

Chrome Cache Entry: 437

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive
Category:	downloaded
Size (bytes):	295320
Entropy (8bit):	7.749011498049896
Encrypted:	false
SSDEEP:	6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0
MD5:	2CBD6AD183914A0C554F0739069E77D7
SHA1:	7BF35F2AFCA666078DB35CA95130BEB2E3782212
SHA-256:	2CF71D098C608C56E07F4655855A886C3102553F648DF88458DF616B26FD612F
SHA-512:	FF1AF2D2A883865F2412DDDCD68006D1907A719FE833319C833F897C93EE750BAC494C0991170DC1CF726B3F0406707DAA361D06568CD610EEB4ED1D9C0FBB10
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
URL:	https://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/dxwebsetup.exe
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......->..i_.i_.i_..\|.d_.i_.._..\|..h_..\|.q_..\|.h_.Richi_.........PE..L...!.};............................^Z...............................................J...............................................................^...#...........................................................................................text............................... ..`.data...............................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 438

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (64241)
Category:	downloaded
Size (bytes):	171312
Entropy (8bit):	5.043680996419841
Encrypted:	false
SSDEEP:	3072:jzCPZkTP3bDLH0tfRqQ0xtLfj4ZDSIpTt813viY8R1j35Ap7LQZLPPJH7PAbOCxx:jlZAW9kJeq8
MD5:	21D2E4BC29CC9BA690164F896A04C2F3
SHA1:	B07F66E6B50916D4A636C2E91F633AC8F63E5B5D
SHA-256:	47E77D470102641070B066A5A73C34DBD14989F55A3D435EFAE0FDEAAFF3AE6D
SHA-512:	8432B3B49C14CE2B2787C99F6B5C9D88CF147EB1308B13E01655B39B3677AFF4010EC8549AB5100D31391DF88A347C58E3B0F22211A48531F418B022B8F9EA11
Malicious:	false
URL:	https://www.microsoft.com/onerfstatics/marketingsites-eas-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc_moz/29-591900/68-c3a397/f4-0855a6/a8-3dc4a6/f1-3221a1/dc-d4cb46/1f-806835/44-c33a61?ver=2.0&_cf=20210618
Preview:	@charset "UTF-8";./! \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and the license under which Microsoft received Third Party Code are set forth below together with the full text of such license. Such notices and license are provided solely for your information. Microsoft, not the third party, licenses this Third Party Code to you under the terms in which you received the Microsoft software or the services, unless Microsoft clearly states that such Microsoft terms do NOT apply for a particular Third Party Code. Unless applicable law gives you more rights, Microsoft reserves all other rights not expressly granted under such agreement(s), whether by implication, estoppel or otherwise././! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css /.body{margin:0}.context-uh

Chrome Cache Entry: 439

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	170
Entropy (8bit):	5.335916817166796
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
MD5:	E7673C60AF825466F83D46DA72CA1635
SHA1:	FC0FCBEE0835709BA2D28798A612BFD687903FB5
SHA-256:	0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
SHA-512:	F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
Malicious:	false
URL:	https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WmJrM1F3QUFBR3pSMHh2YQ==
Preview:	.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

Chrome Cache Entry: 440

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	52
Entropy (8bit):	4.964580823785509
Encrypted:	false
SSDEEP:	3:VG4zQIwzslrTYx414n:VpP2slrTeT
MD5:	51F69C5968665D29DDCF3FA04BA12502
SHA1:	DF3F070FB16A36CDBFE0AABD254AD245C48E78F7
SHA-256:	1F71A318991C7794E85CE753EE8A06652CF60F53FA5FE44278F6137F422E97B1
SHA-512:	0C9F68F57CACC6A8975D64E7E36E88F56477EE25643508A88BEC0187ECBC115B6179DC82B0608AED51BE7910201E78F809C63DD21C28E7DAB35555E61E44F46B
Malicious:	false
URL:	"https://www.google.com/async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDRAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=3258071689962503910&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc"
Preview:	)]}'.22;["Mje5ZeCqLr-nptQP3IysuA0","1946"]3;[1]3;[5]

Chrome Cache Entry: 441

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	350
Entropy (8bit):	6.922576431804136
Encrypted:	false
SSDEEP:	6:6v/lhPKqJZAeExL4cO+QnlBC7rZEiWAbmP4BZQv26xQppp8GBzy3kay5zBup:6v/7ia7EmW0m7bRmPU8dxQpppV+055zK
MD5:	F8F20B1A0E5303C04EBAAFD7F09A625C
SHA1:	ED0ED603206887E2D5AE2F0F770ADC2B869DE6DA
SHA-256:	895172C5269BC2F7F1B26A807944106D88FEF304586399A0D9A10E21C6A8DD46
SHA-512:	C8D8FEB29312771F14B72A6DC992303508A66B0CBDC85AF2EF9659AA36A3F7806ABBA595FB83F36DBF164962DB4493B00E5ECDAC8DA41EAB56DD146D8D9F7C0C
Malicious:	false
URL:	https://www.gstatic.com/images/branding/product/1x/youtube_32dp.png
Preview:	.PNG........IHDR... ... .....szz....%IDATx....d.@......P.A0.0.C1`.......a......C...Eq........0...C..^{........... DBS...I.:+I..H..H.......?.N.....WB..e.._B .[@M.dk..`..o...\|.VU.\|.u...0.......L..0.r....k M]#...o^....(........H...^.....s._........nr.S.`u...M..E4.{_D..M.D..6.@...wB.-=.......-.%l3.$.H..8.z.?R..%}.0...w..=y>2;......IEND.B`.

Chrome Cache Entry: 442

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 29388, version 0.0
Category:	downloaded
Size (bytes):	29388
Entropy (8bit):	7.993008091542256
Encrypted:	true
SSDEEP:	768:2075f+Dti4JBZRdp49Z5wmWPb2O7a35bAvDWIfe:2k5fOtiCXvb2OG3I1e
MD5:	6E75A94D5F7170A1AB532D32C2A35755
SHA1:	9C1B6FFF544089941BBEDDBCF529C3F0B46D853A
SHA-256:	D87D0A7A7FE2C36D1DC093BFE56E9B81B311988789DBD3B65ABF811D551EF02F
SHA-512:	27CDBF98A3F42510EAEB28437E3C4661734B685D63EFF5E47364AC46B73DE617894EDCB19DDD9AFD955DE192CFD8BB755998ED609EC2C279E9AFAB3DB2583175
Malicious:	false
URL:	https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/latest.woff2
Preview:	wOF2......r..........rq.........................`.....P..5..... ..m.6.$........ ..<. ....Z...Vf...-B..H.......`..^........1.......,.)..D.g.m[.......'...QQK..l!Q.......^.]Q.;...I:$..{t.C.".6.".........z....I.<.OX..%....iT.D.m.N;5y......../6jd.....iP.. m.z.....ltv...r..L....V/.%VfVfeqw..%u.,....Z.,z.....t ...5w.}..e..K.c..G.....6E...F.Q .&."&.....bd.hl.m.J.M......,..._6-.E..o.?..U.=?..l..%r....r..-k$..\|....5..[d...d........2.H...-..?Yp....9x\|...Z/z^G..=...?...l..79...S.r...uj.....u.'..jT...._&..xW`.)..Yakd.....O9.J..+..83.>!..'.`Hg...\|t..YXf..'m..B.....(,;.....2#.)..........:......W.3.....\|Q..f...Z.0vW.L.HE...c<.. U..0..?!.d..W......V./rDn{...B0..t.1...W m...@..Q.L.7.._s....m4..yk.....j.fJ..C........"....-..U.V.n..B..Zg....3..........u...nT....M7@...IQ..(..r........!...v^.s..R.... GH..&...~.......k._..?Y'.O......v...E.,....E...9..%.M...o.w..v(.a.K.h...A.......`...}^.h...PJan..Cl...t...E.@..J.c........+..@..6}OA...Q.\..E....0..2........vgK.O

Chrome Cache Entry: 443

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (537)
Category:	downloaded
Size (bytes):	1638
Entropy (8bit):	5.100916407222812
Encrypted:	false
SSDEEP:	24:B5syZspc//k7wQmMdf2aHQhIZMrUrFgLT/i6Oz9uOE63WDwf8mRrde6WXyr1DLk/:BFSc8V7d+aQhexRgvRhkhemxDLJT2
MD5:	2D9015E653ADCC64F3803F6E644CFBEF
SHA1:	B1A59CD4FBE20AAE2BDC6573D295E2C965BA40B3
SHA-256:	4634BB80D4AF708866961EABE579AA6C56B305B76AF620342DBC99E1940A6955
SHA-512:	EA81CE3734104160E76B0CF0C99201F8E9922D688BB6501E60AF273D56115822919ABAB11E75D8E72FCAD6CD3635CEC906100C5C734728011C93DAA96A4FCE8B
Malicious:	false
URL:	"https://www.google.com/xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=syez,syf0,aLUfP?xjs=s3"
Preview:	this._s=this._s\|\|{};(function(_){var window=this;.try{._.lrb=function(a){this.Qn=a};.}catch(e){_._DumpException(e)}.try{.var mrb=function(a){_.Yn.call(this,a.Ka);var b=this;this.window=a.service.window.get();this.wa=this.Qn();this.oa=window.orientation;this.ka=function(){var c=b.Qn(),d=b.BGb()&&90===Math.abs(window.orientation)&&b.oa===-1window.orientation;b.oa=window.orientation;if(c!==b.wa\|\|d){b.wa=c;d=_.db(b.Ne);for(var e=d.next();!e.done;e=d.next()){e=e.value;var f=new _.lrb(c);try{e(f)}catch(g){_.ca(g)}}}};this.Ne=new Set;this.window.addEventListener("resize",this.ka);this.BGb()&&this.window.addEventListener("orientationchange",.this.ka)};_.F(mrb,_.Yn);mrb.nb=_.Yn.nb;mrb.Ga=function(){return{service:{window:_.Zn}}};mrb.prototype.addListener=function(a){this.Ne.add(a)};mrb.prototype.removeListener=function(a){this.Ne.delete(a)};.mrb.prototype.Qn=function(){if(nrb()){var a=_.Cl(this.window);a=new _.jl(a.width,Math.round(a.widththis.window.innerHeight/this.window.innerWidth))}else

Chrome Cache Entry: 444

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (60926), with CRLF line terminators
Category:	downloaded
Size (bytes):	61023
Entropy (8bit):	5.349288021983804
Encrypted:	false
SSDEEP:	768:H3jJaeJ7moxgOkjhbaUb/Q8VBWM3DL0IL2kQ0nlAFXqfyXTWJp5xUokNv:XjJx9moxgrwiN2kFnlA2UT
MD5:	FB9B1F0355F169C08596444C68EE49BC
SHA1:	BF9044665A2C86577306C547663EA56118E29179
SHA-256:	CBCFB303A1E7D1F9DA8965565B535F4122F2DE2F1F3ED9F61F3F9E2DAD3DCF9D
SHA-512:	F831AA9FCE30136A43F477617AFDAC4B13C4F81B4E159BB1DA46959B3365911644D693A925BB5F617AF7BF39CC3E60094F33F37EB71C2CCD308B65585718659B
Malicious:	false
URL:	https://www.clarity.ms/s/0.7.20/clarity.js
Preview:	/* clarity-js v0.7.20: https://github.com/microsoft/clarity (License: MIT) */..!function(){"use strict";var t=Object.freeze({__proto__:null,get queue(){return Wa},get start(){return qa},get stop(){return Xa},get track(){return La}}),e=Object.freeze({__proto__:null,get clone(){return sr},get compute(){return lr},get data(){return er},get keys(){return nr},get reset(){return dr},get start(){return ur},get stop(){return hr},get trigger(){return cr},get update(){return fr}}),n=Object.freeze({__proto__:null,get check(){return yr},get compute(){return kr},get data(){return tr},get start(){return br},get stop(){return Er},get trigger(){return wr}}),a=Object.freeze({__proto__:null,get compute(){return Mr},get data(){return Or},get log(){return Tr},get reset(){return _r},get start(){return xr},get stop(){return Nr},get updates(){return Sr}}),r=Object.freeze({__proto__:null,get callbacks(){return Cr},get clear(){return Yr},get consent(){return Hr},get data(){return Ir},get electron(){return Dr},

Chrome Cache Entry: 445

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://www.microsoft.com/favicon.ico?v2
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 446

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	148823
Entropy (8bit):	5.441199678092472
Encrypted:	false
SSDEEP:	1536:nPYbm+TqNOq0PonWv+6GKgUUfQU7LgdU04J0D6xNn8CL+21MVAZXpndDiSwgED4z:aDQOtGs7VU04ICTJGgMiFR
MD5:	FDD0E71CB6343F43B8BC0C77EE698B9A
SHA1:	02B31FE1E33F8AF7B4F2B5926C133127AEA76E9E
SHA-256:	9E2758D1E5E2784079D1980AAEC9CA70206094D00B4C29B3B326FB8E26A54C40
SHA-512:	AFC02756FE19660185204EBC5C40EB307A476E1DA769E1D4ABF6809ACB05ACD80D6DD39D9CB665E1918A5C4407B54BF6D1899A7F42E6F68EB15F3FEE124A5135
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Oa gb_fb gb_Td gb_md\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Fd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_qd gb_jd gb_wd gb_vd\"\u003e\u003cdiv class\u003d\"gb_pd gb_ed\"\u003e\u003cdiv class\u003d\"gb_Mc gb_o\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Mc gb_Pc gb_o\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 447

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (576)
Category:	downloaded
Size (bytes):	59868
Entropy (8bit):	5.549823852454853
Encrypted:	false
SSDEEP:	768:SlQWqrpRvrzvd49MgfvayRB5lQm6jIlY/rv0/Qql+eGH3Sc1QR40V2JoHivz1U1i:3rpRDzV49wyRBsmBlMXSY70pnduA8
MD5:	30368A72D017E4133BFD3B5D073D06FF
SHA1:	7BD9259C475D46707628108E5A1C33DDAEE43BF3
SHA-256:	ED425C2855B7269156A549BFA9C2594882C8813B1FB3CB52D067D5A9B5471E96
SHA-512:	0A3E298D69906024DC0FB5854F3E57816A81506E513A1823127F4AC7A943A0D942AD8F3D41EB5EC0DB4D2AD8ABE1F39A0B6CDB024C4F547733B9922F676A9BB3
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/structure/page/clientlibs/visitor.ACSHASH30368a72d017e4133bfd3b5d073d06ff.min.js
Preview:	/.. Adobe Visitor API for JavaScript version: 4.4.0. Copyright 2019 Adobe, Inc. All Rights Reserved. More info available at https://marketing.adobe.com/resources/help/en_US/mcvid/./.'use strict';var e=function(){function N(d){return(N="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(f){return typeof f}:function(f){return f&&"function"==typeof Symbol&&f.constructor===Symbol&&f!==Symbol.prototype?"symbol":typeof f})(d)}function O(d,f,g){return f in d?Object.defineProperty(d,f,{value:g,enumerable:!0,configurable:!0,writable:!0}):d[f]=g,d}function P(d,f,g){d=null==d?void 0:d[f];return void 0===d?g:d}function R(d,f){if(d===f)return 0;d=d.toString().split(".");.f=f.toString().split(".");a:{var g=d.concat(f);for(var c=/^\d+$/,k=0,m=g.length;k<m;k++)if(!c.test(g[k])){g=!1;break a}g=!0}if(g){for(;d.length<f.length;)d.push("0");for(;f.length<d.length;)f.push("0");a:{for(g=0;g<d.length;g++){c=parseInt(d[g],10);k=parseInt(f[g],10);if(c>k){d=1;break a}if(k>c){d=-1;break a}}d=0

Chrome Cache Entry: 448

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (501)
Category:	downloaded
Size (bytes):	993
Entropy (8bit):	5.284029861201501
Encrypted:	false
SSDEEP:	24:E1RYXIbtEHvIYWwmqAK/HJ2cNAXzk5vuHM8aJLtMCRWZ4FhQ:E1RYXmtEPT6cLAXzk5kaJL+CwYhQ
MD5:	8613F6E9AB671DE799C6E90ABC1FB95A
SHA1:	7F490BF9E3B57DE75C5F992CF1A476FA256DB742
SHA-256:	32047F50E34D3E948499D645F88D14CDFEB533B44860A8EAB816E64330F4DB44
SHA-512:	6B2BA12E5008ACFB3E3931AB1DFF64DE944C0A8B472A08135DCA9617EB824F87BCC751306D875FE1199628329672A8D2BD3ABD6B57FF350C5BAF5DBAB4AD1BBD
Malicious:	false
URL:	https://www.youtube.com/iframe_api?version=3
Preview:	var scriptUrl = 'https:\/\/www.youtube.com\/s\/player\/6ee8f9ce\/www-widgetapi.vflset\/www-widgetapi.js';try{var ttPolicy=window.trustedTypes.createPolicy("youtube-widget-api",{createScriptURL:function(x){return x}});scriptUrl=ttPolicy.createScriptURL(scriptUrl)}catch(e){}var YT;if(!window["YT"])YT={loading:0,loaded:0};var YTConfig;if(!window["YTConfig"])YTConfig={"host":"https://www.youtube.com"};.if(!YT.loading){YT.loading=1;(function(){var l=[];YT.ready=function(f){if(YT.loaded)f();else l.push(f)};window.onYTReady=function(){YT.loaded=1;var i=0;for(;i<l.length;i++)try{l[i]()}catch(e){}};YT.setConfig=function(c){var k;for(k in c)if(c.hasOwnProperty(k))YTConfig[k]=c[k]};var a=document.createElement("script");a.type="text/javascript";a.id="www-widgetapi-script";a.src=scriptUrl;a.async=true;var c=document.currentScript;if(c){var n=c.nonce\|\|c.getAttribute("nonce");if(n)a.setAttribute("nonce",.n)}var b=document.getElementsByTagName("script")[0];b.parentNode.insertBefore(a,b)})()};.

Chrome Cache Entry: 449

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2213)
Category:	downloaded
Size (bytes):	116572
Entropy (8bit):	5.5500956178779015
Encrypted:	false
SSDEEP:	3072:PGLKSUw90ETvVm+SZp6nwVxctKQiaJy7K:jnqNm+GJVxctKzbW
MD5:	397B29019DC2818E5460224B394B665E
SHA1:	7EE52768E7F46F76DBDC6A05ED8B0A9CA0207667
SHA-256:	9DAD0D44CDBE3098C543A2EED2E168C52CECF2E256C5F1A8A51829638D617350
SHA-512:	A81A07BC862E07031157573865FDDC3FF20C4A25E6F99A8C7409C84DC48F69828004C9265F6BCE5C7A91330CB91554D9159F94009D92F59E73872E7FC5516DD4
Malicious:	false
URL:	https://www.googletagmanager.com/gtag/js?id=923371515
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[],. "tags":[],. "predicates":[],. "rules":[].},."runtime":[ .]..........};...var aa,ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},fa=function(a){return a.raw=a},ha=function(a,b){a.raw=b;return a},ia=function(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if("number"==typeof a.length)return{next:ba(a)};throw Error(String(a)+" is not an iterable or ArrayLike");},ja=function(a){for(var b,c=[];!(b=a.next()).done;)c.push(b.value);return c},ka=function(a){return a instanceof Array?a:.ja(ia(a))},la="function"==typeof Object.create?Object.create:function(a){var b=function(){};b.prototype=a;return new b},ma;if("function"==typeof Object.setPrototypeOf)ma=Object.setPrototypeOf;else{var na;a:{var oa={a:!0},pa={};try{pa.__proto__=oa;na=pa.a;break a}catch(a){}na=!1}ma=na?functi

Chrome Cache Entry: 450

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.0314906788435274
Encrypted:	false
SSDEEP:	3:CUkwltxlHh/:P/
MD5:	325472601571F31E1BF00674C368D335
SHA1:	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A
SHA-256:	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
SHA-512:	717EA0FF7F3F624C268ECCB244E24EC1305AB21557ABB3D6F1A7E183FF68A2D28F13D1D2AF926C9EF6D1FB16DD8CBE34CD98CACF79091DDDC7874DCEE21ECFDC
Malicious:	false
URL:	https://idpix.media6degrees.com/orbserv/hbpix?pixId=16873&pcv=70&ptid=66&tpuv=01&tpu=35050774984483340004567475019318048768
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 451

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 33, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	568
Entropy (8bit):	7.421138171956414
Encrypted:	false
SSDEEP:	12:6v/7Khk+csMHOnzaGq763bW/JMqLHpZkhO5MMbFR53XLe9AJNHDg0i:zhksMumGqG3bW/JVLJ+hQbzN+e9Dg0i
MD5:	19716D2499B6D684F80CC69379447312
SHA1:	9AF5ACE0BFFED8B4A5ED047A7858FCA1D0C99045
SHA-256:	05CDCD49CA93E18A832F59F778FF630F69B8346692BAD733D24BB364EB92CC7A
SHA-512:	436DA89200BD3A2EBEF2260BA8F531B60CF56EFE219A9986AEDE014F9FBBFA48B3124D20DD672974B8EF11AF08A702ED7C5B92B7D86D57E6187D4737F40F1156
Malicious:	false
URL:	https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTkUUipY5hXinAeB-FSJup_G13XrTGYcPnNaqwdrfE&s=10
Preview:	.PNG........IHDR...@...!.....^.].....PLTE.......l..o..j.......VVV.g......ppp....d.........{{{/x....?..m......c....???...333U...........***...M................IHI...z..fff.............cIDATH..iv. ../..P..`F.F.[.....$&...x.....{..K/=.f.j...9I.......8...1^9.s6C.......n......X,.)V.H...,3&.r...=L...\|..p.9..........H}......Kkv........_+.<...dc......W.N5.....n[......9.r.....\|.\X...6...<..._@L.r...~..h;..n..nJ..R...=T\M.....U P..... .g.]q...rc..z...{..0...tB.....E.. f.x...s.....B;"..!....r.C........B.......$h....\.e../...1.K/=.~.a.....Vi....IEND.B`.

Chrome Cache Entry: 452

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2392
Entropy (8bit):	4.833254266614935
Encrypted:	false
SSDEEP:	48:xTpTC2mZdTlT8phcI9RXIYdl8t/RKTbgfPpM8mf:xTVC2A1lT8phcmiU
MD5:	38D7610839BBEA91BF685A35F6269692
SHA1:	22A69A6BB8485D10574F13FB1E4EA189D5A2797C
SHA-256:	BF36452D6EFED854E7BBC230EB4DADF1DD6EAEBC0E99988A537DB139AAA948E2
SHA-512:	925E8E5FB908C7BFFD07BE365DFFCBF19ED11A465D3CDF04BF585FC582809A711F4ACC29C6326225634EB7EC847A02B94CEA9F8EF4D826EE8DB7A134125A8739
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/content/detailspage/v1/detailspage/clientlibs/clientlib.min.ACSHASH38d7610839bbea91bf685a35f6269692.css
Preview:	.dlcdetail__pagetitle{width:75%;margin-inline:auto}.h2+.dlcdetail__lang-chooser{font-weight:500}..dlcdetail__lang-chooser{margin-inline:auto;gap:2rem 3rem}..dlcdetail__lang-chooser select{margin-inline-start:4.5%}..dlcdetail_lang_select_box{min-width:0}..dlcdetails_accordion_body{overflow:hidden}.html:not([dir=rtl]) .custom-select .custom-select-arrow::after{right:0}..dlcdetail__download-btn{width:13rem;text-align:center;padding-inline:.5rem;height:2.5rem}..dlcdetail__download-btn.spinning{padding-block:0}..dlcdetail__download-btn>*{vertical-align:middle}.#dlcdetail__download-spinner{display:inline-block;vertical-align:middle}.#dlcdetail__download-spinner .spinner-dot{width:.75rem;margin-inline-start:1rem}.#dlcdetail__download-spinner .spinner-dot::after{border-color:#fff;background-color:#fff}..dlcdetail__accordion{margin-top:2rem}..dlcdetail__filegrid>section,.dlcdetail__kbgrid>section{padding:1rem 1rem 0 1rem}.@media only screen and (max-width:768px){.dlcdetail__pagetitle{width:auto

Chrome Cache Entry: 453

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	181223
Entropy (8bit):	5.563172071949303
Encrypted:	false
SSDEEP:	3072:DismT/mHKxQlVyDqBPAizS7Mzm3NLJa2lQf+SB7qSASyntnh:2smT+X+NLJar+S9qSASyntnh
MD5:	9839B66D7C986A67A821E7B3783BDF69
SHA1:	4F356C1A92358156486EE50921FE4C728F6D0EAC
SHA-256:	FA334C1E3766C50298F83EE32AED20FCD0978230350837DC7CB9115D096A7167
SHA-512:	ACA1CE5C4821D38C3833ABF0DC82493A3E0444B58D70B5B2E756CF94744823EE243EEE50E36637AF28E04A4D0B5BDAF318AF38DF0925152F062ADD7E6C6735C3
Malicious:	false
URL:	https://mem.gfx.ms/scripts/me/MeControl/10.23347.2/en-US/meBoot.min.js
Preview:	MeControlDefine("meBoot",["exports","@mecontrol/web-inline"],function(t,S){"use strict";var c=function(){},i={},u=[],p=[];function O(t,e){var r,n,o,i,a=p;for(i=arguments.length;2<i--;)u.push(arguments[i]);for(e&&null!=e.children&&(u.length\|\|u.push(e.children),delete e.children);u.length;)if((n=u.pop())&&void 0!==n.pop)for(i=n.length;i--;)u.push(n[i]);else"boolean"==typeof n&&(n=null),(o="function"!=typeof t)&&(null==n?n="":"number"==typeof n?n=String(n):"string"!=typeof n&&(o=!1)),o&&r?a[a.length-1]+=n:a===p?a=[n]:a.push(n),r=o;var s=new c;return s.nodeName=t,s.children=a,s.attributes=null==e?void 0:e,s.key=null==e?void 0:e.key,s}function T(t,e){for(var r in e)t[r]=e[r];return t}function d(t,e){t&&("function"==typeof t?t(e):t.current=e)}var e="function"==typeof Promise?Promise.resolve().then.bind(Promise.resolve()):setTimeout;var l=/acit\|ex(?:s\|g\|n\|p\|$)\|rph\|ows\|mnc\|ntw\|ine[ch]\|zoo\|^ord/i,r=[];function a(t){!t._dirty&&(t._dirty=!0)&&1==r.push(t)&&e(n)}function n(){for(var t;t=r.pop();)t

Chrome Cache Entry: 454

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	3740
Entropy (8bit):	4.667023982777541
Encrypted:	false
SSDEEP:	96:3cVWT9BvpXKZhUyXuXsk8hLb3Dhm2ykOoW:3cVWNXK3XuXW5K
MD5:	67E89E5C622EB84D8D53163D8B12F3CF
SHA1:	839631E9A8BA4BC9234A1C475406BA5FBD2A3B88
SHA-256:	320D8D9EC89B0FCE1E3E367F4046909ADD2DE413238037E715E92B13B5838271
SHA-512:	0CD02C7568B36DF570A6CC9EF8FEE6CF5265960123F04558E07912E173B4641B0DCEDC5A70ECBCD64B99757442DA1C34565369326572F99D1A3F74F793F56D40
Malicious:	false
URL:	https://bat.bing.com/p/action/4000034.js
Preview:	(function(w,d,s,i) {.. var c=d.currentScript;.. if (c) {.. var uo = c.getAttribute('data-ueto');.. if (uo && w[uo] && w[uo].uetConfig && w[uo].uetConfig.deBlock === true).. return;.. }.. var f,j; f=d.getElementsByTagName(s)[0]; j=d.createElement(s); j.async=true;.. j.src='https://www.clarity.ms/tag/uet/'+i+'?insights=1';.. j.onload = function () {.. if (!c) return;.. var co = function(u) { return u && typeof u === 'object' && !(u instanceof Array) && u.beaconParams && u.beaconParams.mid && w.clarity; };.. var r = 40;.. var cl = function() {.. if (r-- < 1) return;.. var uo = c.getAttribute('data-ueto');.. if (!uo) return;.. var u = w[uo];.. w.clarityuetq = w.mtagq \|\| u;.. if (!co(u)) { setTimeout(function () { cl(); }, 250); return; }.. var m = u.beaconParams.mid;.. w.clarity('set', '_uetmid', m);.. w.clarity('metadata'

Chrome Cache Entry: 455

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (530)
Category:	downloaded
Size (bytes):	221438
Entropy (8bit):	5.61660430283973
Encrypted:	false
SSDEEP:	3072:vievqhHriEPFf0OhMSb4ocnhCiI+jDg3o/:Hod0OhMIiISDgY/
MD5:	134702EB870EAD378F145A9484EC8E17
SHA1:	211DE5B880DBB3D08522F25E59DF2E75C7433889
SHA-256:	3051A90084894B6F43440C9501C73D59926C72F9FD05FD67C5BB9BA3771E74BE
SHA-512:	E353561A35EBEAA8DB12EAE468CFB7D2A347569D9954B6443F7B71546E71824A487E89986B21704CD2A4B380D778B8B0D1A1542B10C5924B2051A2F64541ADCC
Malicious:	false
URL:	https://www.youtube.com/s/player/6ee8f9ce/www-widgetapi.vflset/www-widgetapi.js
Preview:	(function(){'use strict';var r;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ca(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var da=ca(this);function v(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.v("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}.function c(f,g){this.g=f;ba(this,"description",{configurable:!0,writable:!0,va

Chrome Cache Entry: 456

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	3379
Entropy (8bit):	4.125986380219418
Encrypted:	false
SSDEEP:	96:yH+cEXMy87iuHfC1AiSpyi0zVG1S8HCyi:yH+cEcy2iu/CmiSpyiMVG1S8HCyi
MD5:	358DECDDE15DBB74CBD59F3B56AFC65F
SHA1:	D684DC70E71717485DBFC84DA012DE982ECA20ED
SHA-256:	F598811878F784445F41DE93130E7AFAAA8667B357222F58677EE79336BC6988
SHA-512:	123CAE876B977C4E340A5B40EFD866460A9B1664A6CBEF66F3413A26DC687599C1B18563BCF87F7F84754268489828BCE70A7743E8C3EF568208BE4B91CBA219
Malicious:	false
URL:	https://mem.gfx.ms/me/mecache?partner=msdlc&wreply=https%3A%2F%2Fwww.microsoft.com
Preview:	<!DOCTYPE html>..<html lang="en" >..<head>.. <meta charset="utf-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=edge" />.. <meta name="viewport" content="width=device-width" />.. .. ..</head>..<body>.. <div id="body" role="main">.. ..<script>. var INIT = "INI", SUCCESS = "OK", FAIL = "BAD", CACHE = "CACHE", MISS = "MISS";. var Gets = [], Sets = [], state = "msdlc";. var targetOrigin = "*";. var SevenDaysMS = 604800000, TimeKey = "_timeOffSet_";. window.addEventListener("message", handleCacheRequest);. postMessageToParent(state, INIT);.. function handleCacheRequest(e) {. if (validateArgs(e)) {. Sets = e.data.sets;. Gets = e.data.gets; . targetOrigin = e.origin;. state = e.data.state;. try {. if (window.localStorage) {. ls = window.localStorage;. for (var idx in Sets) {. try {.

Chrome Cache Entry: 457

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	406
Entropy (8bit):	4.645093417199183
Encrypted:	false
SSDEEP:	12:M9BAG1/qAT9BAs1/qKdDYT9BAR6T9BAOk/CMRZcJfRDZ:M9p/qS91/qfT9J9yRC5N
MD5:	F9F2395C582FA601707B7A5DFAE9F05F
SHA1:	27B15AECD0BFDD3B25556AC00755856D4D331E0D
SHA-256:	D7D6D06624D4BDF6935B848DF342CE322D02B58D12BF12149DF92D557E5E9BC4
SHA-512:	F3378927D96B0B172981A821A8C2A16D0F397ED92E835B7C46316FC48350402D972A5411F0FA4C260F205AA1F7917F83F8247BF8A62C7F22E0076B168275B1E9
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/cascade.component.authoring/clientlibs/clientlib-uhf.min.ACSHASHf9f2395c582fa601707b7a5dfae9f05f.css
Preview:	.c-uhfh .c-action-trigger.glyph-shopping-cart span:not(.shopping-cart-amount),.c-uhfh .c-action-trigger.glyph-shopping-bag span:not(.shopping-cart-amount){line-height:48px !important}..c-uhfh .c-action-trigger.glyph-shopping-cart:after,.c-uhfh .c-action-trigger.glyph-shopping-bag:after{line-height:43px}..c-uhfh.c-sgl-stck .c-search button{line-height:18px}..msame_Header_name{line-height:44px !important}

Chrome Cache Entry: 458

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (552)
Category:	downloaded
Size (bytes):	181466
Entropy (8bit):	5.554874109955879
Encrypted:	false
SSDEEP:	3072:Sfyz+8hxjR20cgOl4L9nH2BrWNeE5Q6nRyWK/wCG4X5GFnX45Ti6ZssSBodxD4t:Sfy6gFXxH2BrWwejZcwC15GuTDZtUgu
MD5:	B4F0B5100B03A879DD5D2E97636EFC37
SHA1:	72C5001013A7514373D5CC4918B0A0D95C65617A
SHA-256:	5BACAEE30D72B76D83BC5FDD190BF027CDD4C270CF7D081E487ABFB8EA63EBFF
SHA-512:	99BF0AFAF3BB642032669DF2E934BE7FACE9A95DD79E9BF59E6D565E6355754796B1F389B32DD12AFEEC4A95B5E627ED58C8C355E9828452448F6B7EA9F2EDB1
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/structure/page/clientlibs/custom-oneds.min.ACSHASHb4f0b5100b03a879dd5d2e97636efc37.js
Preview:	/. Microsoft Dynamic Proto Utility, 1.1.9. Copyright (c) Microsoft and contributors. All rights reserved../.'use strict';!function(Kb){function la(xa){var ca;return(n[xa]\|\|(ca=n[xa]={i:xa,l:!1,exports:{}},Kb[xa].call(ca.exports,ca,ca.exports,la),ca.l=!0,ca)).exports}var n={};la.m=Kb;la.c=n;la.d=function(xa,ca,P){la.o(xa,ca)\|\|Object.defineProperty(xa,ca,{enumerable:!0,get:P})};la.r=function(xa){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(xa,Symbol.toStringTag,{value:"Module"});Object.defineProperty(xa,"__esModule",{value:!0})};la.t=function(xa,ca){if((1&ca&&(xa=la(xa)),8&ca)\|\|4&.ca&&"object"==typeof xa&&xa&&xa.__esModule)return xa;var P=Object.create(null);if(la.r(P),Object.defineProperty(P,"default",{enumerable:!0,value:xa}),2&ca&&"string"!=typeof xa)for(var $a in xa)la.d(P,$a,function(Ua){return xa[Ua]}.bind(null,$a));return P};la.n=function(xa){var ca=xa&&xa.__esModule?function(){return xa.default}:function(){return xa};return la.d(ca,"a",ca),ca};la.o=func

Chrome Cache Entry: 459

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 32372, version 1.31457
Category:	downloaded
Size (bytes):	32372
Entropy (8bit):	7.993995967802269
Encrypted:	true
SSDEEP:	768:SV9/x9u8VMS/4zsy6FpLTVBZlVJnRt3HeJDFAT7MlVI94NpBB5:SVNMSSsy6FNplHnuVaT7B94NpL5
MD5:	0C7DD36AD55FE6D0EF1971DEC6A3FC93
SHA1:	76A7E768908DC16009C58100150BDAA4C3C38F3C
SHA-256:	528961B18C15D0350AD5635713E448C83F2FAF991176211E5546D35D62CF5FAF
SHA-512:	DC267F7F3C389AC56229303847899606BAB0E579F261522008F7ED7FDFC7C333241718A213FDAB1ED00DDE21A98AD2CC6F358518353BEF8252F8429A672FF6FC
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/clientlibs/clientlib-mwf-new/resources/fonts/MWFFluentIcons.woff2
Preview:	wOF2......~t......d..~%..z......................`..V...D....6.$..~..... ..R..`[t.q.o:M.v0.o..j6....T..?b6.....7Wq...i.J...S/P.p[...Hvu.C....W)....VZv..u..."~...&.....Vj.g.k.P..1Cf.{.v......X....5F..Ak...?..Q`.0.;.....E].x..!..H.....lz..m...}..p.........z.7..S..a..@>..F.....E..>.Z.=.{z(..#..d...N..4..............d...k........K.k.,)-.I..m;..O.~Ru3zW.....q.0......b0P.f.G.S.O.....AJ3W4.^uEu..Z..=...L.....^...Q...L..st......Z.##...Xk.p\YKO..vY........`A.F..%..0........l.1.Q%..+ (...b.&F....Q..u^..qz.....U.2.N. .rV9.h..uT....u.F.X%.za..c.V..v.z... hY....a.49k....c~...L.....X.{.~mQ~,e4..<.'...K.l{...;.........D. .......U......3..a......5....8'(.........v..0.BJ...rt}.x...W.e6..X.FEF.....r..5U....._....fg..A.>a.i....m..J..}.....?.\Ti......,.....2E..h../..=......hG...~.?.7.\.$.IQ%..U.2..).j.L..L..oS.U.\.).~;.......Gw~t....%.._.I.....~w.8.K.KNJ..l'.......o...=.....8..).d..j.m...<..8.Q...C...m...x.m.v.>...{...d..Tl..9.....>...Fmf.b.J(!D!.....4

Chrome Cache Entry: 460

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 36 x 36, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	419
Entropy (8bit):	7.289774220010951
Encrypted:	false
SSDEEP:	12:6v/7btrfzYk4t3fPvNYG4gQncbH2RQi9HI9E9:yr7YXQgEcbH2RtHN9
MD5:	F28B4C07E46021BB0991206697EEDAE5
SHA1:	AA622D330BD188C127F354E7E2905B0974A7552C
SHA-256:	C288FE53AF2CEA86FE59890BC302CE308568E73B178532B2826DA79663826A0E
SHA-512:	70D9B53CBC9961CFA6798C87E05ED1B83A7F1AAB941ACDC4B4DAAD4EAE1A3C2C5345EB749EF8B81C02F8FE51BB527F5B06C5FF8B4D4ED582B89599626E67EAF0
Malicious:	false
URL:	https://www.gstatic.com/kpui/social/whatsapp_solid_bg_36x36.png
Preview:	.PNG........IHDR...$...$.......h....3PLTE%.f\.........@.y........w.3.p....i.N.....u.T...+IDATx^...r.0...]^..kS.`..6.lU.C...r..x...d...;....yg............y..9.X...).....z.7l...h.(o...'..(..Bt..D....(..5.k.k..nY.g.b.......j6.C...;)...w......v.J].B..3.~.p.._.(t..U.C['/.1....../...d.B........d.r/St.NV....N...K...5.@..sG.xM..o..(..f2F&h.%..P.+.~..F:m;...."...g.....Z..8a.xS../....IEND.B`.

Chrome Cache Entry: 461

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://www.facebook.com/fr/b.php?p=1531105787105294&e=Zbk3QwAAAGzR0xva&t=2592000&o=0
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 462

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	52
Entropy (8bit):	4.887657746862431
Encrypted:	false
SSDEEP:	3:VG4zQIy2jDQIyeHYx414n:VpPy2jDQ6eT
MD5:	FF462EBC2CBDA2B4A3D8C444E33473BA
SHA1:	4AB33D9CD3EFFD23AB33877474F03D372BF9B631
SHA-256:	239BF9271F86A1F394BA761CB812185E3A9D6D3B616C8A5CD55803134D2F7C32
SHA-512:	9BDAE7C98CFDDA6E6E4F5970424F259CB41F001DE7432E7D0E9758007FEA109ADD8AEE431A4AE370C099CD5EBDDB318649A12697135A2C0079E1A4BC1ECF5227
Malicious:	false
URL:	"https://www.google.com/async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDBAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=7017065288382140415&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc"
Preview:	)]}'.22;["Mje5ZeXlL5SjptQPgumGgAk","1946"]3;[1]3;[5]

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1567)
Category:	downloaded
Size (bytes):	162744
Entropy (8bit):	5.55361449729681
Encrypted:	false
SSDEEP:	3072:7McB72czubn+fO1M2fSFBOsmprj8ZYvK4nmR0o16uR4poXQbTVVVzNRbcDy2V:7Mc12cQ+fO1M2fSFBOsmprj8ZYvK4mRl
MD5:	600F7D98CCB2380C72D1A37C046EB2FE
SHA1:	E69AABA046D69926663E8AD8BBB905430CC9AD3F
SHA-256:	1C4D1D86BD176B2FBECA66A67A350AEEE16FE3C9398B39CA2483DEC3F23B210D
SHA-512:	AC0EF5F44A07A78F38C4D3C635748C4B7E0BFF50AADB9BF99EE1D3D427B4435F3934162160529277214C5D400A9A90A115B2399271B1A879666F9AED4AA51E61
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.ZEEp2pdSHOQ.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvRRKYp7I5vTn-AtFvme6Qlo6hq9Q"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Qj=function(a,b,c){return c?a\|b:a&~b};_.Rj=function(a,b,c){a=_.gb(a,b,c);return Array.isArray(a)?a:_.jb};_.Sj=function(a,b,c){a=_.Qj(a,2,!!(2&b));a=_.Qj(a,32,!!(32&b)&&c);return a=_.Qj(a,2048,!1)};_.Tj=function(a,b,c){0===a&&(a=_.Sj(a,b,c));return a=_.Qj(a,1,!0)};_.Uj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};._.Vj=function(a,b,c,d,e,f){var g=!!(2&b),h=g?1:2;const k=1===h;h=2===h;e=!!e;f&&(f=!g);g=_.Rj(a,b,d);var l=g[_.v]\|0;const p=!!(4&l);if(!p){l=_.Tj(l,b,e);var n=g,u=b;const r=!!(2&l);r&&(u=_.Qj(u,2,!0));let B=!r,J=!0,H=0,P=0;for(;H<n.length;H++){const Z=_.Qa(n[H],c,u);if(Z instanceof c){if(!r){const db=!!((Z.ka[_.v]\|0)&2);B&&(B=!db);J&&(J=db)}n[P++]=Z}}P<H&&(n.length=P);l=_.Qj(l,4,!0);l=_.Qj(l,16,J);l=_.Qj(l,8,B);_.wa(n,l);r&&Object.freeze(n)}c=!!(8&l)\|\|k&&!g.length;if(f&&!c){_.Uj(l)&&(g=_.va(g),l=._.Sj(l,b,e),b=_.fb(a,b,d,g));f=g;c=l;for(n=0;n<f.length;n++)l=f[n],u=_.eb(l),l!==u&&(f[n]=u);c=_.Qj(c,8,!0);c=_.Qj(c,

Chrome Cache Entry: 464

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	downloaded
Size (bytes):	4465
Entropy (8bit):	7.666715222755507
Encrypted:	false
SSDEEP:	96:HxiWESDh8K9aI+yQMPAOjDBk9Et4X6ILzaqPuAO:HcWESDXaXyZjDB9q5O
MD5:	6BCD2C5891A5E617898FF487DF0D2082
SHA1:	A2242A3F396F1FEAF7AEABD40B48122D070F125A
SHA-256:	018716003EA7214D7F973B17997ACEB69CAFEE5C09C96C23851AF2D291522ED7
SHA-512:	A5E78F13A46F88779D91BF6683DB4963D77AA3E0D73CB700468FC0291D60EE8DFD30E8CC2A81EF38A8E6373BB3A7144CF1B4B5BAA5269555957B79D69929CDE0
Malicious:	false
URL:	https://www.gstatic.com/ui/v1/activityindicator/loading_24.gif
Preview:	GIF89a.......rX.c.....R.T.E....S?..IHt....5..N>...k:&..=..}...2.5.KN.6.n;....x..F.f@.L@o...;.[x.ps...I....},._tg...O'....o.P..K..Er5.YS..e....Q.NC..b..TH....Uz6v.;U.d.z.R..!.a...]....d'.R.RW.Se.......;..H{.Si.QH...g$Um.%n.%.x..._.9~.q.......6....L.65.\...A%...<2..J..]...s.....T.a...\|...K?.....I....F>2...}.8..-.p..s..c.L5.w9...OW...:..@......xA.^...h$u..z..qBYY.9w..i...[92..g........#.yK..C..)..pu..M>.AR.I>9~...M4x..D9%j..`..1)...$.g.....n7}......9......._A..{..[..!.cE........or.y..PGG...OD%.hs...........`\...........K@5.x..U.C3=.Pfk...JO.P.>L..M0....\..N...@u...7w...K...x.Mo.St.....O.w=.T`..A.P.S={..k....I.n;..V?..@3.tR.Ii.Uz.Rj.Sq ....>..M......c.8....A._.0....p..RD....fH..a...._9...ZC,.........fA..Q.2:...K?8~.;...J>..M..`...!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	52
Entropy (8bit):	4.940636352673268
Encrypted:	false
SSDEEP:	3:VG4zQO5BAOFcRTYx414n:VpJ5gRTeT
MD5:	1D49DE773995957914F2240D32E4F181
SHA1:	7CCE88A52748F76A5055F192C866B936971FD894
SHA-256:	462EC81CB634467F3A1803C9FBB97B419D519ABB663836D90FEFD36EC506CB27
SHA-512:	2E94BF36E5B82A55F698CB1EC0420E9CC9F8ACDEC31293798EDF08936A1632C3943E22CADE9D64E3647C950CF84AE4D35542940932FB8EDA6E030B7F9F764E15
Malicious:	false
URL:	"https://www.google.com/async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDhAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=9103415834496958732&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc"
Preview:	)]}'.22;["Mje5ZcKSIeOuptQPkqSa4As","1946"]3;[1]3;[5]

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (504)
Category:	downloaded
Size (bytes):	1240
Entropy (8bit):	5.226026021317682
Encrypted:	false
SSDEEP:	24:YwXyyRRvV3I1VnkOSasiYbqIhB1ChqzRAmmOKZTo72O2bC2RRSfuH99Jy:5xR8JVfSRArrLZs
MD5:	00F6C26DE9C7C0A1E7B10D8BB358E008
SHA1:	6BEBC2E9F973ACEFCA9B12BC0C30B157546C1D67
SHA-256:	1A798269DA4C197C27EAC4EE1C2C84D59CEB41A72F5E670EBD59484653CE1BFD
SHA-512:	8757F804366A0BE2C5AA8360C4397C2348625A6FFF74F3139A03853F36014BC0A4B1FBBF018C5071DB730B6371F22BF5E79A54A5B02899BC872A5D82E227ACB3
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/structure/page/clientlibs/embed-partnerscripts.ACSHASH00f6c26de9c7c0a1e7b10d8bb358e008.min.js
Preview:	'use strict';(function(){function c(d,f,a){d[f]="undefined"!==typeof a?a:""}(function(d,f){d=document.getElementById(d);var a=d.innerHTML;a=a.replace("jsonElement",JSON.stringify(f));a=a.replace("//_pageBITags","_pageBITags");d.innerHTML=a})("mediapixel",function(){if("undefined"!==typeof telemetry){var d={},f={};var a=telemetry.webAnalyticsPlugin.config.coreData;var b={pageName:a.pageName},e=document.querySelector('meta[name\x3d"awa-market"]');e=void 0===e?a.market:e.getAttribute("content");c(b,."mkt",e);e=document.querySelector('meta[name\x3d"awa-pageType"]');void 0===e?e=a.pageType:(e=e.getAttribute("content"),"Premium"===e&&(e="PDP"));c(b,"pageType",e);d.pageTags=b;b=a.pageTags.ProductInfo;void 0!==b&&(a={id:b.id},c(a,"sku",b.sku),c(a,"title",b.title),c(a,"prCat",b.prCat),c(a,"type",b.type),c(a,"family",b.family),c(a,"rtg",b.rtg),c(a,"lstPrice",b.lstPrice?b.lstPrice.replace(/[^0-9\.]+/g,""):""),c(a,"rtPrice",b.rtPrice?b.rtPrice.replace(/[^0-9\.]+/g,""):""),c(a,"cur",b.cur),c(a,"sku

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (41652)
Category:	downloaded
Size (bytes):	388398
Entropy (8bit):	5.4353218297610955
Encrypted:	false
SSDEEP:	6144:JAbEL4sOsj8B1tB3Ke6JMvgLPC9uSzvZ5z:uossBmYJMvhRV5z
MD5:	1D6E571684174432168ACC3EC4EEC474
SHA1:	EAAC17C18CEA8ED4EBD87EFA18CF67411EB4B3F3
SHA-256:	3FB856882CD87A671903D75D594F2FB840ABBB70A196395FA2197CBADB03149E
SHA-512:	B470D11FBE4C7945361E6AF71BD3CC2AB66AA4A52709FB9A957E01DD1A568C6009BF147E6B3C2E5DCDCBC084D94D519811F0E685946ADD7203C16506105B9422
Malicious:	false
URL:	https://analytics.tiktok.com/i18n/pixel/static/main.MTU3YmJkODI0MA.js
Preview:	!function(e){var r={};function o(t){if(r[t])return r[t].exports;var n=r[t]={i:t,l:!1,exports:{}};return e[t].call(n.exports,n,n.exports,o),n.l=!0,n.exports}o.m=e,o.c=r,o.d=function(t,n,e){o.o(t,n)\|\|Object.defineProperty(t,n,{enumerable:!0,get:e})},o.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})},o.t=function(n,t){if(1&t&&(n=o(n)),8&t)return n;if(4&t&&"object"==typeof n&&n&&n.__esModule)return n;var e=Object.create(null);if(o.r(e),Object.defineProperty(e,"default",{enumerable:!0,value:n}),2&t&&"string"!=typeof n)for(var r in n)o.d(e,r,function(t){return n[t]}.bind(null,r));return e},o.n=function(t){var n=t&&t.__esModule?function(){return t["default"]}:function(){return t};return o.d(n,"a",n),n},o.o=function(t,n){return Object.prototype.hasOwnProperty.call(t,n)},o.p="https://analytics.tiktok.com/i18n/pixel/",o(o.s="ranp")}({"/6w+":function(t,n,e){"use strict";var

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	742
Entropy (8bit):	4.715663467051154
Encrypted:	false
SSDEEP:	12:t4noU/vmRsSL10UclAEBTFMYNIE5Au/JXl+51tntkB3xYhyUQk2LrtmSEebfuFd3:t4oU/vyB0U4AORNZHt851VtkRUQhrlBU
MD5:	EDD0E34F60D7CA4A2F4ECE79CFF21AE3
SHA1:	2CC789A02534557380D92124E2F8B9483D198FB3
SHA-256:	ED9087D76CDC6D1C53698F6068F79872E77E87C8D012C0CFDAD13B05B6CCB37C
SHA-512:	CE9D50913CAD41D11C7B3963C90788301B63EE1FFFFF73108E9F8709CA0A9FCC6170853A65A820FBF020628B403813C9E3CD262389FEB7D17A6C73C2F724394F
Malicious:	false
URL:	https://fonts.gstatic.com/s/i/productlogos/googleg/v6/24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z" fill="#4285F4"/><path d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z" fill="#34A853"/><path d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z" fill="#FBBC05"/><path d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z" fill="#EA4335"/><path d="M1 1h22v22H1z" fill="none"/></svg>

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 44 x 44, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2602
Entropy (8bit):	7.254194608737519
Encrypted:	false
SSDEEP:	48:fxrVAdMXkOVfdBN9CtAwLWMCyf8nM+FJOPZ9jLb78j0ZclgMIV/vovwnw:JidMPdBN9CtAwLHCp9FUf78llpIVHlw
MD5:	2009E9437D4728F6E8C5FDC876D68FC6
SHA1:	F6955D873CD10B3AD6FFFD5375BA478EC00D4593
SHA-256:	8D43AE761244F4B73BCEEFF2031A203A53709EA768A561D0DE40D97079FB1E4D
SHA-512:	068CFEC569E1272038FDE661D87B48D9368E8D118AC878E89CB30408859AB43AC4F411DE50460CEE9C1BA937BFB67C17271219D6BC21108743EB37BFFAAC6D58
Malicious:	false
URL:	https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RW1fJPf?ver=4512
Preview:	.PNG........IHDR...,...,.......Z.....pHYs...........~.....IDATX.b...?.).g.....,.L,L,X...... ...?~f.w."...S ....._.] .R.```......"..\...cdb......Z!..3...g...#.....XX...Y>223+\|YZ..d.200........JX......!.....V.k...)a=z..aff``ee`da.9....9...a..e``......"..L+.x100.#;.%^....w..O..C.........hp(..`.........b"F................%T$.r0.f....0.Fvv..0.``..d``.d.....S.H.d.200......".`.e......I5...c.FP..B......,.......3.h.P(..........."&...z..?.#.?.&........Y.0.......'8.....;..f6........`...Q..$.300......"&..C..0....`>..u8H..?......,..XX60..>``ba`f.....qb..Q...........i...O.....120>f.....?.r..bu..........[....n....<..A.P.......>...../..E.b....LL..... ...f.......?3....&0...O...>,.}.. ............,... ...0...\|x........_W5..Y.......b..+.4.P.. G3A........w...C..............`...8....$.C....t..P..r,....Ahh....f0........S..b``........`.m'%XX..C.c:.W:..........o..Y.-...A..q......A.......9..h.../X............`.....d0X:.x.?.....9........ .H ._H....$..................`.?*.....4. j/>0.FI...

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12804)
Category:	downloaded
Size (bytes):	269406
Entropy (8bit):	5.588126907771544
Encrypted:	false
SSDEEP:	3072:4Z4+7k7YLBMdNOhf3GlA0HwczyZYSrmfFzR9AwZ6rQyO33ZDsiU6:q4+g7YLBM2hfywczyoJSrQrQI
MD5:	D3C2928263C55FC9F720ACC470553DE8
SHA1:	E6481B9A693B6C7558284A8268AED58D1CDE4F85
SHA-256:	F0B7DF75BAF156633CAC0C0EC757EAD9FA606AAAC2A8FF38865F019B8E1AA54C
SHA-512:	7061D56E20CE89E4BF1D47DB803EAD43F4A597319139A86F9979DCCCA39F159B1F07CBD0A09702BDE7E03DEE7A408E276A6D4DD03C871237BD6DF062899DE894
Malicious:	false
URL:	"https://www.google.com/xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/excm=ABxRVc,AD6AIb,B0xr7b,CTwd8,CWOfE,CX5LId,CdOg1,D1J6He,FmnE6b,FuQWyc,GRJ32c,GXyz1,JxE93,KiXlnd,MRb7nf,NmR9jd,NsEUGe,Oa7Qpb,Ok4XMd,PE728b,PoJj8d,PvSBGf,QNvmne,RSlfle,TO0csb,TnXlGd,Trirbc,TurKxc,U3Ovcc,U6nlJe,UQpTU,UiPhkb,Uznx4d,VZLyBe,WxJ6g,XDlt7d,XHo6qe,XTkmZd,XbupY,YuNOCb,ZGLUZ,ZrXR8b,Zudxcb,a3cZoc,adn7N,ak946,bXyZdf,cKV22c,du3Q4e,eTv59e,f26on,fNMhz,hfJ9hb,jJtSzc,jkRPje,kCkfUb,kOSi0d,mL4hG,oXRDzc,pIseB,pMwOEe,pQk1fc,qngJBf,r24bR,rL2AR,sU6eaf,tlA71,tzTB5,vJPFse,vhpQNc,y25qZb,yChgtb,yfH2Bd,yn9Ffd,ypVg7e,yuQBec,zjNhL,zs9f9d/ed=1/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=sb_wiz,aa,abd,syr9,syrg,syrh,syrf,syri,sy10x,async,sy1ke,bgd,sy3a2,sy3a3,foot,sy1jz,sy5xh,kyn,sy2z2,lli,mu,sf,sy2kq,sy2kr,sy5yc,sonic,TxCJfd,sy6fl,sy6fm,qzxzOb,IsdWVc,sy1tb,sy2eo,sy1tf,sy2rn,sy6fk,syed,sy1ku,sy6fo,spch,tl,syyu,sync,syrc,syrd,sy1ll,sy1lm,sy1ln,EkevXb,sys9,SZXsif,sy11x,fiAufb,sys5,sy1jk,sy1jj,sy2kz,sy39h,sy3cy,sy3cz,sy3cx,sy3qg,sYEX8b,sy1l7,NEW1Qc,xBbsrc,sy1k1,sy1l9,IX53Tb,sywj,sywk,NO84gd,sy1h9,E9M6Uc,Zilivc,sy1qm,sy1qr,b5lhvb,IoGlCf,syv6,syv7,C8HsP,sywl,sywm,gOTY1,sywq,sywp,syws,sywt,sywv,sywu,syww,sy1sv,sy1sy,sy1ov,sy1o4,sy1nz,sy1ss,sy1st,sy1nf,sy1sq,sy1su,sy1sr,sy1sw,sy1sx,sy1sz,sy1t0,sy1t1,sy1t2,RJ1Nyd,syre,sy28z,C8ffD,sy290,sy292,ZUBru,sy291,sy293,sy294,rTuANe,syz9,sy2qb,yfZcPd,syyv,syyw,Dpem5c,syyr,sy282,sy28u,sy28v,sy28x,sy28w,sy28y,Fy1Pv,sy3ax,ROaKxe,sy3ay,sy3az,pj8IAe,sy3pi,vRe0ve,sy3pg,oWVrne,syz2,sy1a6,sy1a7,sy2aa,sy2a3,sy2a5,sy2rg,sy2a9,sy2rh,sy2ri,sy2rs,sy2v2,sy3b2,sy3pj,sy6fp,ogmBcd,sy2a6,sy3pf,Gg40M,sy477,GU4Gab,syuo,UBXHI,syup,R3fhkb,sy4e8,sy6q7,Q59Rjf,sy46l,T5VV,sy455,aDVF7,sy479,rhYw1b,sy1qf,sy1qj,sy1qk,Hlw0zd,M6QgBb,sy1qp,sy1qy,EO13pd,MpJwZc,UUJqVe,sy7d,sOXFj,sy7c,s39S4,NTMZac,nAFL3,oGtAuc,sy86,sy87,q0xTif,y05UD,sy123,sy124,sy125,sy126,sy127,sy12l,sy12m,sy1ge,sy1gf,sy1fd,sy314,sy1d1,sy1cx,sy1rn,sy1cy,sy1dh,sy1di,sy1d5,sy14l,sy1d4,sy1dl,sy1dk,sy1dm,sy1dn,syep,sy182,sy189,sy2np,sy2nq,sy2nr,sy1ds,sy2nz,syjt,sy3cr,sy3cs,sy6gm,sy18f,sy1cs,sy1ct,sy1cv,sy1d2,sy2ny,sy2o6,sy6gn,epYOx?xjs=s3"
Preview:	_F_installCss(".jbBItf{display:block;position:relative}.DU0NJ{bottom:0;left:0;position:absolute;right:0;top:0}.lP3Jof{display:inline-block;position:relative}.nNMuOd{-webkit-animation:qli-container-rotate 1568.2352941176ms linear infinite;animation:qli-container-rotate 1568.2352941176ms linear infinite}@-webkit-keyframes qli-container-rotate{from{-webkit-transform:rotate(0);transform:rotate(0)}to{-webkit-transform:rotate(1turn);transform:rotate(1turn)}}@keyframes qli-container-rotate{from{-webkit-transform:rotate(0);transform:rotate(0)}to{-webkit-transform:rotate(1turn);transform:rotate(1turn)}}.RoKmhb{height:100%;opacity:0;position:absolute;width:100%}.nNMuOd .VQdeab{-webkit-animation:qli-fill-unfill-rotate 5332ms cubic-bezier(0.4,0,0.2,1) infinite both,qli-blue-fade-in-out 5332ms cubic-bezier(0.4,0,0.2,1) infinite both;animation:qli-fill-unfill-rotate 5332ms cubic-bezier(0.4,0,0.2,1) infinite both,qli-blue-fade-in-out 5332ms cubic-bezier(0.4,0,0.2,1) infinite both}.nNMuOd .IEqiAf{-web

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (44708), with no line terminators
Category:	downloaded
Size (bytes):	44708
Entropy (8bit):	5.3920122455953585
Encrypted:	false
SSDEEP:	768:igAw0peAQya0VVI4bMvRZ2xtMrcGxYyxN1YksZd5mOupi1pwyyrX:TApp0b0VXyFxYmMTvyj
MD5:	5B643D7567785EC2427B82D09FFF4508
SHA1:	BBFC599B3BA2EA13BC86AAB9E6D29AB77F154FC6
SHA-256:	74564221A4A4185848E41D3DD61E6891C585E7260F16BD485A7136299E949A72
SHA-512:	D3FEA8DC2FEECEF9E22FD43C8DE240DFA3C4C98F8FBA4DF65E1E111071B0A83190B66185C66E83622617DE9BAEC052C6B2BC2BC1791B224E342E63D6D405072C
Malicious:	false
URL:	https://d.impactradius-event.com/A1133099-331c-4cdf-89b0-06dc20e168021.js
Preview:	(function(w,d){var io={util:{getQueryParam:function(p){var url=window.location.search,match;if(window.location.href.indexOf("#")!==-1){url+="&"+window.location.href.split("#")[1]}match=new RegExp("[?&]"+p+"=([^&]*)","i").exec(url);return match?io.util.safeDecodeURIComponent(match[1]):null},hasValue:function(value){return value!==null&&value!==undefined},strContains:function(str,value){return str.indexOf(value)!==-1},addListener:function(el,ev,fn){if(el){if(el.attachEvent){el.attachEvent("on"+ev,function(){fn.call(el)})}else{el.addEventListener(ev,fn,false)}}},removeListener:function(el,ev,fn){if(el.removeEventListener){el.removeEventListener(ev,fn,false)}if(el.detachEvent){el.detachEvent("on"+ev,fn)}},getDaysInMs:function(days){var d=new Date();d.setDate(d.getDate()+days);return d},getBaseDomain:function(){var s="IR_gbd";if(io.util.hasValue(io.util.getCookie(s))){return io.util.getCookie(s)}var domain=window.location.hostname;if(domain){try{var i=0,p=domain.split(".");while(i<(p.length

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1684), with no line terminators
Category:	downloaded
Size (bytes):	1684
Entropy (8bit):	5.187656423876858
Encrypted:	false
SSDEEP:	48:vZUJVKL8MJEcoh8KFRzZZUvGCUvGUzHgrOW:yJYIco5qKgrOW
MD5:	DE86940009396E8053EB96F8E5B36E9F
SHA1:	82A90E46BEF6A1FE9B32EF5E85A7FD4435E8FC89
SHA-256:	CD63D9584599ADE4CC10A7F73B5AC6E7ADE0DCD13D30C93557FD5D25BB1C0939
SHA-512:	4C2597A5831407091AFBBBD5B7BD82C30A1A2C48D7D1F4D6B16B1F8B204FF90A4C7AB2F99E254592DC972EE895E363F7BB5740F02F6963F0492D48A86E95A5A0
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.8RUPaHb7e5o.L.W.O/m=qcwid/excm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/ct=zgms/rs=AA2YrTungzasoekTaLKrPFUaQFpakqDmnA"
Preview:	.gb_2e{background:rgba(60,64,67,.9);-webkit-border-radius:4px;border-radius:4px;color:#fff;font:500 12px "Roboto",arial,sans-serif;letter-spacing:.8px;line-height:16px;margin-top:4px;min-height:14px;padding:4px 8px;position:absolute;z-index:1000;-webkit-font-smoothing:antialiased}.gb_Dc{text-align:left}.gb_Dc>*{color:#bdc1c6;line-height:16px}.gb_Dc div:first-child{color:white}.gb_na{background:none;border:1px solid transparent;-webkit-border-radius:50%;border-radius:50%;-webkit-box-sizing:border-box;box-sizing:border-box;cursor:pointer;height:40px;margin:8px;outline:none;padding:1px;position:absolute;right:0;top:0;width:40px}.gb_na:hover{background-color:rgba(68,71,70,.08)}.gb_na:focus,.gb_na:active{background-color:rgba(68,71,70,.12)}.gb_na:focus-visible{border-color:#0b57d0;outline:1px solid transparent;outline-offset:-1px}.gb_i .gb_na:hover,.gb_i .gb_na:focus,.gb_i .gb_na:active{background-color:rgba(227,227,227,.08)}.gb_i .gb_na:focus-visible{border-color:#a8c7fa}.gb_oa{-webkit-box

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (537)
Category:	downloaded
Size (bytes):	119837
Entropy (8bit):	5.4831300552030555
Encrypted:	false
SSDEEP:	3072:VZfPGTdK1hP/NS+SV7NUM5bWY2iBg2une0wX02yQ6:XfeTdK1hP1NSV7NUM5bWY2iBg2une0++
MD5:	D4179CDE039EC9EAE2A2A3535CCD9ABA
SHA1:	8913DE91DE1E36956756D979F916A5E4EC0AAE8C
SHA-256:	14135981DD96639A56DAFA71EDFA6FE5DFE7834E269E8092401B97FC40150AFE
SHA-512:	CCDEB348B0864FE027B14C0D946FACF348BD909EE657D0A98497F3A33DCA71D496D3B981027C001AEE78180F2F0E30E60AE5C67C05A0406C8C8352927CD249A0
Malicious:	false
URL:	https://www.youtube.com/s/player/6ee8f9ce/player_ias.vflset/en_US/remote.js
Preview:	(function(g){var window=this;'use strict';var a8=function(a){g.Hp(a,"zx",Math.floor(2147483648Math.random()).toString(36)+Math.abs(Math.floor(2147483648Math.random())^g.ob()).toString(36));return a},b8=function(a,b,c){Array.isArray(c)\|\|(c=[String(c)]);.g.Cga(a.B,b,c)},ryb=function(a){if(a instanceof g.qt)return a;.if("function"==typeof a.Bk)return a.Bk(!1);if(g.bb(a)){var b=0,c=new g.qt;c.next=function(){for(;;){if(b>=a.length)return g.M2;if(b in a)return g.rt(a[b++]);b++}};.return c}throw Error("Not implemented");},syb=function(a,b,c){if(g.bb(a))g.bc(a,b,c);.else for(a=ryb(a);;){var d=a.next();if(d.done)break;b.call(c,d.value,void 0,a)}},tyb=function(a,b){var c=[];.syb(b,function(d){try{var e=g.Mv.prototype.B.call(this,d,!0)}catch(f){if("Storage: Invalid value was encountered"==f)return;throw f;}void 0===e?c.push(d):g.rla(e)&&c.push(d)},a);.return c},uyb=function(a,b){tyb(a,b).forEach(function(c){g.Mv.prototype.remove.call(this,c)},a)},vyb=function(a){if(a.ma){if(a.ma.locationOverri

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (5836)
Category:	downloaded
Size (bytes):	124457
Entropy (8bit):	5.20550018822251
Encrypted:	false
SSDEEP:	768:1ecqKIRxKSipJ+wsbNijF7+OwMG4upEeZxuq5mDMI0B+Naq7wn95nSekV6MH/fEA:GiLbwMG4upEisMl/q/7CLl0H
MD5:	3524CD4FDB60C87CC5E47AA38E3360D8
SHA1:	2FDD7CF44C9841080855C6193182D9756EF4BCD8
SHA-256:	E6A32AA3E68CD953E80CA8E96292375517063B1B2E02434D9DA847C6BD613295
SHA-512:	D77BB9B8DBCF2C4C3638A43C2376409FEB5BD3A4CCCB256CF697E8E5D58834F5442E1DEEC930987B86611A5377F421DC996AB43180A92756F3E678ECDFEF3B30
Malicious:	false
URL:	https://www.microsoft.com/en-us/download/details.aspx?id=35
Preview:	<!DOCTYPE HTML>..<html lang="en-US" dir="ltr">.<head>. . .. ..... . . . . . . . .. . Start of ADDITIONAL DEBUG INFO cv.html .. CVToken: CASMicrosoftCV6dd0cf9a.0. End of ADDITIONAL DEBUG INFO -->.... <link rel="dns-prefetch" href="https://cdn-dynmedia-1.microsoft.com"/>.<link rel="preconnect" href="https://cdn-dynmedia-1.microsoft.com"/>.<link rel="dns-prefetch" href="https://web.vortex.data.microsoft.com"/>.<link rel="preconnect" href="https://web.vortex.data.microsoft.com"/>.<link rel="dns-prefetch" href="https://img-prod-cms-rt-microsoft-com.akamaized.net"/>.<link rel="preconnect" href="https://img-prod-cms-rt-microsoft-com.akamaized.net"/>.<link rel="dns-prefetch" href="https://c.s-microsoft.com"/>.<link rel="preconnect" href="https://c.s-microsoft.com"/>.<link rel="dns-prefetch" href="https://analytics.tiktok.com"/>.<link rel="preconnect" href=

Chrome Cache Entry: 475

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.9889835948335506
Encrypted:	false
SSDEEP:	3:CUkxl7/lHh/:slf/
MD5:	B4491705564909DA7F9EAF749DBBFBB1
SHA1:	279315D507855C6A4351E1E2C2F39DD9CD2FCCD8
SHA-256:	4E0705327480AD2323CB03D9C450FFCAE4A98BF3A5382FA0C7882145ED620E49
SHA-512:	B8D82D64EC656C63570B82215564929ADAD167E61643FD72283B94F3E448EF8AB0AD42202F3537A0DA89960BBDC69498608FC6EC89502C6C338B6226C8BF5E14
Malicious:	false
URL:	https://us-u.openx.net/w/1.0/sd?id=537148856&val=Zbk3QwAAAGzR0xva
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 476

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6107), with no line terminators
Category:	downloaded
Size (bytes):	6107
Entropy (8bit):	5.491400963823037
Encrypted:	false
SSDEEP:	96:tjo/sC63hUjG516E6xY6Z66v3fF8GhyU60urhRncv3FC+2FVjesryc0l256/4:m0ZNStLZPv3N8GhG0u1Rncv3FC+UVjeS
MD5:	F5242E0B2A8FC183AC2D4F48CB85DC0E
SHA1:	226BEE0B8C5EF65E4788E0991B51EA05C26DC786
SHA-256:	434955A763B57088C65C34F23F27250BE4F8D1CB3BF27882A181D240662B2B0F
SHA-512:	75F164DF385ECB8933E94F2067BFE89F61CD47ACA9F5438B19F634A774AB716B79A6C7976F0CA4173A34953BAD44C09E1DE113ADAF546D2ED001FAC8909A0FB9
Malicious:	false
URL:	https://cdnssl.clicktale.net/www/bridge-WR110.js
Preview:	(function(){var t,v,a,z;function q(){a=false;z=ClickTaleGlobal.api\|\|{};t=A("ClickTaleSettings.Integration.ProjectType",0);v={clicktaleOnly:0,m1:1,m2:2,m2Prime:3};n();h();w();l();d()}function d(){if(!z.ClickTaleOnReadyInvoked){z.ClickTaleOnReadyInvoked=true;var E,C=ClickTaleGlobal.scripts,D=function(){if(typeof ClickTaleOnReady=="function"){ClickTaleOnReady()}p(window.ClickTaleOnReadyList)};if(C){E=C.dependencies;E&&E.onDependencyResolved(D);E.notifyScriptLoaded("wr")}else{D()}}}function B(){window._uxa&&_uxa.push(["afterPageView",function(){if(_uxa.push(["isRecording"])){(typeof ClickTaleOnRecording=="function")&&ClickTaleOnRecording();WRPubSub.publish("recording")}}])}function A(F,C){var E=F.split(".");var G=window;for(var D=0;D<E.length&&G;){G=G[E[D++]]}return G===undefined?C:G}function n(){var C=e();if(window.ClickTaleSettings&&ClickTaleSettings.CheckAgentSupport){ClickTaleSettings.CheckAgentSupport(function(D){return D},C)}}function p(J){if(typeof J==="object"&&"length" in J){var I

Chrome Cache Entry: 477

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1505)
Category:	downloaded
Size (bytes):	121630
Entropy (8bit):	5.496341822184716
Encrypted:	false
SSDEEP:	3072:Blqyv+KyDRr0AQHNvaN53HytLNTIG99sdo0v0W:yyqr0RPtzOS0v0W
MD5:	EC9A3858B2C06B17C4811845C37209C4
SHA1:	2DF320AD9DAF33DD31E6381906F7FDCB598EF312
SHA-256:	421319127DE46E1AB3F62CCC60459A5C53A5AD462E5BD62051CF5E346AE26231
SHA-512:	A8AC445F151E4A56D1870E7D0A0B3940672A4B6A2B4A1426E6764F8B2DDBB61427B275FD2797373834D10076B50E06E50F509E2B8EE1FB02CF4A936B7E611B49
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.GsbA68hXs80.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo899t-H8Lxb3OqzMDuPn6TV_i36ag/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);.var ea,fa,na,pa,sa,va,wa,Ca;_.da=function(a){return function(){return _.ba[a].apply(this,arguments)}};_.ba=[];ea=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};fa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.na=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.oa=na(this);pa=function(a,b){if(b)a:{var c=_.oa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&fa(c,a,

Chrome Cache Entry: 478

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65394)
Category:	downloaded
Size (bytes):	91640
Entropy (8bit):	5.360048234640597
Encrypted:	false
SSDEEP:	1536:mzyljYliLzaX5RZfyokAWGCwDG2kLB4OKNm:mmlQeA5RZfTECk
MD5:	47803F84B2D7BABACA8BD0A71D915A18
SHA1:	9C4F4AFF50B1C7857DF95710A846906C58BD8591
SHA-256:	23B3C11A90B0F93F9FC295847ECA352ED5286FBDF5EA2F68F9BD9304D72DD21F
SHA-512:	3664F5BF52B40DCCC9D9AC577AD8B5CA9847ECD6A372E69E755936526B1032699D4EE2BB3C34D1FBDB23557126A394888934997D1C37B65B9C11A87E5A152B2E
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.shared.analytics.mectrl-3.gbl.min.js
Preview:	/!. 1DS JS SDK Shared Analytics, 3.2.14. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,n){var t,r={},i="__ms$mod__",o={},a=o.esm_ms_shared_analytics_mectrl_3_2_14={},u="3.2.14",s="oneDsMeControl3",c=(c=e)[s]=c[s]\|\|{},l=(l=e)[s="oneDsMeControl"]=l[s]\|\|{},e=c[i]=c[i]\|\|{},f=e.v=e.v\|\|[],s=l[i]=l[i]\|\|{},d=s.v=s.v\|\|[];for(t in(s.o=s.o\|\|[]).push(o),n(r),r)c[t]=r[t],f[t]=u,l[t]=r[t],d[t]=u,(a.n=a.n\|\|[]).push(t)}(this,function(e){"use strict";!function(e,n,t){var r=Object.defineProperty;if(r)try{return r(e,n,t)}catch(i){}typeof t.value!==undefined&&(e[n]=t.value)}(e,"__esModule",{value:!0});var y="function",m="object",ce="undefined",C="prototype",I="hasOwnProperty",S=Object,b=S[C],x=S.assign,w=S.create,n=S.defineProperty,_=b[I],T=null;function O(e){e=!1===(e=void 0===e\|\|e)?null:T;return e\|\|((e=(e=(e=typeof globalThis!==ce?globalThis:e)\|\|typeof self===ce?e:self)\|\|typeof window===ce?e:window)\|\|typeof global===ce\|\|(e=global),T=e),e

Chrome Cache Entry: 479

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4054
Entropy (8bit):	7.797012573497454
Encrypted:	false
SSDEEP:	48:zICvnyRHJ3BRZPcSPQ72N2xoiR4fTJX/rj4sFNMkk5/p1k2lPUmbm39o4aL7V9XH:10nvE724xoiRQJPrjpLKSFl9oX31Z1d
MD5:	9F14C20150A003D7CE4DE57C298F0FBA
SHA1:	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F
SHA-256:	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
SHA-512:	D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487
Malicious:	false
URL:	https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Preview:	.PNG........IHDR.............J.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A00BC639840A11E68CBEB97C2156C7FD" xmpMM:InstanceID="xmp.iid:A00BC638840A11E68CBEB97C2156C7FD" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2C931A470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJR 1.4`$.200...l........wg.y.[k/

Chrome Cache Entry: 480

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	660
Entropy (8bit):	7.7436458678149815
Encrypted:	false
SSDEEP:	12:CPgCZ+X6xCDzNAs1dVc1rhVbo50xCmGjkm9vgZAO2YCGoOg/t+YcJNw:KZ+iC134tFoOxC3/vO2YCpR8YcJNw
MD5:	C3DFF0D9F30EC0BCF4DEC9524505916B
SHA1:	4B378403ACBEBC3747E08C69B5FD7770A850C9EB
SHA-256:	73D788F86BE22112BB53762545989C0F1BBDB7343161130952C9BA3834FF81E3
SHA-512:	677EA304D00D176ACF61FF68BF23BD5F77AD2928D7DE9F4B842292BC9D3FB7029FE9F578B62F142DCE689230F392E828098EED3484FE2DBEE6E1A7AA5378E2C6
Malicious:	false
URL:	https://www.google.com/images/searchbox/desktop_searchbox_sprites318_hr.webp
Preview:	RIFF....WEBPVP8L..../'....Hv.=n.......Q...a..(Rv.o..U.....l..m........0l.6l..f.......A?B.C.A...2h..Ag0....G8.n#)R.j.x..P.F..I;.Ox......7-...bX./..]...3..T....5...x...G.C....%.u.....u/._.=....<!q.\...9.....\....p:..P.4.aS.N).>.>.."..9..Vh ....no....l.1..#6p\c..2..>..=8...........FP.^....+/.~......hs..D.Jm..9...r....t*.H..~T^\|.....l..l......he..}f....d.."....K...&1..................pl.Pf.%6...2X..I...eXQ(.K..1%c..w.s._..._K`K.1}..D.E=...<..ytM..>.q'.e.L.~$...b..;k.M.....t\O..m.I._..F....'........z.]..u?~..P.zJM.. k...p~9..D....".Zl$?f..+...\.Pg..%...;.[R>N.#.W.e..@q...(....]&......K.......?.\|.z..(...:&m.V.C.'...D^.R....

Chrome Cache Entry: 481

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	318601
Entropy (8bit):	4.937382205258339
Encrypted:	false
SSDEEP:	3072:Uwtki9QkGoO4QPwGY5DPMwqGsbkyvLUi4beyAX/bSe2yUXaemHqOOkwsik7oZtI+:Rj9p
MD5:	24E963C5973B1072ED7B92DE5BD89AD2
SHA1:	3022D0CFC4EDA6A80AE929C6E6604FFD37ED6F0A
SHA-256:	1B7D8B28E1477457E3C874F870D817CC17B23E3E220627AFEEBF275732536920
SHA-512:	9AC313DF896804EBDF4B8EF086F1B1C1FEDF5608C8CDD42534A118D0FBCA91336CDA2BB44DB6B36403A092ADCD5B472B5D594AB55ED8B39A49436568BAC4F764
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/cascade.component.authoring/clientlibs/clientlib-base.min.ACSHASH24e963c5973b1072ed7b92de5bd89ad2.css
Preview:	.cmp-image__image{width:100%}..aem-Grid{display:block;width:100%}..aem-Grid::before,.aem-Grid::after{display:table;content:" "}..aem-Grid::after{clear:both}..aem-Grid-newComponent{clear:both;margin:0}..aem-GridColumn{box-sizing:border-box;clear:both}..aem-GridShowHidden>.aem-Grid>.aem-GridColumn{display:block !important}..aem-Grid.aem-Grid--1>.aem-GridColumn.aem-GridColumn--default--1{float:left;clear:none;width:100%}..aem-Grid.aem-Grid--1>.aem-GridColumn.aem-GridColumn--offset--default--0{margin-left:0}..aem-Grid.aem-Grid--1>.aem-GridColumn.aem-GridColumn--offset--default--1{margin-left:100%}..aem-Grid.aem-Grid--2>.aem-GridColumn.aem-GridColumn--default--1{float:left;clear:none;width:50%}..aem-Grid.aem-Grid--2>.aem-GridColumn.aem-GridColumn--default--2{float:left;clear:none;width:100%}..aem-Grid.aem-Grid--2>.aem-GridColumn.aem-GridColumn--offset--default--0{margin-left:0}..aem-Grid.aem-Grid--2>.aem-GridColumn.aem-GridColumn--offset--default--1{margin-left:50%}..aem-Grid.aem-Grid--2>.a

Chrome Cache Entry: 482

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (590)
Category:	downloaded
Size (bytes):	1716
Entropy (8bit):	5.2304068952006615
Encrypted:	false
SSDEEP:	48:4435HDQ258U3JqVnCG/6YyTrkzRLj9tSRAE9P:hU25ZqVC6ByTrWRLjSRAE9P
MD5:	4CFFC2C9B55F8BDE649E0D2535A1EEBD
SHA1:	2AAF4DF1E02ED4F5BB48F00A7423F748BF544E0C
SHA-256:	7BB50A050792F761855CC330E0248D037B37DD68FD23FBB7DB8A7E8694F50A94
SHA-512:	599C87219B7E264CFF8E6951192C691E26DFFA88EFC607EDFE9205F1BB08DA28FD61B508FAE93652BE36BE1ADA57E50661490925B247A43C3EB7F24D8CA0C8D0
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/clientlibs/exp-analytics/v1.min.ACSHASH4cffc2c9b55f8bde649e0d2535a1eebd.js
Preview:	'use strict';var experimentationAnalytics=function(){function g(a){return a&&0<a.length?!1:!0}function m(a){return Object.keys(a).map(function(b){return b+""+a[b]}).join("")}function n(a){var b=a.reduce(function(c,e){c[m(e)]=e;return c},{});return Object.keys(b).map(function(c){return b[c]})}function h(a){console.log("sendToVortex Call");a&&a.analytics&&f(a)}function k(a){return{actionType:"A",behavior:"12",content:JSON.stringify({}),pageTags:{tnta:a&&a.analytics?a.analytics.tnta:""}}}function l(a,.b){return{actionType:"A",behavior:"12",content:JSON.stringify({}),pageTags:{tnta:"",at_activity_name:a&&a.responseTokens[b]?a.responseTokens[b]["activity.name"]:"",at_exp_name:a&&a.responseTokens[b]?a.responseTokens[b]["experience.name"]:"",at_activity_id:a&&a.responseTokens[b]?a.responseTokens[b]["activity.id"]:"",at_exp_id:a&&a.responseTokens[b]?a.responseTokens[b]["experience.id"]:""}}}function f(a,b,c){b="number"===typeof b?b:25;c="number"===typeof c?c:200;var e=0;if(window.expAnalytics&

Chrome Cache Entry: 483

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 24 x 24, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	219
Entropy (8bit):	6.672026282090217
Encrypted:	false
SSDEEP:	6:6v/lhPXHBCahwKJu75KNnQY8kzPsYI2R/vXG+pjRMORup:6v/7UqhlNQYpDsYlHG2rRc
MD5:	A645907F22E3265E9C3ECE3872EF9567
SHA1:	377426B57776474466297240AC1F315F2DEB3343
SHA-256:	3B38DF6E208371DCD43F691C977F8F1891B4A0341674A102585A5490EE4AC4B5
SHA-512:	BE849829C32D817E67DBA2E4E2A93939F0AAE8245A3BCE8086A7B7D0A1CC1076BCCBDBE2506071E61E1810C78C0DEF6452C26D138BF1F892DA2294D17BA08214
Malicious:	false
URL:	https://www.google.com/images/icons/material/system/1x/email_grey600_24dp.png
Preview:	.PNG........IHDR.............J~.s....IDATx..1..0.F...o...s..$...!.D.....2..../6.iG.oh..= ..<.q..Fj. +i]q1..0.T..z.......s.@l.S"T<...=......M.eB.....M.}c.P.s._.......[.a.@.h.....`.._1.q..!...i..i...gZ......IEND.B`.

Chrome Cache Entry: 484

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3065)
Category:	downloaded
Size (bytes):	42424
Entropy (8bit):	5.497946156303828
Encrypted:	false
SSDEEP:	768:w+PfNb1eD8Wb4jGZm8kQ9eF0fI0OFc0h1OevIieryS6:LnF1eAWbTVpm0opF+e
MD5:	65E4C1EA0EF81DD1058E657727914791
SHA1:	1CB7191D0E1109663E15F9309562E359063AC523
SHA-256:	6AC7E5E3555B81CAC8EB49F5465DF881FD82D52D836FA9021D86694D0AF2FA26
SHA-512:	6F8A371D124552CCBB8751FD2F61E5806ED3311DF90F39411FA83B6D5BA8C29B1A21CA7A77AF7B8ECFA13676EDCCA13796E1A19B995D10D3F6B2C2A823628BF5
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/clientlibs/clientlib-httpclient.min.ACSHASH65e4c1ea0ef81dd1058e657727914791.js
Preview:	'use strict';!function(l){function d(c){if(b[c])return b[c].exports;var g=b[c]={i:c,l:!1,exports:{}};return l[c].call(g.exports,g,g.exports,d),g.l=!0,g.exports}var b={};d.m=l;d.c=b;d.d=function(c,g,e){d.o(c,g)\|\|Object.defineProperty(c,g,{enumerable:!0,get:e})};d.r=function(c){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(c,Symbol.toStringTag,{value:"Module"});Object.defineProperty(c,"__esModule",{value:!0})};d.t=function(c,g){if((1&g&&(c=d(c)),8&g)\|\|4&g&&"object"==typeof c&&.c&&c.__esModule)return c;var e=Object.create(null);if(d.r(e),Object.defineProperty(e,"default",{enumerable:!0,value:c}),2&g&&"string"!=typeof c)for(var f in c)d.d(e,f,function(k){return c[k]}.bind(null,f));return e};d.n=function(c){var g=c&&c.__esModule?function(){return c.default}:function(){return c};return d.d(g,"a",g),g};d.o=function(c,g){return Object.prototype.hasOwnProperty.call(c,g)};d.p="";d(d.s=123)}([,function(l,d,b){b.d(d,"X",function(){return c});b.d(d,"Y",function(){return g});

Chrome Cache Entry: 485

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (596)
Category:	downloaded
Size (bytes):	1673
Entropy (8bit):	5.341465836803539
Encrypted:	false
SSDEEP:	48:B2NtXbW+J15DR7LXXAW/cupXGbLu9Gbcsa0Z5K:B2nL1fX0u0u+ap
MD5:	CD38A61B95FC958F82B55B5F8E5DE39C
SHA1:	A183EACF39FED2B4681A9125F67E76983A1ADEB8
SHA-256:	DA3F9F72A846CC2292AE420A88BAB3D6B8185A73A5A1D844E8713BAFB3DA5489
SHA-512:	0E7B5674DAC10CD8924E4DA732216EEC5F2BA5B591687C6CA5B9AE85AF10ACE4621F0A5956DA58B6437F8565E14761D4D8A3E4EF2D03C7F9F05ADEB663799259
Malicious:	false
URL:	"https://www.google.com/xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=kMFpHd,sy8j,bm51tf?xjs=s3"
Preview:	this._s=this._s\|\|{};(function(_){var window=this;.try{._.x("kMFpHd");._.wbb=new _.Vn(_.pMa);._.y();.}catch(e){_._DumpException(e)}.try{.var Fbb;_.Gbb=function(a,b,c,d,e){this.efb=a;this.OEf=b;this.Jhc=c;this.PMf=d;this.O5f=e;this.S3b=0;this.Ihc=Fbb(this)};Fbb=function(a){return Math.random()Math.min(a.OEfMath.pow(a.Jhc,a.S3b),a.PMf)};_.Gbb.prototype.Rod=function(){return this.S3b};_.Gbb.prototype.XNa=function(a){return this.S3b>=this.efb?!1:null!=a?!!this.O5f[a]:!0};_.Hbb=function(a){if(!a.XNa())throw Error("ce`"+a.efb);++a.S3b;a.Ihc=Fbb(a)};.}catch(e){_._DumpException(e)}.try{._.x("bm51tf");.var Ibb=function(a){var b={};_.Pa(a.Ltc(),function(e){b[e]=!0});var c=a.Zrc(),d=a.Msc();return new _.Gbb(a.Lsc(),1E3c.oa(),a.mqc(),1E3d.oa(),b)},Jbb=!!(_.Vg[18]>>25&1);var Kbb=function(a){_.Yn.call(this,a.Ka);this.Aj=null;this.wa=a.service.xJc;this.Aa=a.service.metadata;a=a.service.nof;this.ka=a.fetch.bind(a)};_.F(Kbb,_.Yn);Kbb.nb=_.Yn.nb;Kbb.Ga=function(){return{service:{xJc:_.Abb,metadata:_.

Chrome Cache Entry: 486

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8152)
Category:	downloaded
Size (bytes):	8157
Entropy (8bit):	6.014788146631974
Encrypted:	false
SSDEEP:	192:ob/NMezCiVLkMuBIfEGhQI/0sEuLjWc/y+v9+sakdOrNzq:sRzCYLEbaJEuXWIy+v9+skzq
MD5:	61A3A16BB7F7F3C9F1D67B80B17A8A7B
SHA1:	74DE08B4F99EE5A7278E16FEC1B1DCDDB78CFB0F
SHA-256:	C539DD5E7787FA4CC11202835E614C34256945058AB097EF9549BC8B83A6DC78
SHA-512:	22620C705B06B3CF58EF86C2CC2C6103F40746876CC0A05B8820655A1C7B178D2BF25D833B3F5D27A93CABE76DAB7BC6DB9C220DA21FC0E8F2B9648380FF0EEA
Malicious:	false
URL:	https://www.google.com/async/bgasy?ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cs=0&async=_fmt:jspb
Preview:	)]}'.{"bgasy":["https://www.google.com/js/bg/lacXDESmFNCfdjOancbwgXndljS9s2_APphknVt3wEo.js","XCrMroMTJZMDVSmySudlCqOc7r4YrlTYQl9U/I5Qf1EuPH1y8nXoDqK8O0dcwLDnwjhe8wK8vfPAjJb/P/oILnJyc2XUL3roDbxbKti/n3AhMuri9RezrMFssT2ixxTu39d/tVwZjs3z0W8dzHWiF6fkMxcyT/WXZ/cVqosWSdhnC26coRSURz6LAZwoGPOlfShhry0NgfslgNr5GqlOd2XVZxOGVvj7mo5mFMhwnCmsokCoslrzd3qi8bwxOGuKEYirHOrZABqssv0fz2HmtJo+9YwXhpwJRrEvUgYLRbOAnGIjw9UWVIu1gs2UCIsmqXyxo7wU9DAIDAKUxYGrML6xFFVgA/QJcbn7pL2+pUh4680+3BSyLeVBTQwrhPmkQDHmvU5tnUCQ4vy7kdfa/n6kvjz2D9m6jsVYR5xEnemdDU2fZwu5CQj4F81juxrSdvp5AqIHASQpAtaCxu25D6TkyuTZw5Tc6j1/EvuGnUwumGJ3rKoH/0Iidb8DWarm0PU8sBX5KluBaDG/EUZJ4ew2SbPk96dbqrwjhDk686Hx7oViRHyyyZEDZMcZP9nL2aRLUVk9hm6F2h2GBKPYLCA5vq6iXEHbfeLwHS4bY595zw+hPYBiPVGNmRr+tqo22b0x4mCmFtd93pnBAtXRiYv38iJgJFVAR8s0FPPzFKvna7OOl6gn5FevIBccdBEsTbddMefN9drtBFXpHvepuO7y9kEMxmpjtjJNWFoDCTZzeycmxX6nAZpWy1U9i1ZJ8NqoQBPMiQU9halKLUvD/sZtlGDtWzm1seZ0K1ipLiDQ91uHXWnoGGF2ADP6lNwszQBe8x4Vn5rF9npStJYqEfEbDb3OKcvwUlR2VFFEqZTJ/CVaW3DtiC761dHxpXWsZeqT9JnRXX

Chrome Cache Entry: 487

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (30158)
Category:	downloaded
Size (bytes):	30210
Entropy (8bit):	5.277920786521732
Encrypted:	false
SSDEEP:	768:m2b2k0SM0FdK7yI5jMNI6FZ6l8qMy6aAw6Vz1yg:m2h0S5rKX5jgI6FZQP6aAw6V5yg
MD5:	7CE7FBACAA61AA64CE70A08527CAD9CF
SHA1:	3B5FA60B67713649F724A15CF147E43853DF491A
SHA-256:	59894689C611490CBEC89B60870E373321A0DFD9341A8D827231C55B2163C22B
SHA-512:	CAD0AC514CB2B64F4E1148876B740BEDFC9A0255EBE2097782B2E8A22F94A8CE331EF05B8776564745458506E4CCACAECBE81E5E8F359B7C15413BB784837A6A
Malicious:	false
URL:	https://mem.gfx.ms/meversion?partner=MSDLC&market=en-us&uhf=1
Preview:	window.MSA=window.MSA\|\|{};window.MSA.MeControl=window.MSA.MeControl\|\|{};window.MSA.MeControl.Config={"ver":"10.23347.2","mkt":"en-US","ptn":"msdlc","gfx":"https://amcdn.msftauth.net","dbg":false,"aad":true,"int":false,"pxy":true,"msTxt":false,"rwd":true,"telEvs":"PageAction, PageView, ContentUpdate, OutgoingRequest, ClientError, PartnerApiCall, TrackedScenario","instKey":"b8ffe739c47a401190627519795ca4d2-044a8309-9d4b-430b-9d47-6e87775cbab6-6888","oneDSUrl":"https://js.monitor.azure.com/scripts/c/ms.shared.analytics.mectrl-3.gbl.min.js","remAcc":true,"main":"meBoot","wrapperId":"uhf","cdnRegex":"^(?:https?:\\/\\/)?(mem\\.gfx\\.ms(?!\\.)\|controls\\.account.microsoft?(?:-int\|-dev)?(\\.com)?(:[0-9]{1,6})\|amcdn\\.ms(?:ft)?auth\\.net(?!\\.))","timeoutMs":30000,"graphv2":true,"graphinfo":{"graphclientid":"7eadcef8-456d-4611-9480-4fff72b8b9e2","graphscope":"user.read","graphcodeurl":"https://login.microsoftonline.com/common/oauth2/v2.0/authorize","graphredirecturi":"https://amcdn.msftauth.net

Chrome Cache Entry: 488

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1036)
Category:	downloaded
Size (bytes):	1041
Entropy (8bit):	5.57533334782641
Encrypted:	false
SSDEEP:	24:5yJq/HM5BHslgT5FzrE0z10/ykfVkmiKBqPuP8PF7FILmJmQffffffV+:5c5KlgT5JQh/yk9kmePukpFIymQffffA
MD5:	E7F2DDDC2E727B469282E6B5773967DB
SHA1:	AEA9ED8B5C3475B25810A0D3A195C4CAB0B06E6C
SHA-256:	A5DCCC5D00B27D331AD6CADFD9B9761842B17500F079DC2002478B860DDE2C79
SHA-512:	3DF636E84ED738A5C07333DA2C8C7031934ED5559B67BFC88ED74201D3E8F97748F07CE8327AA09BC1F1A6A42549B42E9688443994883261EDD8219A51ED31A1
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=direc&oit=1&cp=5&pgcl=7&gs_rn=42&psi=w2jj9Ekh5vGktcI5&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["direc",["directions","directv","directions atlanta","directions forest park","directv stream","directions google","direct object","direct democracy","directv login","directions google maps"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{},{"google:entityinfo":"CgkvbS8wMm1kc2oSL0NhYmxlIGFuZCBvdGhlciBwYXkgdGVsZXZpc2lvbiBzZXJ2aWNlcyBjb21wYW55MmRodHRwczovL2VuY3J5cHRlZC10Ym4wLmdzdGF0aWMuY29tL2ltYWdlcz9xPXRibjpBTmQ5R2NUa1VVaXBZNWhYaW5BZUItRlNKdXBfRzEzWHJUR1ljUG5OYXF3ZHJmRSZzPTEwOgdESVJFQ1RWSgcjMmE2MGEzUjVnc19zc3A9ZUp6ajR0VFAxVGN3eWswcHpsSmdOR0IwWVBCaVQ4a3NTazB1S1FNQVR2a0d3d3AX"},{},{},{},{},{},{},{},{}],"google:suggestrelevance":[1200,700,601,600,555,554,553,552,551,550],"google:suggestsubtypes":[[512,433,131,457],[512,433,199,465],[512,650,402],[512,650,402],[512,433],[512,433],[512,433,131],[512,433,131],[512,433],[512,433,131]],"google:suggesttype":["QUERY","ENTITY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY",

Chrome Cache Entry: 489

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1998)
Category:	downloaded
Size (bytes):	521888
Entropy (8bit):	5.157203888203875
Encrypted:	false
SSDEEP:	12288:0JpYYYb5T2Z6gigVd1e/zXK5lbgutNPzedZTyatWYre0dZshIw:0JpYb5T2Z6gigv1e/zXKLbgunzedZTyb
MD5:	9D1E62F31F5FB44AABA93302756881F0
SHA1:	931D7EFA42497C6605229384C871AF132744EC1C
SHA-256:	9A956DDE9A7E036FA7B22E0E8566BA18F2D9DC35D2B6FA0F18802D35A71704FB
SHA-512:	6B03806D5E6A5427D6233C6E416D100399A57EF1F0685B0485194F0A7D961B6B6E28DD3D3EE6C65137FE99C0B47827D72BCDBF844786BEE0C13A0050C56CA868
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/clientlibs/clientlib-mwf-new/main-light.min.ACSHASH9d1e62f31f5fb44aaba93302756881f0.js
Preview:	./!. MWF (Moray) Extensions v2.10.0. * Copyright (c) Microsoft Corporation. All rights reserved.. * Copyright 2011-2022 The Bootstrap Authors and Twitter, Inc.. * Copyright .2022 W3C. (MIT, ERCIM, Keio, Beihang).. */..(function (global, factory) {..typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :..typeof define === 'function' && define.amd ? define(['exports'], factory) :..(global = typeof globalThis !== 'undefined' ? globalThis : global \|\| self, factory(global.mwf = {}));.})(this, (function (exports) { 'use strict';...var commonjsGlobal = typeof globalThis !== 'undefined' ? globalThis : typeof window !== 'undefined' ? window : typeof global !== 'undefined' ? global : typeof self !== 'undefined' ? self : {};...var check = function (it) {.. return it && it.Math == Math && it;..};...// https://github.com/zloirock/core-js/issues/86#issuecomment-115759028..var global$a =.. // eslint-disable-next-line es/no-global-this -- safe.. check(typeof globalTh

Chrome Cache Entry: 490

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (624)
Category:	downloaded
Size (bytes):	629
Entropy (8bit):	4.905446231988934
Encrypted:	false
SSDEEP:	12:u8jP3TpqJeqJe3JX2BHslriFuOBUJ3lA7kwuSmmEEGMkw4/ffffffff0wzyV:IJbJoJX2BHslgu7A7F5mmEENmffffff6
MD5:	A32B40F2980634C03EA32B9193DE4E4A
SHA1:	7AB94CC031FA6B320BD7EA3B1FA93183688543C6
SHA-256:	C414CD20D5C48C141901B4246A976D85F1228DFEA718A5BDCA132DF77C096700
SHA-512:	88CE8F0FC8CF94A3A4E1AC78FA52822AC6C8346D1116257ECAD3E78CB41D515B590E6E34D152F3A3D7E0C4ABC14ACC5537BE82CAF48F86BECBFD5511A0E70058
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=directx&oit=1&cp=7&pgcl=7&gs_rn=42&psi=w2jj9Ekh5vGktcI5&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["directx",["directx","directx runtime","directx 11","directx 12","directx download","directx 11 vs 12","directx runtime download","directx 11 vs vulkan","directx 12 download","directx update"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[1300,801,800,750,601,600,553,552,551,550],"google:suggestsubtypes":[[512,433,131],[512,433,131],[512,433,131],[512,433],[512,433],[512],[512,433,131],[512],[512,433,131],[512,433,131]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"],"google:verbatimrelevance":1300}]

Chrome Cache Entry: 491

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1283
Entropy (8bit):	4.393500974386876
Encrypted:	false
SSDEEP:	12:KPgkrfXKLf7fcabNBGFMpYMNwy+Mz4zMGgZv4c0EgtiQ5FgWyb0gDIgdcZPx+Ydg:KPv6HUY5+yAZFAXJqiXZXTMK
MD5:	1BF3F6D72753254D68A4A8C99DB850AD
SHA1:	E98B92CFF496817E3D5E6CD117F06BEEFAAD3E5F
SHA-256:	68D929A10C3CD609B936B50A541533994B044B38558A33530FF45D1B420CC07E
SHA-512:	C2F17E5861E800E32F3AC3DEA7424384E82B2F27B79C14D24686C286D5A6559CABDABB6A58DF9125334E196CC7D3116B583B3AE1D9AE6711AB21F9F4B06AF2C0
Malicious:	false
URL:	https://www.microsoft.com/store/buy/cartcount
Preview:	......<!DOCTYPE html>..<html>..<head>.. <title>title</title>..</head>..<body>.. <script>.. function getCartItemCountFromCookie() {.. var name = 'cartItemCount=';.. var allCookies = document.cookie.split(';');.. for (var i = 0; i < allCookies.length; i++) {.. var c = allCookies[i];.. while (c.charAt(0) === ' ') {.. c = c.substring(1);.. }.. if (c.indexOf(name) === 0) {.. return c.substring(name.length, c.length);.. }.. }.. return 0;.. }.... var count = getCartItemCountFromCookie();.... var parentHost = '';.. var parentOriginProtocol = '';.. var parentOrigin = '';.. try {.. parentHost = parent.location.hostname \|\| '';.. parentOriginProtocol = parent.location.protocol;.. parentOrigin = parent.location.origin;.. } catch {..

Chrome Cache Entry: 492

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1063)
Category:	downloaded
Size (bytes):	94343
Entropy (8bit):	5.503879676836862
Encrypted:	false
SSDEEP:	1536:LBi3dBL4Akfk7VvmnQVyriXd7Lcv7eLPpySIEhRcjkR70RaEG5FWHE8UttP3/gt:LcfLYOLVIvHdhBE8ytP4t
MD5:	0E8A9B6A7CB9081CAAE179F105A9A684
SHA1:	89F5A0D1D156EDE8607900F376FDEE9F34047C7E
SHA-256:	5E0284DF11920DD6714829CD921178C260D6B61B0F0E65F43875F4E0C56E6B16
SHA-512:	59B14D6A15EC1EC86970A82317E3F303737921868F9A4A33A6E64F120E2DF50A08449E74DCB5BD1E5AA49A64D00E1B3A4CDDCB54B7011BEF9346D7D437A760C3
Malicious:	false
URL:	"https://www.google.com/xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=WlNQGd,sy1le,sy1lf,nabPbb,sysv,sysw,sysz,syt0,syt2,syt3,sy3ps,sy6fi,VD4Qme,syew,BYwJlf,syqz,syr0,syr2,VEbNoe,sy297,sy299,sy29a,sy29b,NVlnE,sy298,Dq2Yjb,sy28r,sy28s,qmdEUe,sy29c,sy29d,UqGwg,sy4my,ND0kmf,sy1ja,sy1jb,uLYJpc,sy1j7,n7qy6d,sy1j9,HPGtmd,pjDTFb,sy279,sy27a,sy27b,KgxeNb,sy27d,khkNpe,sy3au,EfPGub?xjs=s3"
Preview:	this._s=this._s\|\|{};(function(_){var window=this;.try{._.x("WlNQGd");.var DPb=function(a,b,c){this.trigger=a;this.NQa=b;this.vD=c},ow=function(a){_.D.call(this,a.Ka);this.Ba=null;this.Aa=[];this.wa=null;this.prefix="";this.eka=[].concat(_.cd(a.controllers.eka),_.cd(a.controllers.T8f),_.cd(a.controllers.rYe));this.menu=this.getRoot().el();this.Ja="listbox"===_.zBa(this.menu);this.Qa=new _.gr(this.N3d,1E3,this);this.Ld(this.Qa);EPb(this)};_.F(ow,_.D);ow.Ga=function(){return{controllers:{eka:"NNJLud",T8f:"hgDUwe",rYe:"tqp7ud"}}};_.k=ow.prototype;_.k.Zcf=function(){return this.wa};._.k.D4b=function(a){var b=void 0===b?!1:b;(a=this.J6().find(a))&&this.oa(a,b)};_.k.J6=function(){var a=this,b=[].concat(_.cd(this.ob("NNJLud").toArray())).filter(function(d){return!a.ka(d).Pxb()}),c=_.No(this,"tqp7ud").el();c&&b.push(c);return b};_.k.I3d=function(){return this.eka};_.k.N3d=function(){this.prefix=""};.var EPb=function(a){var b=a.J6();_.Pa(b,function(c){var d=a.ka(c);if(d.isSelected()&&d.isEnabled

Chrome Cache Entry: 493

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.16293190511019
Encrypted:	false
SSDEEP:	3:CUkwx7tHh/:fD/
MD5:	221D8352905F2C38B3CB2BD191D630B0
SHA1:	D804B495CB9B84B9007A25B5D85F9AE674004CDE
SHA-256:	89FE0EE6020314794FC2CFEACF3D10C31050CFE56F8EBDDF1ED0A33FBE941FA7
SHA-512:	CB3397776F5CA1D15D24786896B2478C6548D0B14DEC0832BFB16C4C419135300704F8A7A4DFBF56D625429C1598EE8110958648F25A3CCA09E6956C1FD3335F
Malicious:	false
URL:	https://px.ads.linkedin.com/collect?pid=7850&fmt=gif&cookiesTest=true&liSync=true
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 494

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 495

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 27168, version 0.0
Category:	downloaded
Size (bytes):	27168
Entropy (8bit):	7.992922969154643
Encrypted:	true
SSDEEP:	768:5t+z+kiMy2C4rU03JPhE4lbMTAPZE6OekA:5t+Vyi3JXqTABEg
MD5:	B7640425501065524CEC27D4A55A85ED
SHA1:	F254C388A65EFB4B271C56DEB5685A77EBE09D9D
SHA-256:	FE8A1047376498C80A157D13555E42A92AD480FCB0BCC9DE51AD1930FBEB7F91
SHA-512:	9795975F44BCAE6B73979B221B1C544AC943BCE0ED485B266749559AE95D39641E09C458F2ED20F4667EFC80CA2C47DC6300AD4A3E5CE1D38AA94E014D61322A
Malicious:	false
URL:	https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/light/latest.woff2
Preview:	wOF2......j .........i..........................`.....L........l....6.$........ ..0. ..i.C.'.9.@5..m.....1".X.13..(.......IE.....6.!s.K.=j.z.;q.......,..r....I..I..E.i..u........26.W.X....>e(<.M.R..^Y..e...+..pC.6.E9.l.$S..bn...)^.1.,..pj..<H....^v...b...\|t.....ys.XH.h.#.qF.....=W.x<q.d.m.^4....._...{...H......K.....ds.v...u{....:.....f$(t...DR.B._.p....m....jPf&e.F.Q..a.G.,.a$+.........f.k....@D{....p "B..X1+g.nN].n....W....?.:..K..D.,Y.....;I7.u.:...R.k...,....{+..Y.O`...W.xw.t..d.:...M}#`7"..\|...j.rW.....U.h..A.m`<..$h M....`..vx.w.Pi.3.}). . .Af.........n)P.w....Z.#N.6...@.e............#..B.<...H.HW......6<..)k[..%c....+O..RG0i...@.........J..3}...6..S.......'+8..ZFezY.r.%9)!n.T@.0vF.....y/..!.-.6..r?...#p\|Y.2...}...nB...6.$8.d:k.......r........ ..@.h.+.....5.H.n.3.P.58..\t..I.N.uB...@N@K.]Q..MIr..C:.{t...........F..*.)3.1J....f....Uzn.\o.#.=&h...t........:@BU....V@3..X.pD.C@ H...}.06...G........X.i]n.#<..K1`.,YV..o..<....ms.B.!..

Chrome Cache Entry: 496

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (502)
Category:	downloaded
Size (bytes):	882
Entropy (8bit):	5.258984908602557
Encrypted:	false
SSDEEP:	24:BZ1v6WqlIBavzLPXp4LzHxn1Xbp7WtCZ+vNbKq:BZIrlyavzLBcJSCcNKq
MD5:	DDC7E41D8DD0216E0C2CFCC7BA955619
SHA1:	F60B3D99F9B2C206711E2555042F92A3B731B13D
SHA-256:	C1AB7DDDA6B314CB821233C5734CD8128BD01F085C21A933BB5C8CDF7889F8ED
SHA-512:	D0774F9E10A2157567CEC501FCA8811FF5BD4A29CCFB8DC4E62868122CA59BACE8B741278735C59AD71C0B55973BE93A5DAEBE17687CE44A935E4083CD266CCC
Malicious:	false
URL:	"https://www.google.com/xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=sy11b,sy11c,dt4g2b?xjs=s3"
Preview:	this._s=this._s\|\|{};(function(_){var window=this;.try{._.lf(_.Gq);.}catch(e){_._DumpException(e)}.try{._.vac=function(a){a.isAvailable()&&(_.ba.silk=_.ba.silk\|\|{},_.ba.silk.s=_.ba.silk.s\|\|{},_.ba.silk.s.sis={},_.ba.silk.s.sis.ca=a.jF.bind(a))};.}catch(e){_._DumpException(e)}.try{._.x("dt4g2b");.var yck=function(a){_.Yn.call(this,a.Ka)};_.F(yck,_.Yn);yck.nb=_.Yn.nb;yck.Ga=_.Yn.Ga;yck.prototype.isAvailable=function(){return!0};yck.prototype.jF=function(a){var b=void 0===a?{}:a,c=b.dia;a=b.dla;b=b.WBa;void 0!==c?_.tg({serviceName:"sis",methodName:"ca"}):_.tg({serviceName:"sis",methodName:"caar"});a:switch(b){case 0:b="https://accounts.google.com/ServiceLogin";break a;default:b="https://accounts.google.com/AccountChooser"}c=_.kna(b,{hl:_.Wu(),"continue":c\|\|_.Ys().toString()});(0,_.Ie)(c,a)};._.$n(_.h1a,yck);._.y();.}catch(e){_._DumpException(e)}.})(this._s);.// Google Inc..

Chrome Cache Entry: 497

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1038)
Category:	downloaded
Size (bytes):	1043
Entropy (8bit):	5.571707648344694
Encrypted:	false
SSDEEP:	24:nyJq/HM5BHslgT5FzrE0z10/ykfVkmiKBqPuP8PF7FILmJmQffffffVuV:nc5KlgT5JQh/yk9kmePukpFIymQffff6
MD5:	CF168F086766BD92008D0F9A3A9B1708
SHA1:	3E4B2BD9955206084E11F8C3E03FDED153B7C177
SHA-256:	914791918B6D44533FDB0E581AC293645F6809E62642A04CA3D677C73458C021
SHA-512:	9DE0AE9AA9837FC470A1EDF199D3C9623588241977EA88A0ABA610C186FEB4B94041FA1E45EAABA950C9DF9230B295086729EFA13404C7B60D21A8011DF36504
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=direct&oit=1&cp=6&pgcl=7&gs_rn=42&psi=w2jj9Ekh5vGktcI5&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["direct",["directions","directv","directions atlanta","directions forest park","directv stream","directions google","direct object","direct democracy","directv login","directions google maps"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{},{"google:entityinfo":"CgkvbS8wMm1kc2oSL0NhYmxlIGFuZCBvdGhlciBwYXkgdGVsZXZpc2lvbiBzZXJ2aWNlcyBjb21wYW55MmRodHRwczovL2VuY3J5cHRlZC10Ym4wLmdzdGF0aWMuY29tL2ltYWdlcz9xPXRibjpBTmQ5R2NUa1VVaXBZNWhYaW5BZUItRlNKdXBfRzEzWHJUR1ljUG5OYXF3ZHJmRSZzPTEwOgdESVJFQ1RWSgcjMmE2MGEzUjVnc19zc3A9ZUp6ajR0VFAxVGN3eWswcHpsSmdOR0IwWVBCaVQ4a3NTazB1S1FNQVR2a0d3d3AX"},{},{},{},{},{},{},{},{}],"google:suggestrelevance":[1200,700,601,600,555,554,553,552,551,550],"google:suggestsubtypes":[[512,433,131,457],[512,433,199,465],[512,650,402],[512,650,402],[512,433],[512,433],[512,433,131],[512,433,131],[512,433],[512,433,131]],"google:suggesttype":["QUERY","ENTITY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"

Chrome Cache Entry: 498

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 26288, version 0.0
Category:	downloaded
Size (bytes):	26288
Entropy (8bit):	7.984195877171481
Encrypted:	false
SSDEEP:	768:56JqQaQphRbTHiKNF5z/02h5KpJW3pPOA8Y9g/:gdTTH5XKpJWdH1W/
MD5:	D0263DC03BE4C393A90BDA733C57D6DB
SHA1:	8A032B6DEAB53A33234C735133B48518F8643B92
SHA-256:	22B4DF5C33045B645CAFA45B04685F4752E471A2E933BFF5BF14324D87DEEE12
SHA-512:	9511BEF269AE0797ADDF4CD6F2FEC4AD0C4A4E06B3E5BF6138C7678A203022AC4818C7D446D154594504C947DA3061030E82472D2708149C0709B1A070FDD0E3
Malicious:	false
URL:	https://www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/mwfmdl2-v3.54.woff
Preview:	wOFF......f........D........................OS/2...X...H...`JM.FVDMX.............^.qcmap..............9cvt ...4... .......fpgm...T.......Y...gasp...D............glyf...P..U5.......head..]....2...6...Chhea..]........$$...hmtx..]..........ye'loca..^............Gmaxp..`.... ... ./..name..`....8....]..Rpost..f........ .Q.wprep..f$........x...x.c`.Pf......:....Q.B3_dHc..`e.bdb... .`@..`......./9.\|...V...)00...-.Wx...S......._..m.m.m.m.m;e..y.~.......<p..a.0t.&...a.pa.0B.1..F...Q.ha.0F.3.....q.xa.0A.0L.&...I.da.0E.2L....i.ta.0C.1..f...Y.la.0G.3.....y.\|a..@X0,.....E.ba.DX2,....e.ra..BX1..V...U.ja..FX3.....u.za..A.0l.6...M.fa.E.2l....m.va..C.1..v...].na..G.3......}.~a.p@80......C.a..pD82.....c.q..pB81..N...S.i..pF83.....s.y..pA.0\.....K.e..pE.2\....k.u..pC.1..n...[.m..pG.3......{.}...@x0<.....G.c...Dx2<....g.s...Bx1..^...W.k...Fx3.....w.{...A.0\|.>...O.g...E.2\|....o.w...C.1..~..._.o..08........?..0$........x...mL.U.............9.x.`[...&BF@X...V.h.Z..h......`n....[..U

Chrome Cache Entry: 499

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 500

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	557
Entropy (8bit):	5.017920631493034
Encrypted:	false
SSDEEP:	12:DEARGUGLqcidEEblemSFxEARuWGBUGLqcSWGBdEEbleeESFZ:D1Jcsl21uWHcSWilv
MD5:	A722775809D2312F435036DEF15BCD62
SHA1:	2C6CF2D7ED0D1810B6C96269A4509071575E5771
SHA-256:	4DF68C42ED06B94BC6C7655FFA3F84487DCF88F2452B8BF43C217427E36E31A2
SHA-512:	3A4325C787C32BB7373B73CF419E94200167AA7CF2E689E4E1F8D46C8D9DE7607A4EAA3A346F25C3711723A30C678DE61F8813EBF81EEB66EA536968825F6B43
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/content/back-to-top-button/v1/back-to-top-button/clientlibs/sites.min.ACSHASHa722775809d2312f435036def15bcd62.css
Preview:	@media screen and (max-width:540px){.sticky.back-to-top.stuck{position:static}.}.@media screen and (min-width:540px){.sticky.back-to-top.pageHasChatContainer{bottom:32px !important;left:12px}.}.div.backToTopEditView[data-mount='back-to-top']{opacity:1 !important}.@media screen and (max-width:540px){.fixed-sticky.fixed-back-to-top.stuck{position:static}.}.@media screen and (min-width:540px){.fixed-sticky.fixed-back-to-top.pageHasChatContainer{bottom:32px !important;left:12px}.}.div.backToTopEditView[data-mount='fixed-back-to-top']{opacity:1 !important}

Chrome Cache Entry: 501

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (905)
Category:	downloaded
Size (bytes):	600245
Entropy (8bit):	5.578019122277839
Encrypted:	false
SSDEEP:	6144:Vs9VP+yKBa6s1uhyKqJOrOBFMBCvuTT0JnCp:wP+yH1o3AMjBCvgTkCp
MD5:	B0BB2F45877AB95F245D7F0B1726A62A
SHA1:	596A953F0D1F995AED07FAF585F8E2E0C099B9AD
SHA-256:	DDA8AFC10E384EFE1E5C310AAFE318B8C8B027C40EFF65886773A32831958436
SHA-512:	A5A21F471154CA39CB1091E3C67546C698C39BD5AAC098F7A52A9EEFC45877B0071E6043E35C8A01E7033E64B58E61558C338352C05326A829D7F8DD50A72815
Malicious:	false
URL:	"https://www.google.com/xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=1/exm=SNUn3,attn,cEt90b,cdos,csi,d,dtl0hd,eHDfl,gwc,hsm,jsa,mb4ZUb,qddgKe,sTsDMc/excm=ABxRVc,AD6AIb,B0xr7b,CTwd8,CWOfE,CX5LId,CdOg1,D1J6He,FmnE6b,FuQWyc,GRJ32c,GXyz1,JxE93,KiXlnd,MRb7nf,NmR9jd,NsEUGe,Oa7Qpb,Ok4XMd,PE728b,PoJj8d,PvSBGf,QNvmne,RSlfle,TO0csb,TnXlGd,Trirbc,TurKxc,U3Ovcc,U6nlJe,UQpTU,UiPhkb,Uznx4d,VZLyBe,WxJ6g,XDlt7d,XHo6qe,XTkmZd,XbupY,YuNOCb,ZGLUZ,ZrXR8b,Zudxcb,a3cZoc,adn7N,ak946,bXyZdf,cKV22c,du3Q4e,eTv59e,f26on,fNMhz,hfJ9hb,jJtSzc,jkRPje,kCkfUb,kOSi0d,mL4hG,oXRDzc,pIseB,pMwOEe,pQk1fc,qngJBf,r24bR,rL2AR,sU6eaf,tlA71,tzTB5,vJPFse,vhpQNc,y25qZb,yChgtb,yfH2Bd,yn9Ffd,ypVg7e,yuQBec,zjNhL,zs9f9d/ed=1/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/ee=AfeaP:TkrAjf;Afksuc:wMx0R;BMxAGc:E5bFse;BgS6mb:fidj5d;BjwMce:cXX2Wb;CxXAWb:YyRLvc;DULqB:RKfG5c;DpcR3d:zL72xf;EABSZ:MXZt9d;ESrPQc:mNTJvc;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;EnlcNd:WeHg4;Erl4fe:FloWmf;F9mqte:UoRcbe;Fmv9Nc:O1Tzwc;G0KhTb:LIaoZ;G6wU6e:hezEbd;GleZL:J1A7Od;HMDDWe:G8QUdb;IBADCc:RYquRb;IoGlCf:b5lhvb;IsdWVc:qzxzOb;JXS8fb:Qj0suc;JbMT3:M25sS;JsbNhc:Xd8iUd;KOxcK:OZqGte;KQzWid:ZMKkN;KcokUb:KiuZBf;KeeMUb:HiPxjc;KpRAue:Tia57b;LBgRLc:XVMNvd;LEikZe:byfTOb,lsjVmc;LsNahb:ucGLNb;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Np8Qkd:Dpx6qc;Nyt6ic:jn2sGd;OgagBe:cNTe0;Oj465e:KG2eXe;OohIYe:mpEAQb;Pjplud:EEDORb,PoEs9b;PqHfGe:im2cZe;Q1Ow7b:x5CSu;QGR0gd:Mlhmy;R2kc8b:ALJqWb;R4IIIb:QWfeKf;R9Ulx:CR7Ufe;RDNBlf:zPRCJb;SLtqO:Kh1xYe;SMDL4c:fTfGO,pnvXVc;SNUn3:ZwDk9d,x8cHvb;ShpF6e:N0pvGc;TxfV6d:YORN0b;U96pRd:FsR04;UDrY1c:eps46d;UVmjEd:EesRsb;UyG7Kb:wQd0G;V2HTTe:RolTY;VGRfx:VFqbr;VN6jIc:ddQyuf;VOcgDe:YquhTb;VsAqSb:PGf2Re;VxQ32b:k0XsBb;WCEKNd:I46Hvd;WDGyFe:jcVOxd;Wfmdue:g3MJlb;XUezZ:sa7lqb;YV5bee:IvPZ6d;ZMvdv:PHFPjb;ZWEUA:afR4Cf;a56pNe:JEfCwb;aAJE9c:WHW6Ef;aZ61od:arTwJ;bFZ6gf:RsDQqe;bcPXSc:gSZLJb;cEt90b:ws9Tlc;cFTWae:gT8qnd;coJ8e:KvoW8;dIoSBb:ZgGg9b;dLlj2:Qqt3Gf;daB6be:lMxGPd;dtl0hd:lLQWFe;eBAeSb:Ck63tb;eBZ5Nd:audvde;eHDfl:ofjVkb;eO3lse:nFClrf;fWLTFc:TVBJbf;g8nkx:U4MzKc;gaub4:TN6bMe;gtVSi:ekUOYd;h3MYod:cEt90b;hK67qb:QWEO5b;hLUtwc:KB8OKd;heHB1:sFczq;hjRo6e:F62sG;iFQyKf:QIhFr,vfuNJf;imqimf:jKGL2e;io8t5d:sgY6Zb;jY0zg:Q6tNgc;k2Qxcb:XY51pe;kCQyJ:ueyPK;kMFpHd:OTA3Ae;kbAm9d:MkHyGd;lkq0A:JyBE3e;nAFL3:NTMZac,s39S4;oGtAuc:sOXFj;oSUNyd:fTfGO,pnvXVc;oUlnpc:RagDlc;okUaUd:wItadb;pKJiXd:VCenhc;pNsl2d:j9Yuyc;pXdRYb:JKoKVe;pj82le:mg5CW;qGV2uc:HHi04c;qZx2Fc:j0xrE;qaS3gd:yiLg6e;qavrXe:zQzcXe;qddgKe:d7YSfd,x4FYXe;rQSrae:C6D5Fc;sP4Vbe:VwDzFe;sTsDMc:kHVSUb;tH4IIe:Ymry6;tosKvd:ZCqP3;trZL0b:qY8PFe;uY49fb:COQbmf;uknmt:GkPrzb;uuQkY:u2V3ud;vGrMZ:lPJJ0c;vfVwPd:lcrkwe;w3bZCb:ZPGaIb;w4rSdf:XKiZ9;w9w86d:dt4g2b;wQlYve:aLUfP;wR5FRb:TtcOte;wV5Pjc:L8KGxe;whEZac:F4AmNb;xBbsrc:NEW1Qc;xbe2wc:uRMPBc;yGxLoc:FmAr0c;yxTchf:KUM7Z;z97YGf:oug9te;zOsCQe:Ko78Df;zaIgPb:Qtpxbd/m=ABJeBb,Da4hkd,Eox39d,GCSbhd,GElbSc,HYSCof,J4ga1b,KHourd,M0hWhd,QhoyLd,Um3BXb,Wo3n8,aD8OEe,cSX9Xe,etGP4c,fcDBE,msmzHf,nPaQu,pFsdhd,pHXghd,tIj4fb,vrkJ0e,xfmZMb?xjs=s1"
Preview:	this._s=this._s\|\|{};(function(_){var window=this;.try{._.tu=_.I("BUYwVb");_.Iwb=_.I("LsLGHf");.}catch(e){_._DumpException(e)}.try{._.JD=function(a){this.Ia=_.n(a)};_.F(_.JD,_.p);_.JD.prototype.getUrl=function(){return _.Pe(this,1)};_.$Gd=function(a,b){return _.Le(a,1,b)};_.k=_.JD.prototype;_.k.Mc=function(){return _.Ze(this,1)};_.k.qe=function(){return _.Oi(this,1)};_.k.Gc=function(){return _.gi(this,2)};_.k.Xc=function(a){return _.cj(this,2,a)};_.k.Bh=function(){return _.sj(this,2)};_.k.Nc=function(){return _.gi(this,3)};_.k.Id=function(a){return _.cj(this,3,a)};_.k.Il=function(){return _.sj(this,3)};_.k.kb="zqxxm";.}catch(e){_._DumpException(e)}.try{.var bHd;_.aHd=[0,_.H,_.ak,-1,_.H];bHd=[0,_.ak,-3];_.KD=function(a){this.Ia=_.n(a,28)};_.F(_.KD,_.p);_.k=_.KD.prototype;_.k.getUniqueId=function(){return _.Pe(this,2)};_.k.W7=function(){return _.Ze(this,2)};_.k.Cv=function(){return _.wh(this,_.JD,3)};_.k.dMa=function(){return _.r(this,_.JD,4)};_.k.getBackgroundColor=function(){return _.Pe

Chrome Cache Entry: 502

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 28908, version 0.0
Category:	downloaded
Size (bytes):	28908
Entropy (8bit):	7.989764549602985
Encrypted:	false
SSDEEP:	768:ncxMT2KlhUWbYQhHETORZaoTMJYfWHwRytVfQwg:nBaXgYQ9EyaoYOfSfo
MD5:	72095568168D6A31E051E4D531759151
SHA1:	8EBE72EF4631721D800AAC28D854C1D1B952FE24
SHA-256:	6BA0D1A726F1887BD61727B308ED0BE0E73EDBA17D4AD11B91AB19B632E078F6
SHA-512:	17F1417D99D76E46601D483F8516731E18CA028221A57C53D557E00F9627234576D62EB3AB5EB5FAA13EBC1D8BFF047AC86B1499756BEE22FFB76B998B7B19A4
Malicious:	false
URL:	https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/semilight/latest.woff2
Preview:	wOF2......p...........p..........................`.....L..e.....T..].6.$........ ..b. ..Y...u.l....f.&......M.../....?..3p\.u.P..zOBE...x.I..T.;.....48.G..H..k..8...X..!...&M).)...{^..#.r.x...h...>.....f......^......gBP#40,.....%.f$..YD...i.`/p,..\.... &eNI.X.?.n+JP.4.g9...lq1.lA.D....E.1..;3.h.Y..ic.-.....V........:.......f.@..!....l.M-.XHJ..MH.H.)w......UN...O.u.3....Z.X..W..#... U ...,.=6P.@..4=.M.a..f.uO{....6d.6.:n....gx..M.s..jB.J..9M.&....R'fd..7....T=...Uu...d.....aQ...Vg.......}<........>@..]?)..T..)..H>..R@..J...Z(.4ePr. ] .A).H.J/..1.\..a.eY...oY.....k!b.......k..(............!...fc.....=@.h.#..-.L........y=.ic..2.P...fx.AJ....5-.(...o.t.+<h.aX0}\|G/.uYx..A.g.^o..S.F...3D....J....."....j.......a$6.....FG..1.a.2......'.g..95 4.h..VL+...Jf.V.+.U.e.Ia.Hc.v..i....dvF....n.zC...........c.La..d..AY.G.U\.B5TOM.A.4.6....4.L...cX...V....O.L..]B{.;./.s...\|..O$....y?.g.=>.G;...w.n....y.<un8..E.[.......?.....].e}^..FE....=:..Du......7.

Chrome Cache Entry: 503

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit grayscale, non-interlaced
Category:	downloaded
Size (bytes):	446
Entropy (8bit):	7.334244373314574
Encrypted:	false
SSDEEP:	12:6v/7KFXcryw1iYEAvO9oL4rckICExMrqfCzgY5wFFVqpOY:a+QPvz4IkICExpwwtqpOY
MD5:	146C086C5DED80E72D9F95B13771EA6A
SHA1:	60BCF86E93154D798489BEA354F635333AA9B315
SHA-256:	B3338321602FECD34CB925A5713638ADD25D908E7E6C88924222E0D04A4E9330
SHA-512:	730A7A4B5A9856D50A2D050B1CF9F4E8D765736B052DAD26503B50D81AB8924136CDDE15827229837D8B05A3213CE639846D53C23E03290A67C1EFCCBFFA21F2
Malicious:	false
URL:	https://www.gstatic.com/kpui/social/x_32x32.png
Preview:	.PNG........IHDR... ... .....V.%(....IDATx.....\......m...A..fX[Am....m...7.X..z$:.66>..@.N..+..#....L.tl.s.tB.!....)....>.......3.....n...}.bx.q.o-q.).....V..B.{.#i.&!.......Y.....V,/.Sg9..u5y.v.h.......8.8.rYki...n..3.<\|._.B.N.QT[.3\...8..b..7G-9D8.0.c.>..wI.Y?.Q...):.2r.l.i..cL.1l...aKH"..5.9...OI.N....../.....O47~...2P.1M;..I.D.kK.p!.....z..`.g..'...]yj..Yw...G..0.B...g...d.X..B...LBL4.........I..<..W#s........IEND.B`.

Chrome Cache Entry: 504

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	4316
Entropy (8bit):	7.882140927231997
Encrypted:	false
SSDEEP:	96:+cLjS/Sc2cxOVrLt+QgPeBDN/6e4ZwaUuwmB/SW5v/kqV+NhAn:+W+/S24V9+QgP2N/MdUuPBt59V+/An
MD5:	8A1972083C3F2B70A0CE25C92F6CAD55
SHA1:	4674AFFCFF88DB8E70FB5A9B64D68197BDB73251
SHA-256:	9C1BBD595BA097F157F93941DADFCF343C2FB9611D743CEFA19C3BD647AF362D
SHA-512:	E62CEE244A8FA5BAF37CB0B1FFFEFE9FFCAC1EA2E3D06F823E40398A4D1287F788D33A3E7773A96B95B356BC5A627083DF65A510A8556DEBB438DCB32B5CA7A9
Malicious:	false
URL:	https://cdn-dynmedia-1.microsoft.com/is/image/microsoftcorp/Feature-Edge-IE-Upgrade:VP3-530x397
Preview:	... ftypavif....avifmif1miafMA1B....meta.......(hdlr........pict............libavif.....pitm..........iloc....D....................(iinf..........infe........av01Color....jiprp...Kipco....ispe................pixi............av1C........colrnclx...........ipma...................mdat.....f!.cD.4..2.......!..@.M.~.x.=.../#C....\.../L"J.<...z^.X...eu.A....L.3yC!.O.).....b.M.....Q.@..\..pp..O.v+.O...N...V...)..."..'.6...%..r..\|..Y0^p.7DQ..F..8...e.q'.=k. Iu.jV.x..j..n#...._...4e6..F.B-"QQ4I..\|..7H/.r....lJ...,.]B...%....k.a&.....\|.\b..g....dk...$.&2\|..QS.C.K....QV.(v.+.f....(...;..W..vc.D.x}...XB.V!.f~v..=.....Z..A.y....."o.j..ZX...2=.......K..s..7u4]g.u1....,...(E.v.r.....i..2.5.}.@.............2!........^...^^.l.D\..{.5....{?....`..m0..=.].D..u.u....#]......Ub..6...v<tB.F..Y...........^..xv..9<4.>......9..D>u#w.s...~........TF.s7......9Z.........y.\Ui....%.>_C.3mW.l&. Wy3......w.V&.`.g.....=.Ofz.k....c.Z..K.....%".....\...~....]......F-.7hn.g....<.].

Chrome Cache Entry: 505

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (889)
Category:	downloaded
Size (bytes):	92962
Entropy (8bit):	5.482012211093105
Encrypted:	false
SSDEEP:	1536:wB4vGoYlmQr+IDv1Ty/6RsSz5TGF/46nNUgDbC03vu9FnHKDfa6Z/VUhdIKq6Tjv:wqxNrNG9FnHKD/oIKq6Tjv
MD5:	35986A813756F39AB6B922979FFEDB03
SHA1:	C8E2213BBAFAF535DA9C6676F3DBA43449E4D15A
SHA-256:	E2D92BDAAD925C6D355331A338384EE3FF82492352975DD4EFDA791AEF4AB3F5
SHA-512:	289F1C432E73F611D54EB1130013174174222A0C5EEF8E2464C5FD51EE33DC702326EEECA80B2AAE213DB2FCCB149297FC37CC9A0B6CF6E928A66BC27843F930
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/cascade.component.authoring/clientlibs/clientlib-jquery.min.ACSHASH35986a813756f39ab6b922979ffedb03.js
Preview:	/. jQuery JavaScript Library v3.5.1. https://jquery.com/.. Includes Sizzle.js. https://sizzlejs.com/.. Copyright JS Foundation and other contributors. Released under the MIT license. https://jquery.org/license.. Date: 2020-05-04T22:49Z. Sizzle CSS Selector Engine v2.3.5. https://sizzlejs.com/.. Copyright JS Foundation and other contributors. Released under the MIT license. https://js.foundation/.. Date: 2020-03-14./.'use strict';(function(H,Sa){"object"===typeof module&&"object"===typeof module.exports?module.exports=H.document?Sa(H,!0):function(Ta){if(!Ta.document)throw Error("jQuery requires a window with a document");return Sa(Ta)}:Sa(H)})("undefined"!==typeof window?window:this,function(H,Sa){function Ta(a,b,c){c=c\|\|M;var d,f=c.createElement("script");f.text=a;if(b)for(d in Kc)(a=b[d]\|\|b.getAttribute&&b.getAttribute(d))&&f.setAttribute(d,a);c.head.appendChild(f).parentNode.removeChild(f)}function Ia(a){return null==.a?a+"":"object"===typeof a\|\|"function"===typeof a?db[Ob.call(a)]

Chrome Cache Entry: 506

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	273
Entropy (8bit):	4.935550956354982
Encrypted:	false
SSDEEP:	6:Q3RnadmyWRLnadIrM9nadYErmC+LGonbWJ/cxLZ/c8en:cYdIRGdIg8dlHEGKbWNq3e
MD5:	48D949B834ED32DFD8266989E9DAB912
SHA1:	CA65B388C56F18256DC5EB3EB1FFC20578E45C76
SHA-256:	A01677A70917A26959BD831C8728392B90EA24185C0A45E0ECC927E8E558D289
SHA-512:	CD6A491474312DC3605BA3259BE5C6F4AD6D14C34DB43FD4658AC15A1C129507A4F085065ACB15F2D3135D479A856736676A7F500C8654B1079E1AD23036931D
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/content/back-to-top-button/v1/back-to-top-button/clientlibs/sites.min.ACSHASH48d949b834ed32dfd8266989e9dab912.js
Preview:	'use strict';$(function(){var a=document.querySelector("#msChatContainer"),b=document.querySelector(".back-to-top.sticky"),c=document.querySelector(".fixed-back-to-top.fixed-sticky");a&&b&&$(b).addClass("pageHasChatContainer");a&&c&&$(c).addClass("pageHasChatContainer")});

Chrome Cache Entry: 507

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7862)
Category:	downloaded
Size (bytes):	83415
Entropy (8bit):	4.995956262817024
Encrypted:	false
SSDEEP:	1536:BRN1GDsWcOiVWEec7ynw+OwnZ7aGogbp0H2EHE8z2nqzfPD236qyP0Vlbw5ZwQEY:BkDsmoy9haGRzK
MD5:	B141BCA6C9E3F0375FA28E0B13A5D736
SHA1:	EC870350FDA5FF7F96A0ACB12714D2A0E2329CFD
SHA-256:	AD0AB36473BB0182B4FF012FF2F482A7B7B300187E68F1B1238617F3D4CE5F82
SHA-512:	7AFA38E0142D1313E8DD20DF71406E7F524BFEBDEEEE2CFF5CD2E2E869F0944028E940C88A8B27FEE3C7CDFC11F7D7ACBF6AA9B49B0477558B9D4B0E4E8536E6
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/cascade.component.authoring/clientlibs/clientlib-base.min.ACSHASHb141bca6c9e3f0375fa28e0b13a5d736.js
Preview:	/******************************************************************************. Copyright 2017 Adobe. . Licensed under the Apache License, Version 2.0 (the "License");. * you may not use this file except in compliance with the License.. * You may obtain a copy of the License at. . http://www.apache.org/licenses/LICENSE-2.0. . Unless required by applicable law or agreed to in writing, software. * distributed under the License is distributed on an "AS IS" BASIS,. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. * See the License for the specific language governing permissions and. * limitations under the License.. ******************************************************************************/.if (window.Element && !Element.prototype.closest) {. // eslint valid-jsdoc: "off". Element.prototype.closest =. function(s) {. "use strict";. var matches = (this.document \|\| this.ownerDocument).querySelectorAll(s);.

Chrome Cache Entry: 508

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3537)
Category:	downloaded
Size (bytes):	52603
Entropy (8bit):	5.316331138717284
Encrypted:	false
SSDEEP:	1536:yYrF+dXpn0e+99D7FPUzHhbtjFnmFRbdwWRI32nB7PXAlnuhPisfq3ECoe5EzpGS:yYrF+d5n0e+99DJPUzHhbtjFnmFRbdwM
MD5:	F0A9F2F65F95B61810777606051EE17D
SHA1:	872BF131CB4BEFD0242339F072F2F9B9FBF8019F
SHA-256:	9CDF2602AC04F7E2BED582D4299C73D464FC4AB069E3AD5A20EE2B6635A015B8
SHA-512:	6823914507BA31E0F61B95CC53F09543C3C14E5530E9EF1B00338FBBD7C25D2E398F5F628DF4ED25D6FF88E0F8BEE506EFE62BA704778BA7CFF09AEC9579D9F0
Malicious:	false
URL:	https://www.gstatic.com/eureka/clank/117/cast_sender.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.'use strict';var f,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},h="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");.},ca=ba(this),da=function(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&h(c,a,{configurable:!0,writable:!0,value:b})}};.da("Symbol",function(a){if(a)return a;var b=function(g,k){this.g=g;h(this,"description",{configurable:!0,writable:!0,value:k})};b.prototype.toStri

Chrome Cache Entry: 509

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 350523
Category:	downloaded
Size (bytes):	101502
Entropy (8bit):	7.997513987039089
Encrypted:	true
SSDEEP:	1536:7uix25pKIguhsmJS2GzZvdCt9tSd3/xUJ7DY/IvMHLYQ8KPYEQUkK5RT5zU1EmVh:SixypKkp2dQtieDYsMrYQGTgDU1Jhxj
MD5:	D0F7DF5A7DD1231FA0F17AA1F4C84643
SHA1:	A87156D8723222541D6E892B8750A963C303ECF0
SHA-256:	158D54B6B8B63A6298F1C99E34323BC298463C0E61AD6B58C30FA400B274E031
SHA-512:	EB9A9B4A4004720B258BD97F4864498DAD596192CD206814EE35E2B42392D697FF46D4A988ACA224F1213F083221D1E41FCEAF0D69B964F9994B7D61D2497A05
Malicious:	false
URL:	https://cdnssl.clicktale.net/www32/ptc/05d32363-d534-4d93-9b65-cde674775e71.js
Preview:	...........k[..(.}....0R..'..5v.o.N..`..8D..Vb$GjC....OU.E....Z.<.w....{WWUWUWW_.qm.{.u...Y.8...\|gh5.?}.....ib5..5....W..z.U0..$...Ate..M....D~.?.1.a.I.YR...4]#.Q.`}....b{..6.C?...E9.{1.n..5..e.^......w-l(... <...W(`57r.]H......./.......6.b6.4...u..C.`q...x+....8.b.[.'O..?..`...d.\|..&.l2.o.. ....s...(T..5.......7..{..o.7.6.t-.9,.....>......3..X....2.....a0a. d45..5.].G...p...X<.... .^vB.\|,.t.a{.5{.\|~.Ot.4.Oy..&..'f./I'..81....!W../.VU...$X..k?......0.p..N...d.N...o.......evD3...........%..,Ip..'..?b...\|x.D..v.2...3...z.k.....k...-.?...4X...,.6X.vzz3.#5.0._)e<...x..#q....A..p......@...'.\|e.x..g.[.h:^...?*':..(......=.G.P....64..^...EC@\|k.ds....ng.x.`.1........Vs...rj..<a.5.1...~.G.\...y.0.X..?........k..x.....;..4u...~.CdB".....:$`.y)..c3m...Vt5......$....B..`i...0.6e....[Ib...~8.E..E..:s.:..`......&\|..d......>....>..On.A...,....yOX.k...v.....g.#.......A......?....r./.6......:`7. .6.E(..X.M..0...E.Q..Q\|.SF..5.....7...:V...'..}.:...@.B....2R..gl.:.

Chrome Cache Entry: 510

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (42133)
Category:	downloaded
Size (bytes):	138067
Entropy (8bit):	5.225028044529473
Encrypted:	false
SSDEEP:	3072:1f4HuF7pxnISnJ9d1EwgXA7nKRZMK/xw/:1f4Hu1I+kw/
MD5:	B9C3E4320DB870036919F1EE117BDA6E
SHA1:	29B5A9066B5B1F1FE5AFE7EE986E80A49E86606A
SHA-256:	A1FE019388875B696EDB373B51A51C0A8E3BAD52CD489617D042C0722BDB1E48
SHA-512:	A878B55E8C65D880CDF14850BAEE1F82254C797C3284485498368F9128E42DCA46F54D9D92750EEEB547C42CAB9A9823AA9AFAB7D881090EBBFA1135CDD410B6
Malicious:	false
URL:	https://www.microsoft.com/onerfstatics/marketingsites-eas-prod/shell/_scrf/js/themes=default/d6-d6e6df/89-746ba4/df-3feeb0/f5-14aef8/bd-f5f332/27-13b2c3/e9-07937b/33-b505e5/fa-7a47db/6e-e2d05f/74-0b2d48/88-5b9b75/1b-240b37/4e-8e1a50/c2-370434/6f-bf5d0f/ea-315ddf/2e-e273bf/17-02d9ee/cf-2a93c7/c0-2ffa80/77-785548/48-4f52bb/3c-6c8ad0/3a-0d7cd3/5f-7d882b/c1-621df2/38-e8e647/17-c82a09/85-bd536d/44-776362/f8-86938e/61-951d1b/39-3d9dc2/81-96da47/ec-e44e19/6c-7627b9?ver=2.0&_cf=20210618&iife=1
Preview:	(function(){/*. @license almond 0.3.3 Copyright jQuery Foundation and other contributors.. * Released under MIT license, http://github.com/requirejs/almond/LICENSE. /.var requirejs,require,define,__extends;(function(n){function r(n,t){return w.call(n,t)}function s(n,t){var o,s,f,e,h,p,c,b,r,l,w,k,u=t&&t.split("/"),a=i.map,y=a&&a[""]\|\|{};if(n){for(n=n.split("/"),h=n.length-1,i.nodeIdCompat&&v.test(n[h])&&(n[h]=n[h].replace(v,"")),n[0].charAt(0)==="."&&u&&(k=u.slice(0,u.length-1),n=k.concat(n)),r=0;r<n.length;r++)if(w=n[r],w===".")n.splice(r,1),r-=1;else if(w==="..")if(r===0\|\|r===1&&n[2]===".."\|\|n[r-1]==="..")continue;else r>0&&(n.splice(r-1,2),r-=2);n=n.join("/")}if((u\|\|y)&&a){for(o=n.split("/"),r=o.length;r>0;r-=1){if(s=o.slice(0,r).join("/"),u)for(l=u.length;l>0;l-=1)if(f=a[u.slice(0,l).join("/")],f&&(f=f[s],f)){e=f;p=r;break}if(e)break;!c&&y&&y[s]&&(c=y[s],b=r)}!e&&c&&(e=c,p=b);e&&(o.splice(0,p,e),n=o.join("/"))}return n}function y(t,i){return function(){var r=b.call(arguments,0

Chrome Cache Entry: 511

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (548)
Category:	downloaded
Size (bytes):	996634
Entropy (8bit):	5.605468907838174
Encrypted:	false
SSDEEP:	12288:NJI3P+60I68RQClpRajR0uIS8RUUbSKJRMBJ8SbsdWid:w3PMqRQipQjR0XS8RUUbSKJR0J8SbFid
MD5:	0046D323F1B98DCA73C8649A485A040D
SHA1:	162539D250723F5C9AB088C774116966E573E079
SHA-256:	4ED3AC4A54A25E12FC36E6DF410CC7C37B1FC7D2DE1AF7DE4E1CB7F75B6DFF8D
SHA-512:	7515180B7F2C500F4B740C3A5E33FAD52C52F89EF57410CBC5CC85DCCD9A5BA8DD4D0FD23F15F0CBD51AA9447C1D86211D63362F995C40BD13CFDC7CCE4501DD
Malicious:	false
URL:	"https://www.google.com/xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=1/ed=1/dg=2/br=1/rs=ACT90oEp1_FAvFBtywXdkASv2V22tHKmTQ/ee=AfeaP:TkrAjf;Afksuc:wMx0R;BMxAGc:E5bFse;BgS6mb:fidj5d;BjwMce:cXX2Wb;CxXAWb:YyRLvc;DULqB:RKfG5c;DpcR3d:zL72xf;EABSZ:MXZt9d;ESrPQc:mNTJvc;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;EnlcNd:WeHg4;Erl4fe:FloWmf,FloWmf;F9mqte:UoRcbe;Fmv9Nc:O1Tzwc;G0KhTb:LIaoZ;G6wU6e:hezEbd;GleZL:J1A7Od;HMDDWe:G8QUdb;IBADCc:RYquRb;IoGlCf:b5lhvb;IsdWVc:qzxzOb;JXS8fb:Qj0suc;JbMT3:M25sS;JsbNhc:Xd8iUd;KOxcK:OZqGte;KQzWid:ZMKkN;KcokUb:KiuZBf;KeeMUb:HiPxjc;KpRAue:Tia57b;LBgRLc:XVMNvd;LEikZe:byfTOb,lsjVmc;LsNahb:ucGLNb;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Np8Qkd:Dpx6qc;Nyt6ic:jn2sGd;OgagBe:cNTe0;Oj465e:KG2eXe,KG2eXe;OohIYe:mpEAQb;Pjplud:EEDORb,PoEs9b;PqHfGe:im2cZe;Q1Ow7b:x5CSu;QGR0gd:Mlhmy;R2kc8b:ALJqWb;R4IIIb:QWfeKf;R9Ulx:CR7Ufe;RDNBlf:zPRCJb;SLtqO:Kh1xYe;SMDL4c:fTfGO,pnvXVc;SNUn3:ZwDk9d,x8cHvb;ShpF6e:N0pvGc;TxfV6d:YORN0b;U96pRd:FsR04;UDrY1c:eps46d;UVmjEd:EesRsb;UyG7Kb:wQd0G;V2HTTe:RolTY;VGRfx:VFqbr;VN6jIc:ddQyuf;VOcgDe:YquhTb;VsAqSb:PGf2Re;VxQ32b:k0XsBb;WCEKNd:I46Hvd;WDGyFe:jcVOxd;Wfmdue:g3MJlb;XUezZ:sa7lqb;YV5bee:IvPZ6d;ZMvdv:PHFPjb;ZWEUA:afR4Cf;a56pNe:JEfCwb;aAJE9c:WHW6Ef;aZ61od:arTwJ;bFZ6gf:RsDQqe;bcPXSc:gSZLJb;cEt90b:ws9Tlc;cFTWae:gT8qnd;coJ8e:KvoW8;dIoSBb:ZgGg9b;dLlj2:Qqt3Gf;daB6be:lMxGPd;dtl0hd:lLQWFe;eBAeSb:Ck63tb;eBZ5Nd:audvde;eHDfl:ofjVkb;eO3lse:nFClrf;fWLTFc:TVBJbf;g8nkx:U4MzKc;gaub4:TN6bMe;gtVSi:ekUOYd;h3MYod:cEt90b;hK67qb:QWEO5b;hLUtwc:KB8OKd;heHB1:sFczq;hjRo6e:F62sG;iFQyKf:QIhFr,vfuNJf;imqimf:jKGL2e;io8t5d:sgY6Zb;jY0zg:Q6tNgc;k2Qxcb:XY51pe;kCQyJ:ueyPK;kMFpHd:OTA3Ae;kbAm9d:MkHyGd;lkq0A:JyBE3e;nAFL3:NTMZac,s39S4;oGtAuc:sOXFj;oSUNyd:fTfGO,fTfGO,pnvXVc;oUlnpc:RagDlc;okUaUd:wItadb;pKJiXd:VCenhc;pNsl2d:j9Yuyc;pXdRYb:JKoKVe;pj82le:mg5CW;qGV2uc:HHi04c;qZx2Fc:j0xrE;qaS3gd:yiLg6e;qavrXe:zQzcXe;qddgKe:d7YSfd,x4FYXe;rQSrae:C6D5Fc;sP4Vbe:VwDzFe;sTsDMc:kHVSUb;tH4IIe:Ymry6;tosKvd:ZCqP3;trZL0b:qY8PFe;uY49fb:COQbmf;uknmt:GkPrzb;uuQkY:u2V3ud;vGrMZ:lPJJ0c;vfVwPd:lcrkwe;w3bZCb:ZPGaIb;w4rSdf:XKiZ9;w9w86d:dt4g2b;wQlYve:aLUfP;wR5FRb:TtcOte;wV5Pjc:L8KGxe;whEZac:F4AmNb;xBbsrc:NEW1Qc;xbe2wc:uRMPBc;yGxLoc:FmAr0c;yxTchf:KUM7Z;z97YGf:oug9te;zOsCQe:Ko78Df;zaIgPb:Qtpxbd/m=attn,cdos,gwc,hsm,jsa,mb4ZUb,d,csi,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl"
Preview:	this._s=this._s\|\|{};(function(_){var window=this;.try{./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././. SPDX-License-Identifier: Apache-2.0 /./. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2013 Google LLC.. SPDX-License-Identifier: Apache-2.0./.var baa,caa,naa,oaa,paa,qaa,raa,saa,taa,uaa,vaa,zaa,xaa,waa,Aaa,yaa,Baa,Daa,Caa,Eaa,Faa,Gaa,Iaa,Jaa,Oaa,$aa,fba,qba,sba,wba,xba,Cba,Dba,Gba,Kba,Mba,$ba,cca,bca,eca,Hba,eb,fca,gca,hb,ica,lca,mca,nca,pca,tca,uca,vca,wca,yca,Aca,Dca,Eca,Gca,Ica,Jca,Lca,Pca,Sca,Uca,Vca,cda,dda,eda,ada,fda,$ca,gda,Zca,hda,ida,oda,qda,rda,vda,wda,xda,zda,Ada,Bda,Cda,Dda,Gda,Hda,Jda,yda,Mda,Nda,Tda,Uda,Wda,Vda,Zda,aea,$da,cea,bea,fea,eea,hea,jea,lea,pea,rea,sea,uea,vea,xea,Cea,Dea,Eea,qea,Gea,Kea,Nea,Tea,Uea,cfa,Zea,dfa,.ffa,jfa,efa,gfa,hfa,Wea,mfa,ifa,nfa,ofa,pfa,lfa,ufa,vfa,wfa,zfa,Afa,Xea,Bfa,Dfa,Hfa,Jfa,Lfa,Nfa,Qfa,Ufa,Wfa,hga,jga,

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.6790332643076535
TrID:	Win64 Executable GUI (202006/5) 91.76% Win64 Executable (generic) (12005/4) 5.45% Clipper DOS Executable (2020/12) 0.92% Generic Win/DOS Executable (2004/3) 0.91% DOS Executable Generic (2002/1) 0.91%
File name:	Palworld.exe
File size:	182'784 bytes
MD5:	a9181a14270ad54407a16516c05817be
SHA1:	9102e64d9101096509414208c228d8d93da8ad6d
SHA256:	0a661adf06c2bef40749e9eba17ffccef0eb0e76321a5a21ec11ca60c34fb0dc
SHA512:	8e5269b94d478941d2ddc934b8a32356487802c53e048cd362ef8a6ca4534b54dfbf4627574a01774a36432f799cb8314afc3764c1019b089f1c99b0eef8d90a
SSDEEP:	3072:Zo6veDO++M3Qf+2vhDOSmjIZuJgNkCS5Bn0j3Ocd5vE:yIk/+MAfNhDxmPqFS5Bn0jE
TLSH:	6C048C0BB3E131F5E077D63488E1054AEBB7B87107609B5F079446AA6F232919D3EBB1
File Content Preview:	MZ......................@......................................................................................................................................................................................................................................

File Icon


Icon Hash:	0761e494d8f17133

Static PE Info

General

Entrypoint:	0x140001ca8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6591C9D8 [Sun Dec 31 20:06:48 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	152cf0529281259defb94b0c7bdbe8e7

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FBE30EE4A20h
dec eax
add esp, 28h
jmp 00007FBE30EE447Fh
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
jmp 00007FBE30EE4611h
dec eax
mov ecx, ebx
call 00007FBE30EEB6EEh
test eax, eax
je 00007FBE30EE4615h
dec eax
mov ecx, ebx
call 00007FBE30EEB75Ah
dec eax
test eax, eax
je 00007FBE30EE45E9h
dec eax
add esp, 20h
pop ebx
ret
dec eax
cmp ebx, FFFFFFFFh
je 00007FBE30EE4608h
call 00007FBE30EE4F04h
int3
call 00007FBE30EE4F1Eh
int3
jmp 00007FBE30EEB740h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [000133CFh]
dec eax
mov ecx, ebx
call dword ptr [000133BEh]
call dword ptr [000133C8h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [000133BCh]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [000133B0h]
test eax, eax
je 00007FBE30EE4609h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [0001EE26h]
call 00007FBE30EE46AEh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [0001EF0Dh], eax
dec eax
lea eax, dword ptr [esp+38h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1f44c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x25000	0xb884	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x22000	0x1218	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x31000	0x69c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1da30	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1d8f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x15000	0x2f0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x13090	0x13200	c9fe39a966d1a3a7917f96d5cfb8292d	False	0.5882608251633987	data	6.481507035274942	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x15000	0xae4e	0xb000	e95ab1decee529cfdd54887c3a420b65	False	0.4572975852272727	data	4.901633412003391	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x20000	0x1da0	0xc00	6cc72702ca22b00f71049538cb757a96	False	0.14453125	data	2.0333283096147357	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x22000	0x1218	0x1400	0140da53bc107634e7d03c3769bfe674	False	0.440234375	data	4.613862077120318	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x24000	0x15c	0x200	2851ab45dfabaf770e5631ccfadc5b6e	False	0.384765625	data	2.826220759254903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x25000	0xb884	0xba00	9cc64b5591dd31640f68f6272bf07703	False	0.7895455309139785	data	7.717262295885247	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x31000	0x69c	0x800	457bb5db21617d7e97997f044eaa29b7	False	0.50048828125	data	4.948591759381074	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x252f8	0x56b9	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9977478491959821
RT_ICON	0x2a9b4	0x98f	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	United States	0.7159787494891704
RT_ICON	0x2b344	0x9e7	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	United States	0.7317554240631163
RT_ICON	0x2bd2c	0xbdd	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	United States	0.7728021073427724
RT_ICON	0x2c90c	0xcac	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	English	United States	0.7919235511713933
RT_ICON	0x2d5b8	0xdcb	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	0.8088360237892949
RT_ICON	0x2e384	0x1b13	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.8928004616938393
RT_RCDATA	0x2fe98	0x5e	data	English	United States	0.776595744680851
RT_RCDATA	0x2fef8	0x8	data	English	United States	2.0
RT_GROUP_ICON	0x2ff00	0x14	data	English	United States	1.05
RT_GROUP_ICON	0x2ff14	0x68	data	English	United States	0.7692307692307693
RT_VERSION	0x2ff7c	0x388	data	English	United States	0.4657079646017699
RT_MANIFEST	0x30304	0x580	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1348), with CRLF line terminators	English	United States	0.4403409090909091

Imports

DLL	Import
KERNEL32.dll	GetExitCodeProcess, CreateProcessW, GetModuleFileNameW, LoadResource, LockResource, WaitForSingleObject, FindResourceW, LoadLibraryW, WriteConsoleW, CreateFileW, GetLastError, CloseHandle, SizeofResource, GetFileAttributesW, GetConsoleMode, GetConsoleOutputCP, FlushFileBuffers, HeapReAlloc, HeapSize, SetFilePointerEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwindEx, RtlPcToFileHeader, RaiseException, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, EncodePointer, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, HeapAlloc, GetFileType, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetStringTypeW, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, LCMapStringW, GetProcessHeap
USER32.dll	wsprintfW, MessageBoxW
ADVAPI32.dll	RegOpenKeyExW, RegCloseKey, RegQueryValueExW
SHELL32.dll	ShellExecuteExW
SHLWAPI.dll	PathCombineW, PathRemoveFileSpecW, PathCanonicalizeW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 30, 2024 18:51:15.033027887 CET	49678	443	192.168.2.17	20.42.65.84
Jan 30, 2024 18:51:15.333736897 CET	49678	443	192.168.2.17	20.42.65.84
Jan 30, 2024 18:51:15.873334885 CET	49671	443	192.168.2.17	204.79.197.203
Jan 30, 2024 18:51:15.939709902 CET	49678	443	192.168.2.17	20.42.65.84
Jan 30, 2024 18:51:16.703715086 CET	49673	443	192.168.2.17	173.222.162.58
Jan 30, 2024 18:51:16.703748941 CET	49674	443	192.168.2.17	173.222.162.58
Jan 30, 2024 18:51:17.150705099 CET	49678	443	192.168.2.17	20.42.65.84
Jan 30, 2024 18:51:18.795712948 CET	49684	443	192.168.2.17	13.67.144.177
Jan 30, 2024 18:51:19.563898087 CET	49678	443	192.168.2.17	20.42.65.84
Jan 30, 2024 18:51:24.369791985 CET	49678	443	192.168.2.17	20.42.65.84
Jan 30, 2024 18:51:25.485713005 CET	49671	443	192.168.2.17	204.79.197.203
Jan 30, 2024 18:51:27.403564930 CET	49717	443	192.168.2.17	52.165.165.26
Jan 30, 2024 18:51:27.403614044 CET	443	49717	52.165.165.26	192.168.2.17
Jan 30, 2024 18:51:27.403693914 CET	49717	443	192.168.2.17	52.165.165.26
Jan 30, 2024 18:51:27.407172918 CET	49717	443	192.168.2.17	52.165.165.26
Jan 30, 2024 18:51:27.407190084 CET	443	49717	52.165.165.26	192.168.2.17
Jan 30, 2024 18:51:27.829009056 CET	443	49717	52.165.165.26	192.168.2.17
Jan 30, 2024 18:51:27.829160929 CET	49717	443	192.168.2.17	52.165.165.26
Jan 30, 2024 18:51:27.832114935 CET	49717	443	192.168.2.17	52.165.165.26
Jan 30, 2024 18:51:27.832123995 CET	443	49717	52.165.165.26	192.168.2.17
Jan 30, 2024 18:51:27.832544088 CET	443	49717	52.165.165.26	192.168.2.17
Jan 30, 2024 18:51:27.880681992 CET	49717	443	192.168.2.17	52.165.165.26
Jan 30, 2024 18:51:27.948107958 CET	49717	443	192.168.2.17	52.165.165.26
Jan 30, 2024 18:51:27.955663919 CET	49672	443	192.168.2.17	173.222.162.58
Jan 30, 2024 18:51:27.956213951 CET	49718	443	192.168.2.17	173.222.162.58
Jan 30, 2024 18:51:27.956307888 CET	443	49718	173.222.162.58	192.168.2.17
Jan 30, 2024 18:51:27.956394911 CET	49718	443	192.168.2.17	173.222.162.58
Jan 30, 2024 18:51:27.956779957 CET	49718	443	192.168.2.17	173.222.162.58
Jan 30, 2024 18:51:27.956816912 CET	443	49718	173.222.162.58	192.168.2.17
Jan 30, 2024 18:51:27.989923954 CET	443	49717	52.165.165.26	192.168.2.17
Jan 30, 2024 18:51:28.219496965 CET	443	49717	52.165.165.26	192.168.2.17
Jan 30, 2024 18:51:28.219540119 CET	443	49717	52.165.165.26	192.168.2.17
Jan 30, 2024 18:51:28.219549894 CET	443	49717	52.165.165.26	192.168.2.17
Jan 30, 2024 18:51:28.219563961 CET	443	49717	52.165.165.26	192.168.2.17
Jan 30, 2024 18:51:28.219603062 CET	443	49717	52.165.165.26	192.168.2.17
Jan 30, 2024 18:51:28.219666958 CET	49717	443	192.168.2.17	52.165.165.26
Jan 30, 2024 18:51:28.219703913 CET	443	49717	52.165.165.26	192.168.2.17
Jan 30, 2024 18:51:28.219717979 CET	443	49717	52.165.165.26	192.168.2.17
Jan 30, 2024 18:51:28.219723940 CET	49717	443	192.168.2.17	52.165.165.26
Jan 30, 2024 18:51:28.219746113 CET	443	49717	52.165.165.26	192.168.2.17
Jan 30, 2024 18:51:28.219789982 CET	49717	443	192.168.2.17	52.165.165.26
Jan 30, 2024 18:51:28.219834089 CET	49717	443	192.168.2.17	52.165.165.26
Jan 30, 2024 18:51:28.240873098 CET	49717	443	192.168.2.17	52.165.165.26
Jan 30, 2024 18:51:28.240896940 CET	443	49717	52.165.165.26	192.168.2.17
Jan 30, 2024 18:51:28.240915060 CET	49717	443	192.168.2.17	52.165.165.26
Jan 30, 2024 18:51:28.240920067 CET	443	49717	52.165.165.26	192.168.2.17
Jan 30, 2024 18:51:28.262725115 CET	49672	443	192.168.2.17	173.222.162.58
Jan 30, 2024 18:51:28.271507025 CET	443	49718	173.222.162.58	192.168.2.17
Jan 30, 2024 18:51:28.271608114 CET	49718	443	192.168.2.17	173.222.162.58
Jan 30, 2024 18:51:28.296562910 CET	49718	443	192.168.2.17	173.222.162.58
Jan 30, 2024 18:51:28.296603918 CET	443	49718	173.222.162.58	192.168.2.17
Jan 30, 2024 18:51:28.297560930 CET	443	49718	173.222.162.58	192.168.2.17
Jan 30, 2024 18:51:28.297626972 CET	49718	443	192.168.2.17	173.222.162.58
Jan 30, 2024 18:51:28.298407078 CET	49718	443	192.168.2.17	173.222.162.58
Jan 30, 2024 18:51:28.298475027 CET	443	49718	173.222.162.58	192.168.2.17
Jan 30, 2024 18:51:28.298589945 CET	49718	443	192.168.2.17	173.222.162.58
Jan 30, 2024 18:51:28.341912985 CET	443	49718	173.222.162.58	192.168.2.17
Jan 30, 2024 18:51:28.637593031 CET	443	49718	173.222.162.58	192.168.2.17
Jan 30, 2024 18:51:28.637680054 CET	49718	443	192.168.2.17	173.222.162.58
Jan 30, 2024 18:51:28.638117075 CET	443	49718	173.222.162.58	192.168.2.17
Jan 30, 2024 18:51:28.638168097 CET	49718	443	192.168.2.17	173.222.162.58
Jan 30, 2024 18:51:28.638187885 CET	443	49718	173.222.162.58	192.168.2.17
Jan 30, 2024 18:51:28.638237953 CET	49718	443	192.168.2.17	173.222.162.58
Jan 30, 2024 18:51:28.869712114 CET	49672	443	192.168.2.17	173.222.162.58
Jan 30, 2024 18:51:30.084702015 CET	49672	443	192.168.2.17	173.222.162.58
Jan 30, 2024 18:51:32.490734100 CET	49672	443	192.168.2.17	173.222.162.58
Jan 30, 2024 18:51:33.973714113 CET	49678	443	192.168.2.17	20.42.65.84
Jan 30, 2024 18:51:34.112957001 CET	49720	443	192.168.2.17	173.194.219.101
Jan 30, 2024 18:51:34.112997055 CET	443	49720	173.194.219.101	192.168.2.17
Jan 30, 2024 18:51:34.113055944 CET	49720	443	192.168.2.17	173.194.219.101
Jan 30, 2024 18:51:34.113672972 CET	49721	443	192.168.2.17	173.194.219.84
Jan 30, 2024 18:51:34.113708019 CET	443	49721	173.194.219.84	192.168.2.17
Jan 30, 2024 18:51:34.113766909 CET	49721	443	192.168.2.17	173.194.219.84
Jan 30, 2024 18:51:34.114068985 CET	49720	443	192.168.2.17	173.194.219.101
Jan 30, 2024 18:51:34.114082098 CET	443	49720	173.194.219.101	192.168.2.17
Jan 30, 2024 18:51:34.114238024 CET	49721	443	192.168.2.17	173.194.219.84
Jan 30, 2024 18:51:34.114252090 CET	443	49721	173.194.219.84	192.168.2.17
Jan 30, 2024 18:51:34.115113974 CET	49722	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.115154982 CET	443	49722	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.115205050 CET	49722	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.115391970 CET	49723	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.115403891 CET	443	49723	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.115456104 CET	49723	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.116580009 CET	49724	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.116633892 CET	443	49724	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.116710901 CET	49724	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.120002985 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.120095968 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.120188951 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.120541096 CET	49722	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.120549917 CET	443	49722	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.121115923 CET	49723	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.121135950 CET	443	49723	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.121553898 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.121573925 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.123478889 CET	49724	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.123495102 CET	443	49724	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.344115019 CET	443	49721	173.194.219.84	192.168.2.17
Jan 30, 2024 18:51:34.344562054 CET	49721	443	192.168.2.17	173.194.219.84
Jan 30, 2024 18:51:34.344575882 CET	443	49721	173.194.219.84	192.168.2.17
Jan 30, 2024 18:51:34.345458031 CET	443	49724	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.345650911 CET	443	49721	173.194.219.84	192.168.2.17
Jan 30, 2024 18:51:34.345665932 CET	49724	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.345731020 CET	443	49724	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.345783949 CET	49721	443	192.168.2.17	173.194.219.84
Jan 30, 2024 18:51:34.346736908 CET	443	49724	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.346790075 CET	49721	443	192.168.2.17	173.194.219.84
Jan 30, 2024 18:51:34.346853971 CET	49724	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.346863031 CET	443	49721	173.194.219.84	192.168.2.17
Jan 30, 2024 18:51:34.347444057 CET	49721	443	192.168.2.17	173.194.219.84
Jan 30, 2024 18:51:34.347450972 CET	443	49721	173.194.219.84	192.168.2.17
Jan 30, 2024 18:51:34.347902060 CET	49724	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.347975016 CET	443	49724	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.348012924 CET	49724	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.356453896 CET	443	49723	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.356856108 CET	49723	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.356869936 CET	443	49723	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.364741087 CET	443	49723	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.364862919 CET	49723	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.365122080 CET	49723	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.365241051 CET	49723	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.365248919 CET	443	49723	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.365519047 CET	443	49723	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.384454966 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.384835958 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.384869099 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.385005951 CET	443	49722	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.385138988 CET	443	49720	173.194.219.101	192.168.2.17
Jan 30, 2024 18:51:34.385174990 CET	49722	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.385199070 CET	443	49722	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.385303974 CET	49720	443	192.168.2.17	173.194.219.101
Jan 30, 2024 18:51:34.385318041 CET	443	49720	173.194.219.101	192.168.2.17
Jan 30, 2024 18:51:34.385768890 CET	443	49720	173.194.219.101	192.168.2.17
Jan 30, 2024 18:51:34.385844946 CET	49720	443	192.168.2.17	173.194.219.101
Jan 30, 2024 18:51:34.385915041 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.385977030 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.386233091 CET	443	49722	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.386292934 CET	49722	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.386349916 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.386416912 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.386472940 CET	443	49720	173.194.219.101	192.168.2.17
Jan 30, 2024 18:51:34.386522055 CET	49720	443	192.168.2.17	173.194.219.101
Jan 30, 2024 18:51:34.386617899 CET	49722	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.386684895 CET	443	49722	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.386879921 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.386890888 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.387104988 CET	49722	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.387111902 CET	443	49722	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.387689114 CET	49720	443	192.168.2.17	173.194.219.101
Jan 30, 2024 18:51:34.387753963 CET	443	49720	173.194.219.101	192.168.2.17
Jan 30, 2024 18:51:34.387788057 CET	49720	443	192.168.2.17	173.194.219.101
Jan 30, 2024 18:51:34.388705015 CET	49721	443	192.168.2.17	173.194.219.84
Jan 30, 2024 18:51:34.388729095 CET	49724	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.388762951 CET	443	49724	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.420700073 CET	49723	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.420715094 CET	443	49723	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.433898926 CET	443	49720	173.194.219.101	192.168.2.17
Jan 30, 2024 18:51:34.436712027 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.436722994 CET	49720	443	192.168.2.17	173.194.219.101
Jan 30, 2024 18:51:34.436731100 CET	443	49720	173.194.219.101	192.168.2.17
Jan 30, 2024 18:51:34.436732054 CET	49722	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.436741114 CET	49724	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.468712091 CET	49723	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.484714031 CET	49720	443	192.168.2.17	173.194.219.101
Jan 30, 2024 18:51:34.563572884 CET	443	49721	173.194.219.84	192.168.2.17
Jan 30, 2024 18:51:34.563716888 CET	443	49721	173.194.219.84	192.168.2.17
Jan 30, 2024 18:51:34.563780069 CET	49721	443	192.168.2.17	173.194.219.84
Jan 30, 2024 18:51:34.564846039 CET	49721	443	192.168.2.17	173.194.219.84
Jan 30, 2024 18:51:34.564891100 CET	443	49721	173.194.219.84	192.168.2.17
Jan 30, 2024 18:51:34.569910049 CET	49723	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.570025921 CET	443	49723	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.570091009 CET	49723	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.586430073 CET	443	49724	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.586483002 CET	443	49724	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.586515903 CET	443	49724	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.586532116 CET	443	49724	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.586533070 CET	49724	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.586596012 CET	443	49724	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.586628914 CET	49724	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.588834047 CET	443	49720	173.194.219.101	192.168.2.17
Jan 30, 2024 18:51:34.588960886 CET	443	49720	173.194.219.101	192.168.2.17
Jan 30, 2024 18:51:34.589001894 CET	49720	443	192.168.2.17	173.194.219.101
Jan 30, 2024 18:51:34.590282917 CET	49720	443	192.168.2.17	173.194.219.101
Jan 30, 2024 18:51:34.590297937 CET	443	49720	173.194.219.101	192.168.2.17
Jan 30, 2024 18:51:34.595108986 CET	443	49724	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.595160961 CET	49724	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.595954895 CET	49724	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.595985889 CET	443	49724	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.624663115 CET	443	49722	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.624799013 CET	443	49722	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.624846935 CET	49722	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.639813900 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.639929056 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.640008926 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.640022039 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.640052080 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.640105963 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.646595955 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.646723032 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.646750927 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.646785021 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.646836042 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.652029991 CET	49722	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.652059078 CET	443	49722	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.653736115 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.653820038 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.653867006 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.659182072 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.659255981 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.659282923 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.666331053 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.666398048 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.666414022 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.708934069 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.741724968 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.745187998 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.745217085 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.745296001 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.745338917 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.745414019 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.752336025 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.759452105 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.759485006 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.759560108 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.759618044 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.759689093 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.766546965 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.773650885 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.773684978 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.773730040 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.773788929 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.773855925 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.780987024 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.787853956 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.787892103 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.787941933 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.787976027 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.788043022 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.794303894 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.800653934 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.800710917 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.800790071 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.800808907 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.800870895 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.807142973 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.813597918 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.813674927 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.813721895 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.813736916 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.813801050 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.820182085 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.823261976 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.823329926 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.823343992 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.843837023 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.843929052 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.843954086 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.846911907 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.846981049 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.847007990 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.853372097 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.853446007 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.853458881 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.859599113 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.859709978 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.859723091 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.865730047 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.865809917 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.865833044 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.871351957 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.871442080 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.871469975 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.877012968 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.877094984 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.877110958 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.882267952 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.882396936 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.882411003 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.887499094 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.887573957 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.887588978 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.892719984 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.892786980 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.892810106 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.898015022 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.898097992 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.898130894 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.905813932 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.905862093 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.905937910 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.905975103 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.906039000 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.911114931 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.916089058 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.916125059 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.916213989 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.916244984 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.916316032 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.920754910 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.925218105 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.925266027 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.925286055 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.925301075 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.925355911 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.929517984 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.933856010 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.933907032 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.933932066 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.933948994 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.934007883 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.938116074 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.942437887 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.942473888 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.942522049 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.942538977 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.942599058 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.946499109 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.946574926 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.946635008 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.946649075 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.950751066 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.950831890 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.950845957 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.955112934 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.955239058 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.955251932 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.959024906 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.959069967 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.959109068 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.959122896 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.959177017 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.961663008 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.964277983 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.964313984 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.964354038 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.964371920 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.964432955 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.966937065 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.969559908 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.969635010 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.969655037 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.969671011 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.969718933 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.972194910 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.974900007 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.974942923 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.974987984 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.975004911 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.975100994 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.977503061 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.980068922 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.980144024 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.980168104 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.980182886 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.980241060 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.982745886 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.985327005 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.985390902 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.985410929 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.987890959 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.987941027 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.987955093 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.991668940 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.991703987 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.991744041 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.991779089 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.991835117 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.994246006 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.995695114 CET	49684	443	192.168.2.17	13.67.144.177
Jan 30, 2024 18:51:34.996756077 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.996799946 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.996834040 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.996886969 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:34.996943951 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:34.999289036 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.001787901 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.001856089 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.001884937 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.001981974 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.002034903 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.002213955 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.002237082 CET	443	49725	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.002250910 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.002280951 CET	49725	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.435029984 CET	49729	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.435132027 CET	443	49729	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.435210943 CET	49729	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.435652018 CET	49729	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.435688972 CET	443	49729	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.630889893 CET	49730	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.630925894 CET	443	49730	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.630990028 CET	49730	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.631455898 CET	49730	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.631475925 CET	443	49730	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.675240040 CET	443	49729	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.675502062 CET	49729	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.675537109 CET	443	49729	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.676599026 CET	443	49729	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.676696062 CET	49729	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.677009106 CET	49729	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.677083015 CET	443	49729	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.677145004 CET	49729	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.677160025 CET	443	49729	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.728838921 CET	49729	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.734328985 CET	49729	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.734452009 CET	443	49729	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.734554052 CET	49729	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.735896111 CET	49731	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.735933065 CET	443	49731	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.735995054 CET	49731	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.736335039 CET	49731	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.736346006 CET	443	49731	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.836646080 CET	49732	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.836682081 CET	443	49732	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.836741924 CET	49732	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.837061882 CET	49732	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.837084055 CET	443	49732	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.842339039 CET	443	49730	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.842557907 CET	49730	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.842580080 CET	443	49730	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.842911959 CET	443	49730	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.843220949 CET	49730	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.843286991 CET	443	49730	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.843350887 CET	49730	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.885904074 CET	443	49730	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.945919037 CET	443	49731	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.946234941 CET	49731	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.946250916 CET	443	49731	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.947235107 CET	443	49731	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.947304964 CET	49731	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.947635889 CET	49731	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.947695971 CET	443	49731	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:35.995726109 CET	49731	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:35.995742083 CET	443	49731	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.020384073 CET	49730	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:36.020517111 CET	443	49730	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.020582914 CET	49730	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:36.025291920 CET	49731	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:36.045851946 CET	443	49732	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.046101093 CET	49732	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:36.046118021 CET	443	49732	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.046524048 CET	443	49732	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.046803951 CET	49732	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:36.046875000 CET	443	49732	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.065901041 CET	443	49731	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.088722944 CET	49732	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:36.144546032 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.144588947 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.144660950 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.145050049 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.145066977 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.193586111 CET	443	49731	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.193633080 CET	443	49731	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.193713903 CET	49731	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:36.193746090 CET	443	49731	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.195154905 CET	443	49731	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.195218086 CET	49731	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:36.195338011 CET	49731	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:36.195357084 CET	443	49731	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.333591938 CET	49732	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:36.357124090 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.357531071 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.357558966 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.358434916 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.358520985 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.359823942 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.359883070 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.360008955 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.360021114 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.373922110 CET	443	49732	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.407759905 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.473586082 CET	443	49732	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.473623991 CET	443	49732	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.473680019 CET	49732	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:36.473696947 CET	443	49732	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.474208117 CET	443	49732	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.474265099 CET	49732	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:36.474466085 CET	49732	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:36.474478960 CET	443	49732	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.563292027 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.563342094 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.563379049 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.563389063 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.563405037 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.563416004 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.563458920 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.563477039 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.563517094 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.570238113 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.577337980 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.577368975 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.577393055 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.577423096 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.577461004 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.584465981 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.592519045 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.592573881 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.592592001 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.647708893 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.665111065 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.668606043 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.668648005 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.668699026 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.668714046 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.668759108 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.675682068 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.682857990 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.682877064 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.682908058 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.682919025 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.682957888 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.689960003 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.697218895 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.697238922 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.697266102 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.697273970 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.697312117 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.704262972 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.710885048 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.710908890 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.710933924 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.710942984 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.710980892 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.717936039 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.724165916 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.724189997 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.724210024 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.724217892 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.724263906 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.730748892 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.737410069 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.737432003 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.737461090 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.737472057 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.737515926 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.744062901 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.750664949 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.750689030 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.750725031 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.750736952 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.750776052 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.766834021 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.769738913 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.769763947 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.769798994 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.769813061 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.769854069 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.775291920 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.780476093 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.780500889 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.780543089 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.780554056 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.780595064 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.785469055 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.790369034 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.790399075 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.790436983 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.790447950 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.790487051 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.795275927 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.800204039 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.800225973 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.800282001 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.800292969 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.800338030 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.805175066 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.810029984 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.810055971 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.810173035 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.810182095 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.810239077 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.814987898 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.817451954 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.817508936 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.817540884 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.822386026 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.822446108 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.822474957 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.827341080 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.827389956 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.827410936 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.832170963 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.832221985 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.832242012 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.837132931 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.837188005 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.837207079 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.841795921 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.841865063 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.841896057 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.846451044 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.846501112 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.846517086 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.850878954 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.850928068 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.850939989 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.855119944 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.855178118 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.855194092 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.859370947 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.859425068 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.859436989 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.863435984 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.863492012 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.863523006 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.867548943 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.867595911 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.867623091 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.873747110 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.873785019 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.873832941 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.873866081 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.873910904 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.874588013 CET	49735	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:36.874620914 CET	443	49735	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.874706984 CET	49735	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:36.875042915 CET	49735	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:36.875060081 CET	443	49735	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:36.877868891 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.882004023 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.882024050 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.882180929 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.882213116 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.882266998 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.884521008 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.887099028 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.887116909 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.887150049 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.887161970 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.887202978 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.889488935 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.889627934 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:36.889678001 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.889821053 CET	49733	443	192.168.2.17	64.233.177.100
Jan 30, 2024 18:51:36.889839888 CET	443	49733	64.233.177.100	192.168.2.17
Jan 30, 2024 18:51:37.087640047 CET	443	49735	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:37.087908983 CET	49735	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:37.087943077 CET	443	49735	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:37.088263988 CET	443	49735	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:37.088546991 CET	49735	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:37.088608980 CET	443	49735	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:37.088717937 CET	49735	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:37.129909992 CET	443	49735	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:37.302829981 CET	49672	443	192.168.2.17	173.222.162.58
Jan 30, 2024 18:51:37.335365057 CET	443	49735	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:37.337933064 CET	443	49735	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:37.338009119 CET	443	49735	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:37.338018894 CET	49735	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:37.338208914 CET	49735	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:37.339278936 CET	49735	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:37.339308977 CET	443	49735	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:38.008255005 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:38.008299112 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:38.008372068 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:38.008915901 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:38.008932114 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:38.218261003 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:38.218713999 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:38.218738079 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:38.219000101 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:38.219347000 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:38.219403982 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:38.262759924 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:39.530828953 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:39.573910952 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.848300934 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.848355055 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.848368883 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:39.848391056 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.848414898 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.848458052 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:39.848468065 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.848504066 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:39.852184057 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.856189966 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.857147932 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:39.857161999 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.859796047 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.859859943 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:39.859873056 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.866934061 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.869153023 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:39.869165897 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.924705982 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:39.924730062 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.950237036 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.950359106 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:39.950383902 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.953656912 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.953710079 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:39.953725100 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.960746050 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.961163998 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:39.961179972 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.967900038 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.967976093 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:39.967997074 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.975033045 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.977169991 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:39.977181911 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.982218981 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.982279062 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:39.982305050 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.989342928 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.993185043 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:39.993201971 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.996454954 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:39.996551037 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:39.996565104 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.002868891 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.004787922 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.004798889 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.009363890 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.013166904 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.013178110 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.015749931 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.015868902 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.015877008 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.022547007 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.025171041 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.025182009 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.028445959 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.028561115 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.028570890 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.034874916 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.034965038 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.034980059 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.052378893 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.052613974 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.052638054 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.055362940 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.057174921 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.057190895 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.061803102 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.061871052 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.061893940 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.067945004 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.068018913 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.068033934 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.074106932 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.074183941 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.074193954 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.079777002 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.079829931 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.079842091 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.085393906 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.088350058 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.088376999 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.090783119 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.093380928 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.093394041 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.095897913 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.095948935 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.095963001 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.096337080 CET	49737	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.096373081 CET	443	49737	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.096942902 CET	49737	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.097332001 CET	49737	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.097341061 CET	443	49737	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.101217985 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.101335049 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.101353884 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.108990908 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.109028101 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.109767914 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.109776974 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.110049009 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.114170074 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.119535923 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.119575977 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.119590998 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.119601965 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.119729996 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.124528885 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.129290104 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.129344940 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.129353046 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.129368067 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.129446030 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.133730888 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.136444092 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.136609077 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.136625051 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.138643026 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.138793945 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.138813019 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.143002033 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.143106937 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.143124104 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.147111893 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.149172068 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.149193048 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.151134968 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.151217937 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.151230097 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.155179024 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.157102108 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.157121897 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.159476042 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.159723043 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.159735918 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.163255930 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.164032936 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.164046049 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.165937901 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.168209076 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.168247938 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.168327093 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.168327093 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.168351889 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.170672894 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.171189070 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.171204090 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.173142910 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.173903942 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.173916101 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.181993008 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.182518959 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.182758093 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.182773113 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.184727907 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.184875011 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.184883118 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.185256004 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.185902119 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.187151909 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.187351942 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.187361002 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.189732075 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.192024946 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.192056894 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.192143917 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.192143917 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.192156076 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.194539070 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.195466042 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.195481062 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.196899891 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.196952105 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.196978092 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.199508905 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.199656963 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.199673891 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.201699972 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.201744080 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.201761007 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.204129934 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.204179049 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.204196930 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.218554974 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.218646049 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.218653917 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.220308065 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.220370054 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.220379114 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.221496105 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.221580982 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.221589088 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.223989010 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.224102020 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.224109888 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.226155043 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.228291988 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.228298903 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.228410006 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.228701115 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.228707075 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.230691910 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.231585026 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.231595993 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.232919931 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.233071089 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.233083010 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.235188961 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.235249996 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.235260963 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.237445116 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.237510920 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.237520933 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.242075920 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.242119074 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.242214918 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.242228031 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.242499113 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.243907928 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.246078968 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.246124029 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.247195005 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.247220993 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.248111963 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.248701096 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.248713970 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.249181032 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.250092983 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.252065897 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.252084970 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.252338886 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.252347946 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.253906012 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.254070997 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.254121065 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.255011082 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.255017996 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.256089926 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.257100105 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.257106066 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.258065939 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.260081053 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.260097027 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.260127068 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.260134935 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.260798931 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.262151003 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.262339115 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.262345076 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.263993979 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.264066935 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.264072895 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.265918970 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.265974045 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.265980005 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.267735004 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.267851114 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.267857075 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.269634962 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.269690037 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.269696951 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.271358967 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.271414042 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.271420956 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.273243904 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.274662971 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.274799109 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.274856091 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.274863958 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.275166988 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.276380062 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.276509047 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.276623011 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.276631117 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.276688099 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.277884960 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.279520988 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.279604912 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.279654026 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.279664993 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.279710054 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.281064034 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.282624006 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.282708883 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.282838106 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.282846928 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.284305096 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.285100937 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.285109997 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.285870075 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.285943031 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.285948992 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.287483931 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.288762093 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.288772106 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.289572954 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.289578915 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.289694071 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.289764881 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.289769888 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.291165113 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.291596889 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.291604042 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.292670965 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.292697906 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.292735100 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.292741060 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.292879105 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.294210911 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.295633078 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.295658112 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.295759916 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.295772076 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.296289921 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.296967030 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.298352957 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.298377037 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.298840046 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.298849106 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.299171925 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.299791098 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.301213980 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.301253080 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.301904917 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.301915884 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.302355051 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.302539110 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.303894043 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.303940058 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.304096937 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.304105043 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.305238008 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.305243015 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.306500912 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.306539059 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.306566954 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.306575060 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.307842016 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.308917999 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.308927059 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.309111118 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.309142113 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.309146881 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.309568882 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.310434103 CET	443	49737	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.310455084 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.311696053 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.312386036 CET	49737	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.312412024 CET	443	49737	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.312700033 CET	443	49737	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.312743902 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.312752962 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.312988997 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.313014984 CET	49737	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.313035965 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.313057899 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.313067913 CET	443	49737	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.313595057 CET	49741	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.313626051 CET	443	49741	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.313683987 CET	49741	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.313833952 CET	49737	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.314249039 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.314347029 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.314383030 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.314594030 CET	49741	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.314603090 CET	443	49741	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.315517902 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.315561056 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.315576077 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.316807985 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.316864967 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.316881895 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.318056107 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.318119049 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.318124056 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.319360971 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.319494009 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.319502115 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.334312916 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.334460974 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.334573984 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.334588051 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.335105896 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.335239887 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.335247040 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.336306095 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.336381912 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.336389065 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.337145090 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.337460041 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.338538885 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.338568926 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.338622093 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.338632107 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.339782000 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.339936018 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.339943886 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.340862989 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.340928078 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.340935946 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.341149092 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.342025042 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.343113899 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.343156099 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.343183041 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.343193054 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.344264984 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.344449997 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.344459057 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.344646931 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.345304012 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.346437931 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.346479893 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.346508980 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.346517086 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.346564054 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.347543955 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.348563910 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.348648071 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.348654985 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.349689960 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.349757910 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.349765062 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.350912094 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.350966930 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.350984097 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.351871014 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.351917982 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.351934910 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.352914095 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.352969885 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.352977991 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.353931904 CET	443	49737	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.354017973 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.354085922 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.354094028 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.355050087 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.355101109 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.355107069 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.356290102 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.356337070 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.356353045 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.357237101 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.358201981 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.358280897 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.358326912 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.358326912 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.358340025 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.359168053 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.360176086 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.360204935 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.360229969 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.360241890 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.360258102 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.361161947 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.362178087 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.362210035 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.362267017 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.362267017 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.362279892 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.363145113 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.364089966 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.364116907 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.364151001 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.364160061 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.365089893 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.365144968 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.365925074 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.365932941 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.366164923 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.366226912 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.366234064 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.367031097 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.367997885 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.368027925 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.368051052 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.368068933 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.368079901 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.369446993 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.369529009 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.369905949 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.369915962 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.370465994 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.371325970 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.371334076 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.371412992 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.371494055 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.371500969 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.372275114 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.372311115 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.373214960 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.373290062 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.373903036 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.373912096 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.374176979 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.374416113 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.374423981 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.374906063 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.375061989 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.375981092 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.376060963 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.376813889 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.376822948 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.376897097 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.376903057 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.376925945 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.377623081 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.377753973 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.378665924 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.378722906 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.378730059 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.379561901 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.379647970 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.380441904 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.380450964 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.380506039 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.380512953 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.381311893 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.381392956 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.381903887 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.381911993 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.382266998 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.382353067 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.382359982 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.383141041 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.383193016 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.383200884 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.383469105 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.383904934 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.384814978 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.384892941 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.384918928 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.384927988 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.385699034 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.385715008 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.386518002 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.386595964 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.386765003 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.386774063 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.387331963 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.387360096 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.388113976 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.388137102 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.388308048 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.388314009 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.389065027 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.389146090 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.389148951 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.389173985 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.389991999 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.390377045 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.390386105 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.390486002 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.390768051 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.391561985 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.391983986 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.391990900 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.392074108 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.392164946 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.392170906 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.392821074 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.393100023 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.393105984 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.393577099 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.393906116 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.393913984 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.394392014 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.394447088 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.394454002 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.395109892 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.395196915 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.395418882 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.395426035 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.395986080 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.396502018 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.396511078 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.396753073 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.397109032 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.397121906 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.397532940 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.397599936 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.397607088 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.398339033 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.398679972 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.398685932 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.399089098 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.399669886 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.399676085 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.399765015 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.399801016 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.400563955 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.400643110 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.400652885 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.400671959 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.400868893 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.401324987 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.402091980 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.402167082 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.402345896 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.402354002 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.402906895 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.403012037 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.403017998 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.403631926 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.404118061 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.404126883 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.404239893 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.404341936 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.405159950 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.405582905 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.405590057 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.405920982 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.406115055 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.406126976 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.406658888 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.406703949 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.406719923 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.407334089 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.407376051 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.407393932 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.408094883 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.408144951 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.408160925 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.408799887 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.408844948 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.408860922 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.409873962 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.409930944 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.409939051 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.410341978 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.410382986 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.410387993 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.410397053 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.410521030 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.410887003 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.411335945 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.411683083 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.411691904 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.412029982 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.412103891 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.412115097 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.412740946 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.413100004 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.413108110 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.413467884 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.413908958 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.413916111 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.414105892 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.414154053 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.414160967 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.414843082 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.414912939 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.414921045 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.415601969 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.416032076 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.416038990 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.416229963 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.416899920 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.416903019 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.416912079 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.416955948 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.416964054 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.417610884 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.417907953 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.417915106 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.418361902 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.419414997 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.419423103 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.419507027 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.419708014 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.419715881 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.420156002 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.420255899 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.420264959 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.420439005 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.421140909 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.421143055 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.421161890 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.421243906 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.421257973 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.421819925 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.421911001 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.421919107 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.422462940 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.422570944 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.422578096 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.423114061 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.423371077 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.423377991 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.423821926 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.424491882 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.424586058 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.424710035 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.424710035 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.424719095 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.425144911 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.425756931 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.425760984 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.425781965 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.425852060 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.425858974 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.426469088 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.426810026 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.426817894 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.427150965 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.427429914 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.427438021 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.427891016 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.427967072 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.427973986 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.428785086 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.429389954 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.429398060 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.429528952 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.429800987 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.429807901 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.430238008 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.430762053 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.430767059 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.430790901 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.430892944 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.430900097 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.431588888 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.432137012 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.432143927 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.432157040 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.432348013 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.432354927 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.432869911 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.433099985 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.433106899 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.433545113 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.433904886 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.433913946 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.434238911 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.434797049 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.434803963 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.434875011 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.435199976 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.435208082 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.435559034 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.435615063 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.435622931 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.436249971 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.436660051 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.436667919 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.436866999 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.437098980 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.437107086 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.437505007 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.437736034 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.437745094 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.438293934 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.438766956 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.438774109 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.438846111 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.439444065 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.439522028 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.439531088 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.439548969 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.439712048 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.440171957 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.440290928 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.440299988 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.440905094 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.440984011 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.440987110 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.441008091 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.441099882 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.442051888 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.442198992 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.442734003 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.442811012 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.442821980 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.442902088 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.442964077 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.442971945 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.443197966 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.443686962 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.443828106 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.444118023 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.444127083 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.444688082 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.444739103 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.444755077 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.445544958 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.445631981 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.445700884 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.445708036 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.445746899 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.445763111 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.445844889 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.445903063 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.445909977 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.446178913 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.446270943 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.446367025 CET	49736	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.446381092 CET	443	49736	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.461675882 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.461711884 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.461762905 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.461946964 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.461965084 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.463320017 CET	49744	443	192.168.2.17	172.217.23.99
Jan 30, 2024 18:51:40.463329077 CET	443	49744	172.217.23.99	192.168.2.17
Jan 30, 2024 18:51:40.463388920 CET	49744	443	192.168.2.17	172.217.23.99
Jan 30, 2024 18:51:40.463570118 CET	49744	443	192.168.2.17	172.217.23.99
Jan 30, 2024 18:51:40.463579893 CET	443	49744	172.217.23.99	192.168.2.17
Jan 30, 2024 18:51:40.519831896 CET	443	49737	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.519867897 CET	443	49737	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.519887924 CET	443	49737	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.519917011 CET	49737	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.519939899 CET	443	49737	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.519980907 CET	49737	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.519985914 CET	443	49737	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.519995928 CET	443	49737	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.520039082 CET	49737	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.521344900 CET	49737	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.521358967 CET	443	49737	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.521384001 CET	49737	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.521408081 CET	49737	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.547548056 CET	443	49741	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.547828913 CET	49741	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.547854900 CET	443	49741	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.548327923 CET	443	49741	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.548613071 CET	49741	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.548698902 CET	443	49741	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.549366951 CET	49741	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.549401045 CET	443	49741	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.577377081 CET	49745	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:40.577435970 CET	443	49745	216.239.34.157	192.168.2.17
Jan 30, 2024 18:51:40.577528954 CET	49745	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:40.577735901 CET	49745	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:40.577764988 CET	443	49745	216.239.34.157	192.168.2.17
Jan 30, 2024 18:51:40.718046904 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.721801996 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.721872091 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.722676039 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.723014116 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.723117113 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.723427057 CET	49746	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.723510981 CET	443	49746	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.723535061 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.723583937 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.723594904 CET	49746	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.723882914 CET	49746	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.723912001 CET	443	49746	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.755279064 CET	443	49741	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.755465984 CET	443	49741	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.755531073 CET	49741	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.757889986 CET	49741	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.757905960 CET	443	49741	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.795547962 CET	443	49745	216.239.34.157	192.168.2.17
Jan 30, 2024 18:51:40.795761108 CET	49745	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:40.795783997 CET	443	49745	216.239.34.157	192.168.2.17
Jan 30, 2024 18:51:40.796667099 CET	443	49745	216.239.34.157	192.168.2.17
Jan 30, 2024 18:51:40.796750069 CET	49745	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:40.797728062 CET	49745	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:40.797797918 CET	443	49745	216.239.34.157	192.168.2.17
Jan 30, 2024 18:51:40.797872066 CET	49745	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:40.797878981 CET	443	49745	216.239.34.157	192.168.2.17
Jan 30, 2024 18:51:40.851744890 CET	49745	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:40.917551041 CET	443	49744	172.217.23.99	192.168.2.17
Jan 30, 2024 18:51:40.917911053 CET	49744	443	192.168.2.17	172.217.23.99
Jan 30, 2024 18:51:40.917969942 CET	443	49744	172.217.23.99	192.168.2.17
Jan 30, 2024 18:51:40.918505907 CET	443	49744	172.217.23.99	192.168.2.17
Jan 30, 2024 18:51:40.918586016 CET	49744	443	192.168.2.17	172.217.23.99
Jan 30, 2024 18:51:40.919508934 CET	443	49744	172.217.23.99	192.168.2.17
Jan 30, 2024 18:51:40.919578075 CET	49744	443	192.168.2.17	172.217.23.99
Jan 30, 2024 18:51:40.920495987 CET	49744	443	192.168.2.17	172.217.23.99
Jan 30, 2024 18:51:40.920583963 CET	443	49744	172.217.23.99	192.168.2.17
Jan 30, 2024 18:51:40.920744896 CET	49744	443	192.168.2.17	172.217.23.99
Jan 30, 2024 18:51:40.920761108 CET	443	49744	172.217.23.99	192.168.2.17
Jan 30, 2024 18:51:40.928761005 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.928901911 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.929033995 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.929050922 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.929177999 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.929224014 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.929238081 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.932045937 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.932121992 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.932136059 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.932157040 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.932209015 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.935359001 CET	443	49746	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.935607910 CET	49746	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.935631990 CET	443	49746	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.936113119 CET	443	49746	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.936403990 CET	49746	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.936511993 CET	443	49746	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.936598063 CET	49746	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.936634064 CET	443	49746	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.939234018 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.946796894 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.946871042 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.946924925 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.946943045 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.947007895 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:40.953576088 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:40.964025021 CET	49744	443	192.168.2.17	172.217.23.99
Jan 30, 2024 18:51:40.995708942 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.001689911 CET	443	49745	216.239.34.157	192.168.2.17
Jan 30, 2024 18:51:41.002140999 CET	49745	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:41.002198935 CET	443	49745	216.239.34.157	192.168.2.17
Jan 30, 2024 18:51:41.002274990 CET	49745	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:41.030774117 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.034162045 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.034234047 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.034264088 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.034307957 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.034363985 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.041243076 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.048389912 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.048429012 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.048471928 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.048492908 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.048547983 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.055537939 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.062697887 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.062731028 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.062769890 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.062786102 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.062834978 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.069834948 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.076311111 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.076343060 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.076365948 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.076380968 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.076504946 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.082825899 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.089329958 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.089397907 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.089397907 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.089415073 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.089467049 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.095850945 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.102366924 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.102421045 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.102433920 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.102468014 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.102524996 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.108808041 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.115319014 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.115355968 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.115382910 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.115396023 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.115458012 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.122601986 CET	49747	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:41.122665882 CET	443	49747	216.239.34.157	192.168.2.17
Jan 30, 2024 18:51:41.122755051 CET	49747	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:41.123141050 CET	49747	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:41.123172998 CET	443	49747	216.239.34.157	192.168.2.17
Jan 30, 2024 18:51:41.133388996 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.136548042 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.136586905 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.136619091 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.136631966 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.136679888 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.143053055 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.143111944 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.143166065 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.143179893 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.149606943 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.149708986 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.149722099 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.156142950 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.156212091 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.156224012 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.156877041 CET	443	49746	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.156985998 CET	443	49746	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.157048941 CET	49746	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.157432079 CET	49746	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.157432079 CET	49746	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.157474995 CET	443	49746	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.157530069 CET	49746	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.162581921 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.162620068 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.162674904 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.162703037 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.162755966 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.168670893 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.174289942 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.174331903 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.174355030 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.174370050 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.174417019 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.179850101 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.185471058 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.185512066 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.185539007 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.185610056 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.185669899 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.191061020 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.193718910 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.193778992 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.193799973 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.199184895 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.199238062 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.199254990 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.204190016 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.204246044 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.204258919 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.208921909 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.208980083 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.208990097 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.213771105 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.213864088 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.213874102 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.218429089 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.218492031 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.218518019 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.222913027 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.222969055 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.222985983 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.227359056 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.227441072 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.227452993 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.231553078 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.231605053 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.231630087 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.235728025 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.235780954 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.235791922 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.239979029 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.240031958 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.240041971 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.244066954 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.244132996 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.244155884 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.247885942 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.247931004 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.248013020 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.248038054 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.248086929 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.250458002 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.253048897 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.253093004 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.253108978 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.253117085 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.253165960 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.255609989 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.258147001 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.258202076 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.258207083 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.258223057 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.258270025 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.260654926 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.263168097 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.263231039 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.263251066 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.265831947 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.265876055 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.265913010 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.265928030 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.265976906 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.265988111 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.268173933 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.268245935 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.268258095 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.270607948 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.270703077 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.270714998 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.273068905 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.273134947 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.273147106 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.275470018 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.275526047 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.275537968 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.279090881 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.279134989 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.279156923 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.279170990 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.279227972 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.281590939 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.284003019 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.284048080 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.284059048 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.284079075 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.284128904 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.286384106 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.288856030 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.288901091 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.288923025 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.288935900 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.288985014 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.291289091 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.293663025 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.293705940 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.293728113 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.293740988 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.293797016 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.296171904 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.298474073 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.298516035 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.298537970 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.298552036 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.298603058 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.300798893 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.303352118 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.303419113 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.303448915 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.303468943 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.303525925 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.305685043 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.307863951 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.307929993 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.307944059 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.309106112 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.309149981 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.309176922 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.309190035 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.309237957 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.311425924 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.313761950 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.313828945 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.313852072 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.313867092 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.313909054 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.315972090 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.318198919 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.318240881 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.318268061 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.318283081 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.318334103 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.320373058 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.322520971 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.322557926 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.322585106 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.322597980 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.322652102 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.322663069 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.324784994 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.324867964 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.324879885 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.326921940 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.326986074 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.326997995 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.329036951 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.329097986 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.329109907 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.331126928 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.331195116 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.331207037 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.333321095 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.333379984 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.333393097 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.336374044 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.336416006 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.336447001 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.336461067 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.336502075 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.337649107 CET	443	49747	216.239.34.157	192.168.2.17
Jan 30, 2024 18:51:41.337862968 CET	49747	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:41.337918997 CET	443	49747	216.239.34.157	192.168.2.17
Jan 30, 2024 18:51:41.338475943 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.339543104 CET	443	49747	216.239.34.157	192.168.2.17
Jan 30, 2024 18:51:41.339610100 CET	49747	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:41.340460062 CET	49747	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:41.340522051 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.340524912 CET	443	49747	216.239.34.157	192.168.2.17
Jan 30, 2024 18:51:41.340543985 CET	49747	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:41.340565920 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.340590000 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.340603113 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.340663910 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.342549086 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.344599962 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.344645977 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.344671965 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.344685078 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.344734907 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.346677065 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.348582029 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.348628998 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.348649979 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.348663092 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.348715067 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.350505114 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.352412939 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.352457047 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.352478027 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.352492094 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.352543116 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.354104996 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.356076956 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.356118917 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.356141090 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.356154919 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.356203079 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.357923985 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.359277964 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.359344006 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.359357119 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.360234976 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.360302925 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.360313892 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.361825943 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.361901045 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.361912012 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.363449097 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.363502979 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.363516092 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.365077972 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.365139961 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.365151882 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.366506100 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.366553068 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.366576910 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.366589069 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.366641045 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.368073940 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.369965076 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.370014906 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.370018959 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.370039940 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.370093107 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.371567011 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.372756958 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.372805119 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.372812986 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.372832060 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.372903109 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.374078989 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.374150991 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.374200106 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.374212027 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.375610113 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.375678062 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.375693083 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.377007008 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.377049923 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.377062082 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.378395081 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.378453970 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.378465891 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.380151987 CET	443	49744	172.217.23.99	192.168.2.17
Jan 30, 2024 18:51:41.380249023 CET	443	49744	172.217.23.99	192.168.2.17
Jan 30, 2024 18:51:41.380306959 CET	49744	443	192.168.2.17	172.217.23.99
Jan 30, 2024 18:51:41.380511045 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.380556107 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.380561113 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.380578995 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.380621910 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.381803989 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.383176088 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.383220911 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.383229017 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.383259058 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.383327961 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.384546041 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.385902882 CET	443	49747	216.239.34.157	192.168.2.17
Jan 30, 2024 18:51:41.385904074 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.385945082 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.385958910 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.385976076 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.386028051 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.387166977 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.388436079 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.388484955 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.388487101 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.388499975 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.388535023 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.389779091 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.391007900 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.391057968 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.391064882 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.391082048 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.391129971 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.392286062 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.392688990 CET	49747	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:41.392713070 CET	443	49747	216.239.34.157	192.168.2.17
Jan 30, 2024 18:51:41.392908096 CET	49744	443	192.168.2.17	172.217.23.99
Jan 30, 2024 18:51:41.392941952 CET	443	49744	172.217.23.99	192.168.2.17
Jan 30, 2024 18:51:41.393512964 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.393584967 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.393615007 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.393627882 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.393681049 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.394819021 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.395956993 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.396004915 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.396024942 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.396037102 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.396084070 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.397237062 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.397838116 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.397898912 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.397911072 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.399046898 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.399110079 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.399121046 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.400207043 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.400254011 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.400264978 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.401545048 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.401602030 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.401613951 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.402662039 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.402714968 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.402726889 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.403814077 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.403865099 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.403876066 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.405033112 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.405078888 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.405091047 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.406002045 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.406054020 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.406064987 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.407134056 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.407206059 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.407217026 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.408286095 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.408359051 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.408370972 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.409773111 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.409842014 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.409852982 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.410479069 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.410542011 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.410553932 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.411586046 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.411653042 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.411665916 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.413220882 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.413268089 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.413295031 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.413307905 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.413357019 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.414328098 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.415301085 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.415340900 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.415360928 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.415374994 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.415424109 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.416400909 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.417413950 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.417458057 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.417485952 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.417499065 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.417550087 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.418463945 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.419495106 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.419542074 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.419548988 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.419567108 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.419619083 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.420547962 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.421567917 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.421610117 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.421629906 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.421643019 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.421693087 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.422489882 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.423444986 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.423491955 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.423496008 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.423515081 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.423568010 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.424510002 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.425447941 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.425492048 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.425518036 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.425529957 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.425578117 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.426435947 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.426924944 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.426980019 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.426990986 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.427892923 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.427949905 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.427961111 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.428884029 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.428940058 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.428951025 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.429802895 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.429857969 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.429872036 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.430820942 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.430874109 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.430885077 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.431749105 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.431806087 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.431817055 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.432667971 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.432722092 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.432733059 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.433691978 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.433753967 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.433763981 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.434595108 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.434676886 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.434688091 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.435502052 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.435559034 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.435570955 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.436474085 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.436532021 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.436544895 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.437316895 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.437377930 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.437388897 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.438220978 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.438282013 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.438294888 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.439136982 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.439196110 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.439207077 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.440036058 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.440090895 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.440100908 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.440690994 CET	49747	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:41.440927029 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.440990925 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.441003084 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.441863060 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.441927910 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.441939116 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.442761898 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.442819118 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.442830086 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.443658113 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.443710089 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.443721056 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.444538116 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.444582939 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.444593906 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.445436001 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.445488930 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.445499897 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.446342945 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.446396112 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.446407080 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.447547913 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.447592020 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.447618008 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.447629929 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.447679043 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.448436975 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.449281931 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.449335098 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.449341059 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.449358940 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.449397087 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.450263977 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.451037884 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.451077938 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.451081991 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.451100111 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.451143026 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.452466965 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.452742100 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.452783108 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.452804089 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.452815056 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.452862024 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.454030037 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.454427004 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.454473019 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.454497099 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.454509020 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.454550982 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.455621004 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.456012011 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.456049919 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.456072092 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.456084013 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.456129074 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.456789017 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.457590103 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.457636118 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.457644939 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.457662106 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.457706928 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.458422899 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.460169077 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.460217953 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.460228920 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.460248947 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.460355997 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.460367918 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.460385084 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.460427046 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.460856915 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.461767912 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.461808920 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.461821079 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.461838007 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.461884022 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.462534904 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.463284016 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.463325977 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.463336945 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.463371038 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.463413000 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.464071035 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.464843035 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.464888096 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.464910030 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.464922905 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.464975119 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.465595007 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.466057062 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.466119051 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.466129065 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.466798067 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.466850042 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.466861010 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.467503071 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.467860937 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.467871904 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.468286991 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.468353987 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.468364954 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.469074011 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.469135046 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.469146013 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.469841957 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.469894886 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.469906092 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.470628977 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.470694065 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.470705032 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.471371889 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.471426010 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.471436977 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.472156048 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.472208977 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.472219944 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.472915888 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.472969055 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.472980976 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.473623991 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.473675013 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.473685980 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.474374056 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.474415064 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.474426031 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.475152969 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.475203991 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.475217104 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.475925922 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.475969076 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.475991011 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.476635933 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.476686001 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.476696968 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.477382898 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.477422953 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.477433920 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.478077888 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.478127956 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.478140116 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.478876114 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.478929996 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.478940010 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.479585886 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.479639053 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.479650021 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.480288982 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.480336905 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.480348110 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.481008053 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.481081009 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.481091976 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.481693029 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.481746912 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.481758118 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.482788086 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.482835054 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.482836962 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.482851028 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.482899904 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.483494043 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.484132051 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.484175920 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.484196901 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.484210014 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.484242916 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.484826088 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.485588074 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.485631943 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.485635042 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.485646963 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.485692024 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.486233950 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.486933947 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.486978054 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.487000942 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.487014055 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.487052917 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.487607002 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.488300085 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.488356113 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.488358021 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.488370895 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.488413095 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.488967896 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.489612103 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.489656925 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.489680052 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.489692926 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.489738941 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.490369081 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.491005898 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.491053104 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.491072893 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.491086006 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.491130114 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.491699934 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.492353916 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.492396116 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.492408037 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.492424965 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.492463112 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.493115902 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.493695974 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.493736982 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.493738890 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.493751049 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.493792057 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.494364977 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.495045900 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.495090008 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.495098114 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.495115042 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.495163918 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.495724916 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.495810032 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.495851040 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.495861053 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.496640921 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.496686935 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.496690035 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.496701002 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.496753931 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.497596979 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.497961044 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.498006105 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.498012066 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.498029947 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.498076916 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.498877048 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.498950958 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.498992920 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.499003887 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.499887943 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.499933004 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.499934912 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.499946117 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.499985933 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.500895977 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.500967026 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.501008034 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.501019001 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.502007961 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.502053022 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.502058029 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.502082109 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.502126932 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.502702951 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.502774954 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.502824068 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.502841949 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.503665924 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.503711939 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.503715992 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.503732920 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.503848076 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.504579067 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.504652023 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.504700899 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.504712105 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.505543947 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.505588055 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.505600929 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.505616903 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.505673885 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.506350040 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.506426096 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.506474972 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.506485939 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.507282019 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.507327080 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.507329941 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.507340908 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.507376909 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.508480072 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.508577108 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.508615971 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.508626938 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.509058952 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.509102106 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.509128094 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.509140015 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.509188890 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.510232925 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.510319948 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.510369062 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.510380983 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.510850906 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.510895967 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.510902882 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.510921955 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.510968924 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.511662960 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.511740923 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.511787891 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.511799097 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.512686968 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.512727976 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.512742996 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.512762070 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.512820005 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.513474941 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.513535976 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.513575077 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.513586044 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.514296055 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.514338970 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.514339924 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.514353991 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.514405966 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.515113115 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.515201092 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.515243053 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.515254021 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.516020060 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.516064882 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.516072035 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.516088963 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.516132116 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.516908884 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.516979933 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.517021894 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.517033100 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.517704964 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.517748117 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.517757893 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.517776012 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.517819881 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.518482924 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.518556118 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.518604040 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.518615007 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.519340992 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.519383907 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.519395113 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.519412041 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.519459963 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.520136118 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.520205975 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.520251036 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.520262003 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.521018982 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.521059036 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.521084070 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.521095037 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.521147013 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.521783113 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.521852970 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.521905899 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.521917105 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.522619009 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.522663116 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.522686005 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.522697926 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.522744894 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.523436069 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.523507118 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.523567915 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.523578882 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.524281979 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.524323940 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.524333954 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.524350882 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.524399996 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.524974108 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.525043964 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.525084019 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.525095940 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.525806904 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.525850058 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.525860071 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.525876999 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.525923014 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.526531935 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.526602983 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.526659966 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.526671886 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.527446032 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.527491093 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.527491093 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.527503967 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.527551889 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.528125048 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.528198957 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.528244019 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.528249025 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.528920889 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.528965950 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.528966904 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.528979063 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.529016018 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.529690981 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.529756069 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.529793978 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.529799938 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.530482054 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.530528069 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.530530930 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.530544996 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.530590057 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.531212091 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.531286001 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.531332016 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.531337023 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.532052994 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.532097101 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.532099009 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.532119036 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.532145977 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.532655001 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.532727957 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.532766104 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.532771111 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.533507109 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.533545971 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.533551931 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.534111977 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.534154892 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.534162045 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.534202099 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.534243107 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.534248114 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.534909964 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.534956932 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.534962893 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.534971952 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.535010099 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.535600901 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.535675049 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.535712957 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.535718918 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.536395073 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.536432981 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.536438942 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.536447048 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.536483049 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.536489010 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.537296057 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.537333965 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.537345886 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.537353039 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.537388086 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.537391901 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.538286924 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.538330078 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.538331985 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.538345098 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.538381100 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.538387060 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.539244890 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.539285898 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.539294958 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.539303064 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.539333105 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.539935112 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.540010929 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.540045023 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.540052891 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.540843010 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.540888071 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.540888071 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.540900946 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.540941954 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.540946960 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.541810036 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.541862965 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.541862965 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.541882992 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.541961908 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.541966915 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.542716980 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.542758942 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.542764902 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.542773008 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.542805910 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.542809963 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.543668985 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.543716908 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.543716908 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.543730974 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.543766022 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.543776035 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.544599056 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.544647932 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.544668913 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.544677019 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.544712067 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.544714928 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.544728041 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.544769049 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.545490026 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.545567989 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.545607090 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.545614004 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.546464920 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.546509981 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.546516895 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.546525002 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.546557903 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.546561956 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.547250986 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.547297955 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.547306061 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.547312021 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.547347069 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.547352076 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.547427893 CET	443	49747	216.239.34.157	192.168.2.17
Jan 30, 2024 18:51:41.547585964 CET	49747	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:41.547655106 CET	443	49747	216.239.34.157	192.168.2.17
Jan 30, 2024 18:51:41.547730923 CET	49747	443	192.168.2.17	216.239.34.157
Jan 30, 2024 18:51:41.548177004 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.548221111 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.548223972 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.548238993 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.548275948 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.548280954 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.549043894 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.549093962 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.549098015 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.549112082 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.549146891 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.549156904 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.549863100 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.549912930 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.549921036 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.549961090 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.550002098 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.550004959 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.550014019 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.550049067 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.550760984 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.550829887 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.550872087 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.550878048 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.551450968 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.551491976 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.551497936 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.551506042 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.551544905 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.551549911 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.552284956 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.552331924 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.552337885 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.552377939 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.552413940 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.552418947 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.553142071 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.553189039 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.553209066 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.553215027 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.553251982 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.553256989 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.553973913 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.554017067 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.554032087 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.554038048 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.554073095 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.554081917 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.554766893 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.554814100 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.554819107 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.554867029 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.554903030 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.554910898 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.555655956 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.555702925 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.555711031 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.555722952 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.555763006 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.555768967 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.556545973 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.556593895 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.556596041 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.556610107 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.556665897 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.556672096 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.557396889 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.557440996 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.557444096 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.557454109 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.557492018 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.557499886 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.558069944 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.558115959 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.558121920 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.558134079 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.558173895 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.558180094 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.558895111 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.558939934 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.558940887 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.558963060 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.559004068 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.559010029 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.559808016 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.559851885 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.559859991 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.559866905 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.559904099 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.559909105 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.560472965 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.560518026 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.560523033 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.560566902 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.560604095 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.560609102 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.561268091 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.561321020 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.561331987 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.561340094 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.561381102 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.561820030 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.561922073 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.561961889 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.561965942 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.561975002 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.562010050 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.562618971 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.562695026 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.562738895 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.562738895 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.562752008 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.562786102 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.563412905 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.563549042 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.563590050 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.563596964 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.563608885 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.563652992 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.563657999 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.564441919 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.564490080 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.564490080 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.564505100 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.564542055 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.564547062 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.565412045 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.565459967 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.565459967 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.565474033 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.565532923 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.565537930 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.565577984 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.565618038 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.565624952 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.566612959 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.566668987 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.566673994 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.566684961 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.566716909 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.566730976 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.567305088 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.567346096 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.567352057 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.567364931 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.567395926 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.567413092 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.567488909 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.567519903 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.567528009 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.568269968 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.568311930 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.568319082 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.568329096 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.568360090 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.568365097 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.569264889 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.569313049 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.569317102 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.569327116 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.569364071 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.569372892 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.569447041 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.569479942 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.569487095 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.570188046 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.570234060 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.570235014 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.570250034 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.570280075 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.570296049 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.571100950 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.571146965 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.571161985 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.571173906 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.571213007 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.571223021 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.571688890 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.571733952 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.571737051 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.571749926 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.571783066 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.571793079 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.572583914 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.572640896 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.572659016 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.572666883 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.572702885 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.572709084 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.572745085 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.572783947 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.572789907 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.573607922 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.573652983 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.573666096 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.573673010 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.573723078 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.573764086 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.573771000 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.573810101 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.574461937 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.574655056 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.574695110 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.574840069 CET	49743	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.574856997 CET	443	49743	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.641098976 CET	49748	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.641184092 CET	443	49748	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.641278982 CET	49748	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.642591000 CET	49748	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.642622948 CET	443	49748	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.861913919 CET	443	49748	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.862200022 CET	49748	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.862224102 CET	443	49748	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.862891912 CET	443	49748	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.863205910 CET	49748	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.863293886 CET	443	49748	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.863620043 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.863653898 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.863724947 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.863970995 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.864005089 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.864057064 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.864300966 CET	49759	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.864331961 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.864396095 CET	49759	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.864649057 CET	49760	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.864670992 CET	443	49760	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.864717960 CET	49760	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.865024090 CET	49761	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.865056992 CET	443	49761	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.865119934 CET	49761	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.865323067 CET	49748	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.865353107 CET	443	49748	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.866153002 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.866168976 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.866422892 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.866440058 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.866682053 CET	49759	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.866704941 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.866890907 CET	49760	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.866902113 CET	443	49760	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.867103100 CET	49761	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:41.867127895 CET	443	49761	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:41.874188900 CET	49762	443	192.168.2.17	142.251.15.119
Jan 30, 2024 18:51:41.874214888 CET	443	49762	142.251.15.119	192.168.2.17
Jan 30, 2024 18:51:41.874269009 CET	49762	443	192.168.2.17	142.251.15.119
Jan 30, 2024 18:51:41.874588966 CET	49762	443	192.168.2.17	142.251.15.119
Jan 30, 2024 18:51:41.874610901 CET	443	49762	142.251.15.119	192.168.2.17
Jan 30, 2024 18:51:42.081461906 CET	443	49748	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.081552982 CET	443	49748	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.081628084 CET	49748	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.082071066 CET	49748	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.082117081 CET	443	49748	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.082145929 CET	49748	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.082168102 CET	49748	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.082771063 CET	49764	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.082801104 CET	443	49764	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.082859993 CET	49764	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.083734989 CET	49764	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.083755970 CET	443	49764	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.097021103 CET	443	49760	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.097229958 CET	49760	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.097245932 CET	443	49760	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.098248959 CET	443	49760	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.098321915 CET	49760	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.098592043 CET	49760	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.098647118 CET	443	49760	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.098855972 CET	49760	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.098865032 CET	443	49760	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.116924047 CET	443	49762	142.251.15.119	192.168.2.17
Jan 30, 2024 18:51:42.117201090 CET	49762	443	192.168.2.17	142.251.15.119
Jan 30, 2024 18:51:42.117223024 CET	443	49762	142.251.15.119	192.168.2.17
Jan 30, 2024 18:51:42.118201017 CET	443	49762	142.251.15.119	192.168.2.17
Jan 30, 2024 18:51:42.118268967 CET	49762	443	192.168.2.17	142.251.15.119
Jan 30, 2024 18:51:42.119214058 CET	49762	443	192.168.2.17	142.251.15.119
Jan 30, 2024 18:51:42.119282007 CET	443	49762	142.251.15.119	192.168.2.17
Jan 30, 2024 18:51:42.119419098 CET	49762	443	192.168.2.17	142.251.15.119
Jan 30, 2024 18:51:42.119431019 CET	443	49762	142.251.15.119	192.168.2.17
Jan 30, 2024 18:51:42.143693924 CET	49760	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.159699917 CET	49762	443	192.168.2.17	142.251.15.119
Jan 30, 2024 18:51:42.168207884 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.168559074 CET	49759	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.168590069 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.170674086 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.170783043 CET	49759	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.171056032 CET	49759	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.171200037 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.171238899 CET	49759	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.171251059 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.196125031 CET	443	49761	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.196352959 CET	49761	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.196371078 CET	443	49761	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.198158979 CET	443	49761	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.198234081 CET	49761	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.198584080 CET	49761	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.198726892 CET	49761	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.198767900 CET	443	49761	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.213742018 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.213974953 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.213992119 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.214709997 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.214931011 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.215065956 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.215146065 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.215159893 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.215221882 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.215286016 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.215317965 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.215734005 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.216053963 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.216135025 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.216247082 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.216283083 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.223691940 CET	49759	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.223726988 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.240211964 CET	49761	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.240230083 CET	443	49761	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.271717072 CET	49759	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.287679911 CET	49761	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.294354916 CET	443	49764	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.294560909 CET	49764	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.294568062 CET	443	49764	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.295991898 CET	443	49764	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.296086073 CET	49764	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.296408892 CET	49764	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.296483040 CET	443	49764	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.296550989 CET	49764	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.296555996 CET	443	49764	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.321954966 CET	443	49762	142.251.15.119	192.168.2.17
Jan 30, 2024 18:51:42.321993113 CET	443	49762	142.251.15.119	192.168.2.17
Jan 30, 2024 18:51:42.322024107 CET	443	49762	142.251.15.119	192.168.2.17
Jan 30, 2024 18:51:42.322035074 CET	49762	443	192.168.2.17	142.251.15.119
Jan 30, 2024 18:51:42.322052956 CET	443	49762	142.251.15.119	192.168.2.17
Jan 30, 2024 18:51:42.322084904 CET	49762	443	192.168.2.17	142.251.15.119
Jan 30, 2024 18:51:42.322094917 CET	443	49762	142.251.15.119	192.168.2.17
Jan 30, 2024 18:51:42.322112083 CET	443	49762	142.251.15.119	192.168.2.17
Jan 30, 2024 18:51:42.322143078 CET	49762	443	192.168.2.17	142.251.15.119
Jan 30, 2024 18:51:42.322809935 CET	49762	443	192.168.2.17	142.251.15.119
Jan 30, 2024 18:51:42.322832108 CET	443	49762	142.251.15.119	192.168.2.17
Jan 30, 2024 18:51:42.334393978 CET	443	49760	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.334517956 CET	443	49760	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.334563017 CET	49760	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.335563898 CET	49760	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.335572004 CET	443	49760	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.338680983 CET	49765	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.338713884 CET	443	49765	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.338773966 CET	49765	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.349487066 CET	49765	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.349519968 CET	443	49765	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.351624012 CET	49764	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.368573904 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.368640900 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.368695021 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.368702888 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.368721962 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.368762016 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.368769884 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.368814945 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.368855953 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.368864059 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.374964952 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.375016928 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.375024080 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.383214951 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.383280993 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.383291960 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.389172077 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.389255047 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.389266968 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.398205042 CET	443	49761	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.398317099 CET	443	49761	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.398375988 CET	49761	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.398396969 CET	443	49761	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.400552988 CET	443	49761	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.400638103 CET	49761	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.400748014 CET	49761	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.400763988 CET	443	49761	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.401339054 CET	49766	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.401371002 CET	443	49766	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.401449919 CET	49766	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.402692080 CET	49766	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.402707100 CET	443	49766	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.411422968 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.411484957 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.411536932 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.411540985 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.411562920 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.411603928 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.411611080 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.411653996 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.411689043 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.411695004 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.418368101 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.418427944 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.418436050 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.425770998 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.425821066 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.425828934 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.430689096 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.430699110 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.432712078 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.432771921 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.432777882 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.470735073 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.470787048 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.470794916 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.474165916 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.474214077 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.474220991 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.478686094 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.478703022 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.481837034 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.481882095 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.481889009 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.488369942 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.488450050 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.488457918 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.495516062 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.495589018 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.495596886 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.502578020 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.502659082 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.502666950 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.509777069 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.509831905 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.509839058 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.513494015 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.513545990 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.513566971 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.516421080 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.516470909 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.516479015 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.516659021 CET	443	49764	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.516752005 CET	443	49764	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.516802073 CET	49764	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.517169952 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.517211914 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.517220020 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.517426014 CET	49764	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.517436981 CET	443	49764	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.517445087 CET	49764	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.517483950 CET	49764	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.518044949 CET	49767	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.518131018 CET	443	49767	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.518198013 CET	49767	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.519176960 CET	49767	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.519212961 CET	443	49767	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.523030996 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.523082018 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.523088932 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.524172068 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.524214029 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.524220943 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.529663086 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.529714108 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.529720068 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.531323910 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.531373024 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.531379938 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.536284924 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.536330938 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.536338091 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.538835049 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.538882017 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.538888931 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.542934895 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.542987108 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.542994022 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.545782089 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.545830965 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.545838118 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.549534082 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.549580097 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.549604893 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.552767038 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.552834034 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.552840948 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.556297064 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.556349039 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.556374073 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.557710886 CET	443	49765	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.557919979 CET	49765	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.557941914 CET	443	49765	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.558243036 CET	443	49765	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.558530092 CET	49765	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.558597088 CET	443	49765	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.558655977 CET	49765	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.559406042 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.559467077 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.559478045 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.566051006 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.566103935 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.566112995 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.572752953 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.572794914 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.572838068 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.572845936 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.572874069 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.572890043 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.575978994 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.576056004 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.576065063 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.579349995 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.579406023 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.579412937 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.582496881 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.582568884 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.582576990 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.585959911 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.586004019 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.586011887 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.588784933 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.588835001 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.588849068 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.592633963 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.592698097 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.592706919 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.594475031 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.594535112 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.594561100 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.596441984 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.596513987 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.596565008 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.596690893 CET	49759	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.596754074 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.596822977 CET	49759	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.599271059 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.599354982 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.599371910 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.600162983 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.600227118 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.600241899 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.603223085 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.603302956 CET	49759	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.603318930 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.605905056 CET	443	49765	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.606091022 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.606142044 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.606158018 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.610373974 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.610413074 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.610456944 CET	49759	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.610471010 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.610522985 CET	49759	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.611442089 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.611501932 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.611522913 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.615096092 CET	443	49766	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.615330935 CET	49766	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.615344048 CET	443	49766	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.615581036 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.615632057 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.615648031 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.615797043 CET	443	49766	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.616218090 CET	49766	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.616297960 CET	443	49766	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.616522074 CET	49766	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.616550922 CET	443	49766	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.617115021 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.617167950 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.617187977 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.617564917 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.619241953 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.619293928 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.619307041 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.622690916 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.622739077 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.622755051 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.623342037 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.623398066 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.623409986 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.624741077 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.624803066 CET	49759	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.624815941 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.628216982 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.628282070 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.628290892 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.628318071 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.628482103 CET	49759	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.628612041 CET	49759	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.628649950 CET	443	49759	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.631195068 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.631234884 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.631272078 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.631288052 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.631329060 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.632810116 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.632860899 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.632873058 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.636739969 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.637665987 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.637828112 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.637837887 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.641993046 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.642049074 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.642060995 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.642062902 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.642113924 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.642118931 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.646698952 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.646784067 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.646790028 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.646878004 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.646915913 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.646920919 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.646934986 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.646970034 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.651355982 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.651416063 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.651422024 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.651669979 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.656074047 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.656112909 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.656194925 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.656229973 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.656239033 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.656246901 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.656255960 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.656303883 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.660383940 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.662879944 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.662935972 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.662944078 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.662951946 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.662986994 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.664755106 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.664797068 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.664823055 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.664844036 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.664884090 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.667494059 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.668812037 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.672141075 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.672188044 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.672214031 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.672221899 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.672260046 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.672853947 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.672893047 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.672905922 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.672914982 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.672951937 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.676759005 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.676796913 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.680674076 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.680712938 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.680742979 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.680752039 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.680788994 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.681324959 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.681371927 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.681374073 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.681387901 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.681425095 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.684580088 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.685995102 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.686194897 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.686243057 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.686249971 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.688381910 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.688436031 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.688442945 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.690670967 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.690716982 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.690720081 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.690732956 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.690771103 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.690881014 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.690922022 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.690928936 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.693483114 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.693591118 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.693598986 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.695214987 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.695765972 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.695822954 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.695831060 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.698229074 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.698302031 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.698311090 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.699728966 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.699790955 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.699794054 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.699805021 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.699842930 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.700680971 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.700737000 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.700745106 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.701967001 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:42.702018976 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:42.702074051 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:42.703231096 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.703273058 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.703282118 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.703972101 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:42.703993082 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:42.704083920 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.705538034 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.705595970 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.705614090 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.707931042 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.707998037 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.708005905 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.708182096 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.708228111 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.708228111 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.708240032 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.708280087 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.710345984 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.710408926 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.710417986 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.712332964 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.712769032 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.712820053 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.712827921 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.716253996 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.716288090 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.716309071 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.716320038 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.716330051 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.716340065 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.716367960 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.716404915 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.718336105 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.718410015 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.718417883 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.718743086 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.721101999 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.721148014 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.721159935 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.721169949 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.721208096 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.722412109 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.722460032 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.722470045 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.723490953 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.725838900 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.725897074 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.725908041 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.726305008 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.726352930 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.726361036 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.728262901 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.728307962 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.728315115 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.728322983 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.728358984 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.728943110 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.729001999 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.729008913 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.730240107 CET	443	49767	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.730474949 CET	49767	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.730494976 CET	443	49767	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.730560064 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.731379032 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.731426954 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.731435061 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.731928110 CET	443	49767	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.731987000 CET	49767	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.732270956 CET	49767	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.732351065 CET	443	49767	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.732455969 CET	49767	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.732470989 CET	443	49767	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.732912064 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.732964039 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.732966900 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.732979059 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.733014107 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.733787060 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.733834982 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.733844042 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.735317945 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.736210108 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.736269951 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.736278057 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.737602949 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.737664938 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.737673998 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.738559008 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.738603115 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.738610029 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.739928007 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.739969969 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.739974022 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.739983082 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.740020037 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.740967035 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.741020918 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.741028070 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.742242098 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.743340969 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.743386030 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.743392944 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.744527102 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.744574070 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.744581938 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.745678902 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.745678902 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.745731115 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.745738029 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.745764017 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.745770931 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.747956991 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.748004913 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.748014927 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.748064995 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.748111010 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.748116970 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.750267029 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.750319958 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.750328064 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.751322031 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.751368999 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.751378059 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.751384974 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.751415968 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.752804995 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.752856016 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.752861977 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.753492117 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.754873991 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.754920959 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.754926920 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.755750895 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.755796909 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.755800009 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.755810976 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.755848885 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.755865097 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.756982088 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.757019997 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.757025003 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.757949114 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.758011103 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.758018017 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.759270906 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.759324074 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.759329081 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.760180950 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.760230064 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.760236979 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.761456013 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.761508942 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.761517048 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.762370110 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.762442112 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.762451887 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.763598919 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.763659954 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.763664961 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.764511108 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.764568090 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.764574051 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.765773058 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.765820980 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.765825987 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.766784906 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.766843081 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.766850948 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.767860889 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.767911911 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.767930984 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.768893003 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.768940926 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.768948078 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.769963026 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.770009041 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.770015955 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.771007061 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.771053076 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.771060944 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.773065090 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.773085117 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.773111105 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.773117065 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.773134947 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.773159027 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.773186922 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.773194075 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.775155067 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.775283098 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.775335073 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.775341988 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.777200937 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.777249098 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.777254105 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.778283119 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.778327942 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.778327942 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.778342962 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.778378010 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.779392004 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.779417992 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.779452085 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.779458046 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.779493093 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.780340910 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.780704975 CET	49767	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.781156063 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.782438040 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.782481909 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.782489061 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.782495975 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.782531977 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.783195019 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.783224106 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.783237934 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.783241987 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.783276081 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.783279896 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.784379959 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.785219908 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.785264015 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.785276890 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.786417007 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.786468983 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.786474943 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.786488056 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.786523104 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.787130117 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.787172079 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.787187099 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.788431883 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.789062023 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.789123058 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.789139032 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.790369987 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.790414095 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.790422916 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.790430069 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.790462971 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.791012049 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.791065931 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.791075945 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.792373896 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.792874098 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.792922020 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.792933941 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.794275045 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.794321060 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.794322968 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.794333935 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.794368029 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.794502974 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.794543982 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.794549942 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.796195984 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.797218084 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.797245026 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.797271967 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.797277927 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.797310114 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.798137903 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.798187017 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.798187017 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.798199892 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.798242092 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.798254967 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.798583984 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.800143957 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.800189018 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.800196886 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.800203085 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.800218105 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.800235033 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.800240993 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.800276041 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.801786900 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.802923918 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.802968025 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.802984953 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.802992105 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.803026915 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.803284883 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.803313971 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.803328037 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.803333044 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.803369045 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.804826021 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.804858923 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.806391001 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.806441069 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.806446075 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.806528091 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.806566954 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.806687117 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.806727886 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.806727886 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.806741953 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.806776047 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.806854010 CET	49757	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.806868076 CET	443	49757	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.808587074 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.810421944 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.810463905 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.810492992 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.810501099 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.810537100 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.812258959 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.813997984 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.814049006 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.814064980 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.814071894 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.814107895 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.815793991 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.817662001 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.817706108 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.817723036 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.817729950 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.817764044 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.819395065 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.821187019 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.821229935 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.821261883 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.821269989 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.821304083 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.822940111 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.824712992 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.824781895 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.824790001 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.825629950 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.825683117 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.825690031 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.827384949 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.827430964 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.827436924 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.829087973 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.829138041 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.829144955 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.830769062 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.830836058 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.830845118 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.832531929 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.832592010 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.832598925 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.834080935 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.834145069 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.834151983 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.835606098 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.835663080 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.835669041 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.837088108 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.837129116 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.837136030 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.838614941 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.838665009 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.838671923 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.840100050 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.840152979 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.840158939 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.840572119 CET	443	49766	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.840667009 CET	443	49766	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.840708971 CET	49766	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.841078997 CET	49766	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.841095924 CET	443	49766	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.841105938 CET	49766	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.841140985 CET	49766	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.841634989 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.841687918 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.841695070 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.843147993 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.843214035 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.843220949 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.844589949 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.844639063 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.844645023 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.846695900 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.846740007 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.846750021 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.846755981 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.846798897 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.848026991 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.849503040 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.849548101 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.849549055 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.849560976 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.849603891 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.850824118 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.852194071 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.852231026 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.852238894 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.852245092 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.852284908 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.853549957 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.855103970 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.855145931 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.855149031 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.855159044 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.855201006 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.856184006 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.857496977 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.857533932 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.857541084 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.858881950 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.858921051 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.858927965 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.858935118 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.858980894 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.860155106 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.861355066 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.861398935 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.861418009 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.861423969 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.861460924 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.862726927 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.863883018 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.863934994 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.863941908 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.864454985 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.864499092 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.864505053 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.865689993 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.865729094 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.865735054 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.866972923 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.867014885 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.867021084 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.868165970 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.868210077 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.868216038 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.869296074 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.869340897 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.869348049 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.870543003 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.870592117 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.870598078 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.871649981 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.871691942 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.871697903 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.872795105 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.872838020 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.872843981 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.873939991 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.873982906 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.873989105 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.875128031 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.875171900 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.875178099 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.876230001 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.876275063 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.876281023 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.877300978 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.877350092 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.877357960 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.878423929 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.878473997 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.878479958 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.880184889 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.880228996 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.880230904 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.880242109 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.880275011 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.881153107 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.882184982 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.882234097 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.882241964 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.883328915 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.883373976 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.883378029 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.883385897 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.883416891 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.884349108 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.885436058 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.885478020 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.885484934 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.885494947 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.885525942 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.886466980 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.887552977 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.887594938 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.887598991 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.887607098 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.887654066 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.888534069 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.889560938 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.889605045 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.889607906 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.889617920 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.889662981 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.890539885 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.891571045 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.891613960 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.891621113 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.891629934 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.891663074 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.892553091 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.893493891 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.893546104 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.893553019 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.894093037 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.894139051 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.894145012 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.894990921 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.895036936 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.895044088 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.895931959 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.895977020 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.895983934 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.896908045 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.896953106 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.896960020 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.897937059 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.897984028 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.897989988 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.898870945 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.898916006 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.898921967 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.899775028 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.899821997 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.899827957 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.900692940 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.900736094 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.900743008 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.901642084 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.901688099 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.901695013 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.902553082 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.902595997 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.902601957 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.903434992 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.903480053 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.903487921 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.904340982 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.904386044 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.904392958 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.905272007 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.905317068 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.905323982 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.906274080 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.906318903 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.906326056 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.907056093 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.907099962 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.907105923 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.907970905 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.908015013 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.908020973 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.908953905 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.908998966 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.909004927 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.909732103 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.909779072 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.909785032 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.910629988 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.910674095 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.910681009 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.911474943 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.911520958 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.911526918 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.912349939 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.912393093 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.912399054 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.913230896 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.913275003 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.913281918 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.913346052 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:42.913636923 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:42.913670063 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:42.914446115 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.914488077 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.914499044 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.914504051 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.914535046 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.914997101 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:42.915064096 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:42.915349960 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.915349960 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:42.915419102 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:42.915472984 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:42.916446924 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.916491032 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.916491985 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.916503906 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.916539907 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.916981936 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.918258905 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.918301105 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.918307066 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.918715954 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.918757915 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.918760061 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.918772936 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.918807030 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.919450045 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.920234919 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.920277119 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.920278072 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.920290947 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.920325041 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.921071053 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.921832085 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.921874046 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.921880007 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.922692060 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.922734022 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.922734976 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.922748089 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.922780991 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.923544884 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.924278975 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.924319983 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.924320936 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.924334049 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.924365044 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.925080061 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.925877094 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.925926924 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.925930977 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.925940037 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.925976038 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.926630020 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.927413940 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.927457094 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.927462101 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.927469969 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.927501917 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.928183079 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.928930044 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.928972006 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.928980112 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.928988934 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.929022074 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.929635048 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.930402040 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.930447102 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.930458069 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.930464983 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.930495977 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.931200027 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.931893110 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.931969881 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.931977034 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.932320118 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.932389975 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.932395935 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.933119059 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.933167934 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.933173895 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.933795929 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.933844090 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.933851004 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.934518099 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.934578896 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.934586048 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.935269117 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.935313940 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.935328007 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.936007023 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.936048985 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.936055899 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.936741114 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.936784029 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.936789989 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.937419891 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.937463045 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.937469006 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.938287973 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.938329935 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.938335896 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.938935041 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.938996077 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.939002037 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.939583063 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.939637899 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.939644098 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.940296888 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.940339088 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.940346003 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.940977097 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.941020966 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.941025972 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.941718102 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.941765070 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.941771030 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.942368031 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.942420006 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.942425966 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.943042040 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.943114996 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.943121910 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.943756104 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.943810940 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.943816900 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.944482088 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.944540024 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.944545984 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.945141077 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.945194006 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.945200920 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.945802927 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.945849895 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.945857048 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.946510077 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.946556091 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.946562052 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.947163105 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.947207928 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.947213888 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.948123932 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.948163986 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.948168993 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.948177099 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.948208094 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.948873043 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.949491978 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.949534893 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.949536085 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.949548006 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.949588060 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.950186968 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.950872898 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.950912952 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.950916052 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.950926065 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.950959921 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.951529980 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.952166080 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.952208996 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.952215910 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.952961922 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.953005075 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.953006983 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.953016996 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.953052044 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.953619003 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.954149961 CET	443	49767	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.954185963 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.954221964 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.954229116 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.954260111 CET	443	49767	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.954401016 CET	49767	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.954649925 CET	49767	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.954675913 CET	443	49767	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.954689026 CET	49767	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.954721928 CET	49767	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.954768896 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.954806089 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.954812050 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.955506086 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.955550909 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.955557108 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.955564022 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.955595970 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.956150055 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.956742048 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:42.956762075 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:42.956789970 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.956824064 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.956829071 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.956871986 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.956912041 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.956918955 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.957824945 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.957869053 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.957871914 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.957880974 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.957915068 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.958725929 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.958801985 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.958838940 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.958846092 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.959676981 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.959719896 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.959722042 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.959734917 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.959769964 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.960661888 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.960737944 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.960774899 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.960781097 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.961591005 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.961635113 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.961637974 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.961647034 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.961678028 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.962528944 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.962837934 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.962879896 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.962882996 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.962892056 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.962928057 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.963793993 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.963903904 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.963938951 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.963946104 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.964010000 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.964046001 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.964147091 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.964159012 CET	443	49758	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.964179993 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.964199066 CET	49758	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.967564106 CET	443	49765	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.967622042 CET	443	49765	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.967684031 CET	49765	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.968699932 CET	49765	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.968718052 CET	443	49765	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.994281054 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.994313002 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:42.994563103 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.994745016 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:42.994767904 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.004756927 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.134030104 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.134080887 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.134150982 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.134241104 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.134265900 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.134265900 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.134335995 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.134390116 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.140700102 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.147758961 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.147795916 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.147851944 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.147917986 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.147984982 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.154930115 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.162142992 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.162220955 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.162235975 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.205424070 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.205699921 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.205725908 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.206300020 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.206595898 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.206682920 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.207000971 CET	49770	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.207037926 CET	443	49770	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.207103014 CET	49770	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.207205057 CET	49771	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.207242012 CET	443	49771	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.207320929 CET	49771	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.207621098 CET	49772	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.207704067 CET	443	49772	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.207788944 CET	49772	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.207990885 CET	49773	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.208018064 CET	443	49773	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.208131075 CET	49773	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.208189011 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.208225012 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.208558083 CET	49770	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.208575010 CET	443	49770	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.208801985 CET	49771	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.208816051 CET	443	49771	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.209011078 CET	49772	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.209044933 CET	443	49772	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.209139109 CET	49773	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.209151983 CET	443	49773	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.212816000 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.235733986 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.239291906 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.239372969 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.239480019 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.239545107 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.239614964 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.246397018 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.253698111 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.253779888 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.253884077 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.253948927 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.254007101 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.260785103 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.267960072 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.268033981 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.268040895 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.268069029 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.268126965 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.275078058 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.281703949 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.281783104 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.281785965 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.281806946 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.281867981 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.288364887 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.294981003 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.295043945 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.295061111 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.303239107 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.303293943 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.303306103 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.308352947 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.308430910 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.308439016 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.315006018 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.315059900 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.315068960 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.315179110 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.315221071 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.315229893 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.321752071 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.321815014 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.321822882 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.338233948 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.338289022 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.338300943 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.340857029 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.340909004 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.340918064 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.345995903 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.346059084 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.346067905 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.351315975 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.351370096 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.351378918 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.355556011 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.355618000 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.355627060 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.360346079 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.360428095 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.360435963 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.364898920 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.364969969 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.364983082 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.369564056 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.369637966 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.369652987 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.374123096 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.374203920 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.374212980 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.378742933 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.378823996 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.378833055 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.385662079 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.385739088 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.385747910 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.390182972 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.390260935 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.390265942 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.390296936 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.390336037 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.394823074 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.399456978 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.399523973 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.399537086 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.404109955 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.404191971 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.404206991 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.404222012 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.404267073 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.408829927 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.413270950 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.413352966 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.413453102 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.413516998 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.413575888 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.417977095 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.418145895 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.418198109 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.418212891 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.422590017 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.422661066 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.422673941 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.426868916 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.426937103 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.426949978 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.430994034 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.431076050 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.431088924 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.435153008 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.435219049 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.435233116 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.441068888 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.441131115 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.441143990 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.443284988 CET	443	49770	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.443495989 CET	49770	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.443523884 CET	443	49770	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.443789005 CET	443	49770	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.443945885 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.444020987 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.444042921 CET	49770	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.444066048 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.444082975 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.444098949 CET	443	49770	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.444148064 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.444205999 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.444206953 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.444222927 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.444267988 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.444401026 CET	49770	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.444431067 CET	443	49770	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.445025921 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.445194960 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.445207119 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.445270061 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.445329905 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.449035883 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.450834990 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.451484919 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.451548100 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.451565027 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.454027891 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.454119921 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.454125881 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.454189062 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.454246998 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.455015898 CET	443	49772	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.455446005 CET	49772	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.455507040 CET	443	49772	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.456460953 CET	443	49772	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.456476927 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.456543922 CET	49772	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.456814051 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.456996918 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.457169056 CET	49772	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.457243919 CET	443	49772	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.457338095 CET	49772	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.457357883 CET	443	49772	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.457968950 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.458009958 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.458024025 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.458039999 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.458086967 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.465115070 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.465977907 CET	49768	443	192.168.2.17	64.233.176.102
Jan 30, 2024 18:51:43.466022015 CET	443	49768	64.233.176.102	192.168.2.17
Jan 30, 2024 18:51:43.472182989 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.472242117 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.472259045 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.499653101 CET	443	49773	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.499902010 CET	443	49771	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.500117064 CET	49773	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.500183105 CET	443	49773	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.500401974 CET	49771	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.500427961 CET	443	49771	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.500821114 CET	49772	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.500914097 CET	443	49771	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.501688957 CET	443	49773	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.501769066 CET	49773	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.501983881 CET	49771	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.502075911 CET	443	49771	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.502279043 CET	49771	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.502312899 CET	443	49771	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.502834082 CET	49773	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.502927065 CET	443	49773	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.503192902 CET	49773	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.503211021 CET	443	49773	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.516695976 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.545608997 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.548827887 CET	49773	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.549164057 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.549217939 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.549251080 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.549288034 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.549350023 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.556313992 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.563407898 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.563457012 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.563507080 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.563538074 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.563590050 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.570595980 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.577636957 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.577686071 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.577723026 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.577739954 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.577776909 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.584768057 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.591357946 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.591401100 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.591453075 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.591465950 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.591504097 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.598045111 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.604609966 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.604655981 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.604684114 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.604696035 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.604732990 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.611358881 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.617857933 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.617902994 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.617935896 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.617948055 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.617980957 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.624522924 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.624587059 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.624629974 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.624640942 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.631213903 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.631278992 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.631289005 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.647519112 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.647603989 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.647614002 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.650439978 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.650505066 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.650511980 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.655895948 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.655946016 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.655951977 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.661236048 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.661288023 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.661298037 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.666209936 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.666282892 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.666289091 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.671197891 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.671273947 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.671279907 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.676131964 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.676178932 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.676184893 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.680979013 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.681063890 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.681070089 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.684566021 CET	443	49770	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.685977936 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.686028957 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.686041117 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.690777063 CET	443	49770	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.690841913 CET	49770	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.692066908 CET	49770	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.692081928 CET	443	49770	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.693270922 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.693314075 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.693331957 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.693345070 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.693380117 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.693579912 CET	443	49772	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.697208881 CET	443	49773	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.697468996 CET	443	49773	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.697523117 CET	49773	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.698290110 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.699398994 CET	49774	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.699421883 CET	443	49774	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.699523926 CET	49774	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.699724913 CET	49773	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.699738979 CET	443	49773	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.701035023 CET	443	49772	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.701098919 CET	49772	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.702817917 CET	49774	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.702827930 CET	443	49774	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.703269005 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.703309059 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.703320980 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.703329086 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.703365088 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.705576897 CET	49772	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.705599070 CET	443	49772	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.708453894 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.708626986 CET	443	49771	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.712903976 CET	443	49771	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.712987900 CET	49771	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.713104010 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.713145018 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.713151932 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.713162899 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.713201046 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.717999935 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.719599962 CET	49771	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.719619036 CET	443	49771	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.722894907 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.722933054 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.722961903 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.722974062 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.723012924 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.727180004 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.731606960 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.731647968 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.731688976 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.731703997 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.731749058 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.735956907 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.739991903 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.740056038 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.740068913 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.744175911 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.744259119 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.744270086 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.750097990 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.750153065 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.750163078 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.750175953 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.750207901 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.754117012 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.758070946 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.758117914 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.758127928 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.760597944 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.760670900 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.760699987 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.760705948 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.760756969 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.763118029 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.765592098 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.765646935 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.765656948 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.765664101 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.765697002 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.768094063 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.770622015 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.770664930 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.770668030 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.770678997 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.770720959 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.773015976 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.775444031 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.775479078 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.775501966 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.775510073 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.775547028 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.777692080 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.780014992 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.780040026 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.780205965 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.780267954 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.780338049 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.782465935 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.783962965 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.784038067 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.784060955 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.786046028 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.786108017 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.786120892 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.788140059 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.788218021 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.788228989 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.790517092 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.790594101 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.790605068 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.792736053 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.792794943 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.792805910 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.794975042 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.795047045 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.795058012 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.797205925 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.797265053 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.797275066 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.799462080 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.799519062 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.799530983 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.801697969 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.801749945 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.801754951 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.803899050 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.803958893 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.803968906 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.806139946 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.806195021 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.806205988 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.808235884 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.808288097 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.808299065 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.811435938 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.811470032 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.811500072 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.811513901 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.811569929 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.813580990 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.815661907 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.815689087 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.815716028 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.815727949 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.815778017 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.817738056 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.820102930 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.820127964 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.820157051 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.820168018 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.820219040 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.822097063 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.824119091 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.824141979 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.824173927 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.824186087 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.824238062 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.826087952 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.828299999 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.828337908 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.828385115 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.828397036 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.828454971 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.830176115 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.832251072 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.832277060 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.832303047 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.832314968 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.832370996 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.834165096 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.834216118 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.834264994 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.834275961 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.837143898 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.837172985 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.837214947 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.837225914 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.837274075 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.839055061 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.840993881 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.841022015 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.841049910 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.841061115 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.841114044 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.842966080 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.844842911 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.844870090 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.844901085 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.844912052 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.844963074 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.846749067 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.848695040 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.848722935 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.848751068 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.848761082 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.848819017 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.850476027 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.852358103 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.852385044 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.852423906 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.852435112 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.852487087 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.854204893 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.856051922 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.856079102 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.856113911 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.856126070 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.856177092 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.857827902 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.859656096 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.859707117 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.859716892 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.860563040 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.860709906 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.860719919 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.862337112 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.862392902 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.862402916 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.864157915 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.864211082 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.864219904 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.865711927 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.865763903 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.865773916 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.867300987 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.867377996 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.867388010 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.868896008 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.868948936 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.868958950 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.870436907 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.870491028 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.870501995 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.871923923 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.871978998 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.871989965 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.873406887 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.873460054 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.873470068 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.874973059 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.875025988 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.875036001 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.876419067 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.876480103 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.876490116 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.878005981 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.878071070 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.878082037 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.879297972 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.879354000 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.879364014 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.880779028 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.880826950 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.880836964 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.882956028 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.882981062 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.883006096 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.883017063 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.883065939 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.883075953 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.883112907 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.883160114 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.883259058 CET	49769	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.883287907 CET	443	49769	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.912610054 CET	443	49774	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.913069010 CET	49774	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.913084984 CET	443	49774	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.913422108 CET	443	49774	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.913747072 CET	49774	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.913799047 CET	443	49774	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.914194107 CET	49775	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.914231062 CET	443	49775	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.914416075 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.914433002 CET	49775	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.914462090 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.914508104 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.914808035 CET	49777	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.914833069 CET	443	49777	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.914881945 CET	49777	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.915085077 CET	49778	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.915126085 CET	443	49778	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.915173054 CET	49778	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.915544033 CET	49779	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.915574074 CET	443	49779	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.915617943 CET	49779	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.915795088 CET	49774	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.915802956 CET	443	49774	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.916043997 CET	49775	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.916058064 CET	443	49775	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.916213036 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.916229963 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.916369915 CET	49777	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.916384935 CET	443	49777	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.916539907 CET	49778	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.916553974 CET	443	49778	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:43.916759014 CET	49779	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:43.916783094 CET	443	49779	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.134696960 CET	443	49774	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.134779930 CET	443	49774	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.134833097 CET	49774	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.135442019 CET	49774	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.135457993 CET	443	49774	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.136168957 CET	49780	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.136204004 CET	443	49780	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.136255980 CET	49780	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.136918068 CET	49780	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.136931896 CET	443	49780	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.163592100 CET	443	49778	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.163917065 CET	443	49777	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.163960934 CET	49778	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.163989067 CET	443	49778	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.164114952 CET	49777	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.164135933 CET	443	49777	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.165267944 CET	443	49778	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.165272951 CET	443	49777	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.165364027 CET	49777	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.165366888 CET	49778	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.165652037 CET	49777	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.165699959 CET	443	49777	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.165901899 CET	49778	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.165965080 CET	443	49778	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.166047096 CET	49777	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.166053057 CET	443	49777	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.166104078 CET	49778	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.166115999 CET	443	49778	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.171184063 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.171355963 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.171374083 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.171665907 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.172164917 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.172229052 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.172276974 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.172327042 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.177470922 CET	443	49779	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.177651882 CET	49779	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.177675009 CET	443	49779	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.178595066 CET	443	49779	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.178673029 CET	49779	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.179217100 CET	443	49775	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.179305077 CET	49779	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.179369926 CET	443	49779	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.179428101 CET	49775	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.179450989 CET	443	49775	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.179745913 CET	49779	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.179759979 CET	443	49779	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.179838896 CET	443	49775	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.180105925 CET	49775	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.180191994 CET	443	49775	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.180241108 CET	49775	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.180249929 CET	443	49775	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.219681978 CET	49778	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.220027924 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.220030069 CET	49777	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.220030069 CET	49779	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.235668898 CET	49775	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.346120119 CET	443	49780	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.346410036 CET	49780	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.346427917 CET	443	49780	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.347412109 CET	443	49780	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.347491980 CET	49780	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.347946882 CET	49780	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.347991943 CET	443	49780	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.348103046 CET	49780	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.348110914 CET	443	49780	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.395710945 CET	49780	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.402116060 CET	443	49778	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.402219057 CET	49778	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.402523041 CET	443	49778	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.402600050 CET	443	49778	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.402643919 CET	49778	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.402703047 CET	443	49779	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.402786970 CET	443	49779	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.402837038 CET	49779	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.403119087 CET	49778	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.403141022 CET	443	49778	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.403156996 CET	49778	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.403187990 CET	49778	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.403913021 CET	443	49777	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.403954983 CET	443	49777	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.403994083 CET	443	49777	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.404002905 CET	49777	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.404026985 CET	443	49777	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.404042006 CET	49779	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.404063940 CET	443	49779	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.404073954 CET	49777	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.404881954 CET	443	49775	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.405117035 CET	443	49775	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.405164957 CET	49775	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.405548096 CET	49775	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.405561924 CET	443	49775	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.410950899 CET	443	49777	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.411042929 CET	49777	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.411050081 CET	443	49777	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.416722059 CET	443	49777	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.416800022 CET	49777	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.416805029 CET	443	49777	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.420357943 CET	443	49777	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.420404911 CET	49777	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.420547009 CET	49777	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.420556068 CET	443	49777	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.432312012 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.432358980 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.432388067 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.432408094 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.432420015 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.432454109 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.432461977 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.432470083 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.432508945 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.439086914 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.446245909 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.446279049 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.446306944 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.446315050 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.446348906 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.453445911 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.460521936 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.460591078 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.460597992 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.506727934 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.534383059 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.537848949 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.537899971 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.537942886 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.538003922 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.538058996 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.545063019 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.552196980 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.552234888 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.552278996 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.552305937 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.552347898 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.559248924 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.566478968 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.566514015 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.566601992 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.566622972 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.566682100 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.572293043 CET	443	49780	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.572371960 CET	443	49780	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.572422981 CET	49780	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.572833061 CET	49780	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.572854996 CET	443	49780	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.572866917 CET	49780	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.572904110 CET	49780	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.573601007 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.580209970 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.580260038 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.580306053 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.580323935 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.580368042 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.586913109 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.593609095 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.593652964 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.593692064 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.593714952 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.593759060 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.600225925 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.606849909 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.606880903 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.606911898 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.606930017 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.606971025 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.613497972 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.613545895 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.613591909 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.613605976 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.620213032 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.620290041 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.620306969 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.636487007 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.636590958 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.636621952 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.639884949 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.639940023 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.639954090 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.645606995 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.645663977 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.645677090 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.651156902 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.651235104 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.651246071 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.656389952 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.656459093 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.656471014 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.661720037 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.661808968 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.661820889 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.667013884 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.667088985 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.667102098 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.672211885 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.672297001 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.672311068 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.677614927 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.677673101 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.677684069 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.682827950 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.682910919 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.682923079 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.690746069 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.690772057 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.690800905 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.690817118 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.690856934 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.696078062 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.701299906 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.701347113 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.701368093 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.701380968 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.701417923 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.701845884 CET	49781	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.701881886 CET	443	49781	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.701953888 CET	49781	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.702334881 CET	49781	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.702344894 CET	443	49781	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.706222057 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.710849047 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.710880041 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.710915089 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.710931063 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.710968971 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.715588093 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.720014095 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.720052004 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.720077991 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.720088005 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.720134020 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.724456072 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.724509001 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.724561930 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.724571943 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.728607893 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.728687048 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.728694916 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.732733965 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.732800007 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.732806921 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.736799002 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.736850023 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.736860991 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.740767956 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.740816116 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.740823984 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.746675968 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.746710062 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.746733904 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.746743917 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.746778965 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.750706911 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.753289938 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.753328085 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.753351927 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.753362894 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.753402948 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.755835056 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.758388996 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.758430004 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.758444071 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.758455038 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.758491039 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.760806084 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.763245106 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.763278961 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.763288021 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.763298035 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.763334990 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.765784025 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.768088102 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.768119097 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.768148899 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.768157005 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.768198013 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.770473003 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.770535946 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.770576000 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.770586014 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.772898912 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.772962093 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.772969961 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.775228024 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.775275946 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.775284052 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.778692961 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.778723001 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.778733969 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.778743029 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.778778076 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.781096935 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.783376932 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.783412933 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.783457041 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.783464909 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.783507109 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.785761118 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.788012028 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.788038969 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.788068056 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.788077116 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.788129091 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.790414095 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.792680025 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.792709112 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.792730093 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.792740107 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.792773008 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.794969082 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.797128916 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.797164917 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.797183990 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.797193050 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.797230959 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.799385071 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.801635981 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.801667929 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.801690102 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.801697969 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.801738024 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.803822041 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.806047916 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.806102991 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.806113005 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.807117939 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.807164907 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.807173014 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.809417009 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.809465885 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.809473038 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.813237906 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.813290119 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.813297033 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.815804958 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.815859079 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.815865993 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.816344976 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.816390991 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.816397905 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.818001986 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.818043947 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.818051100 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.820075989 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.820122957 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.820130110 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.822171926 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.822225094 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.822233915 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.824479103 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.824529886 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.824537992 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.826278925 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.826330900 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.826338053 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.828421116 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.828473091 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.828483105 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.830420017 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.830481052 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.830502987 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.833394051 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.833425045 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.833476067 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.833538055 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.833595037 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.835334063 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.837341070 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.837366104 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.837404013 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.837433100 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.837491035 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.839240074 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.841135979 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.841166973 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.841197968 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.841217995 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.841295004 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.843034983 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.845004082 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.845036983 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.845069885 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.845088959 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.845148087 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.846865892 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.848764896 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.848793030 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.848822117 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.848839998 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.848901987 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.850656033 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.852524042 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.852556944 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.852591038 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.852611065 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.852672100 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.854351044 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.856163979 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.856223106 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.856236935 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.857098103 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.857151985 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.857165098 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.859004021 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.859055996 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.859070063 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.860610962 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.860677958 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.860699892 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.862195969 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.862252951 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.862266064 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.863807917 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.863862038 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.863876104 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.865361929 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.865417957 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.865431070 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.866949081 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.866997004 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.867012978 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.868475914 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.868551016 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.868577003 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.870038986 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.870105028 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.870131969 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.871543884 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.871608019 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.871632099 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.872972012 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.873027086 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.873053074 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.874444008 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.874502897 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.874535084 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.875920057 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.875977039 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.876005888 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.877942085 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.877969980 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.878001928 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.878036022 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.878093004 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.879374027 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.880769014 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.880795002 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.880814075 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.880837917 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.880877972 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.882335901 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.883519888 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.883550882 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.883570910 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.883599997 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.883662939 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.884838104 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.886147022 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.886181116 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.886197090 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.886224985 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.886265039 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.887470961 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.888734102 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.888762951 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.888802052 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.888828039 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.888878107 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.890072107 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.891315937 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.891346931 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.891375065 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.891403913 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.891444921 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.892577887 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.893739939 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.893785000 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.893786907 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.893812895 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.893856049 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.895035028 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.895648003 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.895704985 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.895723104 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.896884918 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.896931887 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.896945953 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.898032904 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.898085117 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.898101091 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.899244070 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.899296999 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.899312019 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.900374889 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.900422096 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.900434971 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.901552916 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.901603937 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.901618004 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.902775049 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.902822971 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.902837038 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.903769016 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.903814077 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.903827906 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.904895067 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.904939890 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.904952049 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.906032085 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.906096935 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.906112909 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.907143116 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.907176971 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.907186985 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.908185005 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.908230066 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.908237934 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.909353018 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.909396887 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.909408092 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.910923004 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.910952091 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.910973072 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.910980940 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.911016941 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.912030935 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.912589073 CET	443	49781	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.912830114 CET	49781	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.912856102 CET	443	49781	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.913137913 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.913167000 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.913177013 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.913187027 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.913224936 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.913232088 CET	443	49781	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.913528919 CET	49781	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.913605928 CET	443	49781	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.914136887 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.914175034 CET	49782	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.914222956 CET	443	49782	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.914292097 CET	49782	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.914572001 CET	49783	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.914608002 CET	443	49783	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.914690018 CET	49783	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.914920092 CET	49781	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.914959908 CET	443	49781	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.915241957 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.915282965 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.915285110 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.915298939 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.915350914 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.915498972 CET	49782	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.915514946 CET	443	49782	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.915823936 CET	49783	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.915838957 CET	443	49783	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.916270971 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.917337894 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.917371035 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.917390108 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.917402029 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.917447090 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.918358088 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.919414043 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.919450045 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.919461012 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.919471025 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.919533014 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.920475006 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.921468019 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.921495914 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.921519995 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.921530962 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.921566010 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.922542095 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.923523903 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.923552036 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.923584938 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.923593998 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.923630953 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.924448967 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.924978018 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.925024033 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.925033092 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.925921917 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.925966024 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.925975084 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.926917076 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.926978111 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.926987886 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.927896976 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.927942038 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.927951097 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.928920984 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.928962946 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.928972006 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.930110931 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.930176020 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.930185080 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.930771112 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.930814981 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.930824041 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.931638002 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.931682110 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.931695938 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.932605982 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.932662010 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.932670116 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.933517933 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.933564901 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.933573961 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.934406042 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.934448004 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.934456110 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.935317993 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.935359955 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.935368061 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.936264992 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.936307907 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.936317921 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.937635899 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.937680960 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.937689066 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.938043118 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.938085079 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.938092947 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.939043045 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.939088106 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.939095974 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.939862013 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.939903975 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.939910889 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.940702915 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.940748930 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.940758944 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.941621065 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.941682100 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.941690922 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.942472935 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.942523956 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.942533016 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.943286896 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.943336964 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.943346024 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.944246054 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.944293022 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.944302082 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.945421934 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.945446968 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.945471048 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.945480108 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.945518970 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.946269989 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.947082996 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.947110891 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.947129965 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.947140932 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.947180033 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.947932959 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.948791981 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.948823929 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.948837042 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.948844910 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.948883057 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.949605942 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.950377941 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.950408936 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.950428963 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.950438023 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.950479031 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.951219082 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.952027082 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.952055931 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.952085018 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.952099085 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.952148914 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.952871084 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.954003096 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.954031944 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.954062939 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.954077959 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.954132080 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.954441071 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.955274105 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.955307961 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.955327988 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.955339909 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.955389977 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.956007004 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.956881046 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.956908941 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.956937075 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.956949949 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.956998110 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.957583904 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.958354950 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.958383083 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.958410025 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.958422899 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.958473921 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.959104061 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.959883928 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.959917068 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.959937096 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.959950924 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.960005999 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.960666895 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.961441994 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.961469889 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.961502075 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.961513996 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.961560965 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.962197065 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.962943077 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.962997913 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.963010073 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.963342905 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.963396072 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.963407993 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.964140892 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.964194059 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.964206934 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.964905977 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.964958906 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.964972019 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.965740919 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.965794086 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.965805054 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.966520071 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.966578007 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.966590881 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.967195988 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.967252016 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.967271090 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.967959881 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.968014956 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.968028069 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.968702078 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.968745947 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.968758106 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.969439983 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.969499111 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.969511032 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.970232010 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.970278025 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.970289946 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.970901012 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.970957994 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.970971107 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.971609116 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.971678972 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.971693993 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.972383976 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.972438097 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.972450018 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.973139048 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.973192930 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.973205090 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.973783016 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.973835945 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.973846912 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.974545956 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.974597931 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.974611998 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.975198984 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.975249052 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.975261927 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.975914955 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.975963116 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.975975037 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.976661921 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.976711988 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.976725101 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.977386951 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.977438927 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.977451086 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.978101969 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.978149891 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.978163004 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.978780985 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.978832960 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.978846073 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.979823112 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.979851961 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.979872942 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.979887009 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.979935884 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.980479002 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.981198072 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.981226921 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.981240988 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.981249094 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.981282949 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.981904984 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.982589960 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.982625961 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.982630968 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.982640028 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.982677937 CET	49776	443	192.168.2.17	173.194.219.103
Jan 30, 2024 18:51:44.983272076 CET	443	49776	173.194.219.103	192.168.2.17
Jan 30, 2024 18:51:44.983916998 CET	443	49776	173.194.219.103	192.168.2.17

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 30, 2024 18:51:33.994330883 CET	192.168.2.17	1.1.1.1	0x787a	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:33.994580030 CET	192.168.2.17	1.1.1.1	0xde11	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Jan 30, 2024 18:51:33.995210886 CET	192.168.2.17	1.1.1.1	0x2967	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:33.995528936 CET	192.168.2.17	1.1.1.1	0xa36b	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Jan 30, 2024 18:51:33.996587992 CET	192.168.2.17	1.1.1.1	0x8af7	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:33.996844053 CET	192.168.2.17	1.1.1.1	0x93b8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 30, 2024 18:51:36.025755882 CET	192.168.2.17	1.1.1.1	0x7997	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:36.025958061 CET	192.168.2.17	1.1.1.1	0x997a	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Jan 30, 2024 18:51:40.344660997 CET	192.168.2.17	1.1.1.1	0xeac8	Standard query (0)	id.google.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:40.345007896 CET	192.168.2.17	1.1.1.1	0xf6a6	Standard query (0)	id.google.com	65	IN (0x0001)	false
Jan 30, 2024 18:51:40.456746101 CET	192.168.2.17	1.1.1.1	0x8ada	Standard query (0)	dns-tunnel-check.googlezip.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:40.459213972 CET	192.168.2.17	1.1.1.1	0x406	Standard query (0)	tunnel.googlezip.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:41.004833937 CET	192.168.2.17	1.1.1.1	0x4d1	Standard query (0)	tunnel.googlezip.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:41.755816936 CET	192.168.2.17	1.1.1.1	0x72cd	Standard query (0)	i.ytimg.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:41.756127119 CET	192.168.2.17	1.1.1.1	0x279b	Standard query (0)	i.ytimg.com	65	IN (0x0001)	false
Jan 30, 2024 18:51:42.582861900 CET	192.168.2.17	1.1.1.1	0x8e74	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:42.583036900 CET	192.168.2.17	1.1.1.1	0x8027	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Jan 30, 2024 18:51:46.317028999 CET	192.168.2.17	1.1.1.1	0x2e19	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:46.317517996 CET	192.168.2.17	1.1.1.1	0x6226	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Jan 30, 2024 18:51:47.781255007 CET	192.168.2.17	1.1.1.1	0xd578	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:47.781940937 CET	192.168.2.17	1.1.1.1	0xf9a8	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Jan 30, 2024 18:51:48.791774988 CET	192.168.2.17	1.1.1.1	0x1108	Standard query (0)	i.ytimg.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:48.792205095 CET	192.168.2.17	1.1.1.1	0x2119	Standard query (0)	i.ytimg.com	65	IN (0x0001)	false
Jan 30, 2024 18:51:50.229830027 CET	192.168.2.17	1.1.1.1	0xfb97	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:50.230042934 CET	192.168.2.17	1.1.1.1	0x8624	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Jan 30, 2024 18:51:50.237291098 CET	192.168.2.17	1.1.1.1	0xc4ad	Standard query (0)	static.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:50.237507105 CET	192.168.2.17	1.1.1.1	0xace	Standard query (0)	static.doubleclick.net	65	IN (0x0001)	false
Jan 30, 2024 18:51:56.356414080 CET	192.168.2.17	1.1.1.1	0x6f34	Standard query (0)	c.s-microsoft.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:56.356584072 CET	192.168.2.17	1.1.1.1	0x8aae	Standard query (0)	c.s-microsoft.com	65	IN (0x0001)	false
Jan 30, 2024 18:51:56.468537092 CET	192.168.2.17	1.1.1.1	0x95ca	Standard query (0)	lptag.liveperson.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:56.468718052 CET	192.168.2.17	1.1.1.1	0x7568	Standard query (0)	lptag.liveperson.net	65	IN (0x0001)	false
Jan 30, 2024 18:51:56.588779926 CET	192.168.2.17	1.1.1.1	0x8bc9	Standard query (0)	lpcdn.lpsnmedia.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:56.589107990 CET	192.168.2.17	1.1.1.1	0xf36d	Standard query (0)	lpcdn.lpsnmedia.net	65	IN (0x0001)	false
Jan 30, 2024 18:51:56.589822054 CET	192.168.2.17	1.1.1.1	0x2c62	Standard query (0)	accdn.lpsnmedia.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:56.590095043 CET	192.168.2.17	1.1.1.1	0xe7a7	Standard query (0)	accdn.lpsnmedia.net	65	IN (0x0001)	false
Jan 30, 2024 18:51:56.709428072 CET	192.168.2.17	1.1.1.1	0xd62c	Standard query (0)	publisher.liveperson.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:56.709738016 CET	192.168.2.17	1.1.1.1	0xa315	Standard query (0)	publisher.liveperson.net	65	IN (0x0001)	false
Jan 30, 2024 18:51:56.832057953 CET	192.168.2.17	1.1.1.1	0x65a6	Standard query (0)	www.clarity.ms	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:56.832300901 CET	192.168.2.17	1.1.1.1	0x5447	Standard query (0)	www.clarity.ms	65	IN (0x0001)	false
Jan 30, 2024 18:51:56.953588963 CET	192.168.2.17	1.1.1.1	0xdb93	Standard query (0)	mem.gfx.ms	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:56.953783989 CET	192.168.2.17	1.1.1.1	0x65bf	Standard query (0)	mem.gfx.ms	65	IN (0x0001)	false
Jan 30, 2024 18:51:56.955507040 CET	192.168.2.17	1.1.1.1	0x3f27	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:56.955864906 CET	192.168.2.17	1.1.1.1	0x532a	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Jan 30, 2024 18:51:57.078938961 CET	192.168.2.17	1.1.1.1	0x6caa	Standard query (0)	d.impactradius-event.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:57.079207897 CET	192.168.2.17	1.1.1.1	0xc52	Standard query (0)	d.impactradius-event.com	65	IN (0x0001)	false
Jan 30, 2024 18:51:57.080949068 CET	192.168.2.17	1.1.1.1	0xa1d2	Standard query (0)	cdnssl.clicktale.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:57.081234932 CET	192.168.2.17	1.1.1.1	0x7674	Standard query (0)	cdnssl.clicktale.net	65	IN (0x0001)	false
Jan 30, 2024 18:51:57.203308105 CET	192.168.2.17	1.1.1.1	0xda47	Standard query (0)	analytics.tiktok.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:57.203526974 CET	192.168.2.17	1.1.1.1	0xd0c9	Standard query (0)	analytics.tiktok.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:01.931251049 CET	192.168.2.17	1.1.1.1	0x4087	Standard query (0)	acctcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:01.931425095 CET	192.168.2.17	1.1.1.1	0x9e8a	Standard query (0)	acctcdn.msftauth.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:02.048835039 CET	192.168.2.17	1.1.1.1	0x2b8c	Standard query (0)	dpm.demdex.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.049035072 CET	192.168.2.17	1.1.1.1	0xb2ac	Standard query (0)	dpm.demdex.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:02.079410076 CET	192.168.2.17	1.1.1.1	0xdd87	Standard query (0)	logincdn.msftauth.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.079605103 CET	192.168.2.17	1.1.1.1	0x2fcb	Standard query (0)	logincdn.msftauth.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:02.297703981 CET	192.168.2.17	1.1.1.1	0x73e7	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.298048973 CET	192.168.2.17	1.1.1.1	0xfa3c	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:02.421366930 CET	192.168.2.17	1.1.1.1	0x6277	Standard query (0)	px.ads.linkedin.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.421870947 CET	192.168.2.17	1.1.1.1	0xdf3	Standard query (0)	px.ads.linkedin.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:02.519959927 CET	192.168.2.17	1.1.1.1	0xe08d	Standard query (0)	mem.gfx.ms	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.520215988 CET	192.168.2.17	1.1.1.1	0xf211	Standard query (0)	mem.gfx.ms	65	IN (0x0001)	false
Jan 30, 2024 18:52:02.536514997 CET	192.168.2.17	1.1.1.1	0x4c3b	Standard query (0)	ats.everesttech.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.536788940 CET	192.168.2.17	1.1.1.1	0x4c00	Standard query (0)	ats.everesttech.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:02.618742943 CET	192.168.2.17	1.1.1.1	0x6c6c	Standard query (0)	microsoft.msafflnk.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.619043112 CET	192.168.2.17	1.1.1.1	0x41ec	Standard query (0)	microsoft.msafflnk.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:02.622070074 CET	192.168.2.17	1.1.1.1	0x34b5	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.622325897 CET	192.168.2.17	1.1.1.1	0x19a8	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:02.698187113 CET	192.168.2.17	1.1.1.1	0x83d3	Standard query (0)	mscom.demdex.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.698499918 CET	192.168.2.17	1.1.1.1	0xbedc	Standard query (0)	mscom.demdex.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:02.713620901 CET	192.168.2.17	1.1.1.1	0x51d2	Standard query (0)	msftenterprise.sc.omtrdc.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.713913918 CET	192.168.2.17	1.1.1.1	0x3aa1	Standard query (0)	msftenterprise.sc.omtrdc.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:02.748395920 CET	192.168.2.17	1.1.1.1	0x9ac1	Standard query (0)	q-aus1.clicktale.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.748658895 CET	192.168.2.17	1.1.1.1	0x2516	Standard query (0)	q-aus1.clicktale.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:02.878937006 CET	192.168.2.17	1.1.1.1	0xf3cb	Standard query (0)	cm.everesttech.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.879108906 CET	192.168.2.17	1.1.1.1	0xe12f	Standard query (0)	cm.everesttech.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:02.883845091 CET	192.168.2.17	1.1.1.1	0xfe41	Standard query (0)	c.clicktale.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.884239912 CET	192.168.2.17	1.1.1.1	0x2d6c	Standard query (0)	c.clicktale.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:03.185616016 CET	192.168.2.17	1.1.1.1	0x771c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.185914993 CET	192.168.2.17	1.1.1.1	0x297	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:03.187467098 CET	192.168.2.17	1.1.1.1	0x8a5f	Standard query (0)	srm.bf.contentsquare.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.187724113 CET	192.168.2.17	1.1.1.1	0x8187	Standard query (0)	srm.bf.contentsquare.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:03.326057911 CET	192.168.2.17	1.1.1.1	0x81cd	Standard query (0)	ib.adnxs.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.326226950 CET	192.168.2.17	1.1.1.1	0xe332	Standard query (0)	ib.adnxs.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:03.437973976 CET	192.168.2.17	1.1.1.1	0x185b	Standard query (0)	idsync.rlcdn.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.438270092 CET	192.168.2.17	1.1.1.1	0x6dcc	Standard query (0)	idsync.rlcdn.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:03.517772913 CET	192.168.2.17	1.1.1.1	0xaa47	Standard query (0)	www.ojrq.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.518075943 CET	192.168.2.17	1.1.1.1	0xb76a	Standard query (0)	www.ojrq.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:03.598716974 CET	192.168.2.17	1.1.1.1	0x150a	Standard query (0)	k-aus1.clicktale.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.598802090 CET	192.168.2.17	1.1.1.1	0x1219	Standard query (0)	k-aus1.clicktale.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:03.707483053 CET	192.168.2.17	1.1.1.1	0x8661	Standard query (0)	www.linkedin.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.707839012 CET	192.168.2.17	1.1.1.1	0x43a7	Standard query (0)	www.linkedin.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:03.771883965 CET	192.168.2.17	1.1.1.1	0xd3b2	Standard query (0)	cm.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.772317886 CET	192.168.2.17	1.1.1.1	0x8b97	Standard query (0)	cm.g.doubleclick.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:04.411812067 CET	192.168.2.17	1.1.1.1	0xe64a	Standard query (0)	dpm.demdex.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:04.412005901 CET	192.168.2.17	1.1.1.1	0x7e9	Standard query (0)	dpm.demdex.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:04.697926044 CET	192.168.2.17	1.1.1.1	0xdbcb	Standard query (0)	u.clarity.ms	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:04.698242903 CET	192.168.2.17	1.1.1.1	0x4e66	Standard query (0)	u.clarity.ms	65	IN (0x0001)	false
Jan 30, 2024 18:52:04.773869991 CET	192.168.2.17	1.1.1.1	0x5c94	Standard query (0)	rtd.tubemogul.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:04.774285078 CET	192.168.2.17	1.1.1.1	0x8b34	Standard query (0)	rtd.tubemogul.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:05.328638077 CET	192.168.2.17	1.1.1.1	0x26a5	Standard query (0)	rtd-tm.everesttech.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:05.328943968 CET	192.168.2.17	1.1.1.1	0x7edc	Standard query (0)	rtd-tm.everesttech.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:05.769908905 CET	192.168.2.17	1.1.1.1	0x79fa	Standard query (0)	idpix.media6degrees.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:05.770076036 CET	192.168.2.17	1.1.1.1	0xf184	Standard query (0)	idpix.media6degrees.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:06.768529892 CET	192.168.2.17	1.1.1.1	0x729	Standard query (0)	analytics.twitter.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:06.768605947 CET	192.168.2.17	1.1.1.1	0xe9cd	Standard query (0)	analytics.twitter.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:07.760464907 CET	192.168.2.17	1.1.1.1	0x3cfb	Standard query (0)	match.adsrvr.org	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:07.760776997 CET	192.168.2.17	1.1.1.1	0x2bb1	Standard query (0)	match.adsrvr.org	65	IN (0x0001)	false
Jan 30, 2024 18:52:08.766685963 CET	192.168.2.17	1.1.1.1	0x6663	Standard query (0)	cms.quantserve.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:08.767326117 CET	192.168.2.17	1.1.1.1	0x898e	Standard query (0)	cms.quantserve.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:10.771358967 CET	192.168.2.17	1.1.1.1	0xc97f	Standard query (0)	servedby.flashtalking.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:10.771534920 CET	192.168.2.17	1.1.1.1	0xc0e2	Standard query (0)	servedby.flashtalking.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:11.768260002 CET	192.168.2.17	1.1.1.1	0x6d8d	Standard query (0)	a.tribalfusion.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:11.768376112 CET	192.168.2.17	1.1.1.1	0x22e7	Standard query (0)	a.tribalfusion.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:12.471245050 CET	192.168.2.17	1.1.1.1	0xe757	Standard query (0)	s.tribalfusion.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:12.471447945 CET	192.168.2.17	1.1.1.1	0xcc98	Standard query (0)	s.tribalfusion.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:12.772828102 CET	192.168.2.17	1.1.1.1	0x2f69	Standard query (0)	cms.analytics.yahoo.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:12.772934914 CET	192.168.2.17	1.1.1.1	0x5892	Standard query (0)	cms.analytics.yahoo.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:13.357070923 CET	192.168.2.17	1.1.1.1	0x9e1a	Standard query (0)	ups.analytics.yahoo.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:13.357180119 CET	192.168.2.17	1.1.1.1	0x8518	Standard query (0)	ups.analytics.yahoo.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:13.772540092 CET	192.168.2.17	1.1.1.1	0xbc93	Standard query (0)	px.owneriq.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:13.772825003 CET	192.168.2.17	1.1.1.1	0xed4b	Standard query (0)	px.owneriq.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:14.761580944 CET	192.168.2.17	1.1.1.1	0x1e59	Standard query (0)	jadserve.postrelease.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:14.761734962 CET	192.168.2.17	1.1.1.1	0xcc97	Standard query (0)	jadserve.postrelease.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:15.765979052 CET	192.168.2.17	1.1.1.1	0x1cc0	Standard query (0)	ds.reson8.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:15.766172886 CET	192.168.2.17	1.1.1.1	0x321b	Standard query (0)	ds.reson8.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:16.770571947 CET	192.168.2.17	1.1.1.1	0xb26d	Standard query (0)	bttrack.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:16.771337986 CET	192.168.2.17	1.1.1.1	0x7990	Standard query (0)	bttrack.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:17.759646893 CET	192.168.2.17	1.1.1.1	0x831f	Standard query (0)	dmpsync.3lift.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:17.759829998 CET	192.168.2.17	1.1.1.1	0x1d73	Standard query (0)	dmpsync.3lift.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:18.765256882 CET	192.168.2.17	1.1.1.1	0xf45b	Standard query (0)	ag.innovid.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:18.765549898 CET	192.168.2.17	1.1.1.1	0xa226	Standard query (0)	ag.innovid.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:19.767647982 CET	192.168.2.17	1.1.1.1	0x291f	Standard query (0)	rtb.adentifi.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:19.767875910 CET	192.168.2.17	1.1.1.1	0x4836	Standard query (0)	rtb.adentifi.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:20.760368109 CET	192.168.2.17	1.1.1.1	0xd6d7	Standard query (0)	sync.crwdcntrl.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:20.760550022 CET	192.168.2.17	1.1.1.1	0xc86c	Standard query (0)	sync.crwdcntrl.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:21.772300005 CET	192.168.2.17	1.1.1.1	0xd1cb	Standard query (0)	sync-tm.everesttech.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:21.773447990 CET	192.168.2.17	1.1.1.1	0x9a76	Standard query (0)	sync-tm.everesttech.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:25.185739040 CET	192.168.2.17	1.1.1.1	0xfafa	Standard query (0)	pixel.rubiconproject.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:25.185925961 CET	192.168.2.17	1.1.1.1	0x1cef	Standard query (0)	pixel.rubiconproject.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:26.187593937 CET	192.168.2.17	1.1.1.1	0x468a	Standard query (0)	dsum-sec.casalemedia.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:26.187730074 CET	192.168.2.17	1.1.1.1	0x582f	Standard query (0)	dsum-sec.casalemedia.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:28.189691067 CET	192.168.2.17	1.1.1.1	0x1f6a	Standard query (0)	us-u.openx.net	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:28.189855099 CET	192.168.2.17	1.1.1.1	0x3c94	Standard query (0)	us-u.openx.net	65	IN (0x0001)	false
Jan 30, 2024 18:52:29.186682940 CET	192.168.2.17	1.1.1.1	0x8c60	Standard query (0)	image2.pubmatic.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:29.187017918 CET	192.168.2.17	1.1.1.1	0x6259	Standard query (0)	image2.pubmatic.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:30.197552919 CET	192.168.2.17	1.1.1.1	0xbe3a	Standard query (0)	sync.search.spotxchange.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:30.198175907 CET	192.168.2.17	1.1.1.1	0xa1a3	Standard query (0)	sync.search.spotxchange.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:30.318298101 CET	192.168.2.17	1.1.1.1	0x682e	Standard query (0)	sync.search.spotxchange.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:31.186836004 CET	192.168.2.17	1.1.1.1	0xf83e	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:31.187004089 CET	192.168.2.17	1.1.1.1	0xfc70	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:31.760729074 CET	192.168.2.17	1.1.1.1	0xc476	Standard query (0)	trc.taboola.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:31.760833025 CET	192.168.2.17	1.1.1.1	0x6c28	Standard query (0)	trc.taboola.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:32.767218113 CET	192.168.2.17	1.1.1.1	0x7867	Standard query (0)	sync.srv.stackadapt.com	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:32.767560005 CET	192.168.2.17	1.1.1.1	0x8833	Standard query (0)	sync.srv.stackadapt.com	65	IN (0x0001)	false
Jan 30, 2024 18:52:43.847326994 CET	192.168.2.17	1.1.1.1	0x4e95	Standard query (0)	sync.search.spotxchange.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 30, 2024 18:51:34.111934900 CET	1.1.1.1	192.168.2.17	0x787a	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:34.111934900 CET	1.1.1.1	192.168.2.17	0x787a	No error (0)	clients.l.google.com		173.194.219.101	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:34.111934900 CET	1.1.1.1	192.168.2.17	0x787a	No error (0)	clients.l.google.com		173.194.219.102	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:34.111934900 CET	1.1.1.1	192.168.2.17	0x787a	No error (0)	clients.l.google.com		173.194.219.113	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:34.111934900 CET	1.1.1.1	192.168.2.17	0x787a	No error (0)	clients.l.google.com		173.194.219.138	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:34.111934900 CET	1.1.1.1	192.168.2.17	0x787a	No error (0)	clients.l.google.com		173.194.219.139	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:34.111934900 CET	1.1.1.1	192.168.2.17	0x787a	No error (0)	clients.l.google.com		173.194.219.100	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:34.112073898 CET	1.1.1.1	192.168.2.17	0xde11	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:34.112483978 CET	1.1.1.1	192.168.2.17	0x2967	No error (0)	accounts.google.com		173.194.219.84	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:34.113991976 CET	1.1.1.1	192.168.2.17	0x8af7	No error (0)	www.google.com		173.194.219.103	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:34.113991976 CET	1.1.1.1	192.168.2.17	0x8af7	No error (0)	www.google.com		173.194.219.105	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:34.113991976 CET	1.1.1.1	192.168.2.17	0x8af7	No error (0)	www.google.com		173.194.219.99	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:34.113991976 CET	1.1.1.1	192.168.2.17	0x8af7	No error (0)	www.google.com		173.194.219.147	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:34.113991976 CET	1.1.1.1	192.168.2.17	0x8af7	No error (0)	www.google.com		173.194.219.104	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:34.113991976 CET	1.1.1.1	192.168.2.17	0x8af7	No error (0)	www.google.com		173.194.219.106	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:34.114046097 CET	1.1.1.1	192.168.2.17	0x93b8	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 30, 2024 18:51:36.143810987 CET	1.1.1.1	192.168.2.17	0x7997	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:36.143810987 CET	1.1.1.1	192.168.2.17	0x7997	No error (0)	plus.l.google.com		64.233.177.100	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:36.143810987 CET	1.1.1.1	192.168.2.17	0x7997	No error (0)	plus.l.google.com		64.233.177.102	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:36.143810987 CET	1.1.1.1	192.168.2.17	0x7997	No error (0)	plus.l.google.com		64.233.177.113	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:36.143810987 CET	1.1.1.1	192.168.2.17	0x7997	No error (0)	plus.l.google.com		64.233.177.138	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:36.143810987 CET	1.1.1.1	192.168.2.17	0x7997	No error (0)	plus.l.google.com		64.233.177.101	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:36.143810987 CET	1.1.1.1	192.168.2.17	0x7997	No error (0)	plus.l.google.com		64.233.177.139	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:36.143959045 CET	1.1.1.1	192.168.2.17	0x997a	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:40.462018013 CET	1.1.1.1	192.168.2.17	0xeac8	No error (0)	id.google.com		172.217.23.99	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:40.574400902 CET	1.1.1.1	192.168.2.17	0x8ada	No error (0)	dns-tunnel-check.googlezip.net		216.239.34.159	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:40.576858044 CET	1.1.1.1	192.168.2.17	0x406	No error (0)	tunnel.googlezip.net		216.239.34.157	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:41.122039080 CET	1.1.1.1	192.168.2.17	0x4d1	No error (0)	tunnel.googlezip.net		216.239.34.157	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:41.873472929 CET	1.1.1.1	192.168.2.17	0x72cd	No error (0)	i.ytimg.com		142.251.15.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:41.873472929 CET	1.1.1.1	192.168.2.17	0x72cd	No error (0)	i.ytimg.com		173.194.219.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:41.873472929 CET	1.1.1.1	192.168.2.17	0x72cd	No error (0)	i.ytimg.com		172.217.215.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:41.873472929 CET	1.1.1.1	192.168.2.17	0x72cd	No error (0)	i.ytimg.com		108.177.122.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:41.873472929 CET	1.1.1.1	192.168.2.17	0x72cd	No error (0)	i.ytimg.com		64.233.185.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:41.873472929 CET	1.1.1.1	192.168.2.17	0x72cd	No error (0)	i.ytimg.com		64.233.176.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:41.873472929 CET	1.1.1.1	192.168.2.17	0x72cd	No error (0)	i.ytimg.com		74.125.138.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:41.873472929 CET	1.1.1.1	192.168.2.17	0x72cd	No error (0)	i.ytimg.com		142.250.9.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:41.873472929 CET	1.1.1.1	192.168.2.17	0x72cd	No error (0)	i.ytimg.com		172.253.124.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:41.873472929 CET	1.1.1.1	192.168.2.17	0x72cd	No error (0)	i.ytimg.com		142.250.105.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:41.873472929 CET	1.1.1.1	192.168.2.17	0x72cd	No error (0)	i.ytimg.com		74.125.136.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:41.873472929 CET	1.1.1.1	192.168.2.17	0x72cd	No error (0)	i.ytimg.com		64.233.177.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:42.700300932 CET	1.1.1.1	192.168.2.17	0x8e74	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:42.700300932 CET	1.1.1.1	192.168.2.17	0x8e74	No error (0)	plus.l.google.com		64.233.176.102	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:42.700300932 CET	1.1.1.1	192.168.2.17	0x8e74	No error (0)	plus.l.google.com		64.233.176.101	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:42.700300932 CET	1.1.1.1	192.168.2.17	0x8e74	No error (0)	plus.l.google.com		64.233.176.138	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:42.700300932 CET	1.1.1.1	192.168.2.17	0x8e74	No error (0)	plus.l.google.com		64.233.176.100	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:42.700300932 CET	1.1.1.1	192.168.2.17	0x8e74	No error (0)	plus.l.google.com		64.233.176.139	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:42.700300932 CET	1.1.1.1	192.168.2.17	0x8e74	No error (0)	plus.l.google.com		64.233.176.113	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:42.700858116 CET	1.1.1.1	192.168.2.17	0x8027	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:46.434899092 CET	1.1.1.1	192.168.2.17	0x2e19	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:46.434899092 CET	1.1.1.1	192.168.2.17	0x2e19	No error (0)	youtube-ui.l.google.com		74.125.138.190	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:46.434899092 CET	1.1.1.1	192.168.2.17	0x2e19	No error (0)	youtube-ui.l.google.com		64.233.177.136	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:46.434899092 CET	1.1.1.1	192.168.2.17	0x2e19	No error (0)	youtube-ui.l.google.com		64.233.185.91	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:46.434899092 CET	1.1.1.1	192.168.2.17	0x2e19	No error (0)	youtube-ui.l.google.com		142.251.15.93	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:46.434899092 CET	1.1.1.1	192.168.2.17	0x2e19	No error (0)	youtube-ui.l.google.com		74.125.138.136	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:46.434899092 CET	1.1.1.1	192.168.2.17	0x2e19	No error (0)	youtube-ui.l.google.com		74.125.138.93	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:46.434899092 CET	1.1.1.1	192.168.2.17	0x2e19	No error (0)	youtube-ui.l.google.com		64.233.185.190	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:46.434899092 CET	1.1.1.1	192.168.2.17	0x2e19	No error (0)	youtube-ui.l.google.com		173.194.219.136	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:46.434899092 CET	1.1.1.1	192.168.2.17	0x2e19	No error (0)	youtube-ui.l.google.com		74.125.138.91	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:46.434899092 CET	1.1.1.1	192.168.2.17	0x2e19	No error (0)	youtube-ui.l.google.com		173.194.219.91	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:46.434899092 CET	1.1.1.1	192.168.2.17	0x2e19	No error (0)	youtube-ui.l.google.com		64.233.177.91	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:46.434899092 CET	1.1.1.1	192.168.2.17	0x2e19	No error (0)	youtube-ui.l.google.com		64.233.185.136	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:46.434899092 CET	1.1.1.1	192.168.2.17	0x2e19	No error (0)	youtube-ui.l.google.com		142.251.15.190	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:46.434899092 CET	1.1.1.1	192.168.2.17	0x2e19	No error (0)	youtube-ui.l.google.com		64.233.185.93	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:46.434899092 CET	1.1.1.1	192.168.2.17	0x2e19	No error (0)	youtube-ui.l.google.com		173.194.219.190	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:46.434899092 CET	1.1.1.1	192.168.2.17	0x2e19	No error (0)	youtube-ui.l.google.com		173.194.219.93	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:46.434926987 CET	1.1.1.1	192.168.2.17	0x6226	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:46.434926987 CET	1.1.1.1	192.168.2.17	0x6226	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Jan 30, 2024 18:51:47.898813963 CET	1.1.1.1	192.168.2.17	0xd578	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:47.898813963 CET	1.1.1.1	192.168.2.17	0xd578	No error (0)	youtube-ui.l.google.com		172.217.215.190	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:47.898813963 CET	1.1.1.1	192.168.2.17	0xd578	No error (0)	youtube-ui.l.google.com		108.177.122.136	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:47.898813963 CET	1.1.1.1	192.168.2.17	0xd578	No error (0)	youtube-ui.l.google.com		142.251.15.91	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:47.898813963 CET	1.1.1.1	192.168.2.17	0xd578	No error (0)	youtube-ui.l.google.com		142.251.15.93	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:47.898813963 CET	1.1.1.1	192.168.2.17	0xd578	No error (0)	youtube-ui.l.google.com		142.251.15.190	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:47.898813963 CET	1.1.1.1	192.168.2.17	0xd578	No error (0)	youtube-ui.l.google.com		108.177.122.190	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:47.898813963 CET	1.1.1.1	192.168.2.17	0xd578	No error (0)	youtube-ui.l.google.com		74.125.138.93	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:47.898813963 CET	1.1.1.1	192.168.2.17	0xd578	No error (0)	youtube-ui.l.google.com		142.250.9.190	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:47.898813963 CET	1.1.1.1	192.168.2.17	0xd578	No error (0)	youtube-ui.l.google.com		142.250.9.93	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:47.898813963 CET	1.1.1.1	192.168.2.17	0xd578	No error (0)	youtube-ui.l.google.com		142.251.15.136	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:47.898813963 CET	1.1.1.1	192.168.2.17	0xd578	No error (0)	youtube-ui.l.google.com		108.177.122.91	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:47.898813963 CET	1.1.1.1	192.168.2.17	0xd578	No error (0)	youtube-ui.l.google.com		142.250.9.91	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:47.898813963 CET	1.1.1.1	192.168.2.17	0xd578	No error (0)	youtube-ui.l.google.com		108.177.122.93	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:47.898813963 CET	1.1.1.1	192.168.2.17	0xd578	No error (0)	youtube-ui.l.google.com		172.217.215.136	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:47.898813963 CET	1.1.1.1	192.168.2.17	0xd578	No error (0)	youtube-ui.l.google.com		172.217.215.91	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:47.898813963 CET	1.1.1.1	192.168.2.17	0xd578	No error (0)	youtube-ui.l.google.com		172.217.215.93	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:47.899040937 CET	1.1.1.1	192.168.2.17	0xf9a8	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:47.899040937 CET	1.1.1.1	192.168.2.17	0xf9a8	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Jan 30, 2024 18:51:48.909197092 CET	1.1.1.1	192.168.2.17	0x1108	No error (0)	i.ytimg.com		172.217.215.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:48.909197092 CET	1.1.1.1	192.168.2.17	0x1108	No error (0)	i.ytimg.com		142.251.15.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:48.909197092 CET	1.1.1.1	192.168.2.17	0x1108	No error (0)	i.ytimg.com		142.250.9.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:48.909197092 CET	1.1.1.1	192.168.2.17	0x1108	No error (0)	i.ytimg.com		108.177.122.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:48.909197092 CET	1.1.1.1	192.168.2.17	0x1108	No error (0)	i.ytimg.com		64.233.177.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:48.909197092 CET	1.1.1.1	192.168.2.17	0x1108	No error (0)	i.ytimg.com		74.125.138.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:48.909197092 CET	1.1.1.1	192.168.2.17	0x1108	No error (0)	i.ytimg.com		142.250.105.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:48.909197092 CET	1.1.1.1	192.168.2.17	0x1108	No error (0)	i.ytimg.com		173.194.219.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:48.909197092 CET	1.1.1.1	192.168.2.17	0x1108	No error (0)	i.ytimg.com		64.233.185.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:48.909197092 CET	1.1.1.1	192.168.2.17	0x1108	No error (0)	i.ytimg.com		64.233.176.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:48.909197092 CET	1.1.1.1	192.168.2.17	0x1108	No error (0)	i.ytimg.com		172.253.124.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:48.909197092 CET	1.1.1.1	192.168.2.17	0x1108	No error (0)	i.ytimg.com		74.125.136.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:50.347377062 CET	1.1.1.1	192.168.2.17	0x8624	No error (0)	googleads.g.doubleclick.net			65	IN (0x0001)	false
Jan 30, 2024 18:51:50.347393036 CET	1.1.1.1	192.168.2.17	0xfb97	No error (0)	googleads.g.doubleclick.net		142.250.9.157	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:50.347393036 CET	1.1.1.1	192.168.2.17	0xfb97	No error (0)	googleads.g.doubleclick.net		142.250.9.154	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:50.347393036 CET	1.1.1.1	192.168.2.17	0xfb97	No error (0)	googleads.g.doubleclick.net		142.250.9.156	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:50.347393036 CET	1.1.1.1	192.168.2.17	0xfb97	No error (0)	googleads.g.doubleclick.net		142.250.9.155	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:50.354648113 CET	1.1.1.1	192.168.2.17	0xc4ad	No error (0)	static.doubleclick.net		74.125.138.148	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:50.354648113 CET	1.1.1.1	192.168.2.17	0xc4ad	No error (0)	static.doubleclick.net		74.125.138.149	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:56.473790884 CET	1.1.1.1	192.168.2.17	0x8aae	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:56.474960089 CET	1.1.1.1	192.168.2.17	0x6f34	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:56.585973024 CET	1.1.1.1	192.168.2.17	0x95ca	No error (0)	lptag.liveperson.net	lptag.liveperson.cotcdb.net.livepersonk.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:56.586337090 CET	1.1.1.1	192.168.2.17	0x7568	No error (0)	lptag.liveperson.net	lptag.liveperson.cotcdb.net.livepersonk.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:56.706568003 CET	1.1.1.1	192.168.2.17	0x8bc9	No error (0)	lpcdn.lpsnmedia.net		34.120.154.120	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:56.706937075 CET	1.1.1.1	192.168.2.17	0x2c62	No error (0)	accdn.lpsnmedia.net	geo.accdn.livepersonk.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:56.708635092 CET	1.1.1.1	192.168.2.17	0xe7a7	No error (0)	accdn.lpsnmedia.net	geo.accdn.livepersonk.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:56.826766014 CET	1.1.1.1	192.168.2.17	0xd62c	No error (0)	publisher.liveperson.net	publisher.livepersonk.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:56.826766014 CET	1.1.1.1	192.168.2.17	0xd62c	No error (0)	liveperson.map.fastly.net		151.101.193.192	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:56.826766014 CET	1.1.1.1	192.168.2.17	0xd62c	No error (0)	liveperson.map.fastly.net		151.101.65.192	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:56.826766014 CET	1.1.1.1	192.168.2.17	0xd62c	No error (0)	liveperson.map.fastly.net		151.101.129.192	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:56.826766014 CET	1.1.1.1	192.168.2.17	0xd62c	No error (0)	liveperson.map.fastly.net		151.101.1.192	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:56.827846050 CET	1.1.1.1	192.168.2.17	0xa315	No error (0)	publisher.liveperson.net	publisher.livepersonk.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:56.949259043 CET	1.1.1.1	192.168.2.17	0x65a6	No error (0)	www.clarity.ms	clarity.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:56.949259043 CET	1.1.1.1	192.168.2.17	0x65a6	No error (0)	clarity.azurefd.net	azurefd-t-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:56.949259043 CET	1.1.1.1	192.168.2.17	0x65a6	No error (0)	shed.dual-low.part-0007.t-0009.t-msedge.net	part-0007.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:56.949259043 CET	1.1.1.1	192.168.2.17	0x65a6	No error (0)	part-0007.t-0009.t-msedge.net		13.107.213.35	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:56.949259043 CET	1.1.1.1	192.168.2.17	0x65a6	No error (0)	part-0007.t-0009.t-msedge.net		13.107.246.35	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:56.949728012 CET	1.1.1.1	192.168.2.17	0x5447	No error (0)	www.clarity.ms	clarity.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:56.949728012 CET	1.1.1.1	192.168.2.17	0x5447	No error (0)	clarity.azurefd.net	azurefd-t-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:56.951616049 CET	1.1.1.1	192.168.2.17	0x4d2a	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:56.951616049 CET	1.1.1.1	192.168.2.17	0x4d2a	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:56.951616049 CET	1.1.1.1	192.168.2.17	0x4d2a	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:56.951616049 CET	1.1.1.1	192.168.2.17	0x4d2a	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:56.951909065 CET	1.1.1.1	192.168.2.17	0x8ac1	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:57.070908070 CET	1.1.1.1	192.168.2.17	0xdb93	No error (0)	mem.gfx.ms	amcdnmsftuswe.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:57.070908070 CET	1.1.1.1	192.168.2.17	0xdb93	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:57.070908070 CET	1.1.1.1	192.168.2.17	0xdb93	No error (0)	part-0012.t-0009.t-msedge.net		13.107.213.40	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:57.070908070 CET	1.1.1.1	192.168.2.17	0xdb93	No error (0)	part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:57.071335077 CET	1.1.1.1	192.168.2.17	0x65bf	No error (0)	mem.gfx.ms	amcdnmsftuswe.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:57.072658062 CET	1.1.1.1	192.168.2.17	0x3f27	No error (0)	js.monitor.azure.com	aijscdn2.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:57.072658062 CET	1.1.1.1	192.168.2.17	0x3f27	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:57.072658062 CET	1.1.1.1	192.168.2.17	0x3f27	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:57.072658062 CET	1.1.1.1	192.168.2.17	0x3f27	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:57.073951006 CET	1.1.1.1	192.168.2.17	0x532a	No error (0)	js.monitor.azure.com	aijscdn2.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:57.196517944 CET	1.1.1.1	192.168.2.17	0x6caa	No error (0)	d.impactradius-event.com		35.186.249.72	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:57.198580027 CET	1.1.1.1	192.168.2.17	0xa1d2	No error (0)	cdnssl.clicktale.net	d1xbuscas8tetl.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:57.198580027 CET	1.1.1.1	192.168.2.17	0xa1d2	No error (0)	d1xbuscas8tetl.cloudfront.net		13.249.39.8	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:57.198580027 CET	1.1.1.1	192.168.2.17	0xa1d2	No error (0)	d1xbuscas8tetl.cloudfront.net		13.249.39.73	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:57.198580027 CET	1.1.1.1	192.168.2.17	0xa1d2	No error (0)	d1xbuscas8tetl.cloudfront.net		13.249.39.106	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:57.198580027 CET	1.1.1.1	192.168.2.17	0xa1d2	No error (0)	d1xbuscas8tetl.cloudfront.net		13.249.39.81	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:51:57.198780060 CET	1.1.1.1	192.168.2.17	0x7674	No error (0)	cdnssl.clicktale.net	d1xbuscas8tetl.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:57.320523977 CET	1.1.1.1	192.168.2.17	0xda47	No error (0)	analytics.tiktok.com	analytics.tiktok.com.ttdns2.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:57.320523977 CET	1.1.1.1	192.168.2.17	0xda47	No error (0)	analytics.tiktok.com.ttdns2.com	analytics.tiktok.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:57.321335077 CET	1.1.1.1	192.168.2.17	0xd0c9	No error (0)	analytics.tiktok.com	analytics.tiktok.com.ttdns2.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:51:57.321335077 CET	1.1.1.1	192.168.2.17	0xd0c9	No error (0)	analytics.tiktok.com.ttdns2.com	analytics.tiktok.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.047442913 CET	1.1.1.1	192.168.2.17	0x6aa0	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.047442913 CET	1.1.1.1	192.168.2.17	0x6aa0	No error (0)	part-0012.t-0009.t-msedge.net		13.107.213.40	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.047442913 CET	1.1.1.1	192.168.2.17	0x6aa0	No error (0)	part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.048446894 CET	1.1.1.1	192.168.2.17	0x2f02	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.048446894 CET	1.1.1.1	192.168.2.17	0x2f02	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.048446894 CET	1.1.1.1	192.168.2.17	0x2f02	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.049201012 CET	1.1.1.1	192.168.2.17	0x4087	No error (0)	acctcdn.msftauth.net	acctcdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.049201012 CET	1.1.1.1	192.168.2.17	0x4087	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.049201012 CET	1.1.1.1	192.168.2.17	0x4087	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.049201012 CET	1.1.1.1	192.168.2.17	0x4087	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.049335957 CET	1.1.1.1	192.168.2.17	0x9e8a	No error (0)	acctcdn.msftauth.net	acctcdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.166352034 CET	1.1.1.1	192.168.2.17	0xb2ac	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.166352034 CET	1.1.1.1	192.168.2.17	0xb2ac	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.166352034 CET	1.1.1.1	192.168.2.17	0xb2ac	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.166366100 CET	1.1.1.1	192.168.2.17	0x2b8c	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.166366100 CET	1.1.1.1	192.168.2.17	0x2b8c	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.166366100 CET	1.1.1.1	192.168.2.17	0x2b8c	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.166366100 CET	1.1.1.1	192.168.2.17	0x2b8c	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.215.173.68	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.166366100 CET	1.1.1.1	192.168.2.17	0x2b8c	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		23.20.31.134	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.166366100 CET	1.1.1.1	192.168.2.17	0x2b8c	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		44.214.208.34	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.166366100 CET	1.1.1.1	192.168.2.17	0x2b8c	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		44.219.54.255	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.166366100 CET	1.1.1.1	192.168.2.17	0x2b8c	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		107.23.240.137	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.166366100 CET	1.1.1.1	192.168.2.17	0x2b8c	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		52.204.246.173	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.166366100 CET	1.1.1.1	192.168.2.17	0x2b8c	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.199.228.201	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.166366100 CET	1.1.1.1	192.168.2.17	0x2b8c	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.80.39.198	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.173207045 CET	1.1.1.1	192.168.2.17	0x8e31	No error (0)	cs1227.wpc.alphacdn.net		192.229.211.199	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.197159052 CET	1.1.1.1	192.168.2.17	0xdd87	No error (0)	logincdn.msftauth.net	lgincdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.197159052 CET	1.1.1.1	192.168.2.17	0xdd87	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.197159052 CET	1.1.1.1	192.168.2.17	0xdd87	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.197159052 CET	1.1.1.1	192.168.2.17	0xdd87	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.197565079 CET	1.1.1.1	192.168.2.17	0x2fcb	No error (0)	logincdn.msftauth.net	lgincdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.213926077 CET	1.1.1.1	192.168.2.17	0x5e09	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.213926077 CET	1.1.1.1	192.168.2.17	0x5e09	No error (0)	part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.213926077 CET	1.1.1.1	192.168.2.17	0x5e09	No error (0)	part-0012.t-0009.t-msedge.net		13.107.213.40	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.293185949 CET	1.1.1.1	192.168.2.17	0xf50d	No error (0)	scdn1efff.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.293185949 CET	1.1.1.1	192.168.2.17	0xf50d	No error (0)	sni1gl.wpc.alphacdn.net		152.195.19.97	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.293621063 CET	1.1.1.1	192.168.2.17	0x6002	No error (0)	scdn1efff.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.316878080 CET	1.1.1.1	192.168.2.17	0xa8c0	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.316878080 CET	1.1.1.1	192.168.2.17	0xa8c0	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.316878080 CET	1.1.1.1	192.168.2.17	0xa8c0	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.414998055 CET	1.1.1.1	192.168.2.17	0x73e7	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.414998055 CET	1.1.1.1	192.168.2.17	0x73e7	No error (0)	star-mini.c10r.facebook.com		31.13.65.36	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.415350914 CET	1.1.1.1	192.168.2.17	0xfa3c	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.538562059 CET	1.1.1.1	192.168.2.17	0x6277	No error (0)	px.ads.linkedin.com	exp1.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.538562059 CET	1.1.1.1	192.168.2.17	0x6277	No error (0)	exp1.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.539371014 CET	1.1.1.1	192.168.2.17	0xdf3	No error (0)	px.ads.linkedin.com	exp1.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.539371014 CET	1.1.1.1	192.168.2.17	0xdf3	No error (0)	exp1.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.637392998 CET	1.1.1.1	192.168.2.17	0xf211	No error (0)	mem.gfx.ms	amcdnmsftuswe.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.637783051 CET	1.1.1.1	192.168.2.17	0xe08d	No error (0)	mem.gfx.ms	amcdnmsftuswe.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.637783051 CET	1.1.1.1	192.168.2.17	0xe08d	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.637783051 CET	1.1.1.1	192.168.2.17	0xe08d	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.637783051 CET	1.1.1.1	192.168.2.17	0xe08d	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.654321909 CET	1.1.1.1	192.168.2.17	0x4c3b	No error (0)	ats.everesttech.net	ats.everesttech.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.654321909 CET	1.1.1.1	192.168.2.17	0x4c3b	No error (0)	dco-ats-00-1519508033.us-east-1.elb.amazonaws.com		3.224.195.202	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.654321909 CET	1.1.1.1	192.168.2.17	0x4c3b	No error (0)	dco-ats-00-1519508033.us-east-1.elb.amazonaws.com		18.208.33.183	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.654947996 CET	1.1.1.1	192.168.2.17	0x4c00	No error (0)	ats.everesttech.net	ats.everesttech.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.739500046 CET	1.1.1.1	192.168.2.17	0x34b5	No error (0)	googleads.g.doubleclick.net		74.125.136.157	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.739500046 CET	1.1.1.1	192.168.2.17	0x34b5	No error (0)	googleads.g.doubleclick.net		74.125.136.156	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.739500046 CET	1.1.1.1	192.168.2.17	0x34b5	No error (0)	googleads.g.doubleclick.net		74.125.136.154	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.739500046 CET	1.1.1.1	192.168.2.17	0x34b5	No error (0)	googleads.g.doubleclick.net		74.125.136.155	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.739790916 CET	1.1.1.1	192.168.2.17	0x19a8	No error (0)	googleads.g.doubleclick.net			65	IN (0x0001)	false
Jan 30, 2024 18:52:02.750207901 CET	1.1.1.1	192.168.2.17	0x6c6c	No error (0)	microsoft.msafflnk.net		35.174.142.23	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.750207901 CET	1.1.1.1	192.168.2.17	0x6c6c	No error (0)	microsoft.msafflnk.net		44.199.1.16	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.750207901 CET	1.1.1.1	192.168.2.17	0x6c6c	No error (0)	microsoft.msafflnk.net		3.209.101.205	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.750207901 CET	1.1.1.1	192.168.2.17	0x6c6c	No error (0)	microsoft.msafflnk.net		50.19.67.0	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.816299915 CET	1.1.1.1	192.168.2.17	0x83d3	No error (0)	mscom.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.816299915 CET	1.1.1.1	192.168.2.17	0x83d3	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.816299915 CET	1.1.1.1	192.168.2.17	0x83d3	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.816299915 CET	1.1.1.1	192.168.2.17	0x83d3	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.211.243.61	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.816299915 CET	1.1.1.1	192.168.2.17	0x83d3	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		52.207.30.198	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.816299915 CET	1.1.1.1	192.168.2.17	0x83d3	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		107.23.221.150	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.816299915 CET	1.1.1.1	192.168.2.17	0x83d3	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.201.247.102	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.816299915 CET	1.1.1.1	192.168.2.17	0x83d3	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.225.20.118	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.816299915 CET	1.1.1.1	192.168.2.17	0x83d3	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.145.188.191	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.816299915 CET	1.1.1.1	192.168.2.17	0x83d3	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		44.219.54.255	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.816299915 CET	1.1.1.1	192.168.2.17	0x83d3	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.226.33.62	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.816431999 CET	1.1.1.1	192.168.2.17	0xbedc	No error (0)	mscom.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.816431999 CET	1.1.1.1	192.168.2.17	0xbedc	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.816431999 CET	1.1.1.1	192.168.2.17	0xbedc	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.831655025 CET	1.1.1.1	192.168.2.17	0x51d2	No error (0)	msftenterprise.sc.omtrdc.net		63.140.39.15	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.831655025 CET	1.1.1.1	192.168.2.17	0x51d2	No error (0)	msftenterprise.sc.omtrdc.net		63.140.39.35	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.831655025 CET	1.1.1.1	192.168.2.17	0x51d2	No error (0)	msftenterprise.sc.omtrdc.net		63.140.38.55	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.831655025 CET	1.1.1.1	192.168.2.17	0x51d2	No error (0)	msftenterprise.sc.omtrdc.net		63.140.39.240	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.831655025 CET	1.1.1.1	192.168.2.17	0x51d2	No error (0)	msftenterprise.sc.omtrdc.net		63.140.39.72	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.831655025 CET	1.1.1.1	192.168.2.17	0x51d2	No error (0)	msftenterprise.sc.omtrdc.net		63.140.38.138	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.831655025 CET	1.1.1.1	192.168.2.17	0x51d2	No error (0)	msftenterprise.sc.omtrdc.net		63.140.39.22	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.831655025 CET	1.1.1.1	192.168.2.17	0x51d2	No error (0)	msftenterprise.sc.omtrdc.net		63.140.38.111	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.831655025 CET	1.1.1.1	192.168.2.17	0x51d2	No error (0)	msftenterprise.sc.omtrdc.net		63.140.38.210	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.831655025 CET	1.1.1.1	192.168.2.17	0x51d2	No error (0)	msftenterprise.sc.omtrdc.net		63.140.39.117	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.866045952 CET	1.1.1.1	192.168.2.17	0x2516	No error (0)	q-aus1.clicktale.net	q-aus1.contentsquare.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.879034996 CET	1.1.1.1	192.168.2.17	0x9ac1	No error (0)	q-aus1.clicktale.net	q-aus1.contentsquare.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.879034996 CET	1.1.1.1	192.168.2.17	0x9ac1	No error (0)	q-aus1.contentsquare.net		3.94.15.197	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.879034996 CET	1.1.1.1	192.168.2.17	0x9ac1	No error (0)	q-aus1.contentsquare.net		52.45.184.156	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.879034996 CET	1.1.1.1	192.168.2.17	0x9ac1	No error (0)	q-aus1.contentsquare.net		35.175.42.150	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:02.996304035 CET	1.1.1.1	192.168.2.17	0xf3cb	No error (0)	cm.everesttech.net	cm.everesttech.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:02.996361971 CET	1.1.1.1	192.168.2.17	0xe12f	No error (0)	cm.everesttech.net	cm.everesttech.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:03.001580000 CET	1.1.1.1	192.168.2.17	0xfe41	No error (0)	c.clicktale.net	c.bf.contentsquare.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:03.001580000 CET	1.1.1.1	192.168.2.17	0xfe41	No error (0)	c.bf.contentsquare.net		34.206.180.7	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.001580000 CET	1.1.1.1	192.168.2.17	0xfe41	No error (0)	c.bf.contentsquare.net		23.20.255.82	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.001580000 CET	1.1.1.1	192.168.2.17	0xfe41	No error (0)	c.bf.contentsquare.net		34.202.63.246	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.001580000 CET	1.1.1.1	192.168.2.17	0xfe41	No error (0)	c.bf.contentsquare.net		3.223.254.133	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.002562046 CET	1.1.1.1	192.168.2.17	0x2d6c	No error (0)	c.clicktale.net	c.bf.contentsquare.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:03.303194046 CET	1.1.1.1	192.168.2.17	0x771c	No error (0)	www.google.com		173.194.219.105	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.303194046 CET	1.1.1.1	192.168.2.17	0x771c	No error (0)	www.google.com		173.194.219.106	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.303194046 CET	1.1.1.1	192.168.2.17	0x771c	No error (0)	www.google.com		173.194.219.104	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.303194046 CET	1.1.1.1	192.168.2.17	0x771c	No error (0)	www.google.com		173.194.219.147	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.303194046 CET	1.1.1.1	192.168.2.17	0x771c	No error (0)	www.google.com		173.194.219.103	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.303194046 CET	1.1.1.1	192.168.2.17	0x771c	No error (0)	www.google.com		173.194.219.99	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.303473949 CET	1.1.1.1	192.168.2.17	0x297	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 30, 2024 18:52:03.305562019 CET	1.1.1.1	192.168.2.17	0x8a5f	No error (0)	srm.bf.contentsquare.net		3.208.151.21	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.305562019 CET	1.1.1.1	192.168.2.17	0x8a5f	No error (0)	srm.bf.contentsquare.net		52.202.193.197	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.305562019 CET	1.1.1.1	192.168.2.17	0x8a5f	No error (0)	srm.bf.contentsquare.net		44.209.148.182	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.443356037 CET	1.1.1.1	192.168.2.17	0x81cd	No error (0)	ib.adnxs.com	g.geo.appnexusgslb.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:03.443356037 CET	1.1.1.1	192.168.2.17	0x81cd	No error (0)	g.geo.appnexusgslb.net	ib.anycast.adnxs.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:03.443356037 CET	1.1.1.1	192.168.2.17	0x81cd	No error (0)	ib.anycast.adnxs.com		68.67.160.137	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.443356037 CET	1.1.1.1	192.168.2.17	0x81cd	No error (0)	ib.anycast.adnxs.com		68.67.178.10	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.443356037 CET	1.1.1.1	192.168.2.17	0x81cd	No error (0)	ib.anycast.adnxs.com		68.67.160.75	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.443356037 CET	1.1.1.1	192.168.2.17	0x81cd	No error (0)	ib.anycast.adnxs.com		68.67.160.186	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.443356037 CET	1.1.1.1	192.168.2.17	0x81cd	No error (0)	ib.anycast.adnxs.com		68.67.181.211	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.443356037 CET	1.1.1.1	192.168.2.17	0x81cd	No error (0)	ib.anycast.adnxs.com		68.67.160.184	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.443356037 CET	1.1.1.1	192.168.2.17	0x81cd	No error (0)	ib.anycast.adnxs.com		68.67.160.24	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.443356037 CET	1.1.1.1	192.168.2.17	0x81cd	No error (0)	ib.anycast.adnxs.com		68.67.161.182	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.443356037 CET	1.1.1.1	192.168.2.17	0x81cd	No error (0)	ib.anycast.adnxs.com		68.67.160.132	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.443356037 CET	1.1.1.1	192.168.2.17	0x81cd	No error (0)	ib.anycast.adnxs.com		68.67.179.153	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.443356037 CET	1.1.1.1	192.168.2.17	0x81cd	No error (0)	ib.anycast.adnxs.com		68.67.160.26	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.443356037 CET	1.1.1.1	192.168.2.17	0x81cd	No error (0)	ib.anycast.adnxs.com		68.67.179.87	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.504337072 CET	1.1.1.1	192.168.2.17	0x8c0b	No error (0)	microsoftmscompoc.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:03.504483938 CET	1.1.1.1	192.168.2.17	0xe23c	No error (0)	microsoftmscompoc.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:03.504483938 CET	1.1.1.1	192.168.2.17	0xe23c	No error (0)	adobetarget.data.adobedc.net		63.140.39.248	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.504483938 CET	1.1.1.1	192.168.2.17	0xe23c	No error (0)	adobetarget.data.adobedc.net		63.140.39.224	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.504483938 CET	1.1.1.1	192.168.2.17	0xe23c	No error (0)	adobetarget.data.adobedc.net		63.140.38.111	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.504483938 CET	1.1.1.1	192.168.2.17	0xe23c	No error (0)	adobetarget.data.adobedc.net		63.140.39.130	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.504483938 CET	1.1.1.1	192.168.2.17	0xe23c	No error (0)	adobetarget.data.adobedc.net		63.140.39.22	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.504483938 CET	1.1.1.1	192.168.2.17	0xe23c	No error (0)	adobetarget.data.adobedc.net		63.140.38.210	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.504483938 CET	1.1.1.1	192.168.2.17	0xe23c	No error (0)	adobetarget.data.adobedc.net		63.140.38.91	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.504483938 CET	1.1.1.1	192.168.2.17	0xe23c	No error (0)	adobetarget.data.adobedc.net		63.140.39.72	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.504483938 CET	1.1.1.1	192.168.2.17	0xe23c	No error (0)	adobetarget.data.adobedc.net		63.140.39.35	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.504483938 CET	1.1.1.1	192.168.2.17	0xe23c	No error (0)	adobetarget.data.adobedc.net		63.140.39.240	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.555283070 CET	1.1.1.1	192.168.2.17	0x185b	No error (0)	idsync.rlcdn.com		35.244.154.8	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.635603905 CET	1.1.1.1	192.168.2.17	0xaa47	No error (0)	www.ojrq.net		34.95.127.121	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.716366053 CET	1.1.1.1	192.168.2.17	0x150a	No error (0)	k-aus1.clicktale.net	k.bf.contentsquare.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:03.716366053 CET	1.1.1.1	192.168.2.17	0x150a	No error (0)	k.bf.contentsquare.net		54.162.65.117	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.716366053 CET	1.1.1.1	192.168.2.17	0x150a	No error (0)	k.bf.contentsquare.net		35.153.26.42	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.717189074 CET	1.1.1.1	192.168.2.17	0x1219	No error (0)	k-aus1.clicktale.net	k.bf.contentsquare.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:03.835011959 CET	1.1.1.1	192.168.2.17	0x43a7	No error (0)	www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:03.835118055 CET	1.1.1.1	192.168.2.17	0x8661	No error (0)	www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:03.889370918 CET	1.1.1.1	192.168.2.17	0xd3b2	No error (0)	cm.g.doubleclick.net		173.194.219.157	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.889370918 CET	1.1.1.1	192.168.2.17	0xd3b2	No error (0)	cm.g.doubleclick.net		173.194.219.156	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.889370918 CET	1.1.1.1	192.168.2.17	0xd3b2	No error (0)	cm.g.doubleclick.net		173.194.219.155	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:03.889370918 CET	1.1.1.1	192.168.2.17	0xd3b2	No error (0)	cm.g.doubleclick.net		173.194.219.154	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:04.528980017 CET	1.1.1.1	192.168.2.17	0x7e9	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:04.528980017 CET	1.1.1.1	192.168.2.17	0x7e9	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:04.528980017 CET	1.1.1.1	192.168.2.17	0x7e9	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:04.529114008 CET	1.1.1.1	192.168.2.17	0xe64a	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:04.529114008 CET	1.1.1.1	192.168.2.17	0xe64a	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:04.529114008 CET	1.1.1.1	192.168.2.17	0xe64a	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:04.529114008 CET	1.1.1.1	192.168.2.17	0xe64a	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		52.201.196.73	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:04.529114008 CET	1.1.1.1	192.168.2.17	0xe64a	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.199.228.201	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:04.529114008 CET	1.1.1.1	192.168.2.17	0xe64a	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.92.107.114	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:04.529114008 CET	1.1.1.1	192.168.2.17	0xe64a	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.225.20.118	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:04.529114008 CET	1.1.1.1	192.168.2.17	0xe64a	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		35.173.67.179	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:04.529114008 CET	1.1.1.1	192.168.2.17	0xe64a	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		35.174.239.187	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:04.529114008 CET	1.1.1.1	192.168.2.17	0xe64a	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		44.217.139.131	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:04.529114008 CET	1.1.1.1	192.168.2.17	0xe64a	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		107.23.240.137	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:04.815309048 CET	1.1.1.1	192.168.2.17	0xdbcb	No error (0)	u.clarity.ms	clarity-ingest-eus-d-sc.eastus.cloudapp.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:04.816318035 CET	1.1.1.1	192.168.2.17	0x4e66	No error (0)	u.clarity.ms	clarity-ingest-eus-d-sc.eastus.cloudapp.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:04.891060114 CET	1.1.1.1	192.168.2.17	0x5c94	No error (0)	rtd.tubemogul.com	h2.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:04.892424107 CET	1.1.1.1	192.168.2.17	0x8b34	No error (0)	rtd.tubemogul.com	h2.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:05.446557045 CET	1.1.1.1	192.168.2.17	0x26a5	No error (0)	rtd-tm.everesttech.net	rtd.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:05.446557045 CET	1.1.1.1	192.168.2.17	0x26a5	No error (0)	rtd.tubemogul.com	h2.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:05.446995020 CET	1.1.1.1	192.168.2.17	0x7edc	No error (0)	rtd-tm.everesttech.net	rtd.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:05.446995020 CET	1.1.1.1	192.168.2.17	0x7edc	No error (0)	rtd.tubemogul.com	h2.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:05.887495041 CET	1.1.1.1	192.168.2.17	0x79fa	No error (0)	idpix.media6degrees.com	idpix.media6degrees.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:05.887495041 CET	1.1.1.1	192.168.2.17	0x79fa	No error (0)	map.media6degrees.com	map.media6degrees.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:05.887963057 CET	1.1.1.1	192.168.2.17	0xf184	No error (0)	idpix.media6degrees.com	idpix.media6degrees.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:05.887963057 CET	1.1.1.1	192.168.2.17	0xf184	No error (0)	map.media6degrees.com	map.media6degrees.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:06.886265039 CET	1.1.1.1	192.168.2.17	0x729	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:06.886265039 CET	1.1.1.1	192.168.2.17	0x729	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:06.886265039 CET	1.1.1.1	192.168.2.17	0x729	No error (0)	s.twitter.com		104.244.42.131	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:06.886326075 CET	1.1.1.1	192.168.2.17	0xe9cd	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:06.886326075 CET	1.1.1.1	192.168.2.17	0xe9cd	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:07.878216028 CET	1.1.1.1	192.168.2.17	0x3cfb	No error (0)	match.adsrvr.org		52.223.40.198	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:07.878216028 CET	1.1.1.1	192.168.2.17	0x3cfb	No error (0)	match.adsrvr.org		3.33.220.150	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:07.878216028 CET	1.1.1.1	192.168.2.17	0x3cfb	No error (0)	match.adsrvr.org		15.197.193.217	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:07.878216028 CET	1.1.1.1	192.168.2.17	0x3cfb	No error (0)	match.adsrvr.org		35.71.131.137	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:08.884145021 CET	1.1.1.1	192.168.2.17	0x6663	No error (0)	cms.quantserve.com	2kpixel.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:08.884145021 CET	1.1.1.1	192.168.2.17	0x6663	No error (0)	2kpixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:08.884145021 CET	1.1.1.1	192.168.2.17	0x6663	No error (0)	global.px.quantserve.com		192.184.69.201	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:08.884145021 CET	1.1.1.1	192.168.2.17	0x6663	No error (0)	global.px.quantserve.com		192.184.69.239	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:08.884145021 CET	1.1.1.1	192.168.2.17	0x6663	No error (0)	global.px.quantserve.com		192.184.69.252	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:08.884145021 CET	1.1.1.1	192.168.2.17	0x6663	No error (0)	global.px.quantserve.com		192.184.69.167	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:08.884145021 CET	1.1.1.1	192.168.2.17	0x6663	No error (0)	global.px.quantserve.com		192.184.69.215	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:08.884875059 CET	1.1.1.1	192.168.2.17	0x898e	No error (0)	cms.quantserve.com	2kpixel.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:08.884875059 CET	1.1.1.1	192.168.2.17	0x898e	No error (0)	2kpixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:10.889002085 CET	1.1.1.1	192.168.2.17	0xc97f	No error (0)	servedby.flashtalking.com	servedby.flashtalking.com-v1.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:10.889076948 CET	1.1.1.1	192.168.2.17	0xc0e2	No error (0)	servedby.flashtalking.com	servedby.flashtalking.com-v1.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:11.885839939 CET	1.1.1.1	192.168.2.17	0x6d8d	No error (0)	a.tribalfusion.com		104.18.25.173	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:11.885839939 CET	1.1.1.1	192.168.2.17	0x6d8d	No error (0)	a.tribalfusion.com		104.18.24.173	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:11.886657953 CET	1.1.1.1	192.168.2.17	0x22e7	No error (0)	a.tribalfusion.com			65	IN (0x0001)	false
Jan 30, 2024 18:52:12.588624001 CET	1.1.1.1	192.168.2.17	0xe757	No error (0)	s.tribalfusion.com		104.18.25.173	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:12.588624001 CET	1.1.1.1	192.168.2.17	0xe757	No error (0)	s.tribalfusion.com		104.18.24.173	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:12.589417934 CET	1.1.1.1	192.168.2.17	0xcc98	No error (0)	s.tribalfusion.com			65	IN (0x0001)	false
Jan 30, 2024 18:52:12.890786886 CET	1.1.1.1	192.168.2.17	0x5892	No error (0)	cms.analytics.yahoo.com	prod.ups-ats.aolp-ds-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:12.890786886 CET	1.1.1.1	192.168.2.17	0x5892	No error (0)	prod.ups-ats.aolp-ds-prd.aws.oath.cloud	prod.ups-ats.us-east-1.aolp-ds-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:12.890786886 CET	1.1.1.1	192.168.2.17	0x5892	No error (0)	prod.ups-ats.us-east-1.aolp-ds-prd.aws.oath.cloud	ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:12.890904903 CET	1.1.1.1	192.168.2.17	0x2f69	No error (0)	cms.analytics.yahoo.com	prod.ups-ats.aolp-ds-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:12.890904903 CET	1.1.1.1	192.168.2.17	0x2f69	No error (0)	prod.ups-ats.aolp-ds-prd.aws.oath.cloud	prod.ups-ats.us-east-1.aolp-ds-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:12.890904903 CET	1.1.1.1	192.168.2.17	0x2f69	No error (0)	prod.ups-ats.us-east-1.aolp-ds-prd.aws.oath.cloud	ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:12.890904903 CET	1.1.1.1	192.168.2.17	0x2f69	No error (0)	ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud		34.200.65.202	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:12.890904903 CET	1.1.1.1	192.168.2.17	0x2f69	No error (0)	ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud		3.225.218.10	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:13.474669933 CET	1.1.1.1	192.168.2.17	0x9e1a	No error (0)	ups.analytics.yahoo.com	prod.ups-ats.aolp-ds-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:13.474669933 CET	1.1.1.1	192.168.2.17	0x9e1a	No error (0)	prod.ups-ats.aolp-ds-prd.aws.oath.cloud	prod.ups-ats.us-east-1.aolp-ds-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:13.474669933 CET	1.1.1.1	192.168.2.17	0x9e1a	No error (0)	prod.ups-ats.us-east-1.aolp-ds-prd.aws.oath.cloud	ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:13.474669933 CET	1.1.1.1	192.168.2.17	0x9e1a	No error (0)	ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud		34.200.65.202	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:13.474669933 CET	1.1.1.1	192.168.2.17	0x9e1a	No error (0)	ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud		3.225.218.10	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:13.474769115 CET	1.1.1.1	192.168.2.17	0x8518	No error (0)	ups.analytics.yahoo.com	prod.ups-ats.aolp-ds-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:13.474769115 CET	1.1.1.1	192.168.2.17	0x8518	No error (0)	prod.ups-ats.aolp-ds-prd.aws.oath.cloud	prod.ups-ats.us-east-1.aolp-ds-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:13.474769115 CET	1.1.1.1	192.168.2.17	0x8518	No error (0)	prod.ups-ats.us-east-1.aolp-ds-prd.aws.oath.cloud	ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:13.890640020 CET	1.1.1.1	192.168.2.17	0xed4b	No error (0)	px.owneriq.net	wildcard.owneriq.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:13.890688896 CET	1.1.1.1	192.168.2.17	0xbc93	No error (0)	px.owneriq.net	wildcard.owneriq.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:14.879266024 CET	1.1.1.1	192.168.2.17	0x1e59	No error (0)	jadserve.postrelease.com	jadserve.postrelease.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:14.879678965 CET	1.1.1.1	192.168.2.17	0xcc97	No error (0)	jadserve.postrelease.com	jadserve.postrelease.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:15.883630991 CET	1.1.1.1	192.168.2.17	0x1cc0	No error (0)	ds.reson8.com	ds.reson8.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:15.883888006 CET	1.1.1.1	192.168.2.17	0x321b	No error (0)	ds.reson8.com	ds.reson8.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:16.888887882 CET	1.1.1.1	192.168.2.17	0xb26d	No error (0)	bttrack.com		192.132.33.68	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:16.888887882 CET	1.1.1.1	192.168.2.17	0xb26d	No error (0)	bttrack.com		192.132.33.69	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:16.888887882 CET	1.1.1.1	192.168.2.17	0xb26d	No error (0)	bttrack.com		192.132.33.67	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:17.878053904 CET	1.1.1.1	192.168.2.17	0x1d73	No error (0)	dmpsync.3lift.com	eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:17.878053904 CET	1.1.1.1	192.168.2.17	0x1d73	No error (0)	eb2.3lift.com	na-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:17.878053904 CET	1.1.1.1	192.168.2.17	0x1d73	No error (0)	na-eb2.3lift.com	us-east-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:17.878407955 CET	1.1.1.1	192.168.2.17	0x831f	No error (0)	dmpsync.3lift.com	eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:17.878407955 CET	1.1.1.1	192.168.2.17	0x831f	No error (0)	eb2.3lift.com	na-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:17.878407955 CET	1.1.1.1	192.168.2.17	0x831f	No error (0)	na-eb2.3lift.com	us-east-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:17.878407955 CET	1.1.1.1	192.168.2.17	0x831f	No error (0)	us-east-eb2.3lift.com		52.223.22.214	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:17.878407955 CET	1.1.1.1	192.168.2.17	0x831f	No error (0)	us-east-eb2.3lift.com		35.71.139.29	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:18.882843971 CET	1.1.1.1	192.168.2.17	0xa226	No error (0)	ag.innovid.com	ag-6-split.ag.innovid.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:18.882843971 CET	1.1.1.1	192.168.2.17	0xa226	No error (0)	aragorn-virg-prod.inbake.com	aragorn-prod-va-lb.inbake.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:18.882889032 CET	1.1.1.1	192.168.2.17	0xf45b	No error (0)	ag.innovid.com	ag-6-split.ag.innovid.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:18.882889032 CET	1.1.1.1	192.168.2.17	0xf45b	No error (0)	aragorn-virg-prod.inbake.com	aragorn-prod-va-lb.inbake.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:18.882889032 CET	1.1.1.1	192.168.2.17	0xf45b	No error (0)	aragorn-prod-va-lb.inbake.com		34.224.206.102	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:18.882889032 CET	1.1.1.1	192.168.2.17	0xf45b	No error (0)	aragorn-prod-va-lb.inbake.com		3.212.203.229	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:18.882889032 CET	1.1.1.1	192.168.2.17	0xf45b	No error (0)	aragorn-prod-va-lb.inbake.com		18.213.41.210	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:18.882889032 CET	1.1.1.1	192.168.2.17	0xf45b	No error (0)	aragorn-prod-va-lb.inbake.com		54.211.78.232	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:18.882889032 CET	1.1.1.1	192.168.2.17	0xf45b	No error (0)	aragorn-prod-va-lb.inbake.com		35.175.19.39	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:18.882889032 CET	1.1.1.1	192.168.2.17	0xf45b	No error (0)	aragorn-prod-va-lb.inbake.com		34.227.244.31	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:18.882889032 CET	1.1.1.1	192.168.2.17	0xf45b	No error (0)	aragorn-prod-va-lb.inbake.com		3.216.235.230	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:18.882889032 CET	1.1.1.1	192.168.2.17	0xf45b	No error (0)	aragorn-prod-va-lb.inbake.com		3.215.235.84	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:19.885003090 CET	1.1.1.1	192.168.2.17	0x291f	No error (0)	rtb.adentifi.com		18.214.166.242	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:19.885003090 CET	1.1.1.1	192.168.2.17	0x291f	No error (0)	rtb.adentifi.com		3.210.33.43	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:19.885003090 CET	1.1.1.1	192.168.2.17	0x291f	No error (0)	rtb.adentifi.com		54.91.171.58	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:19.885003090 CET	1.1.1.1	192.168.2.17	0x291f	No error (0)	rtb.adentifi.com		34.200.159.21	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:19.885003090 CET	1.1.1.1	192.168.2.17	0x291f	No error (0)	rtb.adentifi.com		18.235.96.255	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:19.885003090 CET	1.1.1.1	192.168.2.17	0x291f	No error (0)	rtb.adentifi.com		52.200.178.187	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:20.877857924 CET	1.1.1.1	192.168.2.17	0xd6d7	No error (0)	sync.crwdcntrl.net		50.19.176.119	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:20.877857924 CET	1.1.1.1	192.168.2.17	0xd6d7	No error (0)	sync.crwdcntrl.net		52.21.39.178	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:20.877857924 CET	1.1.1.1	192.168.2.17	0xd6d7	No error (0)	sync.crwdcntrl.net		18.208.240.47	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:20.877857924 CET	1.1.1.1	192.168.2.17	0xd6d7	No error (0)	sync.crwdcntrl.net		52.4.74.148	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:20.877857924 CET	1.1.1.1	192.168.2.17	0xd6d7	No error (0)	sync.crwdcntrl.net		34.234.61.205	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:20.877857924 CET	1.1.1.1	192.168.2.17	0xd6d7	No error (0)	sync.crwdcntrl.net		52.71.57.44	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:20.877857924 CET	1.1.1.1	192.168.2.17	0xd6d7	No error (0)	sync.crwdcntrl.net		44.216.238.183	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:20.877857924 CET	1.1.1.1	192.168.2.17	0xd6d7	No error (0)	sync.crwdcntrl.net		18.232.189.98	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:21.890642881 CET	1.1.1.1	192.168.2.17	0xd1cb	No error (0)	sync-tm.everesttech.net	sync.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:21.890642881 CET	1.1.1.1	192.168.2.17	0xd1cb	No error (0)	sync.tubemogul.com	syncf.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:21.890642881 CET	1.1.1.1	192.168.2.17	0xd1cb	No error (0)	syncf.tubemogul.com	h2.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:21.892132044 CET	1.1.1.1	192.168.2.17	0x9a76	No error (0)	sync-tm.everesttech.net	sync.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:21.892132044 CET	1.1.1.1	192.168.2.17	0x9a76	No error (0)	sync.tubemogul.com	syncf.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:21.892132044 CET	1.1.1.1	192.168.2.17	0x9a76	No error (0)	syncf.tubemogul.com	h2.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:25.302938938 CET	1.1.1.1	192.168.2.17	0xfafa	No error (0)	pixel.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:25.303215981 CET	1.1.1.1	192.168.2.17	0x1cef	No error (0)	pixel.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:26.305156946 CET	1.1.1.1	192.168.2.17	0x468a	No error (0)	dsum-sec.casalemedia.com		104.18.36.155	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:26.305156946 CET	1.1.1.1	192.168.2.17	0x468a	No error (0)	dsum-sec.casalemedia.com		172.64.151.101	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:26.305207014 CET	1.1.1.1	192.168.2.17	0x582f	No error (0)	dsum-sec.casalemedia.com			65	IN (0x0001)	false
Jan 30, 2024 18:52:28.307385921 CET	1.1.1.1	192.168.2.17	0x1f6a	No error (0)	us-u.openx.net		35.244.159.8	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:28.307385921 CET	1.1.1.1	192.168.2.17	0x1f6a	No error (0)	us-u.openx.net		34.98.64.218	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:29.308604956 CET	1.1.1.1	192.168.2.17	0x8c60	No error (0)	image2.pubmatic.com	image2v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:29.308604956 CET	1.1.1.1	192.168.2.17	0x8c60	No error (0)	image2v2.pubmnet.com	pug-njrpb.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:29.308604956 CET	1.1.1.1	192.168.2.17	0x8c60	No error (0)	pug-njrpb.pubmnet.com		162.248.18.37	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:29.308621883 CET	1.1.1.1	192.168.2.17	0x6259	No error (0)	image2.pubmatic.com	image2v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:29.308621883 CET	1.1.1.1	192.168.2.17	0x6259	No error (0)	image2v2.pubmnet.com	pug-vac.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:31.304174900 CET	1.1.1.1	192.168.2.17	0xf83e	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:31.304174900 CET	1.1.1.1	192.168.2.17	0xf83e	No error (0)	star-mini.c10r.facebook.com		31.13.66.35	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:31.304337978 CET	1.1.1.1	192.168.2.17	0xfc70	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:31.878051043 CET	1.1.1.1	192.168.2.17	0xc476	No error (0)	trc.taboola.com	dualstack.tls13.taboola.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:31.878051043 CET	1.1.1.1	192.168.2.17	0xc476	No error (0)	dualstack.tls13.taboola.map.fastly.net		151.101.193.44	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:31.878051043 CET	1.1.1.1	192.168.2.17	0xc476	No error (0)	dualstack.tls13.taboola.map.fastly.net		151.101.129.44	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:31.878051043 CET	1.1.1.1	192.168.2.17	0xc476	No error (0)	dualstack.tls13.taboola.map.fastly.net		151.101.1.44	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:31.878051043 CET	1.1.1.1	192.168.2.17	0xc476	No error (0)	dualstack.tls13.taboola.map.fastly.net		151.101.65.44	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:31.878079891 CET	1.1.1.1	192.168.2.17	0x6c28	No error (0)	trc.taboola.com	dualstack.tls13.taboola.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 30, 2024 18:52:32.884583950 CET	1.1.1.1	192.168.2.17	0x7867	No error (0)	sync.srv.stackadapt.com		52.87.115.253	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:32.884583950 CET	1.1.1.1	192.168.2.17	0x7867	No error (0)	sync.srv.stackadapt.com		54.145.193.121	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:32.884583950 CET	1.1.1.1	192.168.2.17	0x7867	No error (0)	sync.srv.stackadapt.com		54.156.224.85	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:32.884583950 CET	1.1.1.1	192.168.2.17	0x7867	No error (0)	sync.srv.stackadapt.com		54.157.92.163	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:32.884583950 CET	1.1.1.1	192.168.2.17	0x7867	No error (0)	sync.srv.stackadapt.com		54.205.122.29	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:32.884583950 CET	1.1.1.1	192.168.2.17	0x7867	No error (0)	sync.srv.stackadapt.com		54.174.9.153	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:32.884583950 CET	1.1.1.1	192.168.2.17	0x7867	No error (0)	sync.srv.stackadapt.com		54.210.237.164	A (IP address)	IN (0x0001)	false
Jan 30, 2024 18:52:32.884583950 CET	1.1.1.1	192.168.2.17	0x7867	No error (0)	sync.srv.stackadapt.com		54.173.232.72	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49717	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:27 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NvNedGrehGN2W1y&MD=3Z8G6gZk HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-01-30 17:51:28 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 36775c40-17f1-4926-ae77-7b602e70b73d MS-RequestId: 745d2ac7-b43d-4637-870a-a795fc5d0cfc MS-CV: qvXmCt4cr0y7e+ov.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 30 Jan 2024 17:51:27 GMT Connection: close Content-Length: 24490
2024-01-30 17:51:28 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-01-30 17:51:28 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.17	49718	173.222.162.58	443

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:28 UTC	2197	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A41090080B6 X-BM-CBT: 1696586925 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: AC9A64CD89F84E63943FA8FE73357759 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A41090080B6 X-MSEdge-ExternalExp: asynccls1cf,bfbwsbcm0921tf,d-thshld42,fliptrat6,msaslm5t,qfswpos_t1,wsbref-t,wsbuacf X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 951 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=4590362BB5CF472B95BBEDB3112D4B7B; _SS=SID=1DC02F3E55E9691B00B73C9C54F0686B&CPID=1696586926722&AC=1&CPH=4790f32e; _EDGE_S=SID=1DC02F3E55E9691B00B73C9C54F0686B; SRCHUID=V=2&GUID=1F8137B2323E40B3851AF1909FBE6E0A&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1696586886&IPMH=f2fb8120&IPMID=1696586925774&LUT=1696586525257; CortanaAppUID=99325A50A46066F842A6B684698F464A; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
2024-01-30 17:51:28 UTC	951	OUT	Data Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 34 35 39 30 33 36 32 42 42 35 43 46 34 37 32 42 39 35 42 42 45 44 42 33 31 31 32 44 34 42 37 42 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 33 41 36 34 37 39 34 36 41 30 33 38 34 36 31 30 41 38 35 45 38 39 38 38 32 41 35 30 34 43 45 35 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 Data Ascii: <ClientInstRequest><CID>4590362BB5CF472B95BBEDB3112D4B7B</CID><Events><E><T>Event.ClientInst</T><IG>3A647946A0384610A85E89882A504CE5</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"C
2024-01-30 17:51:28 UTC	479	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 38951FE0D0F5475DA72871158C9D0799 Ref B: LAX311000112035 Ref C: 2024-01-30T17:51:28Z Date: Tue, 30 Jan 2024 17:51:28 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.3aa6dc17.1706637088.b86bc0a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.17	49721	173.194.219.84	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:34 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
2024-01-30 17:51:34 UTC	1	OUT	Data Raw: 20 Data Ascii:
2024-01-30 17:51:34 UTC	1799	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 30 Jan 2024 17:51:34 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-WzHS3QtxGrexjCFwFc2kVg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version reporting-endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjMtDikmLw15BiOHxtB5Meyy0mIyCe2_2UaSEQH4x7znQUiHf4eLA4pc9gDQFiIR6OZe-erGUT6Nj1-gMjALrYGDA" Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:34 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2024-01-30 17:51:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.17	49724	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:34 UTC	824	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
2024-01-30 17:51:34 UTC	1703	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:51:34 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-L_hGrK_7CmhFJd55GepMRQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:34 UTC	1703	IN	Data Raw: 66 33 62 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6a 6f 72 67 65 20 70 6f 6c 61 6e 63 6f 20 6d 69 6e 6e 65 73 6f 74 61 20 74 77 69 6e 73 22 2c 22 70 68 69 6c 69 70 73 20 63 70 61 70 20 6d 61 63 68 69 6e 65 73 22 2c 22 6d 65 74 61 7a 6f 6f 20 67 61 6d 65 73 20 73 68 75 74 73 20 64 6f 77 6e 22 2c 22 73 65 61 73 6f 6e 20 39 20 6f 76 65 72 77 61 74 63 68 20 70 61 74 63 68 20 6e 6f 74 65 73 22 2c 22 74 65 6b 6b 65 6e 20 38 20 74 69 65 72 20 6c 69 73 74 22 2c 22 6a 65 66 66 20 67 6f 6f 64 6d 61 6e 20 63 6f 6c 6c 65 67 65 20 62 61 73 6b 65 74 62 61 6c 6c 22 2c 22 72 6f 79 61 6c 20 63 61 72 69 62 62 65 61 6e 20 6c 61 72 67 65 73 74 20 63 72 75 69 73 65 20 73 68 69 70 22 2c 22 69 70 68 6f 6e 65 20 6e 65 77 20 65 6d 6f 6a 69 73 20 32 30 32 34 22 5d 2c 5b 22 22 2c 22 Data Ascii: f3b)]}'["",["jorge polanco minnesota twins","philips cpap machines","metazoo games shuts down","season 9 overwatch patch notes","tekken 8 tier list","jeff goodman college basketball","royal caribbean largest cruise ship","iphone new emojis 2024"],["","
2024-01-30 17:51:34 UTC	1703	IN	Data Raw: 30 4f 44 51 34 65 6b 59 33 52 31 49 33 63 33 70 44 4b 32 35 54 52 57 39 43 4f 45 5a 47 56 55 46 75 62 6d 35 6b 61 6c 42 50 5a 6b 4a 49 59 58 55 30 57 6b 4d 34 59 33 51 30 65 57 55 35 54 45 6c 53 62 58 4e 61 59 58 56 35 56 6d 49 78 52 6c 52 6b 53 55 4a 50 63 47 52 68 61 6b 5a 7a 63 6b 64 33 63 32 35 58 56 32 46 6a 63 56 46 49 57 57 4e 78 61 57 6f 72 65 47 74 75 4d 45 68 31 53 33 52 70 54 7a 52 6c 53 6d 64 31 55 33 6b 72 61 48 4a 72 4d 43 39 55 59 6c 42 55 56 57 56 51 56 48 4a 68 54 30 4e 4c 56 31 59 31 63 45 46 70 5a 32 4a 75 59 6e 56 6d 64 6a 4a 79 62 32 52 6b 64 6c 42 32 55 30 56 4a 64 31 64 4a 56 31 64 54 62 54 6c 5a 4e 46 4a 55 53 6b 77 72 62 6e 59 32 52 32 78 4c 59 6d 67 34 63 56 5a 45 4e 58 70 36 56 47 70 53 62 33 46 6d 4c 7a 6c 72 50 54 6f 64 61 6d Data Ascii: 0ODQ4ekY3R1I3c3pDK25TRW9COEZGVUFubm5kalBPZkJIYXU0WkM4Y3Q0eWU5TElSbXNaYXV5VmIxRlRkSUJPcGRhakZzckd3c25XV2FjcVFIWWNxaWoreGtuMEh1S3RpTzRlSmd1U3kraHJrMC9UYlBUVWVQVHJhT0NLV1Y1cEFpZ2JuYnVmdjJyb2RkdlB2U0VJd1dJV1dTbTlZNFJUSkwrbnY2R2xLYmg4cVZENXp6VGpSb3FmLzlrPTodam
2024-01-30 17:51:34 UTC	500	IN	Data Raw: 48 42 5a 55 33 42 33 62 6c 70 4c 56 57 70 4b 54 6b 39 46 52 32 4d 78 53 56 63 33 52 56 55 32 4d 54 67 76 52 6c 4e 71 4e 58 52 73 51 7a 6c 53 59 56 56 77 54 31 46 45 57 45 35 6b 5a 58 4e 36 64 48 51 77 61 31 4e 47 56 6e 46 56 54 54 46 30 54 6b 4e 76 59 6c 5a 56 55 57 74 6e 56 6d 74 56 53 57 39 6f 64 6c 68 45 55 6d 68 53 55 32 68 4c 62 48 4a 56 52 58 42 54 54 58 46 56 56 47 64 42 5a 55 70 77 53 33 5a 46 64 55 4a 6b 53 6d 4a 46 63 55 78 4c 61 46 42 53 57 48 5a 77 55 53 74 59 55 55 56 42 61 46 64 6e 61 32 73 35 54 57 70 5a 4f 47 6f 77 63 45 59 72 53 79 39 48 56 58 55 31 57 45 64 55 57 57 39 54 61 57 6b 7a 65 47 35 54 4d 6a 5a 46 53 47 56 54 4e 45 52 6e 5a 79 39 5a 53 7a 4a 34 4d 58 68 72 4f 55 31 4f 5a 6b 52 47 63 6d 67 79 61 56 42 44 57 57 78 79 55 30 63 30 Data Ascii: HBZU3B3blpLVWpKTk9FR2MxSVc3RVU2MTgvRlNqNXRsQzlSYVVwT1FEWE5kZXN6dHQwa1NGVnFVTTF0TkNvYlZVUWtnVmtVSW9odlhEUmhSU2hLbHJVRXBTTXFVVGdBZUpwS3ZFdUJkSmJFcUxLaFBSWHZwUStYUUVBaFdna2s5TWpZOGowcEYrSy9HVXU1WEdUWW9TaWkzeG5TMjZFSGVTNERnZy9ZSzJ4MXhrOU1OZkRGcmgyaVBDWWxyU0c0
2024-01-30 17:51:34 UTC	886	IN	Data Raw: 33 36 66 0d 0a 49 63 6c 52 7a 56 6b 4a 54 51 58 42 44 5a 33 42 4c 61 47 74 47 53 6e 6c 44 55 45 56 57 4f 48 46 43 63 32 52 53 65 58 41 34 4b 30 5a 51 52 6b 31 70 4d 31 68 31 55 46 70 77 52 48 6c 71 59 6e 42 68 64 58 70 52 4d 6e 4d 33 54 58 56 49 64 57 78 51 5a 30 4e 6b 63 32 4e 7a 62 6b 35 47 52 31 4d 35 61 46 4a 76 4e 57 6c 6e 52 6b 4d 72 4b 32 31 4f 53 47 52 72 54 44 64 79 55 30 5a 4d 56 6a 56 42 57 6e 4a 4a 53 48 6f 31 59 54 64 6a 59 6d 34 34 55 56 5a 7a 61 32 46 74 4d 6e 42 71 65 6a 64 34 4e 6b 4a 4c 52 6d 73 31 4c 30 39 51 65 55 74 75 4f 47 51 7a 64 44 56 73 4b 31 4a 42 59 55 39 75 4e 57 68 32 52 48 42 49 55 6b 70 56 52 48 41 35 5a 45 39 51 53 57 74 6b 59 54 4d 76 52 47 56 54 4d 6a 49 78 5a 58 42 55 65 57 64 49 4d 30 4d 79 52 6e 45 34 52 54 52 56 62 Data Ascii: 36fIclRzVkJTQXBDZ3BLaGtGSnlDUEVWOHFCc2RSeXA4K0ZQRk1pM1h1UFpwRHlqYnBhdXpRMnM3TXVIdWxQZ0Nkc2Nzbk5GR1M5aFJvNWlnRkMrK21OSGRrTDdyU0ZMVjVBWnJJSHo1YTdjYm44UVZza2FtMnBqejd4NkJLRms1L09QeUtuOGQzdDVsK1JBYU9uNWh2RHBIUkpVRHA5ZE9QSWtkYTMvRGVTMjIxZXBUeWdIM0MyRnE4RTRVb
2024-01-30 17:51:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.17	49723	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:34 UTC	542	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.17	49725	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:34 UTC	727	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
2024-01-30 17:51:34 UTC	1479	IN	HTTP/1.1 200 OK Version: 602283465 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Date: Tue, 30 Jan 2024 17:51:34 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:34 UTC	1479	IN	Data Raw: 32 30 64 30 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4f 61 20 67 62 5f 66 62 20 67 62 5f 54 64 20 67 62 5f 6d 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 20d0)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Oa gb_fb gb_Td gb_md\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-01-30 17:51:34 UTC	1479	IN	Data Raw: 30 33 64 5c 22 67 62 5f 46 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 38 64 20 67 62 5f 48 63 20 67 62 5f 36 64 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 47 6f 6f 67 6c 65 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 2f 3f 74 61 62 5c 75 30 30 33 64 72 72 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4c 63 20 67 62 5f 35 64 5c 22 20 61 72 69 61 2d 68 69 64 64 65 6e 5c 75 30 30 33 64 5c 22 74 72 75 65 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03d\"gb_Fc\"\u003e\u003ca class\u003d\"gb_8d gb_Hc gb_6d\" aria-label\u003d\"Google\" href\u003d\"/?tab\u003drr\"\u003e\u003cspan class\u003d\"gb_Lc gb_5d\" aria-hidden\u003d\"true\" role\u003d\"presentation\"\u003e\u003c\/span\u003e\u003c\/a\u003e\u003c\
2024-01-30 17:51:34 UTC	1479	IN	Data Raw: 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 53 65 61 72 63 68 20 4c 61 62 73 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 68 74 74 70 73 3a 2f 2f 6c 61 62 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 73 6f 75 72 63 65 5c 75 30 30 33 64 6e 74 70 5c 22 20 74 61 72 67 65 74 5c 75 30 30 33 64 5c 22 5f 74 6f 70 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 67 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 Data Ascii: aria-label\u003d\"Search Labs\" href\u003d\"https://labs.google.com/search?source\u003dntp\" target\u003d\"_top\" role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_g\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0
2024-01-30 17:51:34 UTC	1479	IN	Data Raw: 33 63 5c 2f 61 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 20 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 6b 20 67 62 5f 76 20 67 62 5f 49 5c 22 20 64 61 74 61 2d 6f 67 73 72 2d 66 62 5c 75 30 30 33 64 5c 22 74 72 75 65 5c 22 20 64 61 74 61 2d 6f 67 73 72 2d 61 6c 74 5c 75 30 30 33 64 5c 22 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 77 61 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 66 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 64 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 47 6f 6f 67 6c 65 20 61 70 70 73 5c 22 Data Ascii: 3c\/a\u003e \u003c\/div\u003e \u003c\/div\u003e \u003cdiv class\u003d\"gb_k gb_v gb_I\" data-ogsr-fb\u003d\"true\" data-ogsr-alt\u003d\"\" id\u003d\"gbwa\"\u003e\u003cdiv class\u003d\"gb_f\"\u003e\u003ca class\u003d\"gb_d\" aria-label\u003d\"Google apps\"
2024-01-30 17:51:34 UTC	1479	IN	Data Raw: 72 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 55 63 20 67 62 5f 53 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 34 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 46 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 38 64 20 67 62 5f 48 63 20 67 62 5f 36 64 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 47 6f 6f 67 6c 65 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 2f 3f 74 61 62 5c 75 30 30 33 64 72 72 5c 22 5c 75 30 Data Ascii: r\u003e\u003cdiv class\u003d\"gb_Uc gb_Sc\"\u003e\u003cdiv class\u003d\"gb_4c\"\u003e\u003cdiv class\u003d\"gb_Ec\"\u003e\u003cdiv class\u003d\"gb_Fc\"\u003e\u003ca class\u003d\"gb_8d gb_Hc gb_6d\" aria-label\u003d\"Google\" href\u003d\"/?tab\u003drr\"\u0
2024-01-30 17:51:34 UTC	1013	IN	Data Raw: 61 74 61 73 65 74 2e 65 71 69 64 5c 75 30 30 33 64 65 3b 61 2e 43 5b 65 5d 5c 75 30 30 33 64 64 3b 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 63 2c 64 2c 21 31 29 3a 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 74 74 61 63 68 45 76 65 6e 74 3f 62 2e 61 74 74 61 63 68 45 76 65 6e 74 28 5c 22 6f 6e 5c 22 2b 63 2c 64 29 3a 61 2e 6f 2e 6c 6f 67 28 45 72 72 6f 72 28 5c 22 72 60 5c 22 2b 62 29 29 7d 7d 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 5f 2e 41 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 5f 2e 71 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e Data Ascii: ataset.eqid\u003de;a.C[e]\u003dd;b\u0026\u0026b.addEventListener?b.addEventListener(c,d,!1):b\u0026\u0026b.attachEvent?b.attachEvent(\"on\"+c,d):a.o.log(Error(\"r`\"+b))}};\n}catch(e){_._DumpException(e)}\ntry{\n_.Ad\u003dfunction(){if(!_.q.addEventListen
2024-01-30 17:51:34 UTC	318	IN	Data Raw: 31 33 37 0d 0a 3b 74 72 79 7b 62 5c 75 30 30 33 64 63 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 61 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 45 64 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 45 64 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 45 64 7d 29 7d 63 61 74 63 68 28 64 29 7b 5f 2e 71 2e 63 6f 6e 73 6f 6c 65 5c 75 30 30 32 36 5c 75 30 30 32 36 5f 2e 71 2e 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 64 2e 6d 65 73 73 61 67 65 29 7d 72 65 74 75 72 6e 20 62 7d 3b 5f 2e 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 30 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 7d 3b 5f 2e 48 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 41 72 72 Data Ascii: 137;try{b\u003dc.createPolicy(a,{createHTML:Ed,createScript:Ed,createScriptURL:Ed})}catch(d){_.q.console\u0026\u0026_.q.console.error(d.message)}return b};_.Gd\u003dfunction(a,b){return 0\u003d\u003da.lastIndexOf(b,0)};_.Hd\u003dfunction(a,b){return Arr
2024-01-30 17:51:34 UTC	1252	IN	Data Raw: 38 30 30 30 0d 0a 6e 76 61 73 28 30 2c 30 29 29 2e 67 65 74 43 6f 6e 74 65 78 74 28 5c 22 32 64 5c 22 29 7d 63 61 74 63 68 28 61 29 7b 7d 3b 76 61 72 20 49 64 3b 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 76 6f 69 64 20 30 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 49 64 5c 75 30 30 32 36 5c 75 30 30 32 36 28 49 64 5c 75 30 30 33 64 5f 2e 46 64 28 5c 22 6f 67 62 2d 71 74 6d 23 68 74 6d 6c 5c 22 29 29 3b 72 65 74 75 72 6e 20 49 64 7d 3b 76 61 72 20 4d 64 2c 4f 64 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2e 74 6f 53 74 72 69 6e 67 28 29 7d 7d 3b 5f 2e 4c 64 5c Data Ascii: 8000nvas(0,0)).getContext(\"2d\")}catch(a){};var Id;_.Jd\u003dfunction(){void 0\u003d\u003d\u003dId\u0026\u0026(Id\u003d_.Fd(\"ogb-qtm#html\"));return Id};var Md,Od;_.Kd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i.toString()}};_.Ld\
2024-01-30 17:51:34 UTC	1252	IN	Data Raw: 65 48 74 6d 6c 5c 22 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 4a 64 28 29 3b 61 5c 75 30 30 33 64 62 3f 62 2e 63 72 65 61 74 65 48 54 4d 4c 28 61 29 3a 61 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 59 64 28 61 2c 58 64 29 7d 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2e 74 6f 53 74 72 69 6e 67 28 29 7d 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5f 2e 71 2e 74 72 75 73 74 65 64 54 79 70 65 73 5c 75 30 30 32 36 5c 75 30 30 32 36 5f 2e 71 2e 74 72 75 73 74 65 64 54 79 70 65 73 2e 65 6d 70 74 79 48 54 Data Ascii: eHtml\"};_.$d\u003dfunction(a){const b\u003d_.Jd();a\u003db?b.createHTML(a):a;return new _.Yd(a,Xd)};_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i.toString()}};_.ae\u003dnew _.Yd(_.q.trustedTypes\u0026\u0026_.q.trustedTypes.emptyHT
2024-01-30 17:51:34 UTC	1252	IN	Data Raw: 2e 6d 2e 66 6c 6f 6f 72 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 77 69 64 74 68 5c 75 30 30 33 64 4d 61 74 68 2e 66 6c 6f 6f 72 28 74 68 69 73 2e 77 69 64 74 68 29 3b 74 68 69 73 2e 68 65 69 67 68 74 5c 75 30 30 33 64 4d 61 74 68 2e 66 6c 6f 6f 72 28 74 68 69 73 2e 68 65 69 67 68 74 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 5f 2e 6d 2e 72 6f 75 6e 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 77 69 64 74 68 5c 75 30 30 33 64 4d 61 74 68 2e 72 6f 75 6e 64 28 74 68 69 73 2e 77 69 64 74 68 29 3b 74 68 69 73 2e 68 65 69 67 68 74 5c 75 30 30 33 64 4d 61 74 68 2e 72 6f 75 6e 64 28 74 68 69 73 2e 68 65 69 67 68 74 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 5f 2e 52 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 Data Ascii: .m.floor\u003dfunction(){this.width\u003dMath.floor(this.width);this.height\u003dMath.floor(this.height);return this};_.m.round\u003dfunction(){this.width\u003dMath.round(this.width);this.height\u003dMath.round(this.height);return this};_.R\u003dfunction(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.17	49722	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:34 UTC	542	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
2024-01-30 17:51:34 UTC	1434	IN	HTTP/1.1 200 OK Version: 602283465 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Date: Tue, 30 Jan 2024 17:51:34 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:34 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-01-30 17:51:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.17	49720	173.194.219.101	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:34 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.149&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.149 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:51:34 UTC	732	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-m4L6zt0i4oDRr4bFARJP2Q' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 30 Jan 2024 17:51:34 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6238 X-Daystart: 35494 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:34 UTC	520	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 32 33 38 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 35 34 39 34 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6238" elapsed_seconds="35494"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2024-01-30 17:51:34 UTC	200	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2024-01-30 17:51:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.17	49729	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:35 UTC	845	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=di&oit=1&cp=2&pgcl=7&gs_rn=42&psi=w2jj9Ekh5vGktcI5&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.17	49730	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:35 UTC	847	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=dire&oit=1&cp=4&pgcl=7&gs_rn=42&psi=w2jj9Ekh5vGktcI5&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.17	49731	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:36 UTC	848	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=direc&oit=1&cp=5&pgcl=7&gs_rn=42&psi=w2jj9Ekh5vGktcI5&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
2024-01-30 17:51:36 UTC	1703	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:51:36 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-TGenD1UqBpQxNkv7WWB8UA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:36 UTC	1048	IN	Data Raw: 34 31 31 0d 0a 29 5d 7d 27 0a 5b 22 64 69 72 65 63 22 2c 5b 22 64 69 72 65 63 74 69 6f 6e 73 22 2c 22 64 69 72 65 63 74 76 22 2c 22 64 69 72 65 63 74 69 6f 6e 73 20 61 74 6c 61 6e 74 61 22 2c 22 64 69 72 65 63 74 69 6f 6e 73 20 66 6f 72 65 73 74 20 70 61 72 6b 22 2c 22 64 69 72 65 63 74 76 20 73 74 72 65 61 6d 22 2c 22 64 69 72 65 63 74 69 6f 6e 73 20 67 6f 6f 67 6c 65 22 2c 22 64 69 72 65 63 74 20 6f 62 6a 65 63 74 22 2c 22 64 69 72 65 63 74 20 64 65 6d 6f 63 72 61 63 79 22 2c 22 64 69 72 65 63 74 76 20 6c 6f 67 69 6e 22 2c 22 64 69 72 65 63 74 69 6f 6e 73 20 67 6f 6f 67 6c 65 20 6d 61 70 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 Data Ascii: 411)]}'["direc",["directions","directv","directions atlanta","directions forest park","directv stream","directions google","direct object","direct democracy","directv login","directions google maps"],["","","","","","","","","",""],[],{"google:clientda
2024-01-30 17:51:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.17	49732	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:36 UTC	849	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=direct&oit=1&cp=6&pgcl=7&gs_rn=42&psi=w2jj9Ekh5vGktcI5&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
2024-01-30 17:51:36 UTC	1703	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:51:36 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-WpUvtERm8jZbLAOZ_poWZA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:36 UTC	1050	IN	Data Raw: 34 31 33 0d 0a 29 5d 7d 27 0a 5b 22 64 69 72 65 63 74 22 2c 5b 22 64 69 72 65 63 74 69 6f 6e 73 22 2c 22 64 69 72 65 63 74 76 22 2c 22 64 69 72 65 63 74 69 6f 6e 73 20 61 74 6c 61 6e 74 61 22 2c 22 64 69 72 65 63 74 69 6f 6e 73 20 66 6f 72 65 73 74 20 70 61 72 6b 22 2c 22 64 69 72 65 63 74 76 20 73 74 72 65 61 6d 22 2c 22 64 69 72 65 63 74 69 6f 6e 73 20 67 6f 6f 67 6c 65 22 2c 22 64 69 72 65 63 74 20 6f 62 6a 65 63 74 22 2c 22 64 69 72 65 63 74 20 64 65 6d 6f 63 72 61 63 79 22 2c 22 64 69 72 65 63 74 76 20 6c 6f 67 69 6e 22 2c 22 64 69 72 65 63 74 69 6f 6e 73 20 67 6f 6f 67 6c 65 20 6d 61 70 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 Data Ascii: 413)]}'["direct",["directions","directv","directions atlanta","directions forest park","directv stream","directions google","direct object","direct democracy","directv login","directions google maps"],["","","","","","","","","",""],[],{"google:clientd
2024-01-30 17:51:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.17	49733	64.233.177.100	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:36 UTC	922	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.GsbA68hXs80.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo899t-H8Lxb3OqzMDuPn6TV_i36ag/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
2024-01-30 17:51:36 UTC	914	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 121630 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 30 Jan 2024 17:24:55 GMT Expires: Wed, 29 Jan 2025 17:24:55 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 06 Dec 2023 17:20:24 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 1601 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:36 UTC	338	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 5d 29 3b 0a 76 61 72 20 65 61 2c 66 61 2c 6e 61 2c 70 61 2c 73 61 2c 76 61 2c 77 61 2c 43 61 3b 5f 2e 64 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);var ea,fa,na,pa,sa,va,wa,Ca;_.da=function(a)
2024-01-30 17:51:36 UTC	1252	IN	Data Raw: 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 3b 66 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 6e 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b Data Ascii: r b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};fa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};na=function(a){a=[
2024-01-30 17:51:36 UTC	1252	IN	Data Raw: 33 32 41 72 72 61 79 20 46 6c 6f 61 74 36 34 41 72 72 61 79 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 5f 2e 6f 61 5b 62 5b 63 5d 5d 3b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 64 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 26 26 66 61 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 61 28 65 61 28 74 68 69 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 Data Ascii: 32Array Float64Array".split(" "),c=0;c<b.length;c++){var d=_.oa[b[c]];"function"===typeof d&&"function"!=typeof d.prototype[a]&&fa(d.prototype,a,{configurable:!0,writable:!0,value:function(){return sa(ea(this))}})}return a});sa=function(a){a={next:a};a[Sy
2024-01-30 17:51:36 UTC	1252	IN	Data Raw: 3a 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 28 68 29 7d 29 7d 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 65 50 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 68 69 73 2e 4c 66 29 7b 74 68 69 73 2e 4c 66 3d 5b 5d 3b 76 61 72 20 6b 3d 74 68 69 73 3b 74 68 69 73 2e 66 50 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6b 2e 62 37 28 29 7d 29 7d 74 68 69 73 2e 4c 66 2e 70 75 73 68 28 68 29 7d 3b 76 61 72 20 64 3d 5f 2e 6f 61 2e 73 65 74 54 69 6d 65 6f 75 74 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 66 50 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 64 28 68 2c 30 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 62 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 3b 74 68 69 73 2e 4c 66 26 26 74 68 69 73 2e 4c Data Ascii: :new e(function(k){k(h)})}if(a)return a;b.prototype.eP=function(h){if(null==this.Lf){this.Lf=[];var k=this;this.fP(function(){k.b7()})}this.Lf.push(h)};var d=_.oa.setTimeout;b.prototype.fP=function(h){d(h,0)};b.prototype.b7=function(){for(;this.Lf&&this.L
2024-01-30 17:51:36 UTC	1252	IN	Data Raw: 22 2b 68 2b 22 60 22 2b 6b 2b 22 60 22 2b 74 68 69 73 2e 46 61 29 3b 74 68 69 73 2e 46 61 3d 68 3b 74 68 69 73 2e 7a 66 3d 6b 3b 32 3d 3d 3d 74 68 69 73 2e 46 61 26 26 74 68 69 73 2e 51 64 61 28 29 3b 74 68 69 73 2e 63 37 28 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 51 64 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 3d 74 68 69 73 3b 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 68 2e 46 62 61 28 29 29 7b 76 61 72 20 6b 3d 5f 2e 6f 61 2e 63 6f 6e 73 6f 6c 65 3b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 6b 26 26 6b 2e 65 72 72 6f 72 28 68 2e 7a 66 29 7d 7d 2c 0a 31 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 46 62 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 69 56 29 72 65 74 75 72 6e 21 31 3b 76 61 72 Data Ascii: "+h+"`"+k+"`"+this.Fa);this.Fa=h;this.zf=k;2===this.Fa&&this.Qda();this.c7()};e.prototype.Qda=function(){var h=this;d(function(){if(h.Fba()){var k=_.oa.console;"undefined"!==typeof k&&k.error(h.zf)}},1)};e.prototype.Fba=function(){if(this.iV)return!1;var
2024-01-30 17:51:36 UTC	1252	IN	Data Raw: 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 74 68 72 6f 77 20 45 72 72 6f 72 28 22 64 60 22 2b 6d 2e 46 61 29 3b 7d 7d 76 61 72 20 6d 3d 74 68 69 73 3b 6e 75 6c 6c 3d 3d 74 68 69 73 2e 63 73 3f 66 2e 65 50 28 6c 29 3a 74 68 69 73 2e 63 73 2e 70 75 73 68 28 6c 29 3b 74 68 69 73 2e 69 56 3d 21 30 7d 3b 65 2e 72 65 73 6f 6c 76 65 3d 63 3b 65 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 6c 28 68 29 7d 29 7d 3b 65 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 66 6f 72 28 76 61 72 20 6d 3d 5f 2e 74 61 28 68 29 2c 6e 3d 6d 2e 6e 65 78 74 28 29 3b 21 6e 2e 64 6f 6e 65 3b 6e 3d 6d 2e 6e Data Ascii: reak;default:throw Error("d`"+m.Fa);}}var m=this;null==this.cs?f.eP(l):this.cs.push(l);this.iV=!0};e.resolve=c;e.reject=function(h){return new e(function(k,l){l(h)})};e.race=function(h){return new e(function(k,l){for(var m=_.ta(h),n=m.next();!n.done;n=m.n
2024-01-30 17:51:36 UTC	1252	IN	Data Raw: 73 74 61 6e 63 65 6f 66 20 62 29 72 65 74 75 72 6e 20 6e 3b 4f 62 6a 65 63 74 2e 69 73 45 78 74 65 6e 73 69 62 6c 65 28 6e 29 26 26 64 28 6e 29 3b 72 65 74 75 72 6e 20 6d 28 6e 29 7d 29 7d 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 21 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 6c 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6d 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6e 3d 6e 65 77 20 61 28 5b 5b 6c 2c 32 5d 2c 5b 6d 2c 33 5d 5d 29 3b 69 66 28 32 21 3d 6e 2e 67 65 74 28 6c 29 7c 7c 33 21 3d 6e 2e 67 65 74 28 6d 29 29 72 65 74 75 72 6e 21 31 3b 6e 2e 64 65 6c 65 74 65 28 6c 29 3b 6e 2e 73 65 74 28 6d 2c 34 29 3b 72 65 74 75 72 6e 21 6e 2e 68 61 73 28 6c 29 26 26 34 3d 3d 6e 2e Data Ascii: stanceof b)return n;Object.isExtensible(n)&&d(n);return m(n)})}if(function(){if(!a\|\|!Object.seal)return!1;try{var l=Object.seal({}),m=Object.seal({}),n=new a([[l,2],[m,3]]);if(2!=n.get(l)\|\|3!=n.get(m))return!1;n.delete(l);n.set(m,4);return!n.has(l)&&4==n.
2024-01-30 17:51:36 UTC	1252	IN	Data Raw: 65 7c 7c 34 21 3d 6e 2e 76 61 6c 75 65 5b 30 5d 2e 78 7c 7c 22 74 22 21 3d 6e 2e 76 61 6c 75 65 5b 31 5d 7c 7c 21 6d 2e 6e 65 78 74 28 29 2e 64 6f 6e 65 3f 21 31 3a 21 30 7d 63 61 74 63 68 28 70 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 76 61 72 20 62 3d 6e 65 77 20 57 65 61 6b 4d 61 70 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 0a 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 3b 69 66 28 6b 29 7b 6b 3d 5f 2e 74 61 28 6b 29 3b 66 6f 72 28 76 61 72 20 6c 3b 21 28 6c 3d 6b 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6c 3d 6c 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6c 5b 30 5d 2c 6c 5b 31 5d 29 7d 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 Data Ascii: e\|\|4!=n.value[0].x\|\|"t"!=n.value[1]\|\|!m.next().done?!1:!0}catch(p){return!1}}())return a;var b=new WeakMap,c=function(k){this[0]={};this[1]=f();this.size=0;if(k){k=_.ta(k);for(var l;!(l=k.next()).done;)l=l.value,this.set(l[0],l[1])}};c.prototype.set=func
2024-01-30 17:51:36 UTC	1252	IN	Data Raw: 3d 63 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3b 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 76 61 72 20 6d 3d 6c 26 26 74 79 70 65 6f 66 20 6c 3b 22 6f 62 6a 65 63 74 22 3d 3d 6d 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 6d 3f 62 2e 68 61 73 28 6c 29 3f 6d 3d 62 2e 67 65 74 28 6c 29 3a 28 6d 3d 22 22 2b 20 2b 2b 68 2c 62 2e 73 65 74 28 6c 2c 6d 29 29 3a 6d 3d 22 70 5f 22 2b 6c 3b 76 61 72 20 6e 3d 6b 5b 30 5d 5b 6d 5d 3b 69 66 28 6e 26 26 76 61 28 6b 5b 30 5d 2c 6d 29 29 66 6f 72 28 6b 3d 30 3b 6b 3c 6e 2e 6c 65 6e 67 74 68 3b 6b 2b 2b 29 7b 76 61 72 20 70 3d 6e 5b 6b 5d 3b 69 66 28 6c 21 3d 3d 6c 26 26 70 2e 6b 65 79 21 3d 3d 70 2e 6b 65 79 7c 7c 6c 3d 3d 3d 70 2e 6b 65 79 29 72 65 74 75 72 6e 7b 69 64 3a 6d 2c 6c 69 73 74 Data Ascii: =c.prototype.entries;var d=function(k,l){var m=l&&typeof l;"object"==m\|\|"function"==m?b.has(l)?m=b.get(l):(m=""+ ++h,b.set(l,m)):m="p_"+l;var n=k[0][m];if(n&&va(k[0],m))for(k=0;k<n.length;k++){var p=n[k];if(l!==l&&p.key!==p.key\|\|l===p.key)return{id:m,list
2024-01-30 17:51:36 UTC	1252	IN	Data Raw: 65 79 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4f 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 7d 29 7d 7d 29 3b 0a 70 61 28 22 53 65 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 61 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 74 61 28 5b 63 5d 29 29 3b Data Ascii: eys",function(a){return a?a:function(){return Oa(this,function(b){return b})}});pa("Set",function(a){if(function(){if(!a\|\|"function"!=typeof a\|\|!a.prototype.entries\|\|"function"!=typeof Object.seal)return!1;try{var c=Object.seal({x:4}),d=new a(_.ta([c]));

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.17	49735	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:37 UTC	850	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=directx&oit=1&cp=7&pgcl=7&gs_rn=42&psi=w2jj9Ekh5vGktcI5&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
2024-01-30 17:51:37 UTC	1703	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:51:37 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-kJoMgd7DIGFSoKPTXEzpVA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:37 UTC	636	IN	Data Raw: 32 37 35 0d 0a 29 5d 7d 27 0a 5b 22 64 69 72 65 63 74 78 22 2c 5b 22 64 69 72 65 63 74 78 22 2c 22 64 69 72 65 63 74 78 20 72 75 6e 74 69 6d 65 22 2c 22 64 69 72 65 63 74 78 20 31 31 22 2c 22 64 69 72 65 63 74 78 20 31 32 22 2c 22 64 69 72 65 63 74 78 20 64 6f 77 6e 6c 6f 61 64 22 2c 22 64 69 72 65 63 74 78 20 31 31 20 76 73 20 31 32 22 2c 22 64 69 72 65 63 74 78 20 72 75 6e 74 69 6d 65 20 64 6f 77 6e 6c 6f 61 64 22 2c 22 64 69 72 65 63 74 78 20 31 31 20 76 73 20 76 75 6c 6b 61 6e 22 2c 22 64 69 72 65 63 74 78 20 31 32 20 64 6f 77 6e 6c 6f 61 64 22 2c 22 64 69 72 65 63 74 78 20 75 70 64 61 74 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 Data Ascii: 275)]}'["directx",["directx","directx runtime","directx 11","directx 12","directx download","directx 11 vs 12","directx runtime download","directx 11 vs vulkan","directx 12 download","directx update"],["","","","","","","","","",""],[],{"google:clientd
2024-01-30 17:51:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.17	49736	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:39 UTC	1312	OUT	GET /search?q=directx+runtime&oq=directx&gs_lcrp=EgZjaHJvbWUqDQgBEAAYgwEYsQMYgAQyDwgAEEUYORiDARixAxiABDINCAEQABiDARixAxiABDINCAIQABiDARixAxiABDIKCAMQABixAxiABDIKCAQQABixAxiABDIHCAUQABiABDINCAYQABiDARixAxiABDIHCAcQABiABDINCAgQABiDARixAxiABDINCAkQABiDARixAxiABNIBCDQwNjFqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=X9Z9GC2VZ5PTUFlYUNdhKnJP24TRGpGqZqKFL9Pw-Ezk_duysZ_VzzYNGWyHcs80O3scFIEGWC4ejePhlgeAzI7DW28lCxtFqnZqwLPsW3aG59Guvp647PtH9EGoiqhxBjO7Es0rJ7PDVhdGCfedVrlCik0Vmojg2gUg6Tqi0JI
2024-01-30 17:51:39 UTC	2282	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Date: Tue, 30 Jan 2024 17:51:39 GMT Expires: -1 Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-GhlIM3-Vn8MZTzZdrVZ-yw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-01-30-17; expires=Thu, 29-Feb-2024 17:51:39 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; expires=Sun, 28-Jul-2024 17:51:39 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=511=s82NdxBaGSH8HxMBLOcwvQpPzv4y-mUgW_d9F7q5R75kTlIRPMncU7iV21f6MmTKzsbm9O89dDCBLJZZNbykzIqZ9LcgUs96i2BkApgz8PH3PiG1Fhzsjr2PRztNhbt9gnl94FekHS0ArONy3z7WCbcUNDAac--5IhXnjkI59xc; expires=Sat, 06-Apr-2024 09:46:29 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:39 UTC	2282	IN	Data Raw: 65 62 34 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 74 65 6d 73 63 6f 70 65 3d 22 22 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 53 65 61 72 63 68 52 65 73 75 6c 74 73 50 61 67 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 41 6a 6f 43 71 38 5a 67 35 50 63 58 67 66 6c 2f 53 6f 54 69 6b 63 31 65 2f 64 7a 51 43 64 78 57 30 66 76 6f 38 46 78 6d 64 58 74 4d 70 54 48 46 53 50 54 68 44 73 7a 72 32 47 54 6e 34 61 44 4f 39 6e 2f 6c 70 6b 57 33 5a 76 2f 6a 73 Data Ascii: eb4<!doctype html><html itemscope="" itemtype="http://schema.org/SearchResultsPage" lang="en"><head><meta charset="UTF-8"><meta content="origin" name="referrer"><meta content="AjoCq8Zg5PcXgfl/SoTikc1e/dzQCdxW0fvo8FxmdXtMpTHFSPThDszr2GTn4aDO9n/lpkW3Zv/js
2024-01-30 17:51:39 UTC	1489	IN	Data Raw: 65 2e 73 79 3d 5b 5d 3b 67 6f 6f 67 6c 65 2e 78 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 61 29 76 61 72 20 63 3d 61 2e 69 64 3b 65 6c 73 65 7b 64 6f 20 63 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 77 68 69 6c 65 28 67 6f 6f 67 6c 65 2e 79 5b 63 5d 29 7d 67 6f 6f 67 6c 65 2e 79 5b 63 5d 3d 5b 61 2c 62 5d 3b 72 65 74 75 72 6e 21 31 7d 3b 67 6f 6f 67 6c 65 2e 73 78 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 67 6f 6f 67 6c 65 2e 73 79 2e 70 75 73 68 28 61 29 7d 3b 67 6f 6f 67 6c 65 2e 6c 6d 3d 5b 5d 3b 67 6f 6f 67 6c 65 2e 70 6c 6d 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 67 6f 6f 67 6c 65 2e 6c 6d 2e 70 75 73 68 2e 61 70 70 6c 79 28 67 6f 6f 67 6c 65 2e 6c 6d 2c 61 29 7d 3b 67 6f 6f 67 6c 65 2e 6c 71 3d 5b 5d 3b 67 6f 6f 67 6c 65 2e 6c 6f 61 64 3d Data Ascii: e.sy=[];google.x=function(a,b){if(a)var c=a.id;else{do c=Math.random();while(google.y[c])}google.y[c]=[a,b];return!1};google.sx=function(a){google.sy.push(a)};google.lm=[];google.plm=function(a){google.lm.push.apply(google.lm,a)};google.lq=[];google.load=
2024-01-30 17:51:39 UTC	116	IN	Data Raw: 36 65 0d 0a 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 29 69 66 28 22 68 69 64 64 65 6e 22 3d 3d 3d 64 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 7c 7c 22 47 2d 45 58 50 41 4e 44 41 42 4c 45 2d 43 4f 4e 54 45 4e 54 22 3d 3d 3d 64 2e 74 61 67 4e 61 6d 65 26 26 22 68 69 64 64 65 6e 22 3d 3d 3d 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 0d 0a Data Ascii: 6e.parentElement)if("hidden"===d.style.overflow\|\|"G-EXPANDABLE-CONTENT"===d.tagName&&"hidden"===getComputedStyle
2024-01-30 17:51:39 UTC	1252	IN	Data Raw: 38 30 30 30 0d 0a 28 64 29 2e 67 65 74 50 72 6f 70 65 72 74 79 56 61 6c 75 65 28 22 6f 76 65 72 66 6c 6f 77 22 29 29 7b 62 3d 64 3b 62 72 65 61 6b 20 61 7d 62 3d 6e 75 6c 6c 7d 69 66 28 21 62 29 72 65 74 75 72 6e 21 31 3b 61 3d 63 28 61 29 3b 63 3d 63 28 62 29 3b 72 65 74 75 72 6e 20 61 2e 62 6f 74 74 6f 6d 3c 63 2e 74 6f 70 7c 7c 61 2e 74 6f 70 3e 3d 63 2e 62 6f 74 74 6f 6d 7c 7c 61 2e 72 69 67 68 74 3c 63 2e 6c 65 66 74 7c 7c 61 2e 6c 65 66 74 3e 3d 63 2e 72 69 67 68 74 7d 0a 66 75 6e 63 74 69 6f 6e 20 62 61 28 61 29 7b 72 65 74 75 72 6e 22 6e 6f 6e 65 22 3d 3d 3d 61 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3f 21 30 3a 64 6f 63 75 6d 65 6e 74 2e 64 65 66 61 75 6c 74 56 69 65 77 26 26 64 6f 63 75 6d 65 6e 74 2e 64 65 66 61 75 6c 74 56 69 65 77 2e 67 65 Data Ascii: 8000(d).getPropertyValue("overflow")){b=d;break a}b=null}if(!b)return!1;a=c(a);c=c(b);return a.bottom<c.top\|\|a.top>=c.bottom\|\|a.right<c.left\|\|a.left>=c.right}function ba(a){return"none"===a.style.display?!0:document.defaultView&&document.defaultView.ge
2024-01-30 17:51:39 UTC	1252	IN	Data Raw: 68 45 76 65 6e 74 28 22 6f 6e 22 2b 62 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 42 28 61 2c 62 2c 63 2c 64 29 7b 22 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 22 69 6e 20 61 3f 61 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 62 2c 63 2c 64 7c 7c 21 31 29 3a 61 2e 61 74 74 61 63 68 45 76 65 6e 74 26 26 61 2e 64 65 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 22 2b 62 2c 63 29 7d 3b 76 61 72 20 6b 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 67 3d 61 3b 74 68 69 73 2e 6c 3d 5b 5d 3b 74 68 69 73 2e 43 3d 74 68 69 73 2e 67 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 6e 6f 61 66 74 22 29 3b 74 68 69 73 2e 69 3d 21 21 74 68 69 73 2e 67 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 64 65 66 65 72 72 65 64 Data Ascii: hEvent("on"+b,c)}function B(a,b,c,d){"addEventListener"in a?a.removeEventListener(b,c,d\|\|!1):a.attachEvent&&a.detachEvent("on"+b,c)};var ka=function(a){this.g=a;this.l=[];this.C=this.g.hasAttribute("data-noaft");this.i=!!this.g.getAttribute("data-deferred
2024-01-30 17:51:39 UTC	1252	IN	Data Raw: 72 63 20 62 73 72 63 20 75 72 6c 20 6c 6c 20 69 6d 61 67 65 20 69 6d 67 2d 75 72 6c 20 6c 69 6f 69 22 2e 73 70 6c 69 74 28 22 20 22 29 3b 66 75 6e 63 74 69 6f 6e 20 46 28 61 29 7b 66 6f 72 28 3b 61 3b 61 3d 61 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 29 69 66 28 22 47 2d 53 43 52 4f 4c 4c 49 4e 47 2d 43 41 52 4f 55 53 45 4c 22 3d 3d 3d 61 2e 74 61 67 4e 61 6d 65 29 72 65 74 75 72 6e 20 61 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 67 6f 6f 67 6c 65 2e 63 2e 69 69 6d 3d 67 6f 6f 67 6c 65 2e 63 2e 69 69 6d 7c 7c 7b 7d 3b 76 61 72 20 47 3d 67 6f 6f 67 6c 65 2e 63 2e 69 69 6d 2c 6c 61 3d 30 3b 66 75 6e 63 74 69 6f 6e 20 48 28 61 29 7b 76 61 72 20 62 3d 53 74 72 69 6e 67 28 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 63 73 69 69 64 22 29 7c 7c Data Ascii: rc bsrc url ll image img-url lioi".split(" ");function F(a){for(;a;a=a.parentElement)if("G-SCROLLING-CAROUSEL"===a.tagName)return a;return null}google.c.iim=google.c.iim\|\|{};var G=google.c.iim,la=0;function H(a){var b=String(a.getAttribute("data-csiid")\|\|
2024-01-30 17:51:39 UTC	1252	IN	Data Raw: 44 61 74 65 2e 6e 6f 77 28 29 29 29 7d 3b 67 6f 6f 67 6c 65 2e 73 74 61 72 74 54 69 63 6b 28 22 6c 6f 61 64 22 29 3b 67 6f 6f 67 6c 65 2e 74 69 63 6b 28 22 6c 6f 61 64 22 2c 22 68 73 74 22 29 3b 76 61 72 20 4a 3d 67 6f 6f 67 6c 65 2e 74 69 6d 65 72 73 2e 6c 6f 61 64 3b 69 66 28 21 67 6f 6f 67 6c 65 2e 73 74 76 73 63 29 61 3a 7b 76 61 72 20 4b 3d 4a 2e 74 3b 69 66 28 71 29 7b 76 61 72 20 4c 3d 71 2e 74 69 6d 69 6e 67 3b 69 66 28 4c 29 7b 76 61 72 20 4d 3d 4c 2e 6e 61 76 69 67 61 74 69 6f 6e 53 74 61 72 74 2c 4e 3d 4c 2e 72 65 73 70 6f 6e 73 65 53 74 61 72 74 3b 69 66 28 4e 3e 4d 26 26 4e 3c 3d 4b 2e 73 74 61 72 74 29 7b 4b 2e 73 74 61 72 74 3d 4e 3b 4a 2e 77 73 72 74 3d 4e 2d 4d 3b 62 72 65 61 6b 20 61 7d 7d 71 2e 6e 6f 77 26 26 28 4a 2e 77 73 72 74 3d 4d Data Ascii: Date.now()))};google.startTick("load");google.tick("load","hst");var J=google.timers.load;if(!google.stvsc)a:{var K=J.t;if(q){var L=q.timing;if(L){var M=L.navigationStart,N=L.responseStart;if(N>M&&N<=K.start){K.start=N;J.wsrt=N-M;break a}}q.now&&(J.wsrt=M
2024-01-30 17:51:39 UTC	1252	IN	Data Raw: 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 67 6f 6f 67 6c 65 2e 61 66 74 71 26 26 28 67 6f 6f 67 6c 65 2e 61 66 74 71 3d 67 6f 6f 67 6c 65 2e 61 66 74 71 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 61 21 3d 3d 63 7d 29 2c 4f 28 61 29 29 7d 2c 62 29 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 50 28 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 26 26 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 61 76 69 67 61 74 69 6f 6e 26 26 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 61 76 69 67 61 74 69 6f 6e 2e 74 79 70 65 7d 3b 76 61 72 20 71 61 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2c 72 61 3d 22 61 66 74 20 61 66 74 69 20 61 66 74 72 20 61 66 74 73 20 63 62 73 20 63 Data Ascii: t(function(){google.aftq&&(google.aftq=google.aftq.filter(function(c){return a!==c}),O(a))},b))};function P(){return window.performance&&window.performance.navigation&&window.performance.navigation.type};var qa=window.location,ra="aft afti aftr afts cbs c
2024-01-30 17:51:39 UTC	1252	IN	Data Raw: 61 63 6f 6e 28 63 2c 22 22 29 3a 67 6f 6f 67 6c 65 2e 6c 6f 67 28 22 22 2c 22 22 2c 63 29 7d 7d 3b 66 75 6e 63 74 69 6f 6e 20 74 61 28 61 29 7b 61 26 26 67 6f 6f 67 6c 65 2e 74 69 63 6b 28 22 6c 6f 61 64 22 2c 22 63 62 73 22 2c 61 29 3b 67 6f 6f 67 6c 65 2e 74 69 63 6b 28 22 6c 6f 61 64 22 2c 22 63 62 74 22 29 3b 73 61 28 22 63 61 70 22 29 7d 3b 76 61 72 20 75 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 53 3b 61 2e 68 2d 2d 3b 21 61 2e 68 26 26 61 2e 67 26 26 28 61 2e 67 28 29 2c 61 2e 67 3d 6e 75 6c 6c 29 7d 2c 76 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 53 3b 62 2e 67 3d 61 3b 21 62 2e 68 26 26 62 2e 67 26 26 28 62 2e 67 28 29 2c 62 2e 67 3d 6e 75 6c 6c 29 7d 2c 53 3d 6e 65 77 20 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 Data Ascii: acon(c,""):google.log("","",c)}};function ta(a){a&&google.tick("load","cbs",a);google.tick("load","cbt");sa("cap")};var ua=function(){var a=S;a.h--;!a.h&&a.g&&(a.g(),a.g=null)},va=function(a){var b=S;b.g=a;!b.h&&b.g&&(b.g(),b.g=null)},S=new function(){thi
2024-01-30 17:51:39 UTC	1252	IN	Data Raw: 21 30 7d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 78 28 22 69 6d 61 22 2c 6b 29 3b 78 28 22 69 6d 61 64 22 2c 68 29 3b 78 28 22 69 6d 61 63 22 2c 6d 29 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 22 49 62 37 45 66 63 22 29 2e 6c 65 6e 67 74 68 26 26 78 28 22 64 64 6c 22 2c 31 29 3b 78 28 22 77 68 22 2c 63 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 6c 26 26 77 28 22 61 66 74 69 22 2c 6c 29 3b 30 3c 56 26 26 77 28 22 61 66 74 73 22 2c 57 29 3b 58 26 26 77 28 22 61 66 74 72 22 2c 58 29 3b 76 61 72 20 7a 3d 57 2c 51 3d 56 3b 69 66 28 58 3e 7a 7c 7c 68 61 26 26 63 26 26 56 3c 63 26 26 59 3e 3d 63 29 7a 3d 58 2c 51 3d 59 3b 6c 26 26 28 21 6a 61 7c 7c 6c 3e 7a 7c 7c 67 26 26 28 21 58 7c 7c 30 3e 56 29 7c 7c 69 Data Ascii: !0},function(){x("ima",k);x("imad",h);x("imac",m);document.getElementsByClassName("Ib7Efc").length&&x("ddl",1);x("wh",c)},function(l){l&&w("afti",l);0<V&&w("afts",W);X&&w("aftr",X);var z=W,Q=V;if(X>z\|\|ha&&c&&V<c&&Y>=c)z=X,Q=Y;l&&(!ja\|\|l>z\|\|g&&(!X\|\|0>V)\|\|i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.17	49737	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:40 UTC	1364	OUT	GET /images/branding/googlelogo/2x/googlelogo_color_92x30dp.png HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=s82NdxBaGSH8HxMBLOcwvQpPzv4y-mUgW_d9F7q5R75kTlIRPMncU7iV21f6MmTKzsbm9O89dDCBLJZZNbykzIqZ9LcgUs96i2BkApgz8PH3PiG1Fhzsjr2PRztNhbt9gnl94FekHS0ArONy3z7WCbcUNDAac--5IhXnjkI59xc
2024-01-30 17:51:40 UTC	671	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: image/png Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 3831 Date: Tue, 30 Jan 2024 17:51:40 GMT Expires: Tue, 30 Jan 2024 17:51:40 GMT Cache-Control: private, max-age=31536000 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:40 UTC	581	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 b8 00 00 00 3c 08 06 00 00 00 d5 12 70 09 00 00 0e be 49 44 41 54 78 da ed 5d 09 90 5c 45 19 6e c8 ce 12 6e 0f 50 b9 44 c5 60 08 72 ed 9b 37 1b 63 70 e6 bd 99 4d 62 8c 58 10 97 43 94 33 22 77 04 14 8a a3 18 6b 67 66 97 70 68 45 0e 21 87 05 94 1c 15 44 10 39 c2 1e e1 50 82 10 08 58 24 24 20 16 05 45 92 9d 9d cd f5 de cc 5e 09 3b fe 9f ec 66 37 bb db fd ee 99 1d ab bf aa ae 0c ec 9b d7 35 dd df fb fb ef ef ff ff 7e cc 0f 44 93 c5 aa 58 63 a1 56 4f e7 af d3 33 f9 87 b5 b4 b1 3a 96 c9 67 63 19 a3 40 ff 5d d4 53 46 1f fd 9b d3 d3 c6 db 5a 3a ff 18 7d be 41 cf 18 27 2b f7 15 43 4c 42 62 bc 42 4f 17 22 b1 8c f9 07 3d 95 df 02 22 3b 6d 9f 7d cf bc 2f de 94 3f 89 49 48 8c 17 10 29 eb 88 a0 2f 81 a4 be b5 b4 Data Ascii: PNGIHDR<pIDATx]\EnnPD`r7cpMbXC3"wkgfphE!D9PX$$ E^;f75~DXcVO3:gc@]SFZ:}A'+CLBbBO"=";m}/?IH)/
2024-01-30 17:51:40 UTC	1252	IN	Data Raw: 03 8a 15 13 33 ce 24 24 2a 95 e0 90 05 05 9b ca 16 26 21 51 a9 04 47 b4 90 f2 b7 37 f3 08 1e 6f cc cf 62 15 8e 8e 44 ed a4 6c 5c bd 24 1b 0f 2f a6 d6 d6 ae 2b ab d0 f0 99 da 12 fc ad 23 ae 1e cd 02 42 4f 73 f5 a4 be e6 aa 4b 76 b4 4c 58 dc db 12 6a db d1 1a 5a 85 f6 bf cf cd 13 96 e0 6f 3d 2d d5 81 f5 9f b8 65 cb 81 94 de 7c 2a 05 ef 32 14 60 7b 88 56 e4 a7 90 9b 4f 72 ef ed 14 31 9e 3b 6d 41 6e ff 72 13 bc a8 28 a1 0e 4d fd 5e 56 57 af 6b d7 d5 a5 1d ba fa 24 cd cb 53 34 2f 0f 76 e8 e1 9b 69 be ea de 9f f5 cd bd 98 53 68 4d 05 85 ef 9e 18 1b 2b 35 5c 8e 01 cb c6 23 e7 80 c8 34 48 45 3b ad 3d ae be 49 03 7c 1e be eb b9 ff 37 58 68 67 4b e8 9c 01 32 17 ed 34 22 fb 9b bd ad a1 f3 f0 5d 9f 62 1a 35 b4 02 3f 4a 41 b9 5e 8b a0 5d 81 ae fd fd f4 8c 71 f0 67 df Data Ascii: 3$$&!QG7obDl\$/+#BOsKvLXjZo=-e\|2`{VOr1;mAnr(M^VWk$S4/viShM+5\#4HE;=I\|7XhgK24"]b5?JA^]qg
2024-01-30 17:51:40 UTC	1252	IN	Data Raw: 04 4f e5 57 70 1e ba cc 30 bf 6e 31 67 63 d9 6d 95 b7 60 19 88 d0 94 9d 3c 5d 7c 98 7a b2 98 43 c2 6e a8 24 ae 35 fd 17 d8 7e b4 02 ec e4 e9 e2 76 ca 0b e3 8d 5d df 71 4d f0 8c 71 9a af 04 d7 c2 f7 73 dc 93 f5 6c 18 e0 87 d3 9c 5e 0a 55 cb 01 a9 f3 a4 b0 dc db ae d7 1e cf 2d 17 43 88 96 6b c5 1b f3 b3 59 89 81 83 39 79 01 0b 2d 65 9e 35 8c e0 6d bc 1d 39 f3 08 0c b2 95 9f 87 64 29 5e 4e 09 f3 08 9e 74 48 c4 df d5 3f 1e 76 de 29 61 b3 16 f6 bb 7e c0 a2 4d dd 5f f3 91 e0 98 a7 15 a2 b1 dc a4 a9 c7 c2 70 d0 ff 33 ed 12 1b aa 16 11 fb 8a 2d 09 e5 40 66 05 1c a2 29 90 e5 56 94 21 7d 57 e3 17 3c 6f db e5 83 c2 57 e6 10 fc 59 cf 04 d7 d4 16 de 8e 7f f0 1a f8 ca 1c 0b ee b9 7f 22 72 0b c7 82 ef ea 1f 47 dd 71 dc b8 0e e6 01 90 87 fd 24 38 0c 0e 2f e7 87 88 fa a2 Data Ascii: OWp0n1gcm`<]\|zCn$5~v]qMqsl^U-CkY9y-e5m9d)^NtH?v)a~M_p3-@f)V!}W<oWY"rGq$8/
2024-01-30 17:51:40 UTC	746	IN	Data Raw: 90 35 7e c2 cf 39 c2 46 15 16 de e3 e9 48 5d 5f a5 1f f9 e7 60 09 6e 2c e7 6c 28 6d 93 3c a7 ab d7 0c 05 69 dc 37 f8 ee b9 78 f8 22 e6 00 20 39 11 f2 1a 4e 90 86 d3 44 be 7b e8 22 17 2a d8 6c 72 39 b6 79 5b 3d 8d e7 bd 13 5c bc 6f 1a ca 04 f5 d8 50 b5 a5 2b 3f f6 35 11 0a 09 58 3e 17 31 ac 83 bf ee 97 be be 29 56 53 8b 4a 1f 0f 56 fb d5 ac 16 39 81 b9 44 df 8a aa da a1 4a 1f 57 ed 55 0a e8 b8 ee 3f de d4 fd 0d 14 86 b8 a8 77 dd 46 51 cc 39 be 1f fc 23 0e a8 e5 3c b8 8e af 0d e5 7f fb 0c 44 d1 06 8a 12 72 2e 2d 45 0f de e2 86 37 b1 b9 7d cf 0f 20 54 46 12 ea e9 34 10 af 38 48 c1 7c 91 76 fa 3f 1a 52 2b dc 03 ca 08 45 24 4f df d1 1c 7a c5 01 b1 5f 24 29 d0 97 fe 61 2c a0 56 a1 24 d1 a6 d5 7e 90 88 7d d8 40 3e f8 25 63 5f 67 ae f4 fb e8 36 a4 bb e2 ec 41 52 Data Ascii: 5~9FH]_`n,l(m<i7x" 9ND{"*lr9y[=\oP+?5X>1)VSJV9DJWU?wFQ9#<Dr.-E7} TF48H\|v?R+E$Oz_$)a,V$~}@>%c_g6AR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.17	49741	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:40 UTC	1660	OUT	GET /images/searchbox/desktop_searchbox_sprites318_hr.webp HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/search?q=directx+runtime&oq=directx&gs_lcrp=EgZjaHJvbWUqDQgBEAAYgwEYsQMYgAQyDwgAEEUYORiDARixAxiABDINCAEQABiDARixAxiABDINCAIQABiDARixAxiABDIKCAMQABixAxiABDIKCAQQABixAxiABDIHCAUQABiABDINCAYQABiDARixAxiABDIHCAcQABiABDINCAgQABiDARixAxiABDINCAkQABiDARixAxiABNIBCDQwNjFqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=s82NdxBaGSH8HxMBLOcwvQpPzv4y-mUgW_d9F7q5R75kTlIRPMncU7iV21f6MmTKzsbm9O89dDCBLJZZNbykzIqZ9LcgUs96i2BkApgz8PH3PiG1Fhzsjr2PRztNhbt9gnl94FekHS0ArONy3z7WCbcUNDAac--5IhXnjkI59xc
2024-01-30 17:51:40 UTC	671	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: image/webp Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 660 Date: Tue, 30 Jan 2024 17:51:40 GMT Expires: Tue, 30 Jan 2024 17:51:40 GMT Cache-Control: private, max-age=31536000 Last-Modified: Wed, 22 Apr 2020 22:00:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:40 UTC	581	IN	Data Raw: 52 49 46 46 8c 02 00 00 57 45 42 50 56 50 38 4c 80 02 00 00 2f 27 c0 1e 10 d5 48 76 b6 3d 6e 95 fb bf 0a bb 07 b8 51 ea d8 9f 99 61 e5 e8 28 52 76 0c 6f ab da 55 98 1c c6 fe ea 8a 99 6c 18 b6 6d 1b a6 ff 1f dc da f4 06 30 6c db 36 6c ae ed 66 da 0c b1 ed 09 a4 90 41 3f 42 08 43 98 41 19 94 c1 32 68 06 9d 41 67 30 84 10 0e e1 47 38 07 6e 23 29 52 ba 6a f1 78 a0 e6 be 50 9e 46 e5 ce 49 3b cc 4f 78 a1 e7 c7 cf f5 1c 37 2d f7 c8 cf 62 58 9e 2f eb c0 5d c5 88 96 af 33 cb b8 1c 54 80 ab 93 e1 a2 35 b7 ba 01 78 ee ac da f6 47 2e 43 09 aa 19 e0 b7 25 e2 75 03 8e 19 f9 14 75 2f 97 5f b4 3d f0 b2 94 98 bc 10 3c 21 71 06 5c 86 f8 07 39 02 f7 de b2 c2 15 5c f7 a6 1a 07 70 3a 14 bc 50 f8 34 1f 61 53 00 4e 29 9c 3e b0 3e 18 ae 22 06 db 83 39 99 e0 56 68 20 a7 aa d0 80 Data Ascii: RIFFWEBPVP8L/'Hv=nQa(RvoUlm0l6lfA?BCA2hAg0G8n#)RjxPFI;Ox7-bX/]3T5xG.C%uu/_=<!q\9\p:P4aSN)>>"9Vh
2024-01-30 17:51:40 UTC	79	IN	Data Raw: 67 d7 f6 25 ed f7 1a 3b 0c 5b 52 3e 4e 12 23 dc 57 c2 65 8f e2 40 71 07 08 1e 28 e6 10 c1 ef 5d 26 7f 02 0d 1d 96 e2 4b 99 03 b9 bf 9a ed c8 3f af 7c 07 7a 10 1e 28 df 11 e5 3a 26 6d 01 56 ce 43 e7 27 c6 9f c0 0f 44 5e e3 52 9e bb aa 00 Data Ascii: g%;[R>N#We@q(]&K?\|z(:&mVC'D^R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.17	49743	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:40 UTC	3675	OUT	GET /xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=1/ed=1/dg=2/br=1/rs=ACT90oEp1_FAvFBtywXdkASv2V22tHKmTQ/ee=AfeaP:TkrAjf;Afksuc:wMx0R;BMxAGc:E5bFse;BgS6mb:fidj5d;BjwMce:cXX2Wb;CxXAWb:YyRLvc;DULqB:RKfG5c;DpcR3d:zL72xf;EABSZ:MXZt9d;ESrPQc:mNTJvc;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;EnlcNd:WeHg4;Erl4fe:FloWmf,FloWmf;F9mqte:UoRcbe;Fmv9Nc:O1Tzwc;G0KhTb:LIaoZ;G6wU6e:hezEbd;GleZL:J1A7Od;HMDDWe:G8QUdb;IBADCc:RYquRb;IoGlCf:b5lhvb;IsdWVc:qzxzOb;JXS8fb:Qj0suc;JbMT3:M25sS;JsbNhc:Xd8iUd;KOxcK:OZqGte;KQzWid:ZMKkN;KcokUb:KiuZBf;KeeMUb:HiPxjc;KpRAue:Tia57b;LBgRLc:XVMNvd;LEikZe:byfTOb,lsjVmc;LsNahb:ucGLNb;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Np8Qkd:Dpx6qc;Nyt6ic:jn2sGd;OgagBe:cNTe0;Oj465e:KG2eXe,KG2eXe;OohIYe:mpEAQb;Pjplud:EEDORb,PoEs9b;PqHfGe:im2cZe;Q1Ow7b:x5CSu;QGR0gd:Mlhmy;R2kc8b:ALJqWb;R4IIIb:QWfeKf;R9Ulx:CR7Ufe;RDNBlf:zPRCJb;SLtqO:Kh1xYe;SMDL4c:fTfGO,pnvXVc;SNUn3:ZwDk9d,x8cHvb;ShpF6e:N0pvGc;TxfV6d:YORN0b;U96pRd:FsR04;UDrY1c:eps46d;UVmjEd:EesRsb;UyG7Kb:wQd0G;V2HTTe:RolTY;VGRfx:VFqbr;VN6jIc:ddQyuf;VOcgDe:YquhTb;VsAqSb:PGf2Re;VxQ32b:k0XsBb;WCEKNd:I46Hvd;WDGyFe:jcVOxd;Wfmdue:g3MJlb;XUezZ:sa7lqb;YV5bee:IvPZ6d;ZMvdv:PHFPjb;ZWEUA:afR4Cf;a56pNe:JEfCwb;aAJE9c:WHW6Ef;aZ61od:arTwJ;bFZ6gf:RsDQqe;bcPXSc:gSZLJb;cEt90b:ws9Tlc;cFTWae:gT8qnd;coJ8e:KvoW8;dIoSBb:ZgGg9b;dLlj2:Qqt3Gf;daB6be:lMxGPd;dtl0hd:lLQWFe;eBAeSb:Ck63tb;eBZ5Nd:audvde;eHDfl:ofjVkb;eO3lse:nFClrf;fWLTFc:TVBJbf;g8nkx:U4MzKc;gaub4:TN6bMe;gtVSi:ekUOYd;h3MYod:cEt90b;hK67qb:QWEO5b;hLUtwc:KB8OKd;heHB1:sFczq;hjRo6e:F62sG;iFQyKf:QIhFr,vfuNJf;imqimf:jKGL2e;io8t5d:sgY6Zb;jY0zg:Q6tNgc;k2Qxcb:XY51pe;kCQyJ:ueyPK;kMFpHd:OTA3Ae;kbAm9d:MkHyGd;lkq0A:JyBE3e;nAFL3:NTMZac,s39S4;oGtAuc:sOXFj;oSUNyd:fTfGO,fTfGO,pnvXVc;oUlnpc:RagDlc;okUaUd:wItadb;pKJiXd:VCenhc;pNsl2d:j9Yuyc;pXdRYb:JKoKVe;pj82le:mg5CW;qGV2uc:HHi04c;qZx2Fc:j0xrE;qaS3gd:yiLg6e;qavrXe:zQzcXe;qddgKe:d7YSfd,x4FYXe;rQSrae:C6D5Fc;sP4Vbe:VwDzFe;sTsDMc:kHVSUb;tH4IIe:Ymry6;tosKvd:ZCqP3;trZL0b:qY8PFe;uY49fb:COQbmf;uknmt:GkPrzb;uuQkY:u2V3ud;vGrMZ:lPJJ0c;vfVwPd:lcrkwe;w3bZCb:ZPGaIb;w4rSdf:XKiZ9;w9w86d:dt4g2b;wQlYve:aLUfP;wR5FRb:TtcOte;wV5Pjc:L8KGxe;whEZac:F4AmNb;xBbsrc:NEW1Qc;xbe2wc:uRMPBc;yGxLoc:FmAr0c;yxTchf:KUM7Z;z97YGf:oug9te;zOsCQe:Ko78Df;zaIgPb:Qtpxbd/m=attn,cdos,gwc,hsm,jsa,mb4ZUb,d,csi,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=s82NdxBaGSH8HxMBLOcwvQpPzv4y-mUgW_d9F7q5R75kTlIRPMncU7iV21f6MmTKzsbm9O89dDCBLJZZNbykzIqZ9LcgUs96i2BkApgz8PH3PiG1Fhzsjr2PRztNhbt9gnl94FekHS0ArONy3z7WCbcUNDAac--5IhXnjkI59xc
2024-01-30 17:51:40 UTC	818	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding, Origin Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="gws-team" Report-To: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]} Content-Length: 996634 Date: Tue, 30 Jan 2024 17:51:40 GMT Expires: Wed, 29 Jan 2025 17:51:40 GMT Cache-Control: public, immutable, max-age=31536000 Last-Modified: Tue, 30 Jan 2024 06:37:49 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:40 UTC	434	IN	Data Raw: 74 68 69 73 2e 5f 73 3d 74 68 69 73 2e 5f 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 2f 2a 0a 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 2f 2a 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 0a 2f 2a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 Data Ascii: this._s=this._s\|\|{};(function(_){var window=this;try{/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0// SPDX-License-Identifier: Apache-2.0// SPDX-License-Identifier: Apache-2.0 // Copyright The Closure Lib
2024-01-30 17:51:40 UTC	1252	IN	Data Raw: 61 61 2c 77 61 61 2c 41 61 61 2c 79 61 61 2c 42 61 61 2c 44 61 61 2c 43 61 61 2c 45 61 61 2c 46 61 61 2c 47 61 61 2c 49 61 61 2c 4a 61 61 2c 4f 61 61 2c 24 61 61 2c 66 62 61 2c 71 62 61 2c 73 62 61 2c 77 62 61 2c 78 62 61 2c 43 62 61 2c 44 62 61 2c 47 62 61 2c 4b 62 61 2c 4d 62 61 2c 24 62 61 2c 63 63 61 2c 62 63 61 2c 65 63 61 2c 48 62 61 2c 65 62 2c 66 63 61 2c 67 63 61 2c 68 62 2c 69 63 61 2c 6c 63 61 2c 6d 63 61 2c 6e 63 61 2c 70 63 61 2c 74 63 61 2c 75 63 61 2c 76 63 61 2c 77 63 61 2c 79 63 61 2c 41 63 61 2c 44 63 61 2c 45 63 61 2c 47 63 61 2c 49 63 61 2c 4a 63 61 2c 4c 63 61 2c 50 63 61 2c 53 63 61 2c 55 63 61 2c 56 63 61 2c 63 64 61 2c 64 64 61 2c 65 64 61 2c 61 64 61 2c 66 64 61 2c 24 63 61 2c 67 64 61 2c 5a 63 61 2c 68 64 61 2c 69 64 61 2c 6f 64 Data Ascii: aa,waa,Aaa,yaa,Baa,Daa,Caa,Eaa,Faa,Gaa,Iaa,Jaa,Oaa,$aa,fba,qba,sba,wba,xba,Cba,Dba,Gba,Kba,Mba,$ba,cca,bca,eca,Hba,eb,fca,gca,hb,ica,lca,mca,nca,pca,tca,uca,vca,wca,yca,Aca,Dca,Eca,Gca,Ica,Jca,Lca,Pca,Sca,Uca,Vca,cda,dda,eda,ada,fda,$ca,gda,Zca,hda,ida,od
2024-01-30 17:51:40 UTC	1252	IN	Data Raw: 61 2c 61 72 61 2c 66 72 61 2c 69 72 61 2c 6b 72 61 2c 6c 72 61 2c 6f 72 61 2c 71 72 61 2c 72 72 61 2c 75 72 61 2c 73 67 2c 77 72 61 2c 79 72 61 2c 42 72 61 2c 43 72 61 2c 48 72 61 2c 4b 72 61 2c 4e 72 61 2c 4f 72 61 2c 50 72 61 2c 56 72 61 2c 61 73 61 2c 24 72 61 2c 64 73 61 2c 6c 73 61 2c 6e 73 61 2c 71 73 61 2c 73 73 61 2c 74 73 61 2c 76 73 61 2c 79 73 61 2c 77 73 61 2c 49 73 61 2c 54 73 61 2c 56 73 61 2c 57 73 61 2c 58 73 61 2c 49 67 2c 59 73 61 2c 24 73 61 2c 61 74 61 2c 62 74 61 2c 64 74 61 2c 68 74 61 2c 6a 74 61 2c 6b 74 61 2c 6d 74 61 2c 70 74 61 2c 6e 74 61 2c 6f 74 61 2c 71 74 61 2c 72 74 61 2c 0a 73 74 61 3b 5f 2e 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 45 72 72 6f 72 2e 63 61 70 74 75 72 65 53 74 61 63 6b 54 72 61 63 65 29 Data Ascii: a,ara,fra,ira,kra,lra,ora,qra,rra,ura,sg,wra,yra,Bra,Cra,Hra,Kra,Nra,Ora,Pra,Vra,asa,$ra,dsa,lsa,nsa,qsa,ssa,tsa,vsa,ysa,wsa,Isa,Tsa,Vsa,Wsa,Xsa,Ig,Ysa,$sa,ata,bta,dta,hta,jta,kta,mta,pta,nta,ota,qta,rta,sta;_.aa=function(a,b){if(Error.captureStackTrace)
2024-01-30 17:51:40 UTC	1252	IN	Data Raw: 74 68 3d 30 29 3b 72 65 74 75 72 6e 20 63 61 61 28 66 2c 65 29 7d 3b 5f 2e 68 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 3b 64 3f 28 65 3d 65 61 61 29 7c 7c 28 65 3d 65 61 61 3d 6e 65 77 20 54 65 78 74 44 65 63 6f 64 65 72 28 22 75 74 66 2d 38 22 2c 7b 66 61 74 61 6c 3a 21 30 7d 29 29 3a 28 65 3d 66 61 61 29 7c 7c 28 65 3d 66 61 61 3d 6e 65 77 20 54 65 78 74 44 65 63 6f 64 65 72 28 22 75 74 66 2d 38 22 2c 7b 66 61 74 61 6c 3a 21 31 7d 29 29 3b 63 3d 62 2b 63 3b 61 3d 30 3d 3d 3d 62 26 26 63 3d 3d 3d 61 2e 6c 65 6e 67 74 68 3f 61 3a 61 2e 73 75 62 61 72 72 61 79 28 62 2c 63 29 3b 74 72 79 7b 72 65 74 75 72 6e 20 65 2e 64 65 63 6f 64 65 28 61 29 7d 63 61 74 63 68 28 66 29 7b 69 66 28 62 3d 64 29 7b 69 66 28 76 6f 69 64 20 Data Ascii: th=0);return caa(f,e)};_.haa=function(a,b,c,d){var e;d?(e=eaa)\|\|(e=eaa=new TextDecoder("utf-8",{fatal:!0})):(e=faa)\|\|(e=faa=new TextDecoder("utf-8",{fatal:!1}));c=b+c;a=0===b&&c===a.length?a:a.subarray(b,c);try{return e.decode(a)}catch(f){if(b=d){if(void
2024-01-30 17:51:40 UTC	79	IN	Data Raw: 6e 20 5f 2e 6d 61 61 3f 5f 2e 65 61 3f 5f 2e 65 61 2e 62 72 61 6e 64 73 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 28 62 3d 62 2e 62 72 61 6e 64 29 26 26 5f 2e 66 61 28 62 2c 61 29 7d 29 3a 21 31 3a 21 31 7d Data Ascii: n _.maa?_.ea?_.ea.brands.some(function(b){return(b=b.brand)&&_.fa(b,a)}):!1:!1}
2024-01-30 17:51:40 UTC	1252	IN	Data Raw: 3b 5f 2e 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 5f 2e 66 61 28 5f 2e 64 61 28 29 2c 61 29 7d 3b 0a 6f 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 3d 52 65 67 45 78 70 28 22 28 5b 41 2d 5a 5d 5b 5c 5c 77 20 5d 2b 29 2f 28 5b 5e 5c 5c 73 5d 2b 29 5c 5c 73 2a 28 3f 3a 5c 5c 28 28 2e 2a 3f 29 5c 5c 29 29 3f 22 2c 22 67 22 29 2c 63 3d 5b 5d 2c 64 3b 64 3d 62 2e 65 78 65 63 28 61 29 3b 29 63 2e 70 75 73 68 28 5b 64 5b 31 5d 2c 64 5b 32 5d 2c 64 5b 33 5d 7c 7c 76 6f 69 64 20 30 5d 29 3b 72 65 74 75 72 6e 20 63 7d 3b 70 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 21 3d 3d 61 26 26 61 7c 7c 5f 2e 6d 61 61 3f 21 21 5f 2e 65 61 26 26 30 3c 5f 2e 65 61 2e 62 72 61 6e 64 73 Data Ascii: ;_.ha=function(a){return _.fa(_.da(),a)};oaa=function(a){for(var b=RegExp("([A-Z][\\w ]+)/([^\\s]+)\\s(?:\$(.?)\$)?","g"),c=[],d;d=b.exec(a);)c.push([d[1],d[2],d[3]\|\|void 0]);return c};paa=function(a){return void 0!==a&&a\|\|_.maa?!!_.ea&&0<_.ea.brands
2024-01-30 17:51:40 UTC	1252	IN	Data Raw: 62 28 5b 22 43 68 72 6f 6d 65 22 2c 22 43 72 69 4f 53 22 2c 22 48 65 61 64 6c 65 73 73 43 68 72 6f 6d 65 22 5d 29 3a 28 61 3d 61 5b 32 5d 29 26 26 61 5b 31 5d 7c 7c 22 22 7d 3b 0a 43 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 2f 72 76 3a 20 2a 28 5b 5c 64 5c 2e 5d 2a 29 2f 2e 65 78 65 63 28 61 29 3b 69 66 28 62 26 26 62 5b 31 5d 29 72 65 74 75 72 6e 20 62 5b 31 5d 3b 62 3d 22 22 3b 76 61 72 20 63 3d 2f 4d 53 49 45 20 2b 28 5b 5c 64 5c 2e 5d 2b 29 2f 2e 65 78 65 63 28 61 29 3b 69 66 28 63 26 26 63 5b 31 5d 29 69 66 28 61 3d 2f 54 72 69 64 65 6e 74 5c 2f 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 61 29 2c 22 37 2e 30 22 3d 3d 63 5b 31 5d 29 69 66 28 61 26 26 61 5b 31 5d 29 73 77 69 74 63 68 28 61 5b 31 5d 29 7b 63 61 73 65 20 22 34 2e 30 Data Ascii: b(["Chrome","CriOS","HeadlessChrome"]):(a=a[2])&&a[1]\|\|""};Caa=function(a){var b=/rv: ([\d\.])/.exec(a);if(b&&b[1])return b[1];b="";var c=/MSIE +([\d\.]+)/.exec(a);if(c&&c[1])if(a=/Trident\/(\d.\d)/.exec(a),"7.0"==c[1])if(a&&a[1])switch(a[1]){case "4.0
2024-01-30 17:51:40 UTC	1252	IN	Data Raw: 6e 64 3d 3d 3d 61 7d 29 29 72 65 74 75 72 6e 7d 65 6c 73 65 20 69 66 28 22 22 3d 3d 3d 62 29 72 65 74 75 72 6e 3b 72 65 74 75 72 6e 20 6e 65 77 20 48 61 61 28 61 2c 63 2c 62 29 7d 3b 0a 4a 61 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 2e 6d 61 61 3f 21 21 5f 2e 65 61 26 26 21 21 5f 2e 65 61 2e 70 6c 61 74 66 6f 72 6d 3a 21 31 7d 3b 5f 2e 69 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4a 61 61 28 29 3f 22 41 6e 64 72 6f 69 64 22 3d 3d 3d 5f 2e 65 61 2e 70 6c 61 74 66 6f 72 6d 3a 5f 2e 68 61 28 22 41 6e 64 72 6f 69 64 22 29 7d 3b 5f 2e 4b 61 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 2e 68 61 28 22 69 50 68 6f 6e 65 22 29 26 26 21 5f 2e 68 61 28 22 69 50 6f 64 22 29 26 26 21 5f 2e 68 61 28 22 69 50 61 Data Ascii: nd===a}))return}else if(""===b)return;return new Haa(a,c,b)};Jaa=function(){return _.maa?!!_.ea&&!!_.ea.platform:!1};_.ia=function(){return Jaa()?"Android"===_.ea.platform:_.ha("Android")};_.Kaa=function(){return _.ha("iPhone")&&!_.ha("iPod")&&!_.ha("iPa
2024-01-30 17:51:40 UTC	1252	IN	Data Raw: 61 2e 6c 65 6e 67 74 68 2d 31 3b 30 3c 3d 65 3b 2d 2d 65 29 65 20 69 6e 20 64 26 26 62 2e 63 61 6c 6c 28 63 2c 64 5b 65 5d 2c 65 2c 61 29 7d 3b 5f 2e 72 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 62 3d 5f 2e 71 61 28 61 2c 62 2c 63 29 3b 72 65 74 75 72 6e 20 30 3e 62 3f 6e 75 6c 6c 3a 22 73 74 72 69 6e 67 22 3d 3d 3d 74 79 70 65 6f 66 20 61 3f 61 2e 63 68 61 72 41 74 28 62 29 3a 61 5b 62 5d 7d 3b 5f 2e 71 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 66 6f 72 28 76 61 72 20 64 3d 61 2e 6c 65 6e 67 74 68 2c 65 3d 22 73 74 72 69 6e 67 22 3d 3d 3d 74 79 70 65 6f 66 20 61 3f 61 2e 73 70 6c 69 74 28 22 22 29 3a 61 2c 66 3d 30 3b 66 3c 64 3b 66 2b 2b 29 69 66 28 66 20 69 6e 20 65 26 26 62 2e 63 61 6c 6c 28 63 2c 65 5b 66 5d 2c 66 2c 61 29 29 Data Ascii: a.length-1;0<=e;--e)e in d&&b.call(c,d[e],e,a)};_.ra=function(a,b,c){b=_.qa(a,b,c);return 0>b?null:"string"===typeof a?a.charAt(b):a[b]};_.qa=function(a,b,c){for(var d=a.length,e="string"===typeof a?a.split(""):a,f=0;f<d;f++)if(f in e&&b.call(c,e[f],f,a))
2024-01-30 17:51:40 UTC	1252	IN	Data Raw: 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 61 72 67 75 6d 65 6e 74 73 5b 63 5d 3b 69 66 28 5f 2e 46 61 28 64 29 29 7b 76 61 72 20 65 3d 61 2e 6c 65 6e 67 74 68 7c 7c 30 2c 66 3d 64 2e 6c 65 6e 67 74 68 7c 7c 30 3b 61 2e 6c 65 6e 67 74 68 3d 65 2b 66 3b 66 6f 72 28 76 61 72 20 67 3d 30 3b 67 3c 66 3b 67 2b 2b 29 61 5b 65 2b 67 5d 3d 64 5b 67 5d 7d 65 6c 73 65 20 61 2e 70 75 73 68 28 64 29 7d 7d 3b 5f 2e 4b 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 72 65 74 75 72 6e 20 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 70 6c 69 63 65 2e 61 70 70 6c 79 28 61 2c 5f 2e 59 61 61 28 61 72 67 75 6d 65 6e 74 73 2c 31 29 29 7d 3b 5f 2e 59 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 Data Ascii: uments.length;c++){var d=arguments[c];if(_.Fa(d)){var e=a.length\|\|0,f=d.length\|\|0;a.length=e+f;for(var g=0;g<f;g++)a[e+g]=d[g]}else a.push(d)}};_.Ka=function(a,b,c,d){return Array.prototype.splice.apply(a,_.Yaa(arguments,1))};_.Yaa=function(a,b,c){return

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.17	49745	216.239.34.157	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:40 UTC	286	OUT	CONNECT www.microsoft.com:443 HTTP/1.1 Host: www.microsoft.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 chrome-tunnel: key=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
2024-01-30 17:51:40 UTC	145	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Date: Tue, 30 Jan 2024 17:51:40 GMT Content-Length: 16 Connection: close
2024-01-30 17:51:40 UTC	16	IN	Data Raw: 49 6e 76 61 6c 69 64 20 70 72 6f 74 6f 63 6f 6c Data Ascii: Invalid protocol

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.17	49744	172.217.23.99	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:40 UTC	1135	OUT	GET /verify/ANsg4T5QHLvXpo4u06bQ1eEiExZGAYDL-COfDItNG4_cYY8YaN7qmLTCN_DEz-68J9Rsr_JOG2lQzsVa3hABiNicX3XPnK-qGPe1tOZGBNUUFvQmQfsQLw HTTP/1.1 Host: id.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=s82NdxBaGSH8HxMBLOcwvQpPzv4y-mUgW_d9F7q5R75kTlIRPMncU7iV21f6MmTKzsbm9O89dDCBLJZZNbykzIqZ9LcgUs96i2BkApgz8PH3PiG1Fhzsjr2PRztNhbt9gnl94FekHS0ArONy3z7WCbcUNDAac--5IhXnjkI59xc
2024-01-30 17:51:41 UTC	827	IN	HTTP/1.1 204 No Content Content-Type: text/plain; charset=UTF-8 Date: Tue, 30 Jan 2024 17:51:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Cross-Origin-Resource-Policy: cross-origin P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Server: scaffolding on HTTPServer2 Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; expires=Wed, 31-Jul-2024 17:51:41 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.17	49746	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:40 UTC	1552	OUT	POST /gen_204?s=web&t=aft&atyp=csi&ei=Kze5ZY_EKtunqtsPm7mdiAw&rt=wsrt.348,aft.675,afti.675,aftr.399,afts.356,frts.326,frvt.675,hst.151,prt.491,sct.295&frtp=317&imn=38&ima=3&imad=2&imac=3&wh=870&aft=1&aftp=870&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=s82NdxBaGSH8HxMBLOcwvQpPzv4y-mUgW_d9F7q5R75kTlIRPMncU7iV21f6MmTKzsbm9O89dDCBLJZZNbykzIqZ9LcgUs96i2BkApgz8PH3PiG1Fhzsjr2PRztNhbt9gnl94FekHS0ArONy3z7WCbcUNDAac--5IhXnjkI59xc
2024-01-30 17:51:41 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-u8PWvgWd4Zdz4yyRohtJTQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:41 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.17	49747	216.239.34.157	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:41 UTC	284	OUT	CONNECT www.lifewire.com:443 HTTP/1.1 Host: www.lifewire.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 chrome-tunnel: key=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
2024-01-30 17:51:41 UTC	145	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Date: Tue, 30 Jan 2024 17:51:41 GMT Content-Length: 16 Connection: close
2024-01-30 17:51:41 UTC	16	IN	Data Raw: 49 6e 76 61 6c 69 64 20 70 72 6f 74 6f 63 6f 6c Data Ascii: Invalid protocol

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.17	49748	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:41 UTC	1913	OUT	POST /gen_204?atyp=csi&ei=Kze5ZY_EKtunqtsPm7mdiAw&s=web&t=all&frtp=317&imn=38&ima=3&imad=2&imac=3&wh=870&aft=1&aftp=870&adh=tv.6&ime=0&imex=0&imeh=8&imeha=1&imehb=2&imea=0&imeb=8&imel=0&imed=0&scp=0&fld=967&mem=ujhs.7,tjhs.11,jhsl.2173,dm.8&nv=ne.1,feid.a38542f8-984d-4d30-89f1-82d3bde73909&net=dl.10000,ect.4g,rtt.200&hp=&sys=hc.4&p=bs.false&rt=hst.151,sct.295,frts.326,prt.491,xjsls.603,dcl.607,frvt.675,afti.675,afts.356,aftr.399,aft.675,aftqf.676,xjses.1746,xjsee.1786,xjs.1786,lcp.441,fcp.277,wsrt.348,cst.0,dnst.0,rqst.916,rspt.598,rqstt.30,unt.7,cstt.7,dit.955&zx=1706637100756&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq
2024-01-30 17:51:42 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-kOKXZOACrWlSnWpmgnU0wA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:42 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.17	49760	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:42 UTC	1467	OUT	GET /compressiontest/gzip.html HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
2024-01-30 17:51:42 UTC	1734	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Date: Tue, 30 Jan 2024 17:51:42 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-sHO63RsEA7V8ZxVYuZe74A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Encoding: gzip Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-01-30-17; expires=Thu, 29-Feb-2024 17:51:42 GMT; path=/; domain=.google.com; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:42 UTC	122	IN	Data Raw: 30 30 30 30 30 30 30 31 0d 0a 1f 0d 0a 30 30 30 30 30 30 30 31 0d 0a 8b 0d 0a 30 30 30 30 30 30 30 31 0d 0a 08 0d 0a 30 30 30 30 30 30 30 31 0d 0a 00 0d 0a 30 30 30 30 30 30 30 31 0d 0a 00 0d 0a 30 30 30 30 30 30 30 31 0d 0a 00 0d 0a 30 30 30 30 31 0d 0a 00 0d 0a 31 63 0d 0a 00 02 ff b3 51 4c c9 4f 2e a9 2c 48 55 c8 28 c9 cd b1 03 00 48 ec b9 87 0f 00 00 00 0d 0a Data Ascii: 000000010000000100000001000000010000000100000001000011cQLO.,HU(H
2024-01-30 17:51:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.17	49762	142.251.15.119	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:42 UTC	820	OUT	GET /vi/m5Xz14RNOEE/mqdefault.jpg?sqp=-oaymwEFCJQBEFM&rs=AMzJL3k77br3KKy0bjWbmhAEHJOrBx75iw HTTP/1.1 Host: i.ytimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:51:42 UTC	657	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Timing-Allow-Origin: * Content-Length: 3850 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 30 Jan 2024 16:54:51 GMT Expires: Tue, 30 Jan 2024 18:54:51 GMT Cache-Control: public, max-age=7200 Age: 3411 ETag: "1686597455" Content-Type: image/jpeg Vary: Origin Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:42 UTC	595	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 84 00 09 06 07 08 07 06 09 08 07 08 0a 0a 09 0b 0d 16 0f 0d 0c 0c 0d 1b 14 15 10 16 20 1d 22 22 20 1d 1f 1f 24 28 34 2c 24 26 31 27 1f 1f 2d 3d 2d 31 35 37 3a 3a 3a 23 2b 3f 44 3f 38 43 34 39 3a 37 01 0a 0a 0a 0d 0c 0d 1a 0f 0f 1a 37 25 1f 25 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 ff c0 00 11 08 00 53 00 94 03 01 22 00 02 11 01 03 11 01 ff c4 00 1b 00 01 00 02 03 01 01 00 00 00 00 00 00 00 00 00 00 00 04 05 02 03 06 01 07 ff c4 00 3c 10 00 02 01 03 03 02 04 02 06 08 05 05 00 00 00 00 01 02 03 00 04 11 05 12 21 13 31 06 14 22 41 51 61 15 23 32 42 71 81 16 35 52 53 72 92 93 d1 33 Data Ascii: JFIF "" $(4,$&1'-=-157:::#+?D?8C49:77%%77777777777777777777777777777777777777777777777777S"<!1"AQa#2Bq5RSr3
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 8c 3e b1 f6 26 08 3c e5 81 1c 76 f7 c5 49 7d b8 30 5c 3a a3 7e ad e2 55 f9 a6 6a ce 6f 0f 6a f0 ab 99 2c 9b d1 21 8c aa c8 8c d9 c8 1c 28 39 23 2c a3 23 8e 45 62 fa 06 aa 92 34 66 cd 89 53 10 25 64 46 5c c8 e6 35 e4 1c 1f 58 20 fc 31 ce 29 45 5b 63 98 70 ea 8d fa b7 89 57 66 99 ab 28 f4 1d 52 4e 80 4b 65 67 9d 4b c7 18 9e 3d ec a0 13 9d bb b3 8f 49 e7 15 84 7a 2e a3 25 b3 5c 25 ba 14 50 84 8e bc 7b bd 6a 19 06 dd d9 cb 03 c0 f7 a9 da 5b f8 87 54 6f f5 bc 4a 06 69 9a 97 73 a6 de 5a 5e 25 9d c4 21 26 75 dc a0 3a b0 23 24 7d a0 48 ee ac 3e 44 56 7f 44 5e fe e9 7f 9c 53 8d 91 12 0a ba 9d 7b ba 82 59 27 e0 a0 e6 99 a9 df 44 5e fe e9 7f 9c 53 e8 8b df dd 2f f3 8a 98 a4 9f 15 f7 03 d1 41 cd 33 53 be 88 bd fd d2 ff 00 38 ac 27 d3 6e a0 89 a5 92 30 11 7b fa 81 a2 Data Ascii: >&<vI}0\:~Ujoj,!(9#,#Eb4fS%dF\5X 1)E[cpWf(RNKegK=Iz.%\%P{j[ToJisZ^%!&u:#$}H>DVD^S{Y'D^S/A3S8'n0{
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 52 65 2b b8 9c 9f b7 19 cf 07 83 5c b2 b4 4b 22 b4 e2 53 08 3e b1 11 01 f1 f2 cf 19 ae 91 bc 2f 0c d7 37 89 62 f7 ad 0d 95 e4 b6 d7 0f 20 43 b4 24 25 c3 70 3b 16 da 3f 3a cf 74 db 6c 8d 69 d3 d7 cd 73 77 91 b7 77 35 5f 7f aa c5 73 aa e8 f7 de 62 ee 68 ed 1e d8 9b 69 20 0a 20 58 fa 5b f6 36 e3 bb 71 8c 9e c2 a6 de 78 8a 0d 46 c2 f6 29 2e 6f ad 2e ae a0 48 a4 b8 4b 75 72 ca af 37 a4 80 eb c1 49 14 66 b4 6a 9a 2d 96 9f 65 73 2f 9a ba 96 48 e4 58 c6 c8 c3 24 6c 52 37 55 93 1c 8d db db 0d c0 f4 e0 f3 52 b4 ff 00 0c 41 77 6b a6 4c d2 5f 29 ba 89 24 7c 22 ed 90 b4 32 c9 b2 23 8e 58 18 86 41 cf 0d 55 b8 d9 ec da f3 30 34 cb 86 7c 3f 6b 34 35 65 37 88 74 bb 9b 3b b8 a4 37 91 be a5 bc 4e 9e 5f 71 b7 dd 04 71 e4 1d db 5c 03 17 c4 1f 50 e2 b6 fe 9a 46 8f d6 b7 82 ee Data Ascii: Re+\K"S>/7b C$%p;?:tlisww5_sbhi X[6qxF).o.HKur7Ifj-es/HX$lR7URAwkL_)$\|"2#XAU04\|?k45e7t;7N_qq\PF
2024-01-30 17:51:42 UTC	751	IN	Data Raw: 06 b4 66 a6 45 e2 89 e0 b9 ea 41 a6 c0 91 04 8d 12 33 72 c7 68 5e b9 fb 5b 79 c9 b8 63 d8 63 00 54 49 f5 97 b9 d3 61 b5 ba d3 62 92 6b 73 14 90 ce 6e 5b d3 2c 71 2c 61 ca ed f5 7d 80 71 9f 96 7d ea fa 5f 03 05 be 8a da 3d 71 1d 7c d3 5a dc 3f 91 20 c2 e2 dc ce 30 37 fa 81 51 8e e3 04 d6 9b 7f 06 09 e5 8c fd 35 12 da 5c 8b 6f 27 38 b4 62 66 33 a9 64 0c 9b bd 1c 0e 4e 4f 7a 9d ca 80 32 1b 9f 32 93 15 35 51 7f ac bd d5 c5 cc d0 e9 d6 f6 de 66 da e6 17 51 31 63 ba 76 dc f2 16 da 33 83 d9 71 c0 f7 ad 57 da ac f7 d6 76 96 92 5b 45 1c 76 84 08 08 90 b3 22 74 d5 59 3b 0c ee 65 0e 4f c7 23 e7 56 3a 8f 86 4e 9f a3 35 ec 9a 94 6f 77 1d bc 37 13 59 8b 72 36 24 92 f4 86 24 dd 83 86 07 d8 64 57 b6 1e 1d b4 bc b8 d1 6c df 5c e8 df ea f0 09 e2 b7 f2 05 c2 21 dd dd fa 83 Data Ascii: fEA3rh^[yccTIabksn[,q,a}q}_=q\|Z? 07Q5\o'8bf3dNOz225QfQ1cv3qWv[Ev"tY;eO#V:N5ow7Yr6$$dWl\!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.17	49759	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:42 UTC	1497	OUT	GET /complete/search?q&cp=0&client=gws-wiz-serp&xssi=t&gs_pcrt=2&hl=en&authuser=0&pq=directx%20runtime&psi=Kze5ZY_EKtunqtsPm7mdiAw.1706637100809&dpr=1&ofp=GJrdgLGE5beKmQEYj7nR6tHOn6peGIGjt8XCkruerAEY5MrUtIevsffuARi4qbvXxoPa_io&nolsbt=1 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq
2024-01-30 17:51:42 UTC	1737	IN	HTTP/1.1 200 OK X-Content-Type-Options: nosniff Date: Tue, 30 Jan 2024 17:51:42 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: application/json; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-VOV6TXllLL9OK-IdxHCoSg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:42 UTC	1737	IN	Data Raw: 31 35 37 64 0d 0a 29 5d 7d 27 0a 5b 5b 5b 22 6d 69 63 72 6f 73 6f 66 74 20 76 69 73 75 61 6c 20 63 2b 2b 22 2c 30 2c 5b 35 31 32 2c 36 35 30 2c 36 37 2c 33 36 32 2c 33 30 38 5d 2c 7b 22 7a 6c 22 3a 39 30 30 30 30 7d 5d 2c 5b 22 6d 69 63 72 6f 73 6f 66 74 20 76 69 73 75 61 6c 20 63 2b 2b 20 72 75 6e 74 69 6d 65 22 2c 30 2c 5b 35 31 32 2c 36 35 30 2c 36 37 2c 33 36 32 2c 33 30 38 5d 2c 7b 22 7a 6c 22 3a 39 30 30 30 30 7d 5d 2c 5b 22 6d 69 63 72 6f 73 6f 66 74 20 76 69 73 75 61 6c 20 63 2b 2b 20 72 75 6e 74 69 6d 65 20 64 6f 77 6e 6c 6f 61 64 22 2c 30 2c 5b 35 31 32 2c 36 35 30 2c 36 37 2c 33 36 32 2c 33 30 38 5d 2c 7b 22 7a 6c 22 3a 39 30 30 30 30 7d 5d 2c 5b 22 63 2b 2b 20 72 75 6e 74 69 6d 65 22 2c 30 2c 5b 35 31 32 2c 36 35 30 2c 36 37 2c 33 36 32 2c 33 Data Ascii: 157d)]}'[[["microsoft visual c++",0,[512,650,67,362,308],{"zl":90000}],["microsoft visual c++ runtime",0,[512,650,67,362,308],{"zl":90000}],["microsoft visual c++ runtime download",0,[512,650,67,362,308],{"zl":90000}],["c++ runtime",0,[512,650,67,362,3
2024-01-30 17:51:42 UTC	1737	IN	Data Raw: 74 61 74 69 63 2e 63 6f 6d 2f 6c 69 63 65 6e 73 65 64 2d 69 6d 61 67 65 3f 71 5c 75 30 30 33 64 74 62 6e 3a 41 4e 64 39 47 63 51 49 57 62 4f 57 43 7a 38 73 48 77 6d 58 71 72 38 79 46 33 31 39 33 73 56 59 6c 44 36 70 59 6e 5a 61 78 61 34 74 62 4e 30 70 70 48 37 48 31 49 5f 79 53 63 53 63 6e 77 30 4a 44 79 46 66 5a 42 53 6d 74 4e 6b 2d 63 39 74 49 4a 71 76 38 6f 57 52 59 31 63 65 72 58 78 44 64 7a 41 41 5c 75 30 30 32 36 73 5c 75 30 30 33 64 31 39 22 5d 2c 22 7a 66 22 3a 33 33 2c 22 7a 68 22 3a 22 49 6c 68 61 6e 20 4f 6d 61 72 22 2c 22 7a 69 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 20 52 65 70 72 65 73 65 6e 74 61 74 69 76 65 22 2c 22 7a 6c 22 3a 39 30 30 30 31 2c 22 7a 70 22 3a 7b 22 67 73 5f 73 73 70 22 3a 22 65 4a 7a 6a 34 74 56 50 31 7a 63 30 54 Data Ascii: tatic.com/licensed-image?q\u003dtbn:ANd9GcQIWbOWCz8sHwmXqr8yF3193sVYlD6pYnZaxa4tbN0ppH7H1I_yScScnw0JDyFfZBSmtNk-c9tIJqv8oWRY1cerXxDdzAA\u0026s\u003d19"],"zf":33,"zh":"Ilhan Omar","zi":"United States Representative","zl":90001,"zp":{"gs_ssp":"eJzj4tVP1zc0T
2024-01-30 17:51:42 UTC	1737	IN	Data Raw: 53 32 6d 75 38 41 69 6b 69 4a 57 53 50 44 4b 77 35 67 6a 6b 61 56 4a 33 51 57 53 58 32 68 2b 79 61 66 39 70 45 38 6c 69 71 77 77 45 4d 78 65 50 66 69 64 67 34 59 2b 2f 4a 78 52 65 7a 6d 6a 58 4f 72 61 70 5a 57 73 4b 4f 6f 6d 4f 4f 38 34 44 77 71 4d 62 6e 4e 56 69 2b 66 69 76 48 55 73 53 35 66 4a 7a 36 37 6e 36 31 70 58 32 63 39 71 56 37 50 52 58 72 58 30 38 30 6b 41 6a 58 75 62 52 64 2b 4a 79 64 79 4d 38 74 68 39 61 68 46 4f 4d 58 52 4a 75 33 79 56 61 65 31 6e 74 44 4c 48 63 51 75 68 37 31 6c 59 73 70 41 79 4f 6c 4c 57 34 7a 77 6d 70 72 74 37 72 6f 31 7a 58 6b 6b 68 76 48 6c 73 6e 6a 56 6f 6f 32 47 4f 36 4a 48 69 55 6a 7a 7a 31 39 61 68 4a 46 6b 67 73 44 63 67 65 41 53 4c 45 44 6e 38 78 42 49 2b 69 6b 31 4f 2f 62 62 49 31 62 70 43 47 6f 33 78 47 59 49 6a Data Ascii: S2mu8AikiJWSPDKw5gjkaVJ3QWSX2h+yaf9pE8liqwwEMxePfidg4Y+/JxRezmjXOrapZWsKOomOO84DwqMbnNVi+fivHUsS5fJz67n61pX2c9qV7PRXrX080kAjXubRd+JydyM8th9ahFOMXRJu3yVae1ntDLHcQuh71lYspAyOlLW4zwmprt7ro1zXkkhvHlsnjVoo2GO6JHiUjzz19ahJFkgsDcgeASLEDn8xBI+ik1O/bbI1bpCGo3xGYIj
2024-01-30 17:51:42 UTC	298	IN	Data Raw: 38 73 44 69 55 78 67 5a 34 73 67 65 59 50 4c 4e 5a 4e 45 6d 4c 6b 37 35 34 56 46 58 48 51 75 30 6c 39 6f 32 6c 54 32 6d 6d 79 4e 42 4a 4e 4f 6b 6a 7a 4c 7a 77 42 79 48 78 78 55 33 46 37 61 69 56 4a 71 2b 53 71 36 78 48 62 70 32 6b 6d 6a 73 7a 4b 31 75 72 38 4b 4e 4c 67 4d 77 48 55 2b 57 66 4b 70 75 77 73 77 7a 52 6d 5a 6a 33 66 48 34 75 48 6e 6a 72 39 4b 69 4e 52 75 47 76 64 65 61 35 6d 34 65 2f 6c 6b 34 6e 43 71 46 47 2b 2b 63 44 31 7a 56 6f 73 6c 78 42 69 73 65 62 4e 50 47 36 69 64 72 30 37 52 59 73 38 48 4f 61 4e 52 30 33 73 74 70 4f 6e 39 32 39 74 61 52 73 77 47 30 73 67 34 32 50 78 50 4b 71 52 39 6f 65 6c 50 66 64 74 37 53 43 4c 4b 68 6f 46 6d 4a 48 6b 4d 72 2b 6f 46 61 44 32 57 75 2f 62 64 42 73 35 53 63 75 69 39 32 2f 76 58 61 6d 6e 61 4b 31 68 47 Data Ascii: 8sDiUxgZ4sgeYPLNZNEmLk754VFXHQu0l9o2lT2mmyNBJNOkjzLzwByHxxU3F7aiVJq+Sq6xHbp2kmjszK1ur8KNLgMwHU+WfKpuwswzRmZj3fH4uHnjr9KiNRuGvdea5m4e/lk4nCqFG++cD1zVoslxBisebNPG6idr07RYs8HOaNR03stpOn929taRswG0sg42PxPKqR9oelPfdt7SCLKhoFmJHkMr+oFaD2Wu/bdBs5Scui92/vXamnaK1hG
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 31 66 31 35 0d 0a 4e 49 45 39 6e 47 41 6f 41 41 50 4c 4a 49 41 35 37 43 72 52 59 49 59 4c 56 59 38 37 44 49 7a 52 4c 36 38 68 37 38 32 31 71 4d 6b 4c 78 53 4e 31 48 75 70 4f 34 76 37 53 4b 33 52 46 6b 6b 44 38 4f 34 43 5a 4e 63 36 63 70 53 58 4a 30 49 51 6a 48 6f 54 4e 69 34 75 6a 64 77 54 4d 73 34 42 41 4b 73 52 67 48 79 77 64 71 69 45 37 4f 57 79 38 61 53 57 71 4d 48 63 75 32 53 78 79 54 31 35 2b 70 71 53 74 64 55 4d 55 79 76 33 55 33 73 7a 41 38 66 65 34 4c 41 35 35 6a 42 4e 53 79 33 4e 72 4f 41 36 73 72 4b 65 75 61 69 35 7a 53 71 77 32 51 62 74 6f 7a 58 74 42 70 35 30 61 36 6a 56 6f 32 6b 73 5a 52 68 44 6e 78 44 7a 58 34 55 79 30 63 72 46 44 71 56 7a 4b 33 43 76 65 6b 41 2b 51 71 37 39 73 72 64 4c 76 51 72 6c 6b 47 57 69 78 49 6d 42 2f 4b 64 2f 70 6d Data Ascii: 1f15NIE9nGAoAAPLJIA57CrRYIYLVY87DIzRL68h7821qMkLxSN1HupO4v7SK3RFkkD8O4CZNc6cpSXJ0IQjHoTNi4ujdwTMs4BAKsRgHywdqiE7OWy8aSWqMHcu2SxyT15+pqStdUMUyv3U3szA8fe4LA55jBNSy3NrOA6srKeuai5zSqw2QbtozXtBp50a6jVo2ksZRhDnxDzX4Uy0crFDqVzK3CvekA+Qq79srdLvQrlkGWixImB/Kd/pm
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 2f 77 43 5a 76 58 30 72 58 67 30 38 74 74 50 79 59 4d 32 6f 69 70 57 76 41 33 44 53 58 45 7a 58 45 70 50 45 78 4f 4d 31 4d 61 4b 52 44 4b 6a 76 2b 64 77 69 2b 70 4e 52 31 75 66 61 4d 38 49 49 55 48 6e 79 46 53 57 6b 52 47 2f 31 4b 4a 6b 32 74 37 62 78 44 7a 63 2b 65 4b 36 4e 4a 4b 6b 63 35 75 2b 57 57 42 6a 67 30 72 48 75 4b 34 38 52 4a 6f 79 52 6b 56 43 67 73 37 77 31 7a 46 4c 41 55 52 78 54 6f 42 49 30 58 4f 39 47 49 6f 6d 44 6d 69 68 68 5a 52 51 72 72 69 68 54 41 73 48 61 7a 53 50 62 74 4f 55 51 4c 6d 34 74 31 4c 4c 6a 71 76 55 56 6e 68 50 42 43 51 4f 5a 32 72 59 59 50 46 50 4b 65 65 32 42 57 64 39 73 39 4a 47 6d 36 67 62 69 4e 63 57 73 78 4a 58 79 56 75 6f 72 46 6d 68 35 4f 39 36 64 6e 74 66 53 66 34 49 58 52 62 71 57 77 75 55 75 62 63 34 65 4a 77 52 Data Ascii: /wCZvX0rXg08ttPyYM2oipWvA3DSXEzXEpPExOM1MaKRDKjv+dwi+pNR1ufaM8IIUHnyFSWkRG/1KJk2t7bxDzc+eK6NJKkc5u+WWBjg0rHuK48RJoyRkVCgs7w1zFLAURxToBI0XO9GIomDmihhZRQrrihTAsHazSPbtOUQLm4t1LLjqvUVnhPBCQOZ2rYYPFPKee2BWd9s9JGm6gbiNcWsxJXyVuorFmh5O96dntfSf4IXRbqWwuUubc4eJwR
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 2f 6e 56 77 73 7a 39 32 6f 72 6e 61 79 78 47 6f 64 6e 62 71 4d 44 37 79 4e 44 4a 47 66 55 64 50 6a 79 71 2f 4a 44 64 45 34 2b 69 7a 2f 52 7a 71 2b 6e 77 7a 50 76 73 78 6b 34 4c 33 56 69 4f 5a 52 51 50 6d 66 36 31 4a 66 61 53 6b 56 72 62 32 4e 30 32 4f 49 41 78 63 50 56 75 76 2f 50 66 55 50 39 6d 42 34 74 52 75 38 38 69 6e 46 37 38 45 66 31 70 74 39 70 4e 38 31 35 32 6b 4d 48 45 65 37 74 59 67 67 58 70 78 45 42 69 66 71 50 6c 53 68 46 53 6a 54 4c 74 56 71 4a 59 64 51 35 78 37 2f 77 42 46 63 76 74 57 6e 6e 74 7a 41 55 52 49 7a 7a 41 35 2f 4f 6b 37 59 59 79 55 47 56 48 30 70 73 36 46 38 6f 4d 41 2b 74 50 37 65 36 4d 47 6e 32 30 43 59 44 4d 33 65 6c 73 5a 38 51 4a 41 2f 53 72 6f 56 44 68 49 35 75 54 4c 50 4d 39 32 52 32 4b 33 46 74 4a 45 69 79 54 6c 59 65 4d Data Ascii: /nVwsz92ornayxGodnbqMD7yNDJGfUdPjyq/JDdE4+iz/Rzq+nwzPvsxk4L3ViOZRQPmf61JfaSkVrb2N02OIAxcPVuv/PfUP9mB4tRu88inF78Ef1pt9pN8152kMHEe7tYggXpxEBifqPlShFSjTLtVqJYdQ5x7/wBFcvtWnntzAURIzzA5/Ok7YYyUGVH0ps6F8oMA+tP7e6MGn20CYDM3elsZ8QJA/SroVDhI5uTLPM92R2K3FtJEiyTlYeM
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 71 59 6f 76 45 63 6b 75 57 7a 6b 6a 48 39 61 52 75 72 78 6b 74 6f 6d 53 4e 53 38 34 4c 53 4d 57 4a 34 74 78 67 66 74 55 4a 78 55 30 6d 69 33 48 4a 34 32 30 63 30 32 33 45 31 77 67 69 41 61 53 52 73 4b 44 79 79 66 4d 39 4b 6c 5a 64 4c 6a 74 72 61 61 35 31 49 72 4e 49 41 65 47 42 57 77 46 41 38 7a 31 7a 55 48 70 72 36 70 66 58 36 57 6d 6c 51 74 50 63 76 79 69 68 51 6e 34 6e 79 77 63 62 31 62 59 2b 78 56 35 59 77 70 4a 32 6a 31 4f 32 73 67 66 45 73 63 73 6f 59 6a 33 41 62 48 35 31 4b 63 6d 31 53 64 42 69 32 52 64 79 56 73 71 49 57 53 61 4d 74 4c 34 49 2f 79 70 2f 57 69 54 5a 4b 71 69 6b 4b 70 7a 6c 6a 79 47 4f 74 58 53 4a 2b 7a 4e 6f 36 78 57 39 72 63 36 7a 64 6b 2b 41 48 37 71 4d 6e 47 64 2b 75 4f 76 6c 67 56 54 4e 59 31 4f 58 55 62 38 6c 4f 37 43 71 65 46 Data Ascii: qYovEckuWzkjH9aRurxktomSNS84LSMWJ4txgftUJxU0mi3HJ420c023E1wgiAaSRsKDyyfM9KlZdLjtraa51IrNIAeGBWwFA8z1zUHpr6pfX6WmlQtPcvyihQn4nywcb1bY+xV5YwpJ2j1O2sgfEscsoYj3AbH51Kcm1SdBi2RdyVsqIWSaMtL4I/yp/WiTZKqikKpzljyGOtXSJ+zNo6xW9rc6zdk+AH7qMnGd+uOvlgVTNY1OXUb8lO7CqeF
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 58 6b 50 4f 6f 4c 73 6c 6b 74 63 6e 6f 79 6f 54 37 39 36 6e 32 58 4e 53 58 52 42 6a 52 68 6b 30 4b 57 5a 51 44 51 6f 45 4b 64 71 64 4b 4f 70 57 5a 75 59 56 2f 77 41 52 62 35 4b 37 38 31 36 69 71 43 52 6b 4b 4d 35 79 61 31 75 47 49 53 63 4b 6e 6c 56 43 37 59 36 57 4e 4f 76 2b 38 67 48 33 45 32 57 58 41 2f 43 33 55 66 76 57 66 4e 44 2b 59 37 6e 70 2b 6f 76 39 4b 58 34 49 37 52 37 2f 41 4e 67 31 57 43 34 7a 68 4f 4c 67 66 2f 53 64 71 31 61 31 6a 53 65 43 5a 5a 41 47 6a 64 53 70 39 52 69 73 57 6b 47 45 41 72 5a 64 4c 50 38 41 67 59 46 7a 75 79 4c 6e 35 55 59 66 4b 46 36 6a 47 74 73 6c 32 5a 31 66 32 45 6d 6d 61 6c 4a 61 79 41 2b 45 35 55 2b 61 39 44 54 48 55 35 6d 68 46 76 4b 68 77 79 53 42 68 38 4b 30 58 74 31 6f 2f 74 64 6c 48 66 77 72 39 37 41 76 6a 78 7a Data Ascii: XkPOoLslktcnoyoT796n2XNSXRBjRhk0KWZQDQoEKdqdKOpWZuYV/wARb5K7816iqCRkKM5ya1uGIScKnlVC7Y6WNOv+8gH3E2WXA/C3UfvWfND+Y7np+ov9KX4I7R7/ANg1WC4zhOLgf/Sdq1a1jSeCZZAGjdSp9RisWkGEArZdLP8AgYFzuyLn5UYfKF6jGtsl2Z1f2EmmalJayA+E5U+a9DTHU5mhFvKhwySBh8K0Xt1o/tdlHfwr97Avjxz
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 38 57 42 55 66 61 48 68 34 68 35 47 6e 51 77 58 35 55 4c 6f 62 48 31 75 2b 54 77 34 32 36 55 65 55 35 62 67 48 78 70 4f 50 37 74 63 2f 6d 4e 64 58 49 50 45 64 36 62 45 54 66 5a 6d 31 42 31 42 37 6b 44 5a 49 63 66 45 6e 2b 67 50 7a 71 79 4d 61 68 75 79 72 67 78 33 43 2f 36 54 2b 74 54 4a 4e 61 4d 61 39 70 6e 6d 2f 63 4a 76 51 6f 53 45 55 4b 47 67 52 43 39 6b 74 55 4f 6c 61 6b 73 62 62 57 38 2b 46 6b 4a 36 48 6f 61 30 6d 55 6f 42 6e 50 53 73 63 34 67 33 4c 33 56 6f 58 5a 58 56 6c 31 50 54 42 48 4c 2f 41 50 30 57 2f 67 62 4a 33 59 64 44 57 48 44 50 77 7a 76 36 2f 44 61 2b 6f 68 6c 32 38 74 2b 39 30 61 4f 62 72 46 4f 50 6b 64 71 71 2b 6a 58 78 30 79 2b 74 72 73 45 68 56 59 42 2f 56 54 73 61 75 6e 61 39 53 2f 5a 36 34 41 47 65 48 68 62 35 47 73 38 63 2b 47 4a Data Ascii: 8WBUfaHh4h5GnQwX5ULobH1u+Tw426UeU5bgHxpOP7tc/mNdXIPEd6bETfZm1B1B7kDZIcfEn+gPzqyMahuyrgx3C/6T+tTJNaMa9pnm/cJvQoSEUKGgRC9ktUOlaksbbW8+FkJ6Hoa0mUoBnPSsc4g3L3VoXZXVl1PTBHL/AP0W/gbJ3YdDWHDPwzv6/Da+ohl28t+90aObrFOPkdqq+jXx0y+trsEhVYB/VTsauna9S/Z64AGeHhb5Gs8c+GJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.17	49761	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:42 UTC	1834	OUT	GET /complete/search?q=directx%20runtime&cp=0&client=desktop-gws-wiz-on-focus-serp&xssi=t&gs_pcrt=3&hl=en&authuser=0&pq=directx%20runtime&psi=Kze5ZY_EKtunqtsPm7mdiAw.1706637100809&dpr=1&ofp=EAEYmt2AsYTlt4qZARiPudHq0c6fql4YgaO3xcKSu56sARjkytS0h6-x9-4BGLipu9fGg9r-KjLkAQoaChhkaXJlY3R4IHJ1bnRpbWUgdmFsb3JhbnQKDAoKZGlyZWN0eCAxMgofCh1kaXJlY3R4IHJ1bnRpbWUgZnJlZSBkb3dubG9hZAolCiNkaXJlY3R4IHJ1bnRpbWUgZG93bmxvYWQgd2luZG93cyAxMAoMCgpkaXJlY3R4IDExChUKE2RpcmVjdHggMTIgZG93bmxvYWQKLAoqZGlyZWN0eCBlbmQtdXNlciBydW50aW1lIG9mZmxpbmUgaW5zdGFsbGVyChsKGWRpcmVjdHggb2ZmbGluZSBpbnN0YWxsZXIQRw HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq
2024-01-30 17:51:42 UTC	1737	IN	HTTP/1.1 200 OK X-Content-Type-Options: nosniff Date: Tue, 30 Jan 2024 17:51:42 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: application/json; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-psm_4gp8QiT_Irx5Z3Qrmg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:42 UTC	805	IN	Data Raw: 33 31 65 0d 0a 29 5d 7d 27 0a 5b 5b 5b 22 64 69 72 65 63 74 78 20 72 75 6e 74 69 6d 65 5c 75 30 30 33 63 62 5c 75 30 30 33 65 20 76 61 6c 6f 72 61 6e 74 5c 75 30 30 33 63 5c 2f 62 5c 75 30 30 33 65 22 2c 30 2c 5b 37 31 2c 35 39 38 2c 34 33 32 5d 5d 2c 5b 22 64 69 72 65 63 74 78 5c 75 30 30 33 63 62 5c 75 30 30 33 65 20 31 32 5c 75 30 30 33 63 5c 2f 62 5c 75 30 30 33 65 22 2c 30 2c 5b 37 31 2c 35 39 38 2c 34 33 32 5d 5d 2c 5b 22 64 69 72 65 63 74 78 20 72 75 6e 74 69 6d 65 5c 75 30 30 33 63 62 5c 75 30 30 33 65 20 66 72 65 65 20 64 6f 77 6e 6c 6f 61 64 5c 75 30 30 33 63 5c 2f 62 5c 75 30 30 33 65 22 2c 30 2c 5b 37 31 2c 35 39 38 2c 34 33 32 5d 5d 2c 5b 22 64 69 72 65 63 74 78 20 72 75 6e 74 69 6d 65 5c 75 30 30 33 63 62 5c 75 30 30 33 65 20 64 6f 77 6e 6c Data Ascii: 31e)]}'[[["directx runtime\u003cb\u003e valorant\u003c\/b\u003e",0,[71,598,432]],["directx\u003cb\u003e 12\u003c\/b\u003e",0,[71,598,432]],["directx runtime\u003cb\u003e free download\u003c\/b\u003e",0,[71,598,432]],["directx runtime\u003cb\u003e downl
2024-01-30 17:51:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.17	49757	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:42 UTC	1581	OUT	GET /xjs/_/js/md=1/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq
2024-01-30 17:51:42 UTC	818	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding, Origin Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="gws-team" Report-To: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]} Content-Length: 249779 Date: Tue, 30 Jan 2024 17:51:42 GMT Expires: Wed, 29 Jan 2025 17:51:42 GMT Cache-Control: public, immutable, max-age=31536000 Last-Modified: Mon, 29 Jan 2024 22:58:53 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:42 UTC	434	IN	Data Raw: 7b 22 6d 6f 64 75 6c 65 47 72 61 70 68 22 3a 22 71 75 61 6e 74 75 6d 2f 74 37 78 67 49 65 2f 77 73 39 54 6c 63 2f 63 45 74 39 30 62 2f 71 64 64 67 4b 65 2f 79 78 54 63 68 66 2f 73 79 37 35 2f 73 79 37 36 2f 73 79 37 37 3a 36 2c 37 2f 73 79 37 38 2f 78 51 74 5a 62 3a 35 2c 38 2c 39 2f 73 79 37 39 2f 52 39 59 48 4a 63 3a 38 2c 62 2f 4b 55 4d 37 5a 2f 77 72 7a 45 58 62 2f 54 78 43 4a 66 64 2f 57 56 44 79 4b 65 2f 73 79 37 61 2f 56 6a 39 68 70 64 3a 67 2c 68 2f 74 61 66 50 72 66 2f 64 74 6c 30 68 64 2f 6c 4c 51 57 46 65 2f 49 6c 31 4d 34 62 2f 65 48 44 66 6c 2f 46 4f 4e 45 64 66 3a 6b 2f 4a 69 56 4c 6a 64 3a 6b 2f 46 41 55 64 57 3a 6b 2f 5a 31 52 67 30 2f 64 4d 5a 6b 33 65 3a 6e 2f 6f 66 6a 56 6b 62 2f 71 61 53 33 67 64 2f 54 39 79 35 44 64 2f 79 69 4c 67 36 Data Ascii: {"moduleGraph":"quantum/t7xgIe/ws9Tlc/cEt90b/qddgKe/yxTchf/sy75/sy76/sy77:6,7/sy78/xQtZb:5,8,9/sy79/R9YHJc:8,b/KUM7Z/wrzEXb/TxCJfd/WVDyKe/sy7a/Vj9hpd:g,h/tafPrf/dtl0hd/lLQWFe/Il1M4b/eHDfl/FONEdf:k/JiVLjd:k/FAUdW:k/Z1Rg0/dMZk3e:n/ofjVkb/qaS3gd/T9y5Dd/yiLg6
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 31 69 2c 31 6a 2f 73 79 37 6e 2f 78 55 64 69 70 66 3a 31 6c 2f 73 79 37 70 2f 73 79 37 71 3a 31 6e 2f 73 79 37 6f 3a 31 6c 2c 31 6f 2f 73 79 37 73 2f 73 79 37 72 3a 31 70 2c 31 71 2f 73 79 37 74 2f 4e 77 48 30 48 3a 31 6d 2c 31 72 2f 73 79 37 75 3a 31 6a 2f 73 79 37 76 2f 67 79 63 68 67 3a 31 6b 2c 31 74 2c 31 75 2c 31 76 2f 55 6c 6d 6d 72 64 3a 31 77 2f 72 4a 6d 4a 72 63 3a 31 62 2c 31 67 2f 47 48 41 65 41 63 2f 57 74 36 76 6a 66 3a 31 67 2f 6c 73 6a 56 6d 63 3a 31 66 2f 49 5a 54 36 33 2f 56 67 64 36 68 62 2f 73 79 37 78 2f 73 79 37 79 2f 73 79 37 7a 3a 32 34 2c 32 35 2f 59 4e 6a 47 44 64 3a 32 36 2f 69 46 51 79 4b 66 2f 73 79 38 31 2f 73 79 38 32 3a 32 39 2f 73 79 38 30 3a 32 32 2c 32 36 2c 32 61 2f 50 72 50 59 52 64 3a 32 37 2c 32 62 2f 73 79 38 33 2f Data Ascii: 1i,1j/sy7n/xUdipf:1l/sy7p/sy7q:1n/sy7o:1l,1o/sy7s/sy7r:1p,1q/sy7t/NwH0H:1m,1r/sy7u:1j/sy7v/gychg:1k,1t,1u,1v/Ulmmrd:1w/rJmJrc:1b,1g/GHAeAc/Wt6vjf:1g/lsjVmc:1f/IZT63/Vgd6hb/sy7x/sy7y/sy7z:24,25/YNjGDd:26/iFQyKf/sy81/sy82:29/sy80:22,26,2a/PrPYRd:27,2b/sy83/
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 2c 35 32 2c 35 33 2f 73 69 4b 6e 51 64 3a 34 7a 2c 35 34 2f 70 58 64 52 59 62 2f 73 79 39 63 2f 65 35 71 46 4c 63 3a 35 34 2c 35 37 2f 64 49 6f 53 42 62 2f 73 79 39 64 2f 53 70 73 66 53 62 3a 32 67 2c 35 61 2f 5a 67 47 67 39 62 2f 73 79 39 68 2f 73 79 39 6f 2f 73 79 39 70 2f 73 79 39 6a 2f 73 79 39 65 3a 35 64 2c 35 65 2c 35 66 2c 35 67 2f 73 79 39 69 2f 73 79 39 6d 2f 73 79 39 66 3a 35 65 2c 35 66 2c 35 69 2c 35 6a 2f 73 79 39 6e 2f 73 79 39 6b 2f 73 79 39 71 2f 73 79 39 72 2f 73 79 39 73 2f 73 79 39 67 3a 35 68 2c 35 6b 2c 35 6c 2c 35 6d 2c 35 6e 2c 35 6f 2c 35 70 2f 73 79 39 6c 3a 35 67 2c 35 6a 2c 35 6d 2f 73 79 39 74 3a 35 67 2c 35 6e 2f 73 79 39 75 3a 35 6a 2c 35 70 2f 73 79 39 76 2f 73 79 39 78 2f 73 79 39 79 2f 73 79 39 7a 3a 35 77 2f 73 79 61 30 Data Ascii: ,52,53/siKnQd:4z,54/pXdRYb/sy9c/e5qFLc:54,57/dIoSBb/sy9d/SpsfSb:2g,5a/ZgGg9b/sy9h/sy9o/sy9p/sy9j/sy9e:5d,5e,5f,5g/sy9i/sy9m/sy9f:5e,5f,5i,5j/sy9n/sy9k/sy9q/sy9r/sy9s/sy9g:5h,5k,5l,5m,5n,5o,5p/sy9l:5g,5j,5m/sy9t:5g,5n/sy9u:5j,5p/sy9v/sy9x/sy9y/sy9z:5w/sya0
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 38 69 2c 38 6c 2c 38 6e 2c 38 70 2c 38 72 2f 73 79 63 76 3a 38 62 2f 73 79 63 77 2f 73 79 64 62 3a 38 67 2f 73 79 64 32 3a 32 34 2c 37 79 2c 38 38 2c 38 69 2c 38 6e 2c 38 70 2c 38 74 2c 38 75 2c 38 76 2f 73 79 64 63 3a 38 67 2f 73 79 64 64 3a 38 39 2c 38 61 2f 73 79 64 33 3a 32 34 2c 37 79 2c 38 69 2c 38 70 2c 38 74 2c 38 75 2c 38 78 2c 38 79 2f 73 79 64 65 3a 38 67 2f 73 79 64 34 3a 32 34 2c 37 79 2c 38 69 2c 38 70 2c 38 74 2c 38 75 2c 39 30 2f 73 79 64 66 3a 38 67 2f 73 79 64 35 3a 37 6c 2c 38 69 2c 39 32 2f 73 79 63 72 3a 37 76 2c 38 37 2f 73 79 64 67 3a 38 67 2f 73 79 64 36 3a 32 34 2c 38 38 2c 38 69 2c 38 70 2c 39 34 2c 39 35 2f 73 79 64 68 3a 38 67 2f 73 79 64 37 3a 32 34 2c 38 38 2c 38 69 2c 38 70 2c 39 34 2c 39 37 2f 73 79 64 69 3a 38 67 2f 73 79 Data Ascii: 8i,8l,8n,8p,8r/sycv:8b/sycw/sydb:8g/syd2:24,7y,88,8i,8n,8p,8t,8u,8v/sydc:8g/sydd:89,8a/syd3:24,7y,8i,8p,8t,8u,8x,8y/syde:8g/syd4:24,7y,8i,8p,8t,8u,90/sydf:8g/syd5:7l,8i,92/sycr:7v,87/sydg:8g/syd6:24,88,8i,8p,94,95/sydh:8g/syd7:24,88,8i,8p,94,97/sydi:8g/sy
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 74 2f 71 58 45 6f 50 3a 62 73 2c 62 75 2f 77 58 38 4c 6a 62 3a 62 73 2c 62 75 2f 73 34 42 64 48 65 3a 62 73 2c 62 75 2f 48 38 63 4f 66 64 3a 62 73 2c 62 75 2f 67 61 37 58 70 64 3a 62 79 2f 6b 48 56 53 55 62 3a 62 75 2f 50 58 47 75 53 64 3a 62 73 2c 62 75 2f 78 6b 6a 47 76 65 3a 62 73 2c 62 75 2f 73 54 73 44 4d 63 2f 76 31 64 61 4d 2f 4c 4b 34 50 79 65 2f 73 79 65 7a 2f 73 79 66 30 3a 63 36 2f 61 4c 55 66 50 3a 63 37 2f 77 51 6c 59 76 65 2f 61 52 6a 75 78 62 2f 73 79 66 33 3a 38 64 2f 73 79 66 34 2f 73 79 66 32 3a 63 62 2c 63 63 2f 75 78 4d 70 55 3a 31 76 2c 63 64 2f 43 6f 67 46 37 64 2f 73 79 66 35 3a 35 68 2c 35 6c 2c 35 73 2f 73 79 66 36 3a 35 6b 2c 35 6f 2c 35 74 2f 73 79 66 37 3a 35 7a 2f 73 79 66 38 3a 63 69 2f 73 79 66 39 3a 37 35 2c 63 6a 2f 73 79 Data Ascii: t/qXEoP:bs,bu/wX8Ljb:bs,bu/s4BdHe:bs,bu/H8cOfd:bs,bu/ga7Xpd:by/kHVSUb:bu/PXGuSd:bs,bu/xkjGve:bs,bu/sTsDMc/v1daM/LK4Pye/syez/syf0:c6/aLUfP:c7/wQlYve/aRjuxb/syf3:8d/syf4/syf2:cb,cc/uxMpU:1v,cd/CogF7d/syf5:5h,5l,5s/syf6:5k,5o,5t/syf7:5z/syf8:ci/syf9:75,cj/sy
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 32 2f 68 68 63 68 4c 64 3a 66 6e 2f 73 79 68 68 3a 65 32 2f 76 62 6a 64 58 63 3a 66 70 2f 73 79 68 69 3a 65 32 2f 47 58 79 7a 31 3a 66 72 2f 73 79 68 6a 3a 65 32 2f 6d 33 41 61 58 64 3a 66 74 2f 73 79 68 6b 3a 65 32 2f 68 61 50 47 71 64 3a 66 76 2f 73 79 68 6c 3a 65 32 2f 44 32 44 54 45 66 3a 66 78 2f 73 79 68 6d 3a 65 32 2f 77 37 79 73 67 3a 66 7a 2f 73 79 68 6e 3a 65 32 2f 54 33 71 38 57 64 3a 67 31 2f 73 79 68 6f 3a 65 32 2f 66 70 6c 51 78 63 3a 67 33 2f 73 79 68 70 3a 65 32 2f 79 6a 77 34 35 3a 67 35 2f 73 79 68 71 3a 65 32 2f 76 50 69 37 39 63 3a 67 37 2f 50 71 35 30 36 2f 46 58 55 64 77 3a 67 39 2f 73 79 68 73 3a 65 32 2f 45 52 77 56 62 3a 67 62 2f 73 79 68 74 3a 65 32 2f 65 54 76 35 39 65 3a 67 64 2f 73 79 68 75 3a 65 32 2f 67 70 4e 33 34 63 3a 67 Data Ascii: 2/hhchLd:fn/syhh:e2/vbjdXc:fp/syhi:e2/GXyz1:fr/syhj:e2/m3AaXd:ft/syhk:e2/haPGqd:fv/syhl:e2/D2DTEf:fx/syhm:e2/w7ysg:fz/syhn:e2/T3q8Wd:g1/syho:e2/fplQxc:g3/syhp:e2/yjw45:g5/syhq:e2/vPi79c:g7/Pq506/FXUdw:g9/syhs:e2/ERwVb:gb/syht:e2/eTv59e:gd/syhu:e2/gpN34c:g
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 65 65 2f 74 57 37 31 31 62 2f 52 36 55 6b 57 62 2f 78 4d 48 78 35 65 2f 4f 6b 34 58 4d 64 3a 6a 61 2c 6a 62 2c 6a 67 2c 6a 68 2c 6a 69 2c 6a 6a 2c 6a 6b 2c 6a 6c 2f 73 79 6a 6e 3a 65 35 2f 73 79 6a 6f 3a 6a 6e 2f 73 79 6a 71 3a 64 7a 2f 73 79 6a 72 2f 6b 70 41 72 2f 73 79 6a 73 3a 66 31 2c 66 33 2c 67 64 2c 68 31 2c 68 39 2c 69 62 2c 6a 64 2c 6a 6f 2c 6a 70 2c 6a 71 2c 6a 72 2f 6f 30 6a 35 7a 63 3a 6a 73 2f 48 32 33 39 32 65 3a 6a 73 2f 73 79 6a 74 3a 65 35 2c 6a 64 2f 6f 58 52 44 7a 63 3a 6a 76 2f 50 45 37 32 38 62 3a 6a 76 2f 73 79 6a 75 3a 65 32 2f 73 79 6a 77 3a 65 34 2f 63 6a 61 50 6b 62 2f 73 79 6a 78 3a 65 35 2c 67 62 2c 6a 64 2c 6a 71 2c 6a 79 2c 6b 30 2f 49 45 64 6e 4c 65 3a 6a 7a 2c 6b 31 2f 59 4e 77 5a 72 3a 65 76 2c 67 64 2f 73 79 6a 79 3a 6a Data Ascii: ee/tW711b/R6UkWb/xMHx5e/Ok4XMd:ja,jb,jg,jh,ji,jj,jk,jl/syjn:e5/syjo:jn/syjq:dz/syjr/kpAr/syjs:f1,f3,gd,h1,h9,ib,jd,jo,jp,jq,jr/o0j5zc:js/H2392e:js/syjt:e5,jd/oXRDzc:jv/PE728b:jv/syju:e2/syjw:e4/cjaPkb/syjx:e5,gb,jd,jq,jy,k0/IEdnLe:jz,k1/YNwZr:ev,gd/syjy:j
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 2c 6b 66 2f 4b 42 75 46 63 66 3a 6d 78 2f 73 79 6c 6c 3a 6b 65 2f 73 70 62 37 55 62 3a 6d 7a 2f 73 79 6c 6d 3a 6b 65 2f 55 55 6c 45 52 62 3a 6e 31 2f 73 79 6c 6e 3a 6c 67 2f 44 55 6c 4d 42 64 3a 6e 33 2f 73 79 6c 6f 3a 6a 65 2f 4b 69 58 6c 6e 64 3a 6e 35 2f 67 30 45 6b 73 65 2f 54 48 70 6d 57 3a 6e 37 2f 4d 61 66 6a 5a 65 2f 52 54 52 33 4c 3a 6e 39 2f 53 51 41 5a 46 64 2f 5a 75 64 78 63 62 3a 6e 62 2f 4f 6a 74 77 51 65 2f 4d 52 62 37 6e 66 3a 6e 64 2f 58 54 6d 78 77 65 2f 44 31 4a 36 48 65 3a 6e 66 2f 59 6c 4d 63 47 65 2f 46 75 51 57 79 63 3a 6e 68 2f 73 79 6c 76 3a 65 34 2f 78 6b 77 69 30 3a 6e 6a 2f 73 79 6c 77 3a 65 35 2f 46 6d 6e 45 36 62 3a 6e 6c 2f 73 79 6c 78 3a 65 35 2f 57 75 49 50 6e 62 3a 6e 6e 2f 73 79 6c 79 3a 64 7a 2f 62 58 4b 50 7a 64 3a 6e Data Ascii: ,kf/KBuFcf:mx/syll:ke/spb7Ub:mz/sylm:ke/UUlERb:n1/syln:lg/DUlMBd:n3/sylo:je/KiXlnd:n5/g0Ekse/THpmW:n7/MafjZe/RTR3L:n9/SQAZFd/Zudxcb:nb/OjtwQe/MRb7nf:nd/XTmxwe/D1J6He:nf/YlMcGe/FuQWyc:nh/sylv:e4/xkwi0:nj/sylw:e5/FmnE6b:nl/sylx:e5/WuIPnb:nn/syly:dz/bXKPzd:n
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 6c 2f 73 79 6e 6d 2f 73 79 6e 6e 3a 71 74 2f 73 79 6e 6f 2f 73 79 6e 72 2f 73 79 6e 71 3a 71 77 2f 73 79 6e 73 2f 73 79 6e 70 3a 71 78 2c 71 79 2f 73 79 6e 74 3a 71 7a 2f 73 79 6e 75 3a 72 30 2f 73 79 6e 76 2f 67 53 5a 76 64 62 3a 71 67 2c 71 6b 2c 71 73 2c 71 75 2c 71 76 2c 72 31 2c 72 32 2f 4b 48 30 6c 62 66 3a 71 76 2f 73 79 6e 77 3a 71 7a 2f 53 4d 71 75 4f 62 3a 72 35 2f 73 79 6e 79 2f 73 79 6e 78 3a 37 2c 61 6e 2c 72 37 2f 72 74 48 31 62 64 3a 61 6f 2c 72 38 2f 73 79 6e 7a 3a 71 7a 2f 73 79 6f 30 2f 73 79 6f 31 2f 73 79 6f 33 3a 72 38 2f 73 79 6f 32 3a 71 65 2c 72 36 2c 72 61 2c 72 62 2c 72 63 2c 72 64 2f 73 79 6f 34 2f 73 79 6f 35 3a 72 38 2f 73 79 6f 36 3a 72 38 2f 64 35 45 68 4a 65 3a 32 66 2c 71 76 2c 72 39 2c 72 65 2c 72 66 2c 72 67 2c 72 68 2f Data Ascii: l/synm/synn:qt/syno/synr/synq:qw/syns/synp:qx,qy/synt:qz/synu:r0/synv/gSZvdb:qg,qk,qs,qu,qv,r1,r2/KH0lbf:qv/synw:qz/SMquOb:r5/syny/synx:7,an,r7/rtH1bd:ao,r8/synz:qz/syo0/syo1/syo3:r8/syo2:qe,r6,ra,rb,rc,rd/syo4/syo5:r8/syo6:r8/d5EhJe:2f,qv,r9,re,rf,rg,rh/
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 52 78 44 6c 64 3a 75 64 2f 59 56 35 62 65 65 2f 73 79 71 6e 2f 73 79 71 6f 2f 73 79 71 70 2f 73 79 71 71 3a 75 69 2f 73 79 71 72 3a 65 35 2c 75 68 2c 75 6a 2f 73 79 71 73 3a 71 33 2c 75 67 2f 73 79 71 74 2f 73 79 71 76 3a 65 63 2c 65 74 2c 66 62 2c 67 70 2c 6a 65 2c 6a 66 2c 6a 71 2c 6b 30 2c 6b 64 2c 70 36 2f 73 79 71 77 2f 73 79 71 75 3a 35 37 2c 61 66 2c 62 32 2c 71 36 2c 75 64 2c 75 66 2c 75 6b 2c 75 6c 2c 75 6d 2c 75 6e 2c 75 6f 2f 4f 5a 4c 67 75 63 3a 62 34 2c 71 37 2c 75 65 2c 75 70 2f 73 79 71 78 2f 42 59 77 4a 6c 66 3a 62 72 2f 73 79 71 79 2f 4c 31 41 41 6b 62 3a 35 37 2c 71 6f 2c 75 74 2f 73 79 71 7a 3a 71 65 2c 72 64 2f 73 79 72 30 2f 73 79 72 31 2f 73 79 72 32 2f 73 79 72 33 2f 73 79 72 34 3a 75 70 2f 56 45 62 4e 6f 65 3a 6a 67 2c 71 69 2c 72 Data Ascii: RxDld:ud/YV5bee/syqn/syqo/syqp/syqq:ui/syqr:e5,uh,uj/syqs:q3,ug/syqt/syqv:ec,et,fb,gp,je,jf,jq,k0,kd,p6/syqw/syqu:57,af,b2,q6,ud,uf,uk,ul,um,un,uo/OZLguc:b4,q7,ue,up/syqx/BYwJlf:br/syqy/L1AAkb:57,qo,ut/syqz:qe,rd/syr0/syr1/syr2/syr3/syr4:up/VEbNoe:jg,qi,r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.17	49758	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:42 UTC	4413	OUT	GET /xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=1/exm=SNUn3,attn,cEt90b,cdos,csi,d,dtl0hd,eHDfl,gwc,hsm,jsa,mb4ZUb,qddgKe,sTsDMc/excm=ABxRVc,AD6AIb,B0xr7b,CTwd8,CWOfE,CX5LId,CdOg1,D1J6He,FmnE6b,FuQWyc,GRJ32c,GXyz1,JxE93,KiXlnd,MRb7nf,NmR9jd,NsEUGe,Oa7Qpb,Ok4XMd,PE728b,PoJj8d,PvSBGf,QNvmne,RSlfle,TO0csb,TnXlGd,Trirbc,TurKxc,U3Ovcc,U6nlJe,UQpTU,UiPhkb,Uznx4d,VZLyBe,WxJ6g,XDlt7d,XHo6qe,XTkmZd,XbupY,YuNOCb,ZGLUZ,ZrXR8b,Zudxcb,a3cZoc,adn7N,ak946,bXyZdf,cKV22c,du3Q4e,eTv59e,f26on,fNMhz,hfJ9hb,jJtSzc,jkRPje,kCkfUb,kOSi0d,mL4hG,oXRDzc,pIseB,pMwOEe,pQk1fc,qngJBf,r24bR,rL2AR,sU6eaf,tlA71,tzTB5,vJPFse,vhpQNc,y25qZb,yChgtb,yfH2Bd,yn9Ffd,ypVg7e,yuQBec,zjNhL,zs9f9d/ed=1/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/ee=AfeaP:TkrAjf;Afksuc:wMx0R;BMxAGc:E5bFse;BgS6mb:fidj5d;BjwMce:cXX2Wb;CxXAWb:YyRLvc;DULqB:RKfG5c;DpcR3d:zL72xf;EABSZ:MXZt9d;ESrPQc:mNTJvc;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;EnlcNd:WeHg4;Erl4fe:FloWmf;F9mqte:UoRcbe;Fmv9Nc:O1Tzwc;G0KhTb:LIaoZ;G6wU6e:hezEbd;GleZL:J1A7Od;HMDDWe:G8QUdb;IBADCc:RYquRb;IoGlCf:b5lhvb;IsdWVc:qzxzOb;JXS8fb:Qj0suc;JbMT3:M25sS;JsbNhc:Xd8iUd;KOxcK:OZqGte;KQzWid:ZMKkN;KcokUb:KiuZBf;KeeMUb:HiPxjc;KpRAue:Tia57b;LBgRLc:XVMNvd;LEikZe:byfTOb,lsjVmc;LsNahb:ucGLNb;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Np8Qkd:Dpx6qc;Nyt6ic:jn2sGd;OgagBe:cNTe0;Oj465e:KG2eXe;OohIYe:mpEAQb;Pjplud:EEDORb,PoEs9b;PqHfGe:im2cZe;Q1Ow7b:x5CSu;QGR0gd:Mlhmy;R2kc8b:ALJqWb;R4IIIb:QWfeKf;R9Ulx:CR7Ufe;RDNBlf:zPRCJb;SLtqO:Kh1xYe;SMDL4c:fTfGO,pnvXVc;SNUn3:ZwDk9d,x8cHvb;ShpF6e:N0pvGc;TxfV6d:YORN0b;U96pRd:FsR04;UDrY1c:eps46d;UVmjEd:EesRsb;UyG7Kb:wQd0G;V2HTTe:RolTY;VGRfx:VFqbr;VN6jIc:ddQyuf;VOcgDe:YquhTb;VsAqSb:PGf2Re;VxQ32b:k0XsBb;WCEKNd:I46Hvd;WDGyFe:jcVOxd;Wfmdue:g3MJlb;XUezZ:sa7lqb;YV5bee:IvPZ6d;ZMvdv:PHFPjb;ZWEUA:afR4Cf;a56pNe:JEfCwb;aAJE9c:WHW6Ef;aZ61od:arTwJ;bFZ6gf:RsDQqe;bcPXSc:gSZLJb;cEt90b:ws9Tlc;cFTWae:gT8qnd;coJ8e:KvoW8;dIoSBb:ZgGg9b;dLlj2:Qqt3Gf;daB6be:lMxGPd;dtl0hd:lLQWFe;eBAeSb:Ck63tb;eBZ5Nd:audvde;eHDfl:ofjVkb;eO3lse:nFClrf;fWLTFc:TVBJbf;g8nkx:U4MzKc;gaub4:TN6bMe;gtVSi:ekUOYd;h3MYod:cEt90b;hK67qb:QWEO5b;hLUtwc:KB8OKd;heHB1:sFczq;hjRo6e:F62sG;iFQyKf:QIhFr,vfuNJf;imqimf:jKGL2e;io8t5d:sgY6Zb;jY0zg:Q6tNgc;k2Qxcb:XY51pe;kCQyJ:ueyPK;kMFpHd:OTA3Ae;kbAm9d:MkHyGd;lkq0A:JyBE3e;nAFL3:NTMZac,s39S4;oGtAuc:sOXFj;oSUNyd:fTfGO,pnvXVc;oUlnpc:RagDlc;okUaUd:wItadb;pKJiXd:VCenhc;pNsl2d:j9Yuyc;pXdRYb:JKoKVe;pj82le:mg5CW;qGV2uc:HHi04c;qZx2Fc:j0xrE;qaS3gd:yiLg6e;qavrXe:zQzcXe;qddgKe:d7YSfd,x4FYXe;rQSrae:C6D5Fc;sP4Vbe:VwDzFe;sTsDMc:kHVSUb;tH4IIe:Ymry6;tosKvd:ZCqP3;trZL0b:qY8PFe;uY49fb:COQbmf;uknmt:GkPrzb;uuQkY:u2V3ud;vGrMZ:lPJJ0c;vfVwPd:lcrkwe;w3bZCb:ZPGaIb;w4rSdf:XKiZ9;w9w86d:dt4g2b;wQlYve:aLUfP;wR5FRb:TtcOte;wV5Pjc:L8KGxe;whEZac:F4AmNb;xBbsrc:NEW1Qc;xbe2wc:uRMPBc;yGxLoc:FmAr0c;yxTchf:KUM7Z;z97YGf:oug9te;zOsCQe:Ko78Df;zaIgPb:Qtpxbd/m=ABJeBb,Da4hkd,Eox39d,GCSbhd,GElbSc,HYSCof,J4ga1b,KHourd,M0hWhd,QhoyLd,Um3BXb,Wo3n8,aD8OEe,cSX9Xe,etGP4c,fcDBE,msmzHf,nPaQu,pFsdhd,pHXghd,tIj4fb,vrkJ0e,xfmZMb?xjs=s1 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq
2024-01-30 17:51:42 UTC	818	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding, Origin Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="gws-team" Report-To: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]} Content-Length: 600245 Date: Tue, 30 Jan 2024 17:51:42 GMT Expires: Wed, 29 Jan 2025 17:51:42 GMT Cache-Control: public, immutable, max-age=31536000 Last-Modified: Mon, 29 Jan 2024 22:58:53 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:42 UTC	434	IN	Data Raw: 74 68 69 73 2e 5f 73 3d 74 68 69 73 2e 5f 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 74 75 3d 5f 2e 49 28 22 42 55 59 77 56 62 22 29 3b 5f 2e 49 77 62 3d 5f 2e 49 28 22 4c 73 4c 47 48 66 22 29 3b 0a 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 0a 74 72 79 7b 0a 5f 2e 4a 44 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 49 61 3d 5f 2e 6e 28 61 29 7d 3b 5f 2e 46 28 5f 2e 4a 44 2c 5f 2e 70 29 3b 5f 2e 4a 44 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 55 72 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 2e 50 65 28 74 68 69 73 2c 31 29 7d 3b 5f 2e 24 47 64 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 Data Ascii: this._s=this._s\|\|{};(function(_){var window=this;try{_.tu=_.I("BUYwVb");_.Iwb=_.I("LsLGHf");}catch(e){_._DumpException(e)}try{_.JD=function(a){this.Ia=_.n(a)};_.F(_.JD,_.p);_.JD.prototype.getUrl=function(){return _.Pe(this,1)};_.$Gd=function(a,b){ret
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 5f 2e 63 6a 28 74 68 69 73 2c 32 2c 61 29 7d 3b 5f 2e 6b 2e 42 68 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 2e 73 6a 28 74 68 69 73 2c 32 29 7d 3b 5f 2e 6b 2e 4e 63 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 2e 67 69 28 74 68 69 73 2c 33 29 7d 3b 5f 2e 6b 2e 49 64 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 5f 2e 63 6a 28 74 68 69 73 2c 33 2c 61 29 7d 3b 5f 2e 6b 2e 49 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 2e 73 6a 28 74 68 69 73 2c 33 29 7d 3b 5f 2e 6b 2e 6b 62 3d 22 7a 71 78 78 6d 22 3b 0a 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 0a 74 72 79 7b 0a 76 61 72 20 62 48 64 3b 5f 2e 61 48 64 3d 5b 30 2c 5f 2e 48 2c 5f 2e 61 6b 2c 2d 31 Data Ascii: _.cj(this,2,a)};_.k.Bh=function(){return _.sj(this,2)};_.k.Nc=function(){return _.gi(this,3)};_.k.Id=function(a){return _.cj(this,3,a)};_.k.Il=function(){return _.sj(this,3)};_.k.kb="zqxxm";}catch(e){_._DumpException(e)}try{var bHd;_.aHd=[0,_.H,_.ak,-1
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 77 6e 50 72 6f 70 65 72 74 79 28 61 29 3f 70 61 72 73 65 46 6c 6f 61 74 28 72 79 77 5b 61 5d 29 3a 62 7d 3b 74 79 77 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 79 77 7c 7c 73 79 77 28 29 3b 72 79 77 26 26 72 79 77 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 61 29 7d 3b 0a 5f 2e 75 79 77 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 61 2e 65 6c 65 6d 65 6e 74 2c 64 3d 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 22 72 67 5f 62 78 22 29 3b 63 3d 30 3c 64 2e 6c 65 6e 67 74 68 3f 64 5b 30 5d 3a 63 3b 63 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 62 2e 72 5f 2b 22 70 78 22 3b 63 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 62 2e 71 4f 61 2b 22 70 78 22 3b 63 2e 73 74 79 6c 65 2e 70 61 64 64 69 6e 67 54 6f 70 3d 62 2e Data Ascii: wnProperty(a)?parseFloat(ryw[a]):b};tyw=function(a){ryw\|\|syw();ryw&&ryw.hasOwnProperty(a)};_.uyw=function(a,b){var c=a.element,d=c.getElementsByClassName("rg_bx");c=0<d.length?d[0]:c;c.style.width=b.r_+"px";c.style.height=b.qOa+"px";c.style.paddingTop=b.
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 61 72 20 63 3d 76 6f 69 64 20 30 3d 3d 3d 63 3f 21 30 3a 63 3b 74 68 69 73 2e 6c 61 79 6f 75 74 73 3d 6e 75 6c 6c 3b 74 68 69 73 2e 65 6c 65 6d 65 6e 74 3d 61 3b 74 68 69 73 2e 77 61 3d 22 31 22 3d 3d 62 2e 62 63 3b 74 68 69 73 2e 6f 61 3d 70 61 72 73 65 49 6e 74 28 62 2e 63 74 2c 31 30 29 7c 7c 30 3b 74 68 69 73 2e 41 61 3d 70 61 72 73 65 49 6e 74 28 62 2e 63 62 2c 31 30 29 7c 7c 30 3b 74 68 69 73 2e 6b 61 3d 70 61 72 73 65 49 6e 74 28 62 2e 63 6c 2c 31 30 29 7c 7c 30 3b 74 68 69 73 2e 42 61 3d 70 61 72 73 65 49 6e 74 28 62 2e 63 72 2c 31 30 29 7c 7c 30 3b 74 68 69 73 2e 4a 61 3d 22 31 22 3d 3d 62 2e 73 63 3b 74 68 69 73 2e 77 69 64 74 68 3d 62 2e 74 77 3b 74 68 69 73 2e 68 65 69 67 68 74 3d 62 2e 74 68 3b 74 68 69 73 2e 75 49 64 3d 31 3d 3d 62 2e 70 73 Data Ascii: ar c=void 0===c?!0:c;this.layouts=null;this.element=a;this.wa="1"==b.bc;this.oa=parseInt(b.ct,10)\|\|0;this.Aa=parseInt(b.cb,10)\|\|0;this.ka=parseInt(b.cl,10)\|\|0;this.Ba=parseInt(b.cr,10)\|\|0;this.Ja="1"==b.sc;this.width=b.tw;this.height=b.th;this.uId=1==b.ps
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 61 72 20 62 3d 28 61 2e 6b 61 2b 61 2e 42 61 29 2f 31 30 30 3b 61 2e 4a 61 7c 7c 28 62 3d 4d 61 74 68 2e 6d 69 6e 28 31 2c 62 2b 5f 2e 77 79 77 29 29 3b 72 65 74 75 72 6e 28 61 2e 77 69 64 74 68 2d 61 2e 77 69 64 74 68 2a 62 29 2f 61 2e 68 65 69 67 68 74 7d 3b 5f 2e 46 79 77 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 2e 77 61 29 72 65 74 75 72 6e 20 61 2e 4f 70 28 29 3b 76 61 72 20 62 3d 28 61 2e 6f 61 2b 61 2e 41 61 29 2f 31 30 30 3b 61 2e 4a 61 7c 7c 28 62 3d 4d 61 74 68 2e 6d 69 6e 28 31 2c 62 2b 5f 2e 77 79 77 29 29 3b 72 65 74 75 72 6e 20 61 2e 77 69 64 74 68 2f 28 61 2e 68 65 69 67 68 74 2d 61 2e 68 65 69 67 68 74 2a 62 29 7d 3b 5f 2e 47 79 77 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 4c 61 3f 5f 2e 4d 32 28 22 64 61 Data Ascii: ar b=(a.ka+a.Ba)/100;a.Ja\|\|(b=Math.min(1,b+_.wyw));return(a.width-a.widthb)/a.height};_.Fyw=function(a){if(a.wa)return a.Op();var b=(a.oa+a.Aa)/100;a.Ja\|\|(b=Math.min(1,b+_.wyw));return a.width/(a.height-a.heightb)};_.Gyw=function(a){return a.La?_.M2("da
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 64 74 68 3b 6d 2e 69 6d 61 67 65 48 65 69 67 68 74 3d 67 2e 68 65 69 67 68 74 3b 69 66 28 67 2e 77 69 64 74 68 3e 68 7c 7c 67 2e 68 65 69 67 68 74 3e 71 29 7b 76 61 72 20 74 3d 0a 68 2f 71 2c 77 3d 4d 61 74 68 2e 6d 69 6e 28 5f 2e 46 79 77 28 67 29 2c 4d 61 74 68 2e 6d 61 78 28 74 2c 5f 2e 45 79 77 28 67 29 29 29 3b 67 2e 4f 70 28 29 3e 77 3f 28 74 3d 4d 61 74 68 2e 6d 69 6e 28 67 2e 68 65 69 67 68 74 2c 68 2f 77 29 2c 6d 2e 69 6d 61 67 65 57 69 64 74 68 3d 74 2a 67 2e 4f 70 28 29 2c 6d 2e 69 6d 61 67 65 48 65 69 67 68 74 3d 74 29 3a 28 74 3d 4d 61 74 68 2e 6d 69 6e 28 67 2e 77 69 64 74 68 2c 77 3e 74 3f 68 3a 71 2a 77 29 2c 6d 2e 69 6d 61 67 65 57 69 64 74 68 3d 74 2c 6d 2e 69 6d 61 67 65 48 65 69 67 68 74 3d 74 2f 67 2e 4f 70 28 29 29 7d 31 3c 5f 2e 76 Data Ascii: dth;m.imageHeight=g.height;if(g.width>h\|\|g.height>q){var t=h/q,w=Math.min(_.Fyw(g),Math.max(t,_.Eyw(g)));g.Op()>w?(t=Math.min(g.height,h/w),m.imageWidth=tg.Op(),m.imageHeight=t):(t=Math.min(g.width,w>t?h:qw),m.imageWidth=t,m.imageHeight=t/g.Op())}1<_.v
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 62 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 66 3d 62 5b 64 5d 3b 64 3d 66 2e 67 65 74 45 78 74 65 6e 73 69 6f 6e 28 5f 2e 41 79 77 29 3b 65 2e 62 63 3d 5f 2e 49 68 28 64 2c 39 29 3f 22 31 22 3a 22 30 22 3b 65 2e 63 74 3d 5f 2e 67 69 28 64 2c 34 29 3b 65 2e 63 62 3d 5f 2e 67 69 28 64 2c 35 29 3b 65 2e 63 6c 3d 5f 2e 67 69 28 64 2c 36 29 3b 65 2e 63 72 3d 5f 2e 67 69 28 64 2c 37 29 3b 65 2e 73 63 3d 5f 2e 49 68 28 64 2c 38 29 3f 22 31 22 3a 22 30 22 3b 66 3d 5f 2e 72 28 66 2c 5f 2e 4a 44 2c 33 29 3b 65 2e 74 77 3d 5f 2e 67 69 28 66 2c 33 29 3b 65 2e 74 68 3d 5f 2e 67 69 28 66 2c 32 29 3b 65 2e 74 75 3d 5f 2e 50 65 28 66 2c 31 29 3b 69 66 28 30 3c 5f 2e 24 76 61 28 64 2c 31 31 2c 5f 2e 79 79 77 29 2e 67 65 74 4c 65 6e 67 74 68 28 29 29 7b 76 61 72 20 67 3d 7b Data Ascii: b.length){var f=b[d];d=f.getExtension(_.Ayw);e.bc=_.Ih(d,9)?"1":"0";e.ct=_.gi(d,4);e.cb=_.gi(d,5);e.cl=_.gi(d,6);e.cr=_.gi(d,7);e.sc=_.Ih(d,8)?"1":"0";f=_.r(f,_.JD,3);e.tw=_.gi(f,3);e.th=_.gi(f,2);e.tu=_.Pe(f,1);if(0<_.$va(d,11,_.yyw).getLength()){var g={
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 68 28 64 29 3b 72 65 74 75 72 6e 20 63 7d 3b 0a 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 0a 74 72 79 7b 0a 5f 2e 78 28 22 41 42 4a 65 42 62 22 29 3b 0a 76 61 72 20 66 7a 77 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 5f 2e 4a 79 77 2e 63 61 6c 6c 28 74 68 69 73 2c 61 2c 62 2c 64 29 3b 74 68 69 73 2e 41 61 3d 63 7d 3b 5f 2e 46 28 66 7a 77 2c 5f 2e 4a 79 77 29 3b 66 7a 77 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 41 61 2e 73 69 7a 65 28 29 3f 5f 2e 76 2e 78 5a 28 74 68 69 73 2e 41 61 2e 65 6c 28 29 29 2e 66 6c 6f 6f 72 28 29 2e 77 69 64 74 68 3a 5f 2e 4a 79 77 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 61 2e 63 61 6c 6c 28 74 68 69 73 Data Ascii: h(d);return c};}catch(e){_._DumpException(e)}try{_.x("ABJeBb");var fzw=function(a,b,c,d){_.Jyw.call(this,a,b,d);this.Aa=c};_.F(fzw,_.Jyw);fzw.prototype.ka=function(){return this.Aa.size()?_.v.xZ(this.Aa.el()).floor().width:_.Jyw.prototype.ka.call(this
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 65 6c 2e 67 52 2e 57 48 28 29 7d 29 7d 7d 7d 7d 3b 67 7a 77 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6c 61 79 6f 75 74 7d 3b 67 7a 77 2e 70 72 6f 74 6f 74 79 70 65 2e 4e 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 2e 78 43 6d 28 5f 2e 6f 56 2e 57 4d 62 2c 74 68 69 73 2e 6c 61 79 6f 75 74 2e 77 61 29 7d 3b 5f 2e 4a 28 67 7a 77 2e 70 72 6f 74 6f 74 79 70 65 2c 22 6b 34 49 73 65 62 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 4e 62 7d 29 3b 5f 2e 4a 28 67 7a 77 2e 70 72 6f 74 6f 74 79 70 65 2c 22 6e 79 56 49 43 63 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6b 61 7d 29 3b 5f 2e 54 6f 28 5f 2e 56 49 6a 2c 67 7a 77 29 3b 0a 5f 2e 79 Data Ascii: el.gR.WH()})}}}};gzw.prototype.ka=function(){return this.layout};gzw.prototype.Nb=function(){_.xCm(_.oV.WMb,this.layout.wa)};_.J(gzw.prototype,"k4Iseb",function(){return this.Nb});_.J(gzw.prototype,"nyVICc",function(){return this.ka});_.To(_.VIj,gzw);_.y
2024-01-30 17:51:42 UTC	1252	IN	Data Raw: 5f 62 74 22 2c 5f 2e 49 28 22 6a 6e 76 6e 61 66 22 29 29 3b 78 75 2e 73 65 74 28 22 61 63 5f 63 73 22 2c 5f 2e 49 28 22 73 51 46 59 73 63 22 29 29 3b 78 75 2e 73 65 74 28 22 61 63 5f 66 63 22 2c 5f 2e 49 28 22 62 6b 4c 35 64 63 22 29 29 3b 78 75 2e 73 65 74 28 22 61 63 5f 66 65 22 2c 5f 2e 49 28 22 54 39 37 33 6c 62 22 29 29 3b 5f 2e 6c 78 62 3d 5f 2e 49 28 22 75 77 6f 45 44 65 22 29 3b 78 75 2e 73 65 74 28 22 61 63 5f 69 72 22 2c 5f 2e 6c 78 62 29 3b 78 75 2e 73 65 74 28 22 61 63 5f 6c 76 73 22 2c 5f 2e 49 28 22 6c 67 72 41 34 63 22 29 29 3b 78 75 2e 73 65 74 28 22 61 63 5f 72 63 22 2c 5f 2e 49 28 22 75 31 36 64 5a 65 22 29 29 3b 78 75 2e 73 65 74 28 22 61 63 63 65 70 74 22 2c 5f 2e 49 28 22 5a 63 5a 54 37 22 29 29 3b 78 75 2e 73 65 74 28 22 61 63 65 78 Data Ascii: _bt",_.I("jnvnaf"));xu.set("ac_cs",_.I("sQFYsc"));xu.set("ac_fc",_.I("bkL5dc"));xu.set("ac_fe",_.I("T973lb"));_.lxb=_.I("uwoEDe");xu.set("ac_ir",_.lxb);xu.set("ac_lvs",_.I("lgrA4c"));xu.set("ac_rc",_.I("u16dZe"));xu.set("accept",_.I("ZcZT7"));xu.set("acex

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.17	49764	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:42 UTC	1419	OUT	GET /client_204?atyp=i&biw=1034&bih=870&dpr=1&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
2024-01-30 17:51:42 UTC	1394	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-ybO7594UsRLrJCZ7s7GPzg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:42 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-01-30-17; expires=Thu, 29-Feb-2024 17:51:42 GMT; path=/; domain=.google.com; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.17	49765	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:42 UTC	1393	OUT	GET /images/icons/material/system/1x/email_grey600_24dp.png HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
2024-01-30 17:51:42 UTC	670	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: image/png Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 219 Date: Tue, 30 Jan 2024 17:51:42 GMT Expires: Tue, 30 Jan 2024 17:51:42 GMT Cache-Control: private, max-age=31536000 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:42 UTC	219	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 04 00 00 00 4a 7e f5 73 00 00 00 a2 49 44 41 54 78 01 dd 90 31 0e 82 30 18 46 ff c4 15 6f 80 97 90 73 18 f0 24 e2 f0 ce 21 9e 44 0e a2 97 90 c5 32 ca da 04 fb 2f 36 e4 8f 69 47 03 6f 68 be e4 3d 20 95 b5 3c 1c 71 cc 09 46 6a 84 20 2b 69 5d 71 31 d0 d9 30 fc 54 9f d4 7a 2e 03 a1 a0 c3 1b d9 73 a1 40 6c d0 53 22 54 3c 16 fa 9d 3d c2 8e de 04 81 89 96 4d a0 65 42 f7 9b 13 ba cf ba 4d f0 7d 63 85 50 d2 73 b3 5f b4 81 e2 e9 f4 9f 03 5b ae 61 cd a9 40 19 68 ec ad d9 c0 b0 ee 60 cc d2 5f 31 a8 71 19 fa 21 06 99 fc 69 f0 01 69 05 f5 fd 67 5a 06 06 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRJ~sIDATx10Fos$!D2/6iGoh= <qFj +i]q10Tz.s@lS"T<=MeBM}cPs_[a@h`_1q!iigZIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.17	49766	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:42 UTC	3248	OUT	POST /gen_204?atyp=i&ei=Kze5ZY_EKtunqtsPm7mdiAw&ct=slh&v=t1&m=HV&pv=0.518824515729305&me=1:1706637099321,V,0,0,1034,870:0,B,2566:0,N,1,Kze5ZY_EKtunqtsPm7mdiAw:0,R,1,9,24,36,92,33:0,R,1,CA8QAA,24,88,800,40:0,R,1,CBYQAQ,24,88,73,40:0,R,1,CBMQAQ,103,88,110,40:0,R,1,CBIQAQ,219,88,111,40:0,R,1,CBEQAQ,336,88,76,40:0,R,1,CAUQGQ,28,171,652,1968:0,R,1,CAcQAA,28,171,600,117:0,R,1,CB0QAA,28,332,652,248:0,R,1,CB4QAQ,28,369,652,48:0,R,1,CB8QAQ,28,418,652,48:0,R,1,CCAQAQ,28,467,652,48:0,R,1,CCIQAQ,28,516,652,48:0,R,1,CBoQAA,28,624,600,139:0,R,1,CBUQAA,28,807,600,117:0,R,1,CAoQAA,756,165,372,2401:0,R,1,CCgQAA,735,165,393,1211:0,R,1,CCkQAA,736,165,392,72:0,R,1,CCgQBg,736,237,392,1088:0,R,1,CC0QAA,736,237,392,1088:0,R,1,CEQQAA,756,237,372,101:0,R,1,CD4QAA,756,237,372,82:0,R,1,CD4QAQ,756,237,372,82:0,R,1,CD8QAA,756,237,372,82:0,R,1,CDgQAA,756,237,199,82:0,R,1,CD0QAA,957,237,84,82:0,R,1,CDwQAA,756,321,126,82:0,R,1,CDsQAA,884,321,119,82:0,R,1,CDkQAA,1005,321,123,82:0,R,1,CD8QAg,1009,287,119,32:0,R,1,CEUQAA,756,362,372,509:0,R,1,CEEQAA,756,362,372,488:0,R,1,CDEQAA,756,362,372,133:0,R,1,CDEQAQ,756,362,372,133:0,R,1,CDMQAA,756,495,372,29:0,R,1,CC4QAA,756,524,372,29:0,R,1,CC8QAA,756,553,372,29:0,R,1,CDAQAA,756,582,372,51:0,R,1,CDIQAA,756,649,372,201:0,R,1,CDIQAQ,756,650,372,66:0,R,1,CDIQBg,756,717,372,66:0,R,1,CDIQCw,756,784,372,66:1464,x:48,T:0,R,1,9,24,36,92,33:0,R,1,CA8QAA,24,88,800,40:0,R,1,CBYQAQ,24,88,73,40:0,R,1,CBMQAQ,103,88,110,40:0,R,1,CBIQAQ,219,88,111,40:0,R,1,CBEQAQ,336,88,76,40:0,R,1,CG0QAQ,418,88,123,40:0,R,1,CGkQAQ,547,88,65,40:0,R,1,CGwQAQ,618,88,49,40:0,R,1,CGoQAQ,673,88,61,40:0,R,1,CGsQAQ,740,88,81,40:0,R,1,CAUQGQ,28,171,652,1968:0,R,1,CAcQAA,28,171,600,117:0,R,1,CB0QAA,28,332,652,248:0,R,1,CB4QAQ,28,369,652,48:0,R,1,CB8QAQ,28,418,652,48:0,R,1,CCAQAQ,28,467,652,48:0,R,1,CCIQAQ,28,516,652,48:0,R,1,CBoQAA,28,624,600,139:0,R,1,CBUQAA,28,807,600,117:0,R,1,CAoQAA,756,165,372,2445&zx=1706637100840&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq
2024-01-30 17:51:42 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-1V2gysOU47mvJc0cOJH3XQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:42 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.17	49767	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:42 UTC	3275	OUT	POST /gen_204?atyp=i&ei=Kze5ZY_EKtunqtsPm7mdiAw&ct=slh&v=t1&pv=0.518824515729305&me=69:1706637100833,R,1,CCgQAA,735,165,393,1211:0,R,1,CCkQAA,736,165,392,72:0,R,1,CCgQBg,736,237,392,1088:0,R,1,CC0QAA,736,237,392,1088:0,R,1,CEQQAA,756,237,372,101:0,R,1,CD4QAA,756,237,372,82:0,R,1,CD4QAQ,756,237,372,82:0,R,1,CD8QAA,756,237,372,82:0,R,1,CDgQAA,756,237,199,82:0,R,1,CD0QAA,957,237,84,82:0,R,1,CDwQAA,756,321,126,82:0,R,1,CDsQAA,884,321,119,82:0,R,1,CDkQAA,1005,321,123,82:0,R,1,CD8QAg,1009,287,119,32:0,R,1,CEUQAA,756,362,372,509:0,R,1,CEEQAA,756,362,372,488:0,R,1,CDEQAA,756,362,372,133:0,R,1,CDEQAQ,756,362,372,133:0,R,1,CDMQAA,756,495,372,29:0,R,1,CC4QAA,756,524,372,29:0,R,1,CC8QAA,756,553,372,29:0,R,1,CDAQAA,756,582,372,51:0,R,1,CDIQAA,756,649,372,201:0,R,1,CDIQAQ,756,650,372,66:0,R,1,CDIQBg,756,717,372,66:0,R,1,CDIQCw,756,784,372,66:19,T:0,R,1,9,24,36,92,33:0,R,1,CA8QAA,24,88,800,40:0,R,1,CBYQAQ,24,88,73,40:0,R,1,CBMQAQ,103,88,110,40:0,R,1,CBIQAQ,219,88,111,40:0,R,1,CBEQAQ,336,88,76,40:0,R,1,CG0QAQ,418,88,123,40:0,R,1,CGkQAQ,547,88,65,40:0,R,1,CGwQAQ,618,88,49,40:0,R,1,CGoQAQ,673,88,61,40:0,R,1,CGsQAQ,740,88,81,40:0,R,1,CAUQGQ,28,171,652,1968:0,R,1,CAcQAA,28,171,600,117:0,R,1,CB0QAA,28,332,652,248:0,R,1,CB4QAQ,28,369,652,48:0,R,1,CB8QAQ,28,418,652,48:0,R,1,CCAQAQ,28,467,652,48:0,R,1,CCIQAQ,28,516,652,48:0,R,1,CBoQAA,28,624,600,139:0,R,1,CBUQAA,28,807,600,117:0,R,1,CAoQAA,756,165,372,2445:0,R,1,CCgQAA,735,165,393,1211:0,R,1,CCkQAA,736,165,392,72:0,R,1,CCgQBg,736,237,392,1088:0,R,1,CC0QAA,736,237,392,1088:0,R,1,CEQQAA,756,237,372,101:0,R,1,CD4QAA,756,237,372,82:0,R,1,CD4QAQ,756,237,372,82:0,R,1,CD8QAA,756,237,372,82:0,R,1,CDgQAA,756,237,199,82:0,R,1,CD0QAA,957,237,84,82:0,R,1,CDwQAA,756,321,126,82:0,R,1,CDsQAA,884,321,119,82:0,R,1,CDkQAA,1005,321,123,82:0,R,1,CD8QAg,1009,287,119,32:0,R,1,CEUQAA,756,362,372,509:0,R,1,CEEQAA,756,362,372,488:0,R,1,CDEQAA,756,362,372,133:0,R,1,CDEQAQ,756,362,372,133&zx=1706637100858&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
2024-01-30 17:51:42 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-lCNvIOAo6pirlmgJjCSzKQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:42 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.17	49768	64.233.176.102	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:42 UTC	1134	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.GsbA68hXs80.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo899t-H8Lxb3OqzMDuPn6TV_i36ag/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq
2024-01-30 17:51:43 UTC	903	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript; charset=UTF-8 Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 121630 Date: Tue, 30 Jan 2024 17:51:43 GMT Expires: Wed, 29 Jan 2025 17:51:43 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 06 Dec 2023 17:20:24 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:43 UTC	349	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 5d 29 3b 0a 76 61 72 20 65 61 2c 66 61 2c 6e 61 2c 70 61 2c 73 61 2c 76 61 2c 77 61 2c 43 61 3b 5f 2e 64 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);var ea,fa,na,pa,sa,va,wa,Ca;_.da=function(a)
2024-01-30 17:51:43 UTC	1252	IN	Data Raw: 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 3b 66 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 6e 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 Data Ascii: n function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};fa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};na=function(a){a=["object"==t
2024-01-30 17:51:43 UTC	1252	IN	Data Raw: 61 74 36 34 41 72 72 61 79 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 5f 2e 6f 61 5b 62 5b 63 5d 5d 3b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 64 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 26 26 66 61 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 61 28 65 61 28 74 68 69 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 Data Ascii: at64Array".split(" "),c=0;c<b.length;c++){var d=_.oa[b[c]];"function"===typeof d&&"function"!=typeof d.prototype[a]&&fa(d.prototype,a,{configurable:!0,writable:!0,value:function(){return sa(ea(this))}})}return a});sa=function(a){a={next:a};a[Symbol.iterat
2024-01-30 17:51:43 UTC	1252	IN	Data Raw: 74 69 6f 6e 28 6b 29 7b 6b 28 68 29 7d 29 7d 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 65 50 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 68 69 73 2e 4c 66 29 7b 74 68 69 73 2e 4c 66 3d 5b 5d 3b 76 61 72 20 6b 3d 74 68 69 73 3b 74 68 69 73 2e 66 50 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6b 2e 62 37 28 29 7d 29 7d 74 68 69 73 2e 4c 66 2e 70 75 73 68 28 68 29 7d 3b 76 61 72 20 64 3d 5f 2e 6f 61 2e 73 65 74 54 69 6d 65 6f 75 74 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 66 50 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 64 28 68 2c 30 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 62 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 3b 74 68 69 73 2e 4c 66 26 26 74 68 69 73 2e 4c 66 2e 6c 65 6e 67 74 68 3b 29 7b Data Ascii: tion(k){k(h)})}if(a)return a;b.prototype.eP=function(h){if(null==this.Lf){this.Lf=[];var k=this;this.fP(function(){k.b7()})}this.Lf.push(h)};var d=_.oa.setTimeout;b.prototype.fP=function(h){d(h,0)};b.prototype.b7=function(){for(;this.Lf&&this.Lf.length;){
2024-01-30 17:51:43 UTC	1252	IN	Data Raw: 60 22 2b 74 68 69 73 2e 46 61 29 3b 74 68 69 73 2e 46 61 3d 68 3b 74 68 69 73 2e 7a 66 3d 6b 3b 32 3d 3d 3d 74 68 69 73 2e 46 61 26 26 74 68 69 73 2e 51 64 61 28 29 3b 74 68 69 73 2e 63 37 28 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 51 64 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 3d 74 68 69 73 3b 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 68 2e 46 62 61 28 29 29 7b 76 61 72 20 6b 3d 5f 2e 6f 61 2e 63 6f 6e 73 6f 6c 65 3b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 6b 26 26 6b 2e 65 72 72 6f 72 28 68 2e 7a 66 29 7d 7d 2c 0a 31 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 46 62 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 69 56 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 68 3d 5f 2e 6f 61 2e 43 75 73 Data Ascii: `"+this.Fa);this.Fa=h;this.zf=k;2===this.Fa&&this.Qda();this.c7()};e.prototype.Qda=function(){var h=this;d(function(){if(h.Fba()){var k=_.oa.console;"undefined"!==typeof k&&k.error(h.zf)}},1)};e.prototype.Fba=function(){if(this.iV)return!1;var h=_.oa.Cus
2024-01-30 17:51:43 UTC	1252	IN	Data Raw: 74 3a 74 68 72 6f 77 20 45 72 72 6f 72 28 22 64 60 22 2b 6d 2e 46 61 29 3b 7d 7d 76 61 72 20 6d 3d 74 68 69 73 3b 6e 75 6c 6c 3d 3d 74 68 69 73 2e 63 73 3f 66 2e 65 50 28 6c 29 3a 74 68 69 73 2e 63 73 2e 70 75 73 68 28 6c 29 3b 74 68 69 73 2e 69 56 3d 21 30 7d 3b 65 2e 72 65 73 6f 6c 76 65 3d 63 3b 65 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 6c 28 68 29 7d 29 7d 3b 65 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 66 6f 72 28 76 61 72 20 6d 3d 5f 2e 74 61 28 68 29 2c 6e 3d 6d 2e 6e 65 78 74 28 29 3b 21 6e 2e 64 6f 6e 65 3b 6e 3d 6d 2e 6e 65 78 74 28 29 29 63 28 6e 2e 76 Data Ascii: t:throw Error("d`"+m.Fa);}}var m=this;null==this.cs?f.eP(l):this.cs.push(l);this.iV=!0};e.resolve=c;e.reject=function(h){return new e(function(k,l){l(h)})};e.race=function(h){return new e(function(k,l){for(var m=_.ta(h),n=m.next();!n.done;n=m.next())c(n.v
2024-01-30 17:51:43 UTC	1252	IN	Data Raw: 72 65 74 75 72 6e 20 6e 3b 4f 62 6a 65 63 74 2e 69 73 45 78 74 65 6e 73 69 62 6c 65 28 6e 29 26 26 64 28 6e 29 3b 72 65 74 75 72 6e 20 6d 28 6e 29 7d 29 7d 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 21 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 6c 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6d 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6e 3d 6e 65 77 20 61 28 5b 5b 6c 2c 32 5d 2c 5b 6d 2c 33 5d 5d 29 3b 69 66 28 32 21 3d 6e 2e 67 65 74 28 6c 29 7c 7c 33 21 3d 6e 2e 67 65 74 28 6d 29 29 72 65 74 75 72 6e 21 31 3b 6e 2e 64 65 6c 65 74 65 28 6c 29 3b 6e 2e 73 65 74 28 6d 2c 34 29 3b 72 65 74 75 72 6e 21 6e 2e 68 61 73 28 6c 29 26 26 34 3d 3d 6e 2e 67 65 74 28 6d 29 7d 63 61 74 63 Data Ascii: return n;Object.isExtensible(n)&&d(n);return m(n)})}if(function(){if(!a\|\|!Object.seal)return!1;try{var l=Object.seal({}),m=Object.seal({}),n=new a([[l,2],[m,3]]);if(2!=n.get(l)\|\|3!=n.get(m))return!1;n.delete(l);n.set(m,4);return!n.has(l)&&4==n.get(m)}catc
2024-01-30 17:51:43 UTC	1252	IN	Data Raw: 75 65 5b 30 5d 2e 78 7c 7c 22 74 22 21 3d 6e 2e 76 61 6c 75 65 5b 31 5d 7c 7c 21 6d 2e 6e 65 78 74 28 29 2e 64 6f 6e 65 3f 21 31 3a 21 30 7d 63 61 74 63 68 28 70 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 76 61 72 20 62 3d 6e 65 77 20 57 65 61 6b 4d 61 70 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 0a 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 3b 69 66 28 6b 29 7b 6b 3d 5f 2e 74 61 28 6b 29 3b 66 6f 72 28 76 61 72 20 6c 3b 21 28 6c 3d 6b 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6c 3d 6c 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6c 5b 30 5d 2c 6c 5b 31 5d 29 7d 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 6b Data Ascii: ue[0].x\|\|"t"!=n.value[1]\|\|!m.next().done?!1:!0}catch(p){return!1}}())return a;var b=new WeakMap,c=function(k){this[0]={};this[1]=f();this.size=0;if(k){k=_.ta(k);for(var l;!(l=k.next()).done;)l=l.value,this.set(l[0],l[1])}};c.prototype.set=function(k,l){k
2024-01-30 17:51:43 UTC	1252	IN	Data Raw: 65 2e 65 6e 74 72 69 65 73 3b 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 76 61 72 20 6d 3d 6c 26 26 74 79 70 65 6f 66 20 6c 3b 22 6f 62 6a 65 63 74 22 3d 3d 6d 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 6d 3f 62 2e 68 61 73 28 6c 29 3f 6d 3d 62 2e 67 65 74 28 6c 29 3a 28 6d 3d 22 22 2b 20 2b 2b 68 2c 62 2e 73 65 74 28 6c 2c 6d 29 29 3a 6d 3d 22 70 5f 22 2b 6c 3b 76 61 72 20 6e 3d 6b 5b 30 5d 5b 6d 5d 3b 69 66 28 6e 26 26 76 61 28 6b 5b 30 5d 2c 6d 29 29 66 6f 72 28 6b 3d 30 3b 6b 3c 6e 2e 6c 65 6e 67 74 68 3b 6b 2b 2b 29 7b 76 61 72 20 70 3d 6e 5b 6b 5d 3b 69 66 28 6c 21 3d 3d 6c 26 26 70 2e 6b 65 79 21 3d 3d 70 2e 6b 65 79 7c 7c 6c 3d 3d 3d 70 2e 6b 65 79 29 72 65 74 75 72 6e 7b 69 64 3a 6d 2c 6c 69 73 74 3a 6e 2c 69 6e 64 65 78 3a 6b 2c Data Ascii: e.entries;var d=function(k,l){var m=l&&typeof l;"object"==m\|\|"function"==m?b.has(l)?m=b.get(l):(m=""+ ++h,b.set(l,m)):m="p_"+l;var n=k[0][m];if(n&&va(k[0],m))for(k=0;k<n.length;k++){var p=n[k];if(l!==l&&p.key!==p.key\|\|l===p.key)return{id:m,list:n,index:k,
2024-01-30 17:51:43 UTC	1252	IN	Data Raw: 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4f 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 7d 29 7d 7d 29 3b 0a 70 61 28 22 53 65 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 61 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 74 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 Data Ascii: on(a){return a?a:function(){return Oa(this,function(b){return b})}});pa("Set",function(a){if(function(){if(!a\|\|"function"!=typeof a\|\|!a.prototype.entries\|\|"function"!=typeof Object.seal)return!1;try{var c=Object.seal({x:4}),d=new a(_.ta([c]));if(!d.has(c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.17	49769	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:43 UTC	3586	OUT	GET /xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/excm=ABxRVc,AD6AIb,B0xr7b,CTwd8,CWOfE,CX5LId,CdOg1,D1J6He,FmnE6b,FuQWyc,GRJ32c,GXyz1,JxE93,KiXlnd,MRb7nf,NmR9jd,NsEUGe,Oa7Qpb,Ok4XMd,PE728b,PoJj8d,PvSBGf,QNvmne,RSlfle,TO0csb,TnXlGd,Trirbc,TurKxc,U3Ovcc,U6nlJe,UQpTU,UiPhkb,Uznx4d,VZLyBe,WxJ6g,XDlt7d,XHo6qe,XTkmZd,XbupY,YuNOCb,ZGLUZ,ZrXR8b,Zudxcb,a3cZoc,adn7N,ak946,bXyZdf,cKV22c,du3Q4e,eTv59e,f26on,fNMhz,hfJ9hb,jJtSzc,jkRPje,kCkfUb,kOSi0d,mL4hG,oXRDzc,pIseB,pMwOEe,pQk1fc,qngJBf,r24bR,rL2AR,sU6eaf,tlA71,tzTB5,vJPFse,vhpQNc,y25qZb,yChgtb,yfH2Bd,yn9Ffd,ypVg7e,yuQBec,zjNhL,zs9f9d/ed=1/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=sb_wiz,aa,abd,syr9,syrg,syrh,syrf,syri,sy10x,async,sy1ke,bgd,sy3a2,sy3a3,foot,sy1jz,sy5xh,kyn,sy2z2,lli,mu,sf,sy2kq,sy2kr,sy5yc,sonic,TxCJfd,sy6fl,sy6fm,qzxzOb,IsdWVc,sy1tb,sy2eo,sy1tf,sy2rn,sy6fk,syed,sy1ku,sy6fo,spch,tl,syyu,sync,syrc,syrd,sy1ll,sy1lm,sy1ln,EkevXb,sys9,SZXsif,sy11x,fiAufb,sys5,sy1jk,sy1jj,sy2kz,sy39h,sy3cy,sy3cz,sy3cx,sy3qg,sYEX8b,sy1l7,NEW1Qc,xBbsrc,sy1k1,sy1l9,IX53Tb,sywj,sywk,NO84gd,sy1h9,E9M6Uc,Zilivc,sy1qm,sy1qr,b5lhvb,IoGlCf,syv6,syv7,C8HsP,sywl,sywm,gOTY1,sywq,sywp,syws,sywt,sywv,sywu,syww,sy1sv,sy1sy,sy1ov,sy1o4,sy1nz,sy1ss,sy1st,sy1nf,sy1sq,sy1su,sy1sr,sy1sw,sy1sx,sy1sz,sy1t0,sy1t1,sy1t2,RJ1Nyd,syre,sy28z,C8ffD,sy290,sy292,ZUBru,sy291,sy293,sy294,rTuANe,syz9,sy2qb,yfZcPd,syyv,syyw,Dpem5c,syyr,sy282,sy28u,sy28v,sy28x,sy28w,sy28y,Fy1Pv,sy3ax,ROaKxe,sy3ay,sy3az,pj8IAe,sy3pi,vRe0ve,sy3pg,oWVrne,syz2,sy1a6,sy1a7,sy2aa,sy2a3,sy2a5,sy2rg,sy2a9,sy2rh,sy2ri,sy2rs,sy2v2,sy3b2,sy3pj,sy6fp,ogmBcd,sy2a6,sy3pf,Gg40M,sy477,GU4Gab,syuo,UBXHI,syup,R3fhkb,sy4e8,sy6q7,Q59Rjf,sy46l,T5VV,sy455,aDVF7,sy479,rhYw1b,sy1qf,sy1qj,sy1qk,Hlw0zd,M6QgBb,sy1qp,sy1qy,EO13pd,MpJwZc,UUJqVe,sy7d,sOXFj,sy7c,s39S4,NTMZac,nAFL3,oGtAuc,sy86,sy87,q0xTif,y05UD,sy123,sy124,sy125,sy126,sy127,sy12l,sy12m,sy1ge,sy1gf,sy1fd,sy314,sy1d1,sy1cx,sy1rn,sy1cy,sy1dh,sy1di,sy1d5,sy14l,sy1d4,sy1dl,sy1dk,sy1dm,sy1dn,syep,sy182,sy189,sy2np,sy2nq,sy2nr,sy1ds,sy2nz,syjt,sy3cr,sy3cs,sy6gm,sy18f,sy1cs,sy1ct,sy1cv,sy1d2,sy2ny,sy2o6,sy6gn,epYOx?xjs=s3 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
2024-01-30 17:51:43 UTC	818	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding, Origin Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="gws-team" Report-To: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]} Content-Length: 269406 Date: Tue, 30 Jan 2024 17:51:43 GMT Expires: Wed, 29 Jan 2025 17:51:43 GMT Cache-Control: public, immutable, max-age=31536000 Last-Modified: Mon, 29 Jan 2024 22:58:53 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:43 UTC	434	IN	Data Raw: 5f 46 5f 69 6e 73 74 61 6c 6c 43 73 73 28 22 2e 6a 62 42 49 74 66 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 44 55 30 4e 4a 7b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 72 69 67 68 74 3a 30 3b 74 6f 70 3a 30 7d 2e 6c 50 33 4a 6f 66 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 6e 4e 4d 75 4f 64 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 71 6c 69 2d 63 6f 6e 74 61 69 6e 65 72 2d 72 6f 74 61 74 65 20 31 35 36 38 2e 32 33 35 32 39 34 31 31 37 36 6d 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 61 6e 69 6d 61 74 69 6f 6e 3a 71 6c 69 2d 63 6f 6e Data Ascii: _F_installCss(".jbBItf{display:block;position:relative}.DU0NJ{bottom:0;left:0;position:absolute;right:0;top:0}.lP3Jof{display:inline-block;position:relative}.nNMuOd{-webkit-animation:qli-container-rotate 1568.2352941176ms linear infinite;animation:qli-con
2024-01-30 17:51:43 UTC	1252	IN	Data Raw: 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 74 75 72 6e 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 71 6c 69 2d 63 6f 6e 74 61 69 6e 65 72 2d 72 6f 74 61 74 65 7b 66 72 6f 6d 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 29 7d 74 6f 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 74 75 72 6e 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 74 75 72 6e 29 7d 7d 2e 52 6f 4b 6d 68 62 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 6f 70 61 63 69 74 79 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 6e 4e 4d 75 4f 64 20 2e 56 51 64 65 61 62 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 Data Ascii: nsform:rotate(1turn)}}@keyframes qli-container-rotate{from{-webkit-transform:rotate(0);transform:rotate(0)}to{-webkit-transform:rotate(1turn);transform:rotate(1turn)}}.RoKmhb{height:100%;opacity:0;position:absolute;width:100%}.nNMuOd .VQdeab{-webkit-anima
2024-01-30 17:51:43 UTC	1252	IN	Data Raw: 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 34 2c 30 2c 30 2e 32 2c 31 29 20 69 6e 66 69 6e 69 74 65 20 62 6f 74 68 2c 71 6c 69 2d 67 72 65 65 6e 2d 66 61 64 65 2d 69 6e 2d 6f 75 74 20 35 33 33 32 6d 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 34 2c 30 2c 30 2e 32 2c 31 29 20 69 6e 66 69 6e 69 74 65 20 62 6f 74 68 3b 61 6e 69 6d 61 74 69 6f 6e 3a 71 6c 69 2d 66 69 6c 6c 2d 75 6e 66 69 6c 6c 2d 72 6f 74 61 74 65 20 35 33 33 32 6d 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 34 2c 30 2c 30 2e 32 2c 31 29 20 69 6e 66 69 6e 69 74 65 20 62 6f 74 68 2c 71 6c 69 2d 67 72 65 65 6e 2d 66 61 64 65 2d 69 6e 2d 6f 75 74 20 35 33 33 32 6d 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 34 2c 30 2c 30 2e 32 2c 31 29 20 69 6e 66 69 6e 69 74 65 20 62 6f Data Ascii: cubic-bezier(0.4,0,0.2,1) infinite both,qli-green-fade-in-out 5332ms cubic-bezier(0.4,0,0.2,1) infinite both;animation:qli-fill-unfill-rotate 5332ms cubic-bezier(0.4,0,0.2,1) infinite both,qli-green-fade-in-out 5332ms cubic-bezier(0.4,0,0.2,1) infinite bo
2024-01-30 17:51:43 UTC	1252	IN	Data Raw: 72 6d 3a 72 6f 74 61 74 65 28 32 37 30 64 65 67 29 7d 33 37 2e 35 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 34 30 35 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 34 30 35 64 65 67 29 7d 35 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 35 34 30 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 35 34 30 64 65 67 29 7d 36 32 2e 35 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 36 37 35 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 36 37 35 64 65 67 29 7d 37 35 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 38 31 30 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a Data Ascii: rm:rotate(270deg)}37.5%{-webkit-transform:rotate(405deg);transform:rotate(405deg)}50%{-webkit-transform:rotate(540deg);transform:rotate(540deg)}62.5%{-webkit-transform:rotate(675deg);transform:rotate(675deg)}75%{-webkit-transform:rotate(810deg);transform:
2024-01-30 17:51:43 UTC	1252	IN	Data Raw: 61 64 65 2d 69 6e 2d 6f 75 74 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 36 35 25 7b 6f 70 61 63 69 74 79 3a 30 7d 37 35 25 7b 6f 70 61 63 69 74 79 3a 30 2e 39 39 7d 39 30 25 7b 6f 70 61 63 69 74 79 3a 30 2e 39 39 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 7d 2e 62 65 44 51 50 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 77 69 64 74 68 3a 35 30 25 7d 2e 46 63 58 66 69 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6c 65 66 74 3a 34 35 25 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 Data Ascii: ade-in-out{0%{opacity:0}65%{opacity:0}75%{opacity:0.99}90%{opacity:0.99}100%{opacity:0}}.beDQP{display:inline-block;height:100%;overflow:hidden;position:relative;width:50%}.FcXfi{box-sizing:border-box;height:100%;left:45%;overflow:hidden;position:absolute
2024-01-30 17:51:43 UTC	1252	IN	Data Raw: 4d 75 4f 64 20 2e 4a 37 75 75 55 65 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 71 6c 69 2d 6c 65 66 74 2d 73 70 69 6e 20 31 33 33 33 6d 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 34 2c 30 2c 30 2e 32 2c 31 29 20 69 6e 66 69 6e 69 74 65 20 62 6f 74 68 3b 61 6e 69 6d 61 74 69 6f 6e 3a 71 6c 69 2d 6c 65 66 74 2d 73 70 69 6e 20 31 33 33 33 6d 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 34 2c 30 2c 30 2e 32 2c 31 29 20 69 6e 66 69 6e 69 74 65 20 62 6f 74 68 3b 62 6f 72 64 65 72 2d 6c 65 66 74 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 42 53 6e 4c 62 20 2e 6e 4e 4d 75 4f 64 20 2e 73 44 50 49 43 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 71 6c 69 2d 72 69 67 Data Ascii: MuOd .J7uuUe{-webkit-animation:qli-left-spin 1333ms cubic-bezier(0.4,0,0.2,1) infinite both;animation:qli-left-spin 1333ms cubic-bezier(0.4,0,0.2,1) infinite both;border-left-color:#fff;border-top-color:#fff}.BSnLb .nNMuOd .sDPIC{-webkit-animation:qli-rig
2024-01-30 17:51:43 UTC	1252	IN	Data Raw: 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 35 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 35 64 65 67 29 7d 31 30 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 2d 31 33 30 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 2d 31 33 30 64 65 67 29 7d 7d 63 2d 77 69 7a 7b 63 6f 6e 74 61 69 6e 3a 73 74 79 6c 65 7d 63 2d 77 69 7a 3e 63 2d 64 61 74 61 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 63 2d 77 69 7a 2e 72 45 54 53 44 7b 63 6f 6e 74 61 69 6e 3a 6e 6f 6e 65 7d 63 2d 77 69 7a 2e 55 62 69 38 5a 7b 63 6f 6e 74 61 69 6e 3a 6c 61 79 6f 75 74 20 73 74 79 6c 65 7d 2e 44 71 66 42 77 7b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6f 70 61 63 69 74 79 3a 30 3b 7a 2d 69 6e 64 65 78 3a Data Ascii: ansform:rotate(5deg);transform:rotate(5deg)}100%{-webkit-transform:rotate(-130deg);transform:rotate(-130deg)}}c-wiz{contain:style}c-wiz>c-data{display:none}c-wiz.rETSD{contain:none}c-wiz.Ubi8Z{contain:layout style}.DqfBw{overflow:hidden;opacity:0;z-index:
2024-01-30 17:51:43 UTC	1252	IN	Data Raw: 77 65 62 6b 69 74 2d 66 6c 65 78 2d 67 72 6f 77 3a 31 3b 66 6c 65 78 2d 67 72 6f 77 3a 31 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 69 6e 69 74 69 61 6c 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 69 6e 69 74 69 61 6c 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 6e 6f 72 6d 61 6c 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 36 70 78 7d 2e 67 49 59 4a 55 63 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 72 67 62 28 32 34 38 2c 32 34 39 2c 32 35 30 29 3b 62 6f 72 64 65 72 3a 31 70 78 20 64 61 73 68 65 64 20 23 63 30 63 30 63 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 38 70 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c Data Ascii: webkit-flex-grow:1;flex-grow:1;-webkit-box-pack:initial;-webkit-justify-content:initial;justify-content:normal;padding-top:16px}.gIYJUc{background:rgb(248,249,250);border:1px dashed #c0c0c0;border-radius:8px;box-sizing:border-box;display:-webkit-box;displ
2024-01-30 17:51:43 UTC	1252	IN	Data Raw: 33 30 30 70 78 7d 2e 61 6c 54 42 51 65 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 28 32 35 32 2c 32 33 32 2c 32 33 30 29 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 38 70 78 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 38 70 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 Data Ascii: 300px}.alTBQe{-webkit-box-align:center;-webkit-align-items:center;align-items:center;background-color:rgb(252,232,230);border-top-left-radius:8px;border-top-right-radius:8px;-webkit-box-pack:justify;-webkit-justify-content:space-between;justify-content:sp
2024-01-30 17:51:43 UTC	1252	IN	Data Raw: 62 28 32 31 38 2c 32 32 30 2c 32 32 34 29 7d 2e 41 79 65 31 6b 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 52 61 6f 55 55 65 7b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 69 6e 6c 69 6e 65 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 31 38 70 78 7d 2e 65 38 45 75 6c 65 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 Data Ascii: b(218,220,224)}.Aye1k{width:inherit;position:relative;display:block}.RaoUUe{display:-webkit-inline-box;display:-webkit-inline-flex;display:inline-flex;margin-right:18px}.e8Eule{box-sizing:border-box;display:-webkit-box;display:-webkit-flex;display:flex;-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.17	49770	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:43 UTC	1762	OUT	GET /async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDhAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=9103415834496958732&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
2024-01-30 17:51:43 UTC	1637	IN	HTTP/1.1 200 OK Version: 602283465 X-Content-Type-Options: nosniff Content-Type: text/plain; charset=UTF-8 Content-Disposition: attachment; filename="f.txt" Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:43 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Expires: Tue, 30 Jan 2024 17:51:43 GMT Set-Cookie: 1P_JAR=2024-01-30-17; expires=Thu, 29-Feb-2024 17:51:43 GMT; path=/; domain=.google.com; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:43 UTC	48	IN	Data Raw: 32 61 0d 0a 29 5d 7d 27 0a 32 32 3b 5b 22 4c 7a 65 35 5a 64 79 4c 4a 61 36 50 77 62 6b 50 30 62 4b 35 71 41 34 22 2c 22 31 39 34 36 22 5d 0d 0a Data Ascii: 2a)]}'22;["Lze5ZdyLJa6PwbkP0bK5qA4","1946"]
2024-01-30 17:51:43 UTC	15	IN	Data Raw: 61 0d 0a 33 3b 5b 31 5d 33 3b 5b 35 5d 0d 0a Data Ascii: a3;[1]3;[5]
2024-01-30 17:51:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.17	49772	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:43 UTC	1762	OUT	GET /async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDRAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=3258071689962503910&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
2024-01-30 17:51:43 UTC	1637	IN	HTTP/1.1 200 OK Version: 602283465 X-Content-Type-Options: nosniff Content-Type: text/plain; charset=UTF-8 Content-Disposition: attachment; filename="f.txt" Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:43 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Expires: Tue, 30 Jan 2024 17:51:43 GMT Set-Cookie: 1P_JAR=2024-01-30-17; expires=Thu, 29-Feb-2024 17:51:43 GMT; path=/; domain=.google.com; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:43 UTC	48	IN	Data Raw: 32 61 0d 0a 29 5d 7d 27 0a 32 32 3b 5b 22 4c 7a 65 35 5a 63 54 6b 4a 66 76 37 77 62 6b 50 71 6f 53 4d 77 41 55 22 2c 22 31 39 34 36 22 5d 0d 0a Data Ascii: 2a)]}'22;["Lze5ZcTkJfv7wbkPqoSMwAU","1946"]
2024-01-30 17:51:43 UTC	15	IN	Data Raw: 61 0d 0a 33 3b 5b 31 5d 33 3b 5b 35 5d 0d 0a Data Ascii: a3;[1]3;[5]
2024-01-30 17:51:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.17	49771	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:43 UTC	1762	OUT	GET /async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDBAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=7017065288382140415&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
2024-01-30 17:51:43 UTC	1637	IN	HTTP/1.1 200 OK Version: 602283465 X-Content-Type-Options: nosniff Content-Type: text/plain; charset=UTF-8 Content-Disposition: attachment; filename="f.txt" Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:43 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Expires: Tue, 30 Jan 2024 17:51:43 GMT Set-Cookie: 1P_JAR=2024-01-30-17; expires=Thu, 29-Feb-2024 17:51:43 GMT; path=/; domain=.google.com; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:43 UTC	48	IN	Data Raw: 32 61 0d 0a 29 5d 7d 27 0a 32 32 3b 5b 22 4c 7a 65 35 5a 65 54 64 4a 75 48 5a 77 62 6b 50 6b 4e 4b 48 69 41 6f 22 2c 22 31 39 34 36 22 5d 0d 0a Data Ascii: 2a)]}'22;["Lze5ZeTdJuHZwbkPkNKHiAo","1946"]
2024-01-30 17:51:43 UTC	15	IN	Data Raw: 61 0d 0a 33 3b 5b 31 5d 33 3b 5b 35 5d 0d 0a Data Ascii: a3;[1]3;[5]
2024-01-30 17:51:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.17	49773	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:43 UTC	1473	OUT	POST /gen_204?atyp=i&ei=Kze5ZY_EKtunqtsPm7mdiAw&ct=kptm:il&iw=1017&ih=853&r=0&sh=1024&sw=1280&tmw=374&tmh=82&nvi=6&eg=0&zx=1706637102152&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
2024-01-30 17:51:43 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-KwEZH2I5Eq5zizNg9ESGWQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:43 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.17	49774	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:43 UTC	1456	OUT	POST /gen_204?atyp=csi&ei=Kze5ZY_EKtunqtsPm7mdiAw&s=async&astyp=asyncContextualTask&rt=ttfb.663,ft.667&zx=1706637102814&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
2024-01-30 17:51:44 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-G0MFBijrPoDQ0QvOLVZ6YA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:44 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.17	49777	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:44 UTC	1352	OUT	GET /async/bgasy?ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cs=0&async=_fmt:jspb HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
2024-01-30 17:51:44 UTC	1479	IN	HTTP/1.1 200 OK Version: 602283465 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Date: Tue, 30 Jan 2024 17:51:44 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:44 UTC	1479	IN	Data Raw: 31 32 38 37 0d 0a 29 5d 7d 27 0a 7b 22 62 67 61 73 79 22 3a 5b 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 6a 73 2f 62 67 2f 6c 61 63 58 44 45 53 6d 46 4e 43 66 64 6a 4f 61 6e 63 62 77 67 58 6e 64 6c 6a 53 39 73 32 5f 41 50 70 68 6b 6e 56 74 33 77 45 6f 2e 6a 73 22 2c 22 58 43 72 4d 72 6f 4d 54 4a 5a 4d 44 56 53 6d 79 53 75 64 6c 43 71 4f 63 37 72 34 59 72 6c 54 59 51 6c 39 55 2f 49 35 51 66 31 45 75 50 48 31 79 38 6e 58 6f 44 71 4b 38 4f 30 64 63 77 4c 44 6e 77 6a 68 65 38 77 4b 38 76 66 50 41 6a 4a 62 2f 50 2f 6f 49 4c 6e 4a 79 63 32 58 55 4c 33 72 6f 44 62 78 62 4b 74 69 2f 6e 33 41 68 4d 75 72 69 39 52 65 7a 72 4d 46 73 73 54 32 69 78 78 54 75 33 39 64 2f 74 56 77 5a 6a 73 33 7a 30 57 38 64 7a 48 57 69 46 36 66 6b 4d 78 63 Data Ascii: 1287)]}'{"bgasy":["https://www.google.com/js/bg/lacXDESmFNCfdjOancbwgXndljS9s2_APphknVt3wEo.js","XCrMroMTJZMDVSmySudlCqOc7r4YrlTYQl9U/I5Qf1EuPH1y8nXoDqK8O0dcwLDnwjhe8wK8vfPAjJb/P/oILnJyc2XUL3roDbxbKti/n3AhMuri9RezrMFssT2ixxTu39d/tVwZjs3z0W8dzHWiF6fkMxc
2024-01-30 17:51:44 UTC	1479	IN	Data Raw: 4d 64 41 36 76 39 58 57 52 47 76 59 77 6d 49 49 42 78 41 6f 42 2b 43 34 4a 2f 4c 72 65 78 6a 6e 4a 77 32 58 67 65 31 46 67 5a 77 45 63 33 54 59 74 6b 35 48 2b 70 6f 50 63 56 39 44 47 4c 42 57 48 44 7a 58 7a 53 47 33 30 6f 43 74 74 4c 31 39 6d 35 50 49 65 66 30 78 49 62 73 72 6d 31 4b 6b 56 65 67 64 59 6a 31 52 78 7a 44 6b 36 68 74 6f 36 61 36 47 2b 4a 6e 45 6b 56 43 47 4d 6d 4b 71 35 70 6a 2f 56 66 77 30 56 34 49 66 39 78 57 70 30 53 6e 2f 6b 51 44 76 54 75 4d 74 6a 61 6c 75 4f 70 45 74 64 4b 33 35 37 59 6c 68 56 37 4e 58 47 47 45 54 33 55 33 64 62 4d 35 79 52 70 49 6c 34 6b 62 76 4b 54 77 55 6b 76 54 54 53 79 79 46 35 56 76 4f 6f 53 4a 47 42 57 31 2b 68 34 6c 59 41 6e 4b 30 46 4a 59 70 58 63 72 50 74 67 65 63 63 44 6a 31 41 34 72 74 78 69 6a 69 63 32 66 Data Ascii: MdA6v9XWRGvYwmIIBxAoB+C4J/LrexjnJw2Xge1FgZwEc3TYtk5H+poPcV9DGLBWHDzXzSG30oCttL19m5PIef0xIbsrm1KkVegdYj1RxzDk6hto6a6G+JnEkVCGMmKq5pj/Vfw0V4If9xWp0Sn/kQDvTuMtjaluOpEtdK357YlhV7NXGGET3U3dbM5yRpIl4kbvKTwUkvTTSyyF5VvOoSJGBW1+h4lYAnK0FJYpXcrPtgeccDj1A4rtxijic2f
2024-01-30 17:51:44 UTC	1479	IN	Data Raw: 42 6f 57 4c 56 33 45 4b 50 59 50 41 48 4c 59 37 4a 63 42 7a 44 75 54 79 4c 49 39 65 34 71 34 42 49 6b 62 5a 74 59 35 63 41 2f 4d 67 74 75 64 64 4d 77 33 35 6c 6e 77 74 4b 77 7a 39 63 64 2f 53 4e 53 55 4f 4e 6d 61 6f 75 52 50 69 59 4e 38 73 72 45 45 50 4a 52 36 43 6d 6b 33 73 78 57 67 4c 32 54 79 73 32 7a 30 62 4f 35 64 6a 4e 6c 54 44 70 57 63 4e 38 4e 72 63 49 53 6d 61 63 36 54 67 6d 45 6f 30 38 52 46 43 33 77 39 71 78 4d 6c 31 65 58 4a 4c 6e 49 50 4a 38 34 59 46 44 4b 41 2b 4a 45 78 61 79 58 39 48 6e 54 51 7a 4f 32 65 70 7a 50 61 78 4e 46 30 55 6a 4a 35 36 6a 33 69 48 4a 48 53 77 41 6b 52 72 4b 62 31 69 33 76 78 56 44 42 49 45 41 69 32 6a 31 4b 63 78 74 72 4c 5a 39 52 68 67 73 5a 55 6e 6d 72 70 4b 2b 57 50 56 57 39 63 52 78 34 35 38 37 46 31 74 7a 54 42 Data Ascii: BoWLV3EKPYPAHLY7JcBzDuTyLI9e4q4BIkbZtY5cA/MgtuddMw35lnwtKwz9cd/SNSUONmaouRPiYN8srEEPJR6Cmk3sxWgL2Tys2z0bO5djNlTDpWcN8NrcISmac6TgmEo08RFC3w9qxMl1eXJLnIPJ84YFDKA+JExayX9HnTQzO2epzPaxNF0UjJ56j3iHJHSwAkRrKb1i3vxVDBIEAi2j1KcxtrLZ9RhgsZUnmrpK+WPVW9cRx4587F1tzTB
2024-01-30 17:51:44 UTC	314	IN	Data Raw: 6c 4c 2b 79 6b 66 47 53 41 74 70 68 77 36 59 2f 65 31 45 2b 6e 47 34 4d 74 67 7a 41 4f 4b 62 4b 6e 77 4f 55 56 4b 6f 46 4e 71 79 36 62 48 6a 51 6f 49 64 39 4b 47 57 65 43 58 66 70 49 33 61 42 49 4b 48 2f 6d 30 33 37 63 38 31 66 41 31 64 4d 54 66 34 42 51 54 52 57 32 75 4b 4f 7a 78 32 31 6c 42 32 72 72 53 69 6b 75 62 67 79 67 77 6a 4c 71 74 61 31 72 55 2b 41 6e 75 73 6a 43 44 46 76 4e 39 4f 4b 68 42 39 50 37 59 79 32 42 39 56 2b 50 37 6a 61 68 6e 37 4f 55 36 30 70 6f 33 75 46 36 75 37 74 45 6d 41 31 58 4f 65 6e 64 6d 4f 57 51 57 55 6a 38 53 63 32 43 64 30 65 31 6a 72 4f 4d 49 6b 6c 2f 49 70 4e 44 47 52 76 50 52 59 63 32 57 79 47 79 53 38 42 2f 6a 43 75 50 72 77 41 36 59 55 31 41 49 51 48 74 6b 4d 37 61 55 47 6e 64 6d 31 66 37 51 68 79 41 55 4e 74 73 45 42 Data Ascii: lL+ykfGSAtphw6Y/e1E+nG4MtgzAOKbKnwOUVKoFNqy6bHjQoId9KGWeCXfpI3aBIKH/m037c81fA1dMTf4BQTRW2uKOzx21lB2rrSikubgygwjLqta1rU+AnusjCDFvN9OKhB9P7Yy2B9V+P7jahn7OU60po3uF6u7tEmA1XOendmOWQWUj8Sc2Cd0e1jrOMIkl/IpNDGRvPRYc2WyGyS8B/jCuPrwA6YU1AIQHtkM7aUGndm1f7QhyAUNtsEB
2024-01-30 17:51:44 UTC	1252	IN	Data Raw: 64 35 36 0d 0a 74 2b 73 65 45 31 50 75 5a 64 68 45 4c 4b 6c 67 75 50 33 64 4d 56 6a 75 59 69 47 49 59 39 4c 5a 59 69 51 39 76 46 67 75 33 65 36 35 65 61 2f 6e 64 48 52 36 52 4b 58 39 69 72 68 75 48 52 32 76 58 6e 54 77 67 6e 69 64 34 63 35 38 6b 30 67 56 39 78 58 39 34 69 55 5a 61 7a 77 65 45 75 37 71 34 6f 52 6a 68 69 69 76 39 76 74 79 43 78 4b 6b 6b 6b 62 70 78 6c 48 68 44 50 6e 4b 51 31 39 58 37 67 6b 42 69 31 74 38 35 72 6a 35 37 73 65 64 64 39 63 4a 77 61 66 59 42 4b 71 74 7a 73 45 6f 4b 58 6d 42 37 6c 6d 58 31 66 2b 46 68 64 64 6a 71 5a 77 66 6e 61 55 47 61 42 73 4b 70 36 52 32 58 32 6e 7a 76 70 4f 37 63 47 78 49 46 5a 68 65 52 33 72 4b 36 75 34 4c 72 4a 76 4f 78 4d 47 55 65 44 39 4b 45 52 6f 71 36 36 66 76 64 75 53 73 56 52 72 72 68 33 71 38 2f 51 Data Ascii: d56t+seE1PuZdhELKlguP3dMVjuYiGIY9LZYiQ9vFgu3e65ea/ndHR6RKX9irhuHR2vXnTwgnid4c58k0gV9xX94iUZazweEu7q4oRjhiiv9vtyCxKkkkbpxlHhDPnKQ19X7gkBi1t85rj57sedd9cJwafYBKqtzsEoKXmB7lmX1f+FhddjqZwfnaUGaBsKp6R2X2nzvpO7cGxIFZheR3rK6u4LrJvOxMGUeD9KERoq66fvduSsVRrrh3q8/Q
2024-01-30 17:51:44 UTC	1252	IN	Data Raw: 4a 53 69 4e 4d 37 4e 4c 70 79 41 51 77 7a 73 65 42 52 50 2b 46 4c 36 4d 58 71 79 54 71 67 54 58 6e 52 6a 7a 36 4d 36 2f 31 73 5a 57 57 6c 38 68 53 53 4d 43 4c 64 61 56 2f 49 56 79 6c 31 6d 51 44 61 75 56 6f 71 7a 47 52 4b 56 38 46 64 56 48 6e 6a 33 39 31 77 31 53 6b 73 37 70 54 6d 53 59 58 36 57 2f 37 34 73 4c 78 72 32 50 70 35 49 50 62 31 39 63 67 71 6d 6b 41 4b 57 78 44 71 50 45 35 64 71 78 57 46 69 36 4a 37 4e 55 72 65 48 41 64 57 66 33 6e 65 71 4e 49 78 4d 62 70 65 75 44 36 39 76 6e 78 49 41 54 51 62 59 33 6d 50 51 46 4c 62 61 68 56 54 79 64 4b 79 59 47 59 6b 4e 5a 67 7a 70 61 44 6d 6f 70 70 6d 6f 49 68 6f 6f 53 54 62 30 37 57 30 66 67 32 67 2f 30 55 38 7a 73 50 43 4f 6b 6b 4a 54 67 70 6a 77 68 6d 71 2b 37 73 6d 73 2b 68 52 75 54 56 7a 41 6e 38 65 57 Data Ascii: JSiNM7NLpyAQwzseBRP+FL6MXqyTqgTXnRjz6M6/1sZWWl8hSSMCLdaV/IVyl1mQDauVoqzGRKV8FdVHnj391w1Sks7pTmSYX6W/74sLxr2Pp5IPb19cgqmkAKWxDqPE5dqxWFi6J7NUreHAdWf3neqNIxMbpeuD69vnxIATQbY3mPQFLbahVTydKyYGYkNZgzpaDmoppmoIhooSTb07W0fg2g/0U8zsPCOkkJTgpjwhmq+7sms+hRuTVzAn8eW
2024-01-30 17:51:44 UTC	917	IN	Data Raw: 44 4e 45 72 33 66 72 79 4f 2f 52 79 53 57 4b 4b 78 4a 43 4c 6a 4c 39 2b 34 7a 6c 34 6d 55 73 45 63 41 6d 39 63 78 47 63 41 74 37 61 6d 2f 73 35 70 64 6a 33 32 74 69 65 71 4a 65 6e 66 48 61 46 55 6d 31 79 6c 2f 4a 4b 6e 71 6c 63 51 43 39 39 65 4f 71 64 6a 52 34 6c 30 48 78 39 72 59 48 30 68 54 76 67 53 6c 48 30 31 49 39 5a 49 4a 4e 41 58 53 4a 52 30 77 77 58 37 61 41 55 49 42 39 52 5a 4d 71 6e 42 4c 43 54 65 4c 77 67 41 76 33 67 33 70 79 62 2b 41 6c 76 67 58 53 63 78 49 67 4b 30 35 79 49 62 53 42 78 54 47 78 6b 72 57 32 61 34 2f 73 50 6c 31 65 43 55 78 6c 71 4c 37 35 7a 4c 59 37 55 67 75 49 6f 34 63 6b 70 2b 64 79 4e 57 30 62 72 39 65 33 48 6b 52 2f 4b 4c 55 76 44 32 67 47 6b 49 69 56 69 53 46 74 35 50 52 78 48 69 74 57 68 32 50 2f 36 68 2b 6e 67 78 78 79 Data Ascii: DNEr3fryO/RySWKKxJCLjL9+4zl4mUsEcAm9cxGcAt7am/s5pdj32tieqJenfHaFUm1yl/JKnqlcQC99eOqdjR4l0Hx9rYH0hTvgSlH01I9ZIJNAXSJR0wwX7aAUIB9RZMqnBLCTeLwgAv3g3pyb+AlvgXScxIgK05yIbSBxTGxkrW2a4/sPl1eCUxlqL75zLY7UguIo4ckp+dyNW0br9e3HkR/KLUvD2gGkIiViSFt5PRxHitWh2P/6h+ngxxy
2024-01-30 17:51:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.17	49778	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:44 UTC	1339	OUT	GET /client_204?cs=1&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg
2024-01-30 17:51:44 UTC	1792	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-6t9NCtLwGwKm6TCt2SPESA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Tue, 30 Jan 2024 17:51:44 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-01-30-17; expires=Thu, 29-Feb-2024 17:51:44 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4; expires=Wed, 31-Jul-2024 17:51:41 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.17	49776	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:44 UTC	4201	OUT	GET /xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/excm=ABxRVc,AD6AIb,B0xr7b,CTwd8,CWOfE,CX5LId,CdOg1,D1J6He,FmnE6b,FuQWyc,GRJ32c,GXyz1,JxE93,KiXlnd,MRb7nf,NmR9jd,NsEUGe,Oa7Qpb,Ok4XMd,PE728b,PoJj8d,PvSBGf,QNvmne,RSlfle,TO0csb,TnXlGd,Trirbc,TurKxc,U3Ovcc,U6nlJe,UQpTU,UiPhkb,Uznx4d,VZLyBe,WxJ6g,XDlt7d,XHo6qe,XTkmZd,XbupY,YuNOCb,ZGLUZ,ZrXR8b,Zudxcb,a3cZoc,adn7N,ak946,bXyZdf,cKV22c,du3Q4e,eTv59e,f26on,fNMhz,hfJ9hb,jJtSzc,jkRPje,kCkfUb,kOSi0d,mL4hG,oXRDzc,pIseB,pMwOEe,pQk1fc,qngJBf,r24bR,rL2AR,sU6eaf,tlA71,tzTB5,vJPFse,vhpQNc,y25qZb,yChgtb,yfH2Bd,yn9Ffd,ypVg7e,yuQBec,zjNhL,zs9f9d/ed=1/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=uKlGbf,sy1wl,sy3ap,DpX64d,sy3aq,EufiNb,sytm,P10Owf,synl,synv,gSZvdb,sy57c,vTw9Fc,sy1th,sy5de,SC7lYd,eTVOC,Pq506,kpAr,AjRVIe,tE6Rzd,phecbc,q28gvc,g0Ekse,jtFQAf,rKbWof,bIMMof,ARtdse,sy1wv,sy1ww,p2I2Je,z2eFcc,QzraZb,I9JIjc,nzu4Ud,gGYzg,FjjTod,tDA9G,UX8qee,tW711b,R6UkWb,xMHx5e,TnJGKb,SnmExf,synh,syr4,syhf,syih,sywz,syyf,syyg,Mbif2,syi3,syiy,sykd,syke,syk5,sykf,sykg,sysd,syhm,syhq,syi7,syiv,sy1al,syii,sy1am,sy1h7,sy1cg,sy1hb,sy1jd,sy1jc,sy1jq,sy1jr,sy1k0,sy1ms,sy1pd,sy1ou,sy1om,sy1p8,sy1p1,sy1p9,sy1pa,sy1pe,sy1pf,sy1ox,sy1pb,sy1px,sy1pw,sy1t3,sy1t4,sy1t5,sy1t9,sy1t8,sy1t6,sy1tr,sy1wo,sy1wx,syhc,sy1x2,sy1z1,syht,sy1z5,sy1wy,sy1x0,sy1x1,sy1x3,sy1x6,sy1x5,sy1wz,sy1x7,sy1x8,sy1x9,sy1xa,syi0,syim,sy1xe,sy1xf,sy1xg,syjw,syhs,syju,syjx,syrx,sy1xb,sy1xd,sy1xc,syh5,syh6,syi5,syi9,syis,syjn,syjo,syjq,syjs,sy1xj,sy1xk,sy1xi,sy1xl,sy1xm,syk4,sykq,sykr,syks,sykt,syku,sykv,sykw,sykx,syky,sykz,syl0,syl1,syl2,syl3,syl4,syl5,syl6,syl7,syl8,syl9,syla,sylb,sylc,syld,syle,sylf,sylg,sylh,sygq,syli,sylj,sylk,syll,sylm,syln,sy1xp,sy1xo,sy1xn,sy1xq,sy1xr,syk1,sy1xt,syk2,syk6,syk8,syka,sy1xu,sy1xv,sy1xw,syi4,sym9,syma,sy1xx,sy1bu,sy1wq,sy1xz,sy1y0,sy1y1,sy1y2,sy1y3,syho,syy5,syy2,syy6,syhk,syy7,syxh,syy8,syy9,sy1y6,sy1y7,sym7,sy1y5,sy1y8,sy1y9,sy1y4,sy1xy,sy1ya,sy1ea,sy1yi,syhd,syi8,syiu,syxz,syy0,syiw,sylz,symn,syy1,syy3,syz8,sy1e4,sy1e5,sy1eb,sy1ed,sy1ee,sy1xh,sy1yf,sy1yh,sy1yj,sy1ym,sy1yl,sy1yn,sy1yo,sy1yk,sy1yp,sy1yq,sy1yr,sy1ys,syjf,syjh,syjb,syjj,syjm,syr1,syr3,sy1yt,sy1yu,sykj,sykk,sykh,syki,syng,sy1yw,sy1yv,sy1yx,sykm,sykn,sykp,syso,sy1yz,sy1yy,sy1z0,sy1z2,sy1z3,sy1z4,sy1z6,sy1bp,sy1bq,syh8,syhu,sy1br,sy1bs,sy1bt,sy1w5,sy1w4,sy1w7,sy1x4,syxl,syxm,syxn,syxo,syxp,syxq,syxs,syxt,syxu,syxv,syxw,syxx,sy1yb,syj1,syxk,sy1yc,sy1yd,sy1ye,sy1z8,sy1z9,sy1z7,symb,sy1xs,sy1yg,sy1zb,sy1zc,sy1za,sy1zd,sy1ze,sy1zf,sy1zg,sy1zh,sy1zi,sy1zk,sy1zj,sy1zl,sy1ow,sy1p5,sy1zm,sy1zn,syij,sy1zo,sy1zp,syj6,sy1zq,sy1zr,sy1zs,syxy,sy1zt,sy1zu,exgaYe,sy1k3,sy3ph,bpec7b,sy1j8,sy20o,rhe7Pb,synf,synj,synk,DPreE,sy4u1,sy6vg,FH3rkc,sy3b0,sy3b1,qcH9Lc,sy2pr,sy3b3,YFicMc?xjs=s3 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
2024-01-30 17:51:44 UTC	818	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding, Origin Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="gws-team" Report-To: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]} Content-Length: 764044 Date: Tue, 30 Jan 2024 17:51:44 GMT Expires: Wed, 29 Jan 2025 17:51:44 GMT Cache-Control: public, immutable, max-age=31536000 Last-Modified: Mon, 29 Jan 2024 22:58:53 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:44 UTC	434	IN	Data Raw: 5f 46 5f 69 6e 73 74 61 6c 6c 43 73 73 28 22 2e 53 33 50 42 32 64 7b 6d 61 72 67 69 6e 3a 61 75 74 6f 7d 2e 58 33 42 52 68 65 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 61 75 74 6f 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 61 75 74 6f 7d 2e 54 42 43 39 75 62 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 70 78 7d 2e 56 43 4f 46 4b 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 38 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 38 70 78 7d 2e 51 6c 62 33 37 63 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 32 70 78 7d 2e 48 62 58 35 39 65 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 70 78 7d 2e 46 49 66 57 49 65 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 70 78 7d 2e 4f 68 53 63 69 63 Data Ascii: _F_installCss(".S3PB2d{margin:auto}.X3BRhe{margin-left:auto;margin-right:auto}.TBC9ub{margin-left:0px;margin-right:0px}.VCOFK{margin-left:8px;margin-right:8px}.Qlb37c{margin-left:2px;margin-right:2px}.HbX59e{margin-left:0px}.FIfWIe{margin-left:4px}.OhScic
2024-01-30 17:51:44 UTC	1252	IN	Data Raw: 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 32 70 78 7d 2e 72 32 66 6a 6d 64 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 7d 2e 74 7a 4d 34 74 64 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 38 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 7d 2e 47 55 48 61 7a 64 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 32 70 78 7d 2e 7a 55 64 70 70 63 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 34 70 78 7d 2e 47 30 76 51 72 62 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 70 78 7d 2e 6f 75 79 37 4d 63 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 36 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 31 36 70 78 7d 2e 57 74 35 54 66 65 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 70 78 3b 70 61 Data Ascii: px;margin-top:12px}.r2fjmd{margin-bottom:0px;margin-top:0px}.tzM4td{margin-bottom:8px;margin-top:8px}.GUHazd{padding-bottom:12px}.zUdppc{padding-bottom:4px}.G0vQrb{padding-bottom:2px}.ouy7Mc{padding-left:16px;padding-right:16px}.Wt5Tfe{padding-left:0px;pa
2024-01-30 17:51:44 UTC	1252	IN	Data Raw: 39 35 70 78 29 7b 2e 47 65 4f 7a 6e 63 20 2e 71 6b 37 4c 58 63 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 68 65 69 67 68 74 3a 34 34 38 70 78 7d 7d 2e 4b 55 66 31 38 2e 69 76 6b 64 62 66 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 36 29 3b 6f 70 61 63 69 74 79 3a 31 3b 76 69 73 69 62 69 6c 69 74 79 3a 69 6e 68 65 72 69 74 7d 2e 56 66 73 4c 70 66 2e 69 76 6b 64 62 66 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 3b 6f 70 61 63 69 74 79 3a 2e 34 3b 76 69 73 69 62 69 6c 69 74 79 3a 69 6e 68 65 72 69 74 7d 2e 4a 33 48 6e 6c 66 2e 69 76 6b 64 62 66 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 30 32 31 32 34 3b 6f 70 61 63 69 74 79 3a 2e 37 3b 76 69 73 69 62 69 6c 69 74 Data Ascii: 95px){.GeOznc .qk7LXc{height:100%;max-height:448px}}.KUf18.ivkdbf{background-color:rgba(0,0,0,0.6);opacity:1;visibility:inherit}.VfsLpf.ivkdbf{background-color:#000;opacity:.4;visibility:inherit}.J3Hnlf.ivkdbf{background-color:#202124;opacity:.7;visibilit
2024-01-30 17:51:44 UTC	1252	IN	Data Raw: 66 74 3a 30 3b 7a 2d 69 6e 64 65 78 3a 39 39 39 37 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 61 75 74 6f 7d 2e 6d 63 50 50 5a 2e 78 67 37 72 41 65 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 6d 63 50 50 5a 3a 3a 61 66 74 65 72 7b 63 6f 6e 74 65 6e 74 3a 5c 22 5c 22 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 Data Ascii: ft:0;z-index:9997;vertical-align:middle;visibility:hidden;white-space:nowrap;max-height:100%;max-width:100%;overflow-x:hidden;overflow-y:auto}.mcPPZ.xg7rAe{text-align:center}.mcPPZ::after{content:\"\";display:inline-block;height:100%;vertical-align:middle
2024-01-30 17:51:44 UTC	1252	IN	Data Raw: 37 5a 4a 2c 2e 41 62 39 67 4d 63 20 2e 6e 79 51 63 39 62 7b 63 6f 6c 6f 72 3a 23 37 30 37 35 37 61 7d 2e 4d 63 37 5a 4a 7b 68 65 69 67 68 74 3a 32 34 70 78 7d 2e 4d 63 37 5a 4a 2c 2e 6e 79 51 63 39 62 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 3b 6f 75 74 6c 69 6e 65 2d 77 69 64 74 68 3a 30 3b 74 61 70 2d 68 69 67 68 6c 69 67 68 74 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 30 29 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 30 3b 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 30 7d 2e 62 6c 36 73 74 62 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 31 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 67 Data Ascii: 7ZJ,.Ab9gMc .nyQc9b{color:#70757a}.Mc7ZJ{height:24px}.Mc7ZJ,.nyQc9b{display:block;outline:none;outline-width:0;tap-highlight-color:rgba(0,0,0,0);-webkit-flex-shrink:0;flex-shrink:0}.bl6stb{display:block;white-space:nowrap;-webkit-box-flex:1;-webkit-flex-g
2024-01-30 17:51:44 UTC	1252	IN	Data Raw: 7d 2e 78 4f 61 5a 44 65 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6c 65 66 74 3a 30 3b 72 69 67 68 74 3a 30 7d 2e 78 6c 59 34 71 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 34 70 78 3b 70 61 64 64 69 6e 67 3a 30 20 38 70 78 7d 2e 78 6c 59 34 71 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 7d 2e 78 6c 59 34 71 2c 2e 50 4f 55 51 77 64 2c 2e 58 71 4b 66 7a 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 33 34 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 6f 74 74 6f 6d 7d 2e 78 6c 59 34 71 2e 71 33 4e 31 76 62 7b 6d 69 6e 2d 77 69 64 74 68 3a 34 36 70 78 3b 70 61 64 64 69 6e 67 3a 30 20 31 31 70 78 7d 2e 78 6c 59 34 71 Data Ascii: }.xOaZDe{box-sizing:border-box;left:0;right:0}.xlY4q{line-height:34px;padding:0 8px}.xlY4q{font-size:14px}.xlY4q,.POUQwd,.XqKfz{box-sizing:border-box;display:inline-block;height:34px;vertical-align:bottom}.xlY4q.q3N1vb{min-width:46px;padding:0 11px}.xlY4q
2024-01-30 17:51:44 UTC	1252	IN	Data Raw: 64 6f 77 3a 30 20 31 70 78 20 32 70 78 20 72 67 62 61 28 36 30 2c 36 34 2c 36 37 2c 30 2e 33 29 2c 30 20 32 70 78 20 36 70 78 20 32 70 78 20 72 67 62 61 28 36 30 2c 36 34 2c 36 37 2c 30 2e 31 35 29 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 7d 2e 5a 6b 6b 4b 31 65 3a 68 6f 76 65 72 2c 2e 78 61 4e 73 66 63 3a 66 6f 63 75 73 20 2e 5a 6b 6b 4b 31 65 2c 61 3a 66 6f 63 75 73 20 2e 5a 6b 6b 4b 31 65 2c 2e 78 61 4e 73 66 63 3a 61 63 74 69 76 65 20 2e 5a 6b 6b 4b 31 65 2c 61 3a 61 63 74 69 76 65 20 2e 5a 6b 6b 4b 31 65 2c 2e 5a 6b 6b 4b 31 65 3a 66 6f 63 75 73 2c 2e 5a 6b 6b 4b 31 65 3a 61 63 74 69 76 65 7b 63 6f 6c 6f 72 3a 23 32 30 32 31 32 34 7d 2e 5a 6b 6b 4b 31 65 5b 64 69 73 61 Data Ascii: dow:0 1px 2px rgba(60,64,67,0.3),0 2px 6px 2px rgba(60,64,67,0.15);border-color:transparent;background:#fff}.ZkkK1e:hover,.xaNsfc:focus .ZkkK1e,a:focus .ZkkK1e,.xaNsfc:active .ZkkK1e,a:active .ZkkK1e,.ZkkK1e:focus,.ZkkK1e:active{color:#202124}.ZkkK1e[disa
2024-01-30 17:51:44 UTC	1252	IN	Data Raw: 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 31 37 34 65 61 36 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 32 65 33 66 63 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 32 65 33 66 63 7d 2e 78 61 4e 73 66 63 3a 66 6f 63 75 73 20 2e 5a 6b 6b 4b 31 65 5b 73 65 6c 65 63 74 65 64 5d 3a 68 6f 76 65 72 3a 6e 6f 74 28 3a 61 63 74 69 76 65 29 2c 61 3a 66 6f 63 75 73 20 2e 5a 6b 6b 4b 31 65 5b 73 65 6c 65 63 74 65 64 5d 3a 68 6f 76 65 72 3a 6e 6f 74 28 3a 61 63 74 69 76 65 29 2c 2e 5a 6b 6b 4b 31 65 5b 73 65 6c 65 63 74 65 64 5d 3a 68 6f 76 65 72 3a 66 6f 63 75 73 3a 6e 6f 74 28 3a 61 63 74 69 76 65 29 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 32 65 33 66 63 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 61 65 63 62 66 61 7d 2e 4c 30 4e 37 33 63 3a 61 66 74 65 72 7b 6c Data Ascii: :hover{color:#174ea6;border-color:#d2e3fc;background:#d2e3fc}.xaNsfc:focus .ZkkK1e[selected]:hover:not(:active),a:focus .ZkkK1e[selected]:hover:not(:active),.ZkkK1e[selected]:hover:focus:not(:active){border-color:#d2e3fc;background:#aecbfa}.L0N73c:after{l
2024-01-30 17:51:44 UTC	1252	IN	Data Raw: 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 23 64 61 64 63 65 30 3b 68 65 69 67 68 74 3a 30 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 70 78 7d 2e 65 4e 52 77 79 66 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 65 43 63 55 41 2c 2e 63 44 6e 78 4f 7b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 7d 2e 72 4c 64 57 66 65 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 69 6e 68 65 72 69 Data Ascii: {border-top:1px solid #dadce0;height:0;margin-left:5px;margin-right:5px}.eNRwyf{height:100%;width:100%}.eCcUA,.cDnxO{pointer-events:none;position:absolute;top:0;left:0;width:100%;height:100%;border-radius:50%}.rLdWfe{position:absolute;border-radius:inheri
2024-01-30 17:51:44 UTC	1252	IN	Data Raw: 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 61 75 74 6f 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 61 75 74 6f 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 67 7a 56 31 74 20 2e 6e 69 4f 34 75 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 73 74 72 65 74 63 68 3b 2d 77 65 62 6b 69 74 2d 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 73 74 72 65 74 63 68 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 73 74 72 65 74 63 68 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 Data Ascii: ;-webkit-box-pack:center;-webkit-justify-content:center;justify-content:center;margin-left:auto;margin-right:auto;position:relative;width:100%}.gzV1t .niO4u{-webkit-box-align:stretch;-webkit-align-items:stretch;align-items:stretch;display:-webkit-box;disp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.17	49779	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:44 UTC	1456	OUT	POST /gen_204?atyp=csi&ei=Kze5ZY_EKtunqtsPm7mdiAw&s=async&astyp=asyncContextualTask&rt=ttfb.675,ft.675&zx=1706637102823&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
2024-01-30 17:51:44 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-3FTqQfdXs8gU5jFraeodlQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:44 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.17	49775	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:44 UTC	1456	OUT	POST /gen_204?atyp=csi&ei=Kze5ZY_EKtunqtsPm7mdiAw&s=async&astyp=asyncContextualTask&rt=ttfb.688,ft.689&zx=1706637102837&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0
2024-01-30 17:51:44 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-3ARzR53kJCuScd7OCqAkaA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:44 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.17	49780	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:44 UTC	1444	OUT	POST /gen_204?atyp=i&ei=Kze5ZY_EKtunqtsPm7mdiAw&dt19=2&zx=1706637103023&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; NID=511=rAZ8vlW45jD6CxStF9D5RSyHvu0bGUWZ7ZLxl3hqVfyBriTC9W2qXDLMMeubSpPywSbksKMUZBJ7RpVGHJnLGgqyyn8HsNP2mfC72QcsOSsai_Ja45lmwWy-2o866CgZJ03eHGmAd5uWYNK7PuVmhECbs2-t2WZ99Hbg8Pbu1GQ6fUpnVJiP2Kev4NIjLvqI1tnq; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg
2024-01-30 17:51:44 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-rn8znxxpMQoO_I9zaw7knA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:44 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.17	49781	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:44 UTC	1809	OUT	GET /async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDhAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=9103415834496958732&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:45 UTC	1637	IN	HTTP/1.1 200 OK Version: 602283465 X-Content-Type-Options: nosniff Content-Type: text/plain; charset=UTF-8 Content-Disposition: attachment; filename="f.txt" Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:45 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Expires: Tue, 30 Jan 2024 17:51:45 GMT Set-Cookie: 1P_JAR=2024-01-30-17; expires=Thu, 29-Feb-2024 17:51:45 GMT; path=/; domain=.google.com; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:45 UTC	48	IN	Data Raw: 32 61 0d 0a 29 5d 7d 27 0a 32 32 3b 5b 22 4d 54 65 35 5a 66 50 55 42 50 65 4d 77 62 6b 50 70 34 53 67 6d 41 49 22 2c 22 31 39 34 36 22 5d 0d 0a Data Ascii: 2a)]}'22;["MTe5ZfPUBPeMwbkPp4SgmAI","1946"]
2024-01-30 17:51:45 UTC	15	IN	Data Raw: 61 0d 0a 33 3b 5b 31 5d 33 3b 5b 35 5d 0d 0a Data Ascii: a3;[1]3;[5]
2024-01-30 17:51:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.17	49782	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:45 UTC	1809	OUT	GET /async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDRAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=3258071689962503910&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:45 UTC	1637	IN	HTTP/1.1 200 OK Version: 602283465 X-Content-Type-Options: nosniff Content-Type: text/plain; charset=UTF-8 Content-Disposition: attachment; filename="f.txt" Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:45 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Expires: Tue, 30 Jan 2024 17:51:45 GMT Set-Cookie: 1P_JAR=2024-01-30-17; expires=Thu, 29-Feb-2024 17:51:45 GMT; path=/; domain=.google.com; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:45 UTC	48	IN	Data Raw: 32 61 0d 0a 29 5d 7d 27 0a 32 32 3b 5b 22 4d 54 65 35 5a 61 44 65 45 76 43 68 70 74 51 50 76 59 4f 67 6f 41 63 22 2c 22 31 39 34 36 22 5d 0d 0a Data Ascii: 2a)]}'22;["MTe5ZaDeEvChptQPvYOgoAc","1946"]
2024-01-30 17:51:45 UTC	15	IN	Data Raw: 61 0d 0a 33 3b 5b 31 5d 33 3b 5b 35 5d 0d 0a Data Ascii: a3;[1]3;[5]
2024-01-30 17:51:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.17	49783	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:45 UTC	1809	OUT	GET /async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDBAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=7017065288382140415&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:45 UTC	1637	IN	HTTP/1.1 200 OK Version: 602283465 X-Content-Type-Options: nosniff Content-Type: text/plain; charset=UTF-8 Content-Disposition: attachment; filename="f.txt" Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:45 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Expires: Tue, 30 Jan 2024 17:51:45 GMT Set-Cookie: 1P_JAR=2024-01-30-17; expires=Thu, 29-Feb-2024 17:51:45 GMT; path=/; domain=.google.com; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:45 UTC	48	IN	Data Raw: 32 61 0d 0a 29 5d 7d 27 0a 32 32 3b 5b 22 4d 54 65 35 5a 65 7a 66 45 74 43 5a 70 74 51 50 6d 65 79 30 75 41 4d 22 2c 22 31 39 34 36 22 5d 0d 0a Data Ascii: 2a)]}'22;["MTe5ZezfEtCZptQPmey0uAM","1946"]
2024-01-30 17:51:45 UTC	15	IN	Data Raw: 61 0d 0a 33 3b 5b 31 5d 33 3b 5b 35 5d 0d 0a Data Ascii: a3;[1]3;[5]
2024-01-30 17:51:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.17	49784	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:45 UTC	1819	OUT	GET /xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=sy3av,sy3qf,w4UyN,sy1j6,QKZgZd,sy1jf,sy1jg,Qj0suc,JXS8fb,sy1je,sy1ji,sy1jl,sy1jm,sy1jn,sy1jo,sy1jp,sy1js,Wct42,sysh,LiBxPe,sy46v,sy6kg,J9Q59e,sy46w,a6Sgfb?xjs=s3 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:45 UTC	817	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding, Origin Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="gws-team" Report-To: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]} Content-Length: 17091 Date: Tue, 30 Jan 2024 17:51:45 GMT Expires: Wed, 29 Jan 2025 17:51:45 GMT Cache-Control: public, immutable, max-age=31536000 Last-Modified: Mon, 29 Jan 2024 22:58:53 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:45 UTC	435	IN	Data Raw: 74 68 69 73 2e 5f 73 3d 74 68 69 73 2e 5f 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 53 5a 69 3d 5f 2e 49 28 22 4c 68 78 38 65 66 22 29 3b 0a 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 0a 74 72 79 7b 0a 5f 2e 56 6f 6a 3d 5f 2e 7a 28 22 77 34 55 79 4e 22 2c 5b 5d 29 3b 0a 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 0a 74 72 79 7b 0a 5f 2e 78 28 22 77 34 55 79 4e 22 29 3b 0a 76 61 72 20 6b 68 74 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 5f 2e 44 2e 63 61 6c 6c 28 74 68 69 73 2c 61 2e 4b 61 29 3b 74 68 69 73 2e 6b 61 3d 21 31 3b 74 68 69 73 2e 6f 61 3d 5f 2e 66 64 28 22 65 6c 50 64 64 Data Ascii: this._s=this._s\|\|{};(function(_){var window=this;try{_.SZi=_.I("Lhx8ef");}catch(e){_._DumpException(e)}try{_.Voj=_.z("w4UyN",[]);}catch(e){_._DumpException(e)}try{_.x("w4UyN");var kht=function(a){_.D.call(this,a.Ka);this.ka=!1;this.oa=_.fd("elPdd
2024-01-30 17:51:45 UTC	1252	IN	Data Raw: 5f 2e 53 5a 69 29 2c 21 74 68 69 73 2e 6b 61 29 7b 76 61 72 20 61 3d 5f 2e 63 43 28 6e 65 77 20 5f 2e 58 42 2c 5f 2e 59 42 28 6e 65 77 20 5f 2e 64 43 2c 31 33 34 36 33 34 29 29 3b 5f 2e 73 66 28 64 6f 63 75 6d 65 6e 74 2c 5f 2e 65 43 2c 7b 77 41 3a 61 7d 29 3b 74 68 69 73 2e 6b 61 3d 21 30 7d 7d 65 6c 73 65 20 5f 2e 76 2e 73 65 74 53 74 79 6c 65 28 74 68 69 73 2e 6f 61 2c 22 74 72 61 6e 73 66 6f 72 6d 22 2c 22 22 29 3b 74 68 69 73 2e 6f 62 28 22 73 75 45 4f 64 63 22 29 2e 73 65 74 53 74 79 6c 65 28 22 76 69 73 69 62 69 6c 69 74 79 22 2c 22 68 69 64 64 65 6e 22 29 7d 3b 0a 6b 68 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 68 6f 77 54 6f 6f 6c 74 69 70 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 62 28 22 73 75 45 4f 64 63 22 29 2e 73 65 74 53 74 79 6c Data Ascii: _.SZi),!this.ka){var a=_.cC(new _.XB,_.YB(new _.dC,134634));_.sf(document,_.eC,{wA:a});this.ka=!0}}else _.v.setStyle(this.oa,"transform","");this.ob("suEOdc").setStyle("visibility","hidden")};kht.prototype.showTooltip=function(){this.ob("suEOdc").setStyl
2024-01-30 17:51:45 UTC	1252	IN	Data Raw: 73 74 72 69 6e 67 73 20 6f 72 20 75 6e 73 75 70 70 6f 72 74 65 64 20 6b 65 79 73 22 29 3b 5f 2e 65 34 63 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 65 34 63 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 5f 2e 77 67 28 7b 73 65 72 76 69 63 65 4e 61 6d 65 3a 22 73 68 22 2c 6d 65 74 68 6f 64 4e 61 6d 65 3a 22 73 73 73 22 7d 2c 61 29 7d 3b 5f 2e 67 34 63 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 5f 2e 7a 72 61 28 7b 73 65 72 76 69 63 65 4e 61 6d 65 3a 22 73 68 22 2c 6d 65 74 68 6f 64 4e 61 6d 65 3a 22 73 73 73 22 7d 2c 5f 2e 72 46 61 28 61 29 29 7d 3b 5f 2e 68 34 63 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 2e 47 67 28 22 73 68 22 2c 22 62 63 74 6e 73 62 22 29 7d 3b 5f 2e 69 34 63 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 2e 47 67 28 22 73 68 22 2c 22 72 62 74 6e 73 62 Data Ascii: strings or unsupported keys");_.e4c(a);return a};_.e4c=function(a){_.wg({serviceName:"sh",methodName:"sss"},a)};_.g4c=function(a){_.zra({serviceName:"sh",methodName:"sss"},_.rFa(a))};_.h4c=function(){_.Gg("sh","bctnsb")};_.i4c=function(){_.Gg("sh","rbtnsb
2024-01-30 17:51:45 UTC	1252	IN	Data Raw: 28 61 29 7d 3b 5f 2e 46 28 5f 2e 48 34 63 2c 5f 2e 70 29 3b 5f 2e 48 34 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 43 6f 6e 74 65 78 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 2e 72 28 74 68 69 73 2c 5f 2e 78 73 2c 32 29 7d 3b 5f 2e 48 34 63 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 43 6f 6e 74 65 78 74 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 5f 2e 53 62 28 74 68 69 73 2c 5f 2e 78 73 2c 32 2c 61 29 7d 3b 5f 2e 49 34 63 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 49 61 3d 5f 2e 6e 28 61 29 7d 3b 5f 2e 46 28 5f 2e 49 34 63 2c 5f 2e 70 29 3b 76 61 72 20 4a 34 63 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 49 61 3d 5f 2e 6e 28 61 29 7d 3b 5f 2e 46 28 4a 34 63 2c 5f 2e 70 29 3b 4a 34 63 2e 70 72 6f Data Ascii: (a)};_.F(_.H4c,_.p);_.H4c.prototype.getContext=function(){return _.r(this,_.xs,2)};_.H4c.prototype.setContext=function(a){return _.Sb(this,_.xs,2,a)};_.I4c=function(a){this.Ia=_.n(a)};_.F(_.I4c,_.p);var J4c=function(a){this.Ia=_.n(a)};_.F(J4c,_.p);J4c.pro
2024-01-30 17:51:45 UTC	1252	IN	Data Raw: 34 63 3b 5f 2e 4e 34 63 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 53 34 63 7c 7c 28 53 34 63 3d 52 34 63 28 27 5b 6e 75 6c 6c 2c 5b 5b 34 38 2c 22 31 22 5d 5d 5d 27 29 29 29 2e 46 72 61 28 29 7d 3b 0a 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 0a 74 72 79 7b 0a 76 61 72 20 56 34 63 2c 54 34 63 3b 5f 2e 55 34 63 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 2c 63 2c 64 2c 65 2c 66 2c 67 2c 68 2c 6c 2c 6d 2c 71 2c 74 3b 72 65 74 75 72 6e 20 5f 2e 62 66 28 66 75 6e 63 74 69 6f 6e 28 77 29 7b 69 66 28 31 3d 3d 77 2e 6b 61 29 72 65 74 75 72 6e 20 62 3d 6e 65 77 20 5f 2e 47 72 2c 5f 2e 55 62 28 62 2c 31 2c 61 29 2c 63 3d 6e 65 77 20 5f 2e 47 34 63 2c 5f 2e 53 62 28 63 2c 5f 2e 47 72 2c 31 2c Data Ascii: 4c;_.N4c=function(){return(S4c\|\|(S4c=R4c('[null,[[48,"1"]]]'))).Fra()};}catch(e){_._DumpException(e)}try{var V4c,T4c;_.U4c=function(a){var b,c,d,e,f,g,h,l,m,q,t;return _.bf(function(w){if(1==w.ka)return b=new _.Gr,_.Ub(b,1,a),c=new _.G4c,_.Sb(c,_.Gr,1,
2024-01-30 17:51:45 UTC	1252	IN	Data Raw: 2e 4c 62 3d 74 68 69 73 2e 45 63 3d 74 68 69 73 2e 77 61 3d 74 68 69 73 2e 58 61 3d 74 68 69 73 2e 72 62 3d 74 68 69 73 2e 57 64 3d 74 68 69 73 2e 45 62 3d 74 68 69 73 2e 79 64 3d 74 68 69 73 2e 41 61 3d 21 31 3b 74 68 69 73 2e 4c 61 3d 6e 75 6c 6c 3b 74 68 69 73 2e 44 64 3d 74 68 69 73 2e 48 62 3d 74 68 69 73 2e 6c 64 3d 21 31 3b 74 68 69 73 2e 66 42 61 3d 74 68 69 73 2e 55 61 3d 74 68 69 73 2e 4a 61 3d 74 68 69 73 2e 42 61 3d 74 68 69 73 2e 48 61 3d 6e 75 6c 6c 3b 74 68 69 73 2e 4f 62 3d 30 3b 74 68 69 73 2e 51 61 3d 61 2e 73 65 72 76 69 63 65 2e 73 68 61 72 65 3b 74 68 69 73 2e 62 72 61 3d 61 2e 73 65 72 76 69 63 65 2e 62 72 61 3b 61 3d 61 2e 6a 73 64 61 74 61 2e 6a 63 67 3b 74 68 69 73 2e 66 42 61 3d 5f 2e 41 6a 28 61 2c 66 35 63 29 3f 61 2e 67 65 74 Data Ascii: .Lb=this.Ec=this.wa=this.Xa=this.rb=this.Wd=this.Eb=this.yd=this.Aa=!1;this.La=null;this.Dd=this.Hb=this.ld=!1;this.fBa=this.Ua=this.Ja=this.Ba=this.Ha=null;this.Ob=0;this.Qa=a.service.share;this.bra=a.service.bra;a=a.jsdata.jcg;this.fBa=_.Aj(a,f5c)?a.get
2024-01-30 17:51:45 UTC	1252	IN	Data Raw: 61 28 22 74 76 22 29 2e 47 62 28 29 3b 74 68 69 73 2e 77 61 3d 74 68 69 73 2e 67 65 74 44 61 74 61 28 22 73 73 64 6d 22 29 2e 47 62 28 29 3b 74 68 69 73 2e 45 63 3d 74 68 69 73 2e 67 65 74 44 61 74 61 28 22 73 73 70 75 22 29 2e 47 62 28 29 3b 74 68 69 73 2e 48 61 3d 5f 2e 78 6d 28 74 68 69 73 2e 67 65 74 44 61 74 61 28 22 73 73 74 68 22 29 29 3b 74 68 69 73 2e 42 61 3d 0a 5f 2e 78 6d 28 74 68 69 73 2e 67 65 74 44 61 74 61 28 22 73 73 70 74 22 29 29 3b 74 68 69 73 2e 4a 61 3d 5f 2e 78 6d 28 74 68 69 73 2e 67 65 74 44 61 74 61 28 22 73 73 74 22 29 29 3b 69 35 63 28 74 68 69 73 29 7d 3b 5f 2e 46 28 69 43 2c 5f 2e 44 29 3b 69 43 2e 47 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b 6a 73 64 61 74 61 3a 7b 6a 63 67 3a 5f 2e 68 43 7d 2c 73 65 72 76 Data Ascii: a("tv").Gb();this.wa=this.getData("ssdm").Gb();this.Ec=this.getData("sspu").Gb();this.Ha=_.xm(this.getData("ssth"));this.Ba=_.xm(this.getData("sspt"));this.Ja=_.xm(this.getData("sst"));i5c(this)};_.F(iC,_.D);iC.Ga=function(){return{jsdata:{jcg:_.hC},serv
2024-01-30 17:51:45 UTC	1252	IN	Data Raw: 63 74 69 6f 6e 28 67 29 7b 69 66 28 31 3d 3d 67 2e 6b 61 29 7b 69 66 28 32 45 33 3e 44 61 74 65 2e 6e 6f 77 28 29 2d 61 2e 4f 62 29 72 65 74 75 72 6e 20 67 2e 72 65 74 75 72 6e 28 50 72 6f 6d 69 73 65 2e 72 65 6a 65 63 74 28 67 35 63 29 29 3b 61 2e 4f 62 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 2e 62 66 28 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 68 2e 72 65 74 75 72 6e 28 61 2e 51 61 2e 65 30 28 6e 35 63 28 61 29 29 2e 74 68 65 6e 28 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 73 77 69 74 63 68 28 6c 29 7b 63 61 73 65 20 31 3a 6f 35 63 28 61 29 3b 70 35 63 28 61 2c 7b 41 5f 61 3a 21 30 7d 29 3b 71 35 63 28 61 2c 7b 41 5f 61 3a 21 30 7d 29 3b 72 35 63 28 61 29 3b 6c 3d 61 2e 66 42 61 3f 5f Data Ascii: ction(g){if(1==g.ka){if(2E3>Date.now()-a.Ob)return g.return(Promise.reject(g5c));a.Ob=Date.now();b=function(){return _.bf(function(h){return h.return(a.Qa.e0(n5c(a)).then(function(l){switch(l){case 1:o5c(a);p5c(a,{A_a:!0});q5c(a,{A_a:!0});r5c(a);l=a.fBa?_
2024-01-30 17:51:45 UTC	1252	IN	Data Raw: 64 2e 70 79 63 3b 76 61 72 20 67 3d 61 2e 67 65 74 54 69 74 6c 65 28 29 2c 68 3d 61 2e 4c 6f 2e 67 65 74 49 6d 61 67 65 55 72 6c 28 29 2c 6c 3d 61 2e 4c 6f 2e 42 33 63 28 29 3b 6c 3d 6c 3f 6c 3a 61 2e 4c 6f 2e 57 74 62 28 29 3b 76 61 72 20 6d 3d 61 2e 4c 6f 2e 74 4d 62 28 29 7c 7c 67 3b 76 61 72 20 71 3d 21 65 3b 0a 6d 3d 61 2e 77 61 26 26 61 2e 42 61 3f 61 2e 42 61 3a 61 2e 58 61 26 26 6c 3f 6c 3a 28 76 6f 69 64 20 30 3d 3d 3d 71 7c 7c 71 29 26 26 6c 3f 6d 3f 61 2e 6f 5a 2e 6f 61 28 29 3f 6c 2b 22 5c 6e 5c 6e 22 2b 6d 3a 6d 2b 22 20 22 2b 6c 3a 6c 3a 6d 3b 61 3d 61 2e 51 61 2e 74 70 61 28 29 26 26 21 6b 35 63 28 61 29 26 26 77 35 63 28 61 29 3b 72 65 74 75 72 6e 7b 74 69 74 6c 65 3a 66 26 26 67 7c 7c 76 6f 69 64 20 30 2c 69 6d 61 67 65 55 72 6c 3a 62 26 Data Ascii: d.pyc;var g=a.getTitle(),h=a.Lo.getImageUrl(),l=a.Lo.B3c();l=l?l:a.Lo.Wtb();var m=a.Lo.tMb()\|\|g;var q=!e;m=a.wa&&a.Ba?a.Ba:a.Xa&&l?l:(void 0===q\|\|q)&&l?m?a.oZ.oa()?l+"\n\n"+m:m+" "+l:l:m;a=a.Qa.tpa()&&!k5c(a)&&w5c(a);return{title:f&&g\|\|void 0,imageUrl:b&
2024-01-30 17:51:45 UTC	406	IN	Data Raw: 26 26 28 62 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 70 72 6f 64 75 63 74 2f 31 78 2f 67 73 61 5f 69 6f 73 5f 32 35 30 64 70 2e 70 6e 67 22 29 3b 72 65 74 75 72 6e 20 62 7d 2c 75 35 63 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3b 72 65 74 75 72 6e 21 21 5f 2e 47 69 28 61 2e 6f 5a 2c 36 2c 5f 2e 5a 34 63 29 26 26 21 28 6e 75 6c 6c 3d 3d 28 62 3d 61 2e 4c 6f 29 7c 7c 21 62 2e 58 73 28 29 29 7d 3b 69 43 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 66 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 71 35 63 28 74 68 69 73 2c 7b 41 5f 61 3a 21 31 7d 29 7d 3b 0a 69 43 2e 70 72 6f 74 6f 74 79 70 65 2e 50 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 41 61 7c 7c 74 35 63 28 21 31 2c Data Ascii: &&(b="https://www.google.com/images/branding/product/1x/gsa_ios_250dp.png");return b},u5c=function(a){var b;return!!_.Gi(a.oZ,6,_.Z4c)&&!(null==(b=a.Lo)\|\|!b.Xs())};iC.prototype.kf=function(){q5c(this,{A_a:!1})};iC.prototype.Pe=function(){this.Aa\|\|t5c(!1,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.17	49785	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:45 UTC	1503	OUT	POST /gen_204?atyp=csi&ei=Kze5ZY_EKtunqtsPm7mdiAw&s=async&astyp=asyncContextualTask&rt=ttfb.463,ft.464&zx=1706637104279&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:45 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Bw9GqLG0J54j_GPCY8DatA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:45 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.17	49786	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:45 UTC	1512	OUT	POST /gen_204?atyp=csi&ei=Kze5ZY_EKtunqtsPm7mdiAw&s=jsa&jsi=s,st.5840,t.0,at.3,et.click,n.msmzHf,cn.1,ie.1,vi.1&zx=1706637104460&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:45 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-gHS9t-4MKN0LjJyzc6L0XA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:45 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.17	49791	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:45 UTC	1969	OUT	GET /xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=WlNQGd,sy1le,sy1lf,nabPbb,sysv,sysw,sysz,syt0,syt2,syt3,sy3ps,sy6fi,VD4Qme,syew,BYwJlf,syqz,syr0,syr2,VEbNoe,sy297,sy299,sy29a,sy29b,NVlnE,sy298,Dq2Yjb,sy28r,sy28s,qmdEUe,sy29c,sy29d,UqGwg,sy4my,ND0kmf,sy1ja,sy1jb,uLYJpc,sy1j7,n7qy6d,sy1j9,HPGtmd,pjDTFb,sy279,sy27a,sy27b,KgxeNb,sy27d,khkNpe,sy3au,EfPGub?xjs=s3 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:46 UTC	817	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding, Origin Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="gws-team" Report-To: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]} Content-Length: 94343 Date: Tue, 30 Jan 2024 17:51:45 GMT Expires: Wed, 29 Jan 2025 17:51:45 GMT Cache-Control: public, immutable, max-age=31536000 Last-Modified: Mon, 29 Jan 2024 22:58:53 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:46 UTC	435	IN	Data Raw: 74 68 69 73 2e 5f 73 3d 74 68 69 73 2e 5f 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 78 28 22 57 6c 4e 51 47 64 22 29 3b 0a 76 61 72 20 44 50 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 74 68 69 73 2e 74 72 69 67 67 65 72 3d 61 3b 74 68 69 73 2e 4e 51 61 3d 62 3b 74 68 69 73 2e 76 44 3d 63 7d 2c 6f 77 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 5f 2e 44 2e 63 61 6c 6c 28 74 68 69 73 2c 61 2e 4b 61 29 3b 74 68 69 73 2e 42 61 3d 6e 75 6c 6c 3b 74 68 69 73 2e 41 61 3d 5b 5d 3b 74 68 69 73 2e 77 61 3d 6e 75 6c 6c 3b 74 68 69 73 2e 70 72 65 66 69 78 3d 22 22 3b 74 68 69 73 2e 65 6b 61 3d 5b 5d 2e 63 6f 6e 63 61 74 28 5f 2e 63 64 28 61 2e 63 6f 6e 74 72 6f 6c 6c 65 72 73 Data Ascii: this._s=this._s\|\|{};(function(_){var window=this;try{_.x("WlNQGd");var DPb=function(a,b,c){this.trigger=a;this.NQa=b;this.vD=c},ow=function(a){_.D.call(this,a.Ka);this.Ba=null;this.Aa=[];this.wa=null;this.prefix="";this.eka=[].concat(_.cd(a.controllers
2024-01-30 17:51:46 UTC	1252	IN	Data Raw: 68 69 73 29 7d 3b 5f 2e 46 28 6f 77 2c 5f 2e 44 29 3b 6f 77 2e 47 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b 63 6f 6e 74 72 6f 6c 6c 65 72 73 3a 7b 65 6b 61 3a 22 4e 4e 4a 4c 75 64 22 2c 54 38 66 3a 22 68 67 44 55 77 65 22 2c 72 59 65 3a 22 74 71 70 37 75 64 22 7d 7d 7d 3b 5f 2e 6b 3d 6f 77 2e 70 72 6f 74 6f 74 79 70 65 3b 5f 2e 6b 2e 5a 63 66 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 77 61 7d 3b 0a 5f 2e 6b 2e 44 34 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 76 6f 69 64 20 30 3d 3d 3d 62 3f 21 31 3a 62 3b 28 61 3d 74 68 69 73 2e 4a 36 28 29 2e 66 69 6e 64 28 61 29 29 26 26 74 68 69 73 2e 6f 61 28 61 2c 62 29 7d 3b 5f 2e 6b 2e 4a 36 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 68 Data Ascii: his)};_.F(ow,_.D);ow.Ga=function(){return{controllers:{eka:"NNJLud",T8f:"hgDUwe",rYe:"tqp7ud"}}};_.k=ow.prototype;_.k.Zcf=function(){return this.wa};_.k.D4b=function(a){var b=void 0===b?!1:b;(a=this.J6().find(a))&&this.oa(a,b)};_.k.J6=function(){var a=th
2024-01-30 17:51:46 UTC	1252	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 63 3d 3d 3d 62 7d 29 7d 3b 6f 77 2e 70 72 6f 74 6f 74 79 70 65 2e 6f 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 3d 76 6f 69 64 20 30 3d 3d 3d 62 3f 21 31 3a 62 3b 48 50 62 28 74 68 69 73 2c 61 29 26 26 49 50 62 28 74 68 69 73 2c 61 2c 62 29 7d 3b 0a 76 61 72 20 49 50 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 76 61 72 20 64 3d 61 2e 6b 61 28 62 29 3b 69 66 28 64 2e 69 73 45 6e 61 62 6c 65 64 28 29 29 7b 47 50 62 28 61 2c 62 29 3b 73 77 69 74 63 68 28 64 2e 67 65 74 54 79 70 65 28 29 29 7b 63 61 73 65 20 32 3a 76 61 72 20 65 3d 61 2e 42 61 21 3d 3d 62 3b 65 26 26 28 46 50 62 28 61 29 2c 61 2e 42 61 3d 62 2c 64 2e 56 71 28 21 30 29 29 3b 4a 50 62 28 61 2c 64 2c 65 2c 63 29 3b 62 Data Ascii: (function(c){return c===b})};ow.prototype.oa=function(a,b){b=void 0===b?!1:b;HPb(this,a)&&IPb(this,a,b)};var IPb=function(a,b,c){var d=a.ka(b);if(d.isEnabled()){GPb(a,b);switch(d.getType()){case 2:var e=a.Ba!==b;e&&(FPb(a),a.Ba=b,d.Vq(!0));JPb(a,d,e,c);b
2024-01-30 17:51:46 UTC	1252	IN	Data Raw: 21 31 3a 63 3b 69 66 28 62 29 7b 76 61 72 20 64 3d 61 2e 6b 61 28 62 29 3b 69 66 28 21 64 2e 69 73 45 6e 61 62 6c 65 64 28 29 26 26 63 29 72 65 74 75 72 6e 3b 64 2e 70 55 63 28 21 30 29 3b 64 2e 77 35 62 28 29 26 26 62 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 61 62 69 6e 64 65 78 22 2c 22 30 22 29 7d 65 6c 73 65 20 61 2e 6d 65 6e 75 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 61 62 69 6e 64 65 78 22 2c 22 30 22 29 2c 61 2e 6d 65 6e 75 2e 66 6f 63 75 73 28 29 3b 61 2e 77 61 21 3d 3d 62 26 26 61 2e 77 61 26 26 28 63 3d 61 2e 6b 61 28 61 2e 77 61 29 2c 63 2e 77 35 62 28 29 26 26 61 2e 77 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 61 62 69 6e 64 65 78 22 2c 22 2d 31 22 29 2c 63 2e 70 55 63 28 21 31 29 29 3b 61 2e 77 61 3d 62 7d 2c 4b 50 62 Data Ascii: !1:c;if(b){var d=a.ka(b);if(!d.isEnabled()&&c)return;d.pUc(!0);d.w5b()&&b.setAttribute("tabindex","0")}else a.menu.setAttribute("tabindex","0"),a.menu.focus();a.wa!==b&&a.wa&&(c=a.ka(a.wa),c.w5b()&&a.wa.setAttribute("tabindex","-1"),c.pUc(!1));a.wa=b},KPb
2024-01-30 17:51:46 UTC	1252	IN	Data Raw: 29 74 68 69 73 2e 77 61 26 26 28 64 3d 36 3d 3d 3d 74 68 69 73 2e 6b 61 28 74 68 69 73 2e 77 61 29 2e 67 65 74 54 79 70 65 28 29 7c 7c 31 30 3d 3d 3d 74 68 69 73 2e 6b 61 28 74 68 69 73 2e 77 61 29 2e 67 65 74 54 79 70 65 28 29 2c 49 50 62 28 74 68 69 73 2c 74 68 69 73 2e 77 61 2c 21 30 29 29 3b 65 6c 73 65 20 69 66 28 5f 2e 43 42 61 28 63 29 29 74 68 69 73 2e 51 61 2e 73 74 61 72 74 28 29 2c 67 3d 0a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 63 29 2c 74 68 69 73 2e 70 72 65 66 69 78 3d 3d 3d 67 3f 67 3d 4d 50 62 28 74 68 69 73 2c 21 30 29 3a 28 74 68 69 73 2e 70 72 65 66 69 78 2b 3d 67 2c 67 3d 4d 50 62 28 74 68 69 73 2c 21 31 29 29 2c 67 26 26 28 47 50 62 28 74 68 69 73 2c 67 29 2c 74 68 69 73 2e 48 61 28 74 68 69 73 2e 77 61 29 29 3b Data Ascii: )this.wa&&(d=6===this.ka(this.wa).getType()\|\|10===this.ka(this.wa).getType(),IPb(this,this.wa,!0));else if(_.CBa(c))this.Qa.start(),g=String.fromCharCode(c),this.prefix===g?g=MPb(this,!0):(this.prefix+=g,g=MPb(this,!1)),g&&(GPb(this,g),this.Ha(this.wa));
2024-01-30 17:51:46 UTC	1252	IN	Data Raw: 6e 64 69 6e 67 43 6c 69 65 6e 74 52 65 63 74 28 29 2e 74 6f 70 2d 4d 61 74 68 2e 66 6c 6f 6f 72 28 28 63 2e 68 65 69 67 68 74 2d 65 2e 68 65 69 67 68 74 29 2f 32 29 29 7d 7d 7d 3b 5f 2e 4a 28 6f 77 2e 70 72 6f 74 6f 74 79 70 65 2c 22 75 59 54 32 56 62 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 76 55 63 7d 29 3b 0a 5f 2e 4a 28 6f 77 2e 70 72 6f 74 6f 74 79 70 65 2c 22 49 67 4a 6c 39 63 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 4d 33 64 7d 29 3b 5f 2e 4a 28 6f 77 2e 70 72 6f 74 6f 74 79 70 65 2c 22 54 78 35 52 62 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 4c 33 64 7d 29 3b 5f 2e 4a 28 6f 77 2e 70 72 6f 74 6f 74 79 70 65 2c 22 57 4f 51 71 59 62 22 2c 66 75 6e 63 Data Ascii: ndingClientRect().top-Math.floor((c.height-e.height)/2))}}};_.J(ow.prototype,"uYT2Vb",function(){return this.vUc});_.J(ow.prototype,"IgJl9c",function(){return this.M3d});_.J(ow.prototype,"Tx5Rb",function(){return this.L3d});_.J(ow.prototype,"WOQqYb",func
2024-01-30 17:51:46 UTC	1252	IN	Data Raw: 65 6e 75 3d 5f 2e 4f 6f 28 61 2e 63 6f 6e 74 72 6f 6c 6c 65 72 2e 69 68 2c 22 78 6c 30 37 4f 62 22 29 3b 74 68 69 73 2e 62 75 74 74 6f 6e 3d 5f 2e 4e 6f 28 61 2e 63 6f 6e 74 72 6f 6c 6c 65 72 2e 69 68 2c 22 4c 67 62 73 53 65 22 29 3b 74 68 69 73 2e 70 6f 70 75 70 3d 61 2e 63 6f 6e 74 72 6f 6c 6c 65 72 2e 69 68 3b 74 68 69 73 2e 6f 61 3d 5f 2e 53 66 28 74 68 69 73 2e 67 65 74 44 61 74 61 28 22 66 66 70 22 29 2c 21 31 29 7d 3b 5f 2e 46 28 53 72 64 2c 5f 2e 44 29 3b 53 72 64 2e 47 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b 63 6f 6e 74 72 6f 6c 6c 65 72 3a 7b 69 68 3a 22 56 36 38 62 64 65 22 7d 7d 7d 3b 0a 53 72 64 2e 70 72 6f 74 6f 74 79 70 65 2e 41 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 74 68 69 73 2c 63 3d 5b 5d 3b 5f Data Ascii: enu=_.Oo(a.controller.ih,"xl07Ob");this.button=_.No(a.controller.ih,"LgbsSe");this.popup=a.controller.ih;this.oa=_.Sf(this.getData("ffp"),!1)};_.F(Srd,_.D);Srd.Ga=function(){return{controller:{ih:"V68bde"}}};Srd.prototype.Aa=function(a){var b=this,c=[];_
2024-01-30 17:51:46 UTC	1252	IN	Data Raw: 2e 73 75 28 29 2c 22 7a 2d 69 6e 64 65 78 22 2c 22 22 29 2c 5f 2e 76 2e 73 65 74 53 74 79 6c 65 28 63 2c 22 70 6f 73 69 74 69 6f 6e 22 2c 22 22 29 2c 5f 2e 76 2e 73 65 74 53 74 79 6c 65 28 63 2c 22 62 6f 74 74 6f 6d 22 2c 22 22 29 29 7d 3b 53 72 64 2e 70 72 6f 74 6f 74 79 70 65 2e 42 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6d 65 6e 75 2e 74 68 65 6e 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 26 26 61 2e 6c 49 61 28 6e 75 6c 6c 29 7d 29 7d 3b 5f 2e 4a 28 53 72 64 2e 70 72 6f 74 6f 74 79 70 65 2c 22 56 46 7a 77 65 62 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 42 61 7d 29 3b 5f 2e 4a 28 53 72 64 2e 70 72 6f 74 6f 74 79 70 65 2c 22 67 44 6b 66 34 63 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 Data Ascii: .su(),"z-index",""),_.v.setStyle(c,"position",""),_.v.setStyle(c,"bottom",""))};Srd.prototype.Ba=function(){this.menu.then(function(a){a&&a.lIa(null)})};_.J(Srd.prototype,"VFzweb",function(){return this.Ba});_.J(Srd.prototype,"gDkf4c",function(){return th
2024-01-30 17:51:46 UTC	1252	IN	Data Raw: 2e 73 65 74 4d 6f 6e 74 68 3d 5f 2e 6c 76 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 55 54 43 4d 6f 6e 74 68 3b 5f 2e 6b 2e 73 65 74 44 61 74 65 3d 5f 2e 6c 76 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 55 54 43 44 61 74 65 3b 5f 2e 6b 2e 73 65 74 48 6f 75 72 73 3d 5f 2e 6c 76 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 55 54 43 48 6f 75 72 73 3b 5f 2e 6b 2e 73 65 74 4d 69 6e 75 74 65 73 3d 5f 2e 6c 76 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 55 54 43 4d 69 6e 75 74 65 73 3b 0a 5f 2e 6b 2e 73 65 74 53 65 63 6f 6e 64 73 3d 5f 2e 6c 76 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 55 54 43 53 65 63 6f 6e 64 73 3b 5f 2e 6b 2e 73 65 74 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 3d 5f 2e 6c 76 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 55 54 43 4d 69 6c 6c 69 73 65 63 6f 6e Data Ascii: .setMonth=_.lv.prototype.setUTCMonth;_.k.setDate=_.lv.prototype.setUTCDate;_.k.setHours=_.lv.prototype.setUTCHours;_.k.setMinutes=_.lv.prototype.setUTCMinutes;_.k.setSeconds=_.lv.prototype.setUTCSeconds;_.k.setMilliseconds=_.lv.prototype.setUTCMillisecon
2024-01-30 17:51:46 UTC	638	IN	Data Raw: 69 6e 28 22 22 29 7d 3b 6e 51 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 3d 44 61 74 65 2e 55 54 43 28 62 2e 67 65 74 55 54 43 46 75 6c 6c 59 65 61 72 28 29 2c 62 2e 67 65 74 55 54 43 4d 6f 6e 74 68 28 29 2c 62 2e 67 65 74 55 54 43 44 61 74 65 28 29 2c 62 2e 67 65 74 55 54 43 48 6f 75 72 73 28 29 2c 62 2e 67 65 74 55 54 43 4d 69 6e 75 74 65 73 28 29 29 2f 33 36 45 35 3b 66 6f 72 28 76 61 72 20 63 3d 30 3b 63 3c 61 2e 6f 61 2e 6c 65 6e 67 74 68 26 26 62 3e 3d 61 2e 6f 61 5b 63 5d 3b 29 63 2b 3d 32 3b 72 65 74 75 72 6e 20 30 3d 3d 63 3f 30 3a 61 2e 6f 61 5b 63 2d 31 5d 7d 3b 5f 2e 6f 51 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 3d 61 2e 42 61 2d 6e 51 62 28 61 2c 62 29 3b 72 65 74 75 72 6e 2d 31 34 34 30 3d 3d 3d 61 3f 30 3a 61 7d 3b 6b 51 Data Ascii: in("")};nQb=function(a,b){b=Date.UTC(b.getUTCFullYear(),b.getUTCMonth(),b.getUTCDate(),b.getUTCHours(),b.getUTCMinutes())/36E5;for(var c=0;c<a.oa.length&&b>=a.oa[c];)c+=2;return 0==c?0:a.oa[c-1]};_.oQb=function(a,b){a=a.Ba-nQb(a,b);return-1440===a?0:a};kQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.17	49789	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:45 UTC	1955	OUT	POST /url?sa=t&source=web&rct=j&opi=89978449&url=https://www.microsoft.com/en-us/download/details.aspx%3Fid%3D35&ved=2ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQFnoECAYQAQ HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 5 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: text/ping sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" Cache-Control: max-age=0 Ping-From: https://www.google.com/search?q=directx+runtime&oq=directx&gs_lcrp=EgZjaHJvbWUqDQgBEAAYgwEYsQMYgAQyDwgAEEUYORiDARixAxiABDINCAEQABiDARixAxiABDINCAIQABiDARixAxiABDIKCAMQABixAxiABDIKCAQQABixAxiABDIHCAUQABiABDINCAYQABiDARixAxiABDIHCAcQABiABDINCAgQABiDARixAxiABDINCAkQABiDARixAxiABNIBCDQwNjFqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-wow64: ?0 sec-ch-ua-model: "" sec-ch-ua-bitness: "64" Ping-To: https://www.microsoft.com/en-us/download/details.aspx?id=35 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:45 UTC	5	OUT	Data Raw: 50 49 4e 47 00 Data Ascii: PING
2024-01-30 17:51:46 UTC	1454	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:51:45 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-klyQpbKKNsCrZY-HdmHORg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Server: gws X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:46 UTC	1454	IN	Data Raw: 35 65 34 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 20 4e 6f 74 69 63 65 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 2c 64 69 76 2c 61 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 52 6f 62 6f 74 6f 2c 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 33 70 78 7d 64 69 76 7b 63 6f 6c 6f 72 3a 23 30 30 30 7d 61 3a 6c 69 6e 6b 7b 63 6f 6c 6f 72 3a 23 36 38 31 64 61 38 Data Ascii: 5e4<html lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>Redirect Notice</title><style>body,div,a{font-family:Roboto,arial,sans-serif}body{background-color:#fff;margin-top:3px}div{color:#000}a:link{color:#681da8
2024-01-30 17:51:46 UTC	61	IN	Data Raw: 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 7d 29 28 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: ).call(this);})();</script><br><br><br></div></body></html>
2024-01-30 17:51:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.17	49790	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:45 UTC	2003	OUT	POST /gen_204?atyp=i&ei=Kze5ZY_EKtunqtsPm7mdiAw&ct=slh&v=t1&im=M&pv=0.518824515729305&me=135:1706637100852,R,1,CDMQAA,756,495,372,29:0,R,1,CC4QAA,756,524,372,29:0,R,1,CC8QAA,756,553,372,29:0,R,1,CDAQAA,756,582,372,51:0,R,1,CDIQAA,756,649,372,201:0,R,1,CDIQAQ,756,650,372,66:0,R,1,CDIQBg,756,717,372,66:0,R,1,CDIQCw,756,784,372,66:13,h,1,CAUQGQ,i:18,h,1,CB0QAA,i:22,h,1,CCIQAQ,i:47,h,1,CCIQAQ,o:0,h,1,CCAQAQ,i:75,h,1,CCAQAQ,o:0,h,1,CB8QAQ,i:72,h,1,CB8QAQ,o:0,h,1,CB4QAQ,i:73,h,1,CB4QAQ,o:48,h,1,CB0QAA,o:143,h,1,CAcQAA,i:3095,G,1,CAcQAA,216,48,1:0,c,244,219:0,G,1,CAcQAA,216,48:0,G,1,CAUQGQ,216,48:3,e,U&zx=1706637104461&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:46 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-283_2UwlEThH0NxzsYfFIw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:45 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.17	49792	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:45 UTC	1487	OUT	POST /gen_204?atyp=csi&ei=Kze5ZY_EKtunqtsPm7mdiAw&s=web&nt=navigate&t=fi&st=5772&fid=1&zx=1706637104465&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:46 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-SiGwqnvL1azL8jQf7zFS1w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:45 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.17	49793	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:45 UTC	1503	OUT	POST /gen_204?atyp=csi&ei=Kze5ZY_EKtunqtsPm7mdiAw&s=async&astyp=asyncContextualTask&rt=ttfb.687,ft.688&zx=1706637104517&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:46 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-hQ7hm5CcVMD42Jw7bbNv4A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:46 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.17	49794	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:45 UTC	1503	OUT	POST /gen_204?atyp=csi&ei=Kze5ZY_EKtunqtsPm7mdiAw&s=async&astyp=asyncContextualTask&rt=ttfb.675,ft.676&zx=1706637104519&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:46 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Q1VPc8y4A-tRWdow5pXGFQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:46 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.17	49795	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:46 UTC	1809	OUT	GET /async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDhAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=9103415834496958732&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:46 UTC	1637	IN	HTTP/1.1 200 OK Version: 602283465 X-Content-Type-Options: nosniff Content-Type: text/plain; charset=UTF-8 Content-Disposition: attachment; filename="f.txt" Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:46 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Expires: Tue, 30 Jan 2024 17:51:46 GMT Set-Cookie: 1P_JAR=2024-01-30-17; expires=Thu, 29-Feb-2024 17:51:46 GMT; path=/; domain=.google.com; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:46 UTC	48	IN	Data Raw: 32 61 0d 0a 29 5d 7d 27 0a 32 32 3b 5b 22 4d 6a 65 35 5a 63 4b 53 49 65 4f 75 70 74 51 50 6b 71 53 61 34 41 73 22 2c 22 31 39 34 36 22 5d 0d 0a Data Ascii: 2a)]}'22;["Mje5ZcKSIeOuptQPkqSa4As","1946"]
2024-01-30 17:51:46 UTC	15	IN	Data Raw: 61 0d 0a 33 3b 5b 31 5d 33 3b 5b 35 5d 0d 0a Data Ascii: a3;[1]3;[5]
2024-01-30 17:51:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.17	49797	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:46 UTC	1809	OUT	GET /async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDRAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=3258071689962503910&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:46 UTC	1637	IN	HTTP/1.1 200 OK Version: 602283465 X-Content-Type-Options: nosniff Content-Type: text/plain; charset=UTF-8 Content-Disposition: attachment; filename="f.txt" Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:46 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Expires: Tue, 30 Jan 2024 17:51:46 GMT Set-Cookie: 1P_JAR=2024-01-30-17; expires=Thu, 29-Feb-2024 17:51:46 GMT; path=/; domain=.google.com; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:46 UTC	48	IN	Data Raw: 32 61 0d 0a 29 5d 7d 27 0a 32 32 3b 5b 22 4d 6a 65 35 5a 65 43 71 4c 72 2d 6e 70 74 51 50 33 49 79 73 75 41 30 22 2c 22 31 39 34 36 22 5d 0d 0a Data Ascii: 2a)]}'22;["Mje5ZeCqLr-nptQP3IysuA0","1946"]
2024-01-30 17:51:46 UTC	15	IN	Data Raw: 61 0d 0a 33 3b 5b 31 5d 33 3b 5b 35 5d 0d 0a Data Ascii: a3;[1]3;[5]
2024-01-30 17:51:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.17	49798	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:46 UTC	1809	OUT	GET /async/asyncContextualTask?vet=12ahUKEwjPhdrQ1oWEAxXbk2oFHZtcB8EQ4dMLegQIDBAA..i&ei=Kze5ZY_EKtunqtsPm7mdiAw&opi=89978449&yv=3&cid=7017065288382140415&cs=0&async=_ck:xjs.s.gMJ68YNNwbg.L.W.O,_k:xjs.s.en_US.I0W95LBEUe0.O,_am:ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE,_csss:ACT90oEuPDpRISdXedwyDAkLFqogPDiTdA,_fmt:prog,_id:rNi7Zc HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:46 UTC	1637	IN	HTTP/1.1 200 OK Version: 602283465 X-Content-Type-Options: nosniff Content-Type: text/plain; charset=UTF-8 Content-Disposition: attachment; filename="f.txt" Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:46 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Expires: Tue, 30 Jan 2024 17:51:46 GMT Set-Cookie: 1P_JAR=2024-01-30-17; expires=Thu, 29-Feb-2024 17:51:46 GMT; path=/; domain=.google.com; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:46 UTC	48	IN	Data Raw: 32 61 0d 0a 29 5d 7d 27 0a 32 32 3b 5b 22 4d 6a 65 35 5a 65 58 6c 4c 35 53 6a 70 74 51 50 67 75 6d 47 67 41 6b 22 2c 22 31 39 34 36 22 5d 0d 0a Data Ascii: 2a)]}'22;["Mje5ZeXlL5SjptQPgumGgAk","1946"]
2024-01-30 17:51:46 UTC	15	IN	Data Raw: 61 0d 0a 33 3b 5b 31 5d 33 3b 5b 35 5d 0d 0a Data Ascii: a3;[1]3;[5]
2024-01-30 17:51:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.17	49799	74.125.138.190	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:46 UTC	698	OUT	GET /iframe_api?version=3 HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:51:46 UTC	2087	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 X-Content-Type-Options: nosniff Expires: Tue, 30 Jan 2024 17:51:46 GMT Date: Tue, 30 Jan 2024 17:51:46 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube_main" Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Cross-Origin-Resource-Policy: cross-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Origin-Trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9 P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF X-XSS-Protection: 0 Set-Cookie: YSC=MmYKqDmYcs4; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_INFO1_LIVE=oCH7UytiVXo; Domain=.youtube.com; Expires=Sun, 28-Jul-2024 17:51:46 GMT; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgSw%3D%3D; Domain=.youtube.com; Expires=Sun, 28-Jul-2024 17:51:46 GMT; Path=/; Secure; HttpOnly; SameSite=lax Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:46 UTC	1000	IN	Data Raw: 33 65 31 0d 0a 76 61 72 20 73 63 72 69 70 74 55 72 6c 20 3d 20 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 5c 2f 73 5c 2f 70 6c 61 79 65 72 5c 2f 36 65 65 38 66 39 63 65 5c 2f 77 77 77 2d 77 69 64 67 65 74 61 70 69 2e 76 66 6c 73 65 74 5c 2f 77 77 77 2d 77 69 64 67 65 74 61 70 69 2e 6a 73 27 3b 74 72 79 7b 76 61 72 20 74 74 50 6f 6c 69 63 79 3d 77 69 6e 64 6f 77 2e 74 72 75 73 74 65 64 54 79 70 65 73 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 79 6f 75 74 75 62 65 2d 77 69 64 67 65 74 2d 61 70 69 22 2c 7b 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 66 75 6e 63 74 69 6f 6e 28 78 29 7b 72 65 74 75 72 6e 20 78 7d 7d 29 3b 73 63 72 69 70 74 55 72 6c 3d 74 74 50 6f 6c 69 63 79 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 Data Ascii: 3e1var scriptUrl = 'https:\/\/www.youtube.com\/s\/player\/6ee8f9ce\/www-widgetapi.vflset\/www-widgetapi.js';try{var ttPolicy=window.trustedTypes.createPolicy("youtube-widget-api",{createScriptURL:function(x){return x}});scriptUrl=ttPolicy.createScriptUR
2024-01-30 17:51:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.17	49800	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:46 UTC	1683	OUT	GET /xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=kMFpHd,sy8j,bm51tf?xjs=s3 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:47 UTC	816	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding, Origin Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="gws-team" Report-To: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]} Content-Length: 1673 Date: Tue, 30 Jan 2024 17:51:46 GMT Expires: Wed, 29 Jan 2025 17:51:46 GMT Cache-Control: public, immutable, max-age=31536000 Last-Modified: Mon, 29 Jan 2024 22:58:53 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:47 UTC	436	IN	Data Raw: 74 68 69 73 2e 5f 73 3d 74 68 69 73 2e 5f 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 78 28 22 6b 4d 46 70 48 64 22 29 3b 0a 5f 2e 77 62 62 3d 6e 65 77 20 5f 2e 56 6e 28 5f 2e 70 4d 61 29 3b 0a 5f 2e 79 28 29 3b 0a 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 0a 74 72 79 7b 0a 76 61 72 20 46 62 62 3b 5f 2e 47 62 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 74 68 69 73 2e 65 66 62 3d 61 3b 74 68 69 73 2e 4f 45 66 3d 62 3b 74 68 69 73 2e 4a 68 63 3d 63 3b 74 68 69 73 2e 50 4d 66 3d 64 3b 74 68 69 73 2e 4f 35 66 3d 65 3b 74 68 69 73 2e 53 33 62 3d 30 3b 74 68 69 73 2e 49 68 63 3d 46 62 62 28 74 68 69 73 29 7d Data Ascii: this._s=this._s\|\|{};(function(_){var window=this;try{_.x("kMFpHd");_.wbb=new _.Vn(_.pMa);_.y();}catch(e){_._DumpException(e)}try{var Fbb;_.Gbb=function(a,b,c,d,e){this.efb=a;this.OEf=b;this.Jhc=c;this.PMf=d;this.O5f=e;this.S3b=0;this.Ihc=Fbb(this)}
2024-01-30 17:51:47 UTC	588	IN	Data Raw: 68 69 73 2e 65 66 62 3f 21 31 3a 6e 75 6c 6c 21 3d 61 3f 21 21 74 68 69 73 2e 4f 35 66 5b 61 5d 3a 21 30 7d 3b 5f 2e 48 62 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 58 4e 61 28 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 63 65 60 22 2b 61 2e 65 66 62 29 3b 2b 2b 61 2e 53 33 62 3b 61 2e 49 68 63 3d 46 62 62 28 61 29 7d 3b 0a 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 0a 74 72 79 7b 0a 5f 2e 78 28 22 62 6d 35 31 74 66 22 29 3b 0a 76 61 72 20 49 62 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 7b 7d 3b 5f 2e 50 61 28 61 2e 4c 74 63 28 29 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 62 5b 65 5d 3d 21 30 7d 29 3b 76 61 72 20 63 3d 61 2e 5a 72 63 28 29 2c 64 3d 61 2e 4d 73 63 28 29 3b 72 Data Ascii: his.efb?!1:null!=a?!!this.O5f[a]:!0};_.Hbb=function(a){if(!a.XNa())throw Error("ce`"+a.efb);++a.S3b;a.Ihc=Fbb(a)};}catch(e){_._DumpException(e)}try{_.x("bm51tf");var Ibb=function(a){var b={};_.Pa(a.Ltc(),function(e){b[e]=!0});var c=a.Zrc(),d=a.Msc();r
2024-01-30 17:51:47 UTC	649	IN	Data Raw: 74 6f 74 79 70 65 2e 6f 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 31 21 3d 74 68 69 73 2e 41 61 2e 67 65 74 54 79 70 65 28 61 2e 79 72 28 29 29 29 72 65 74 75 72 6e 20 5f 2e 62 62 62 28 61 29 3b 76 61 72 20 63 3d 74 68 69 73 2e 77 61 2e 6b 61 3b 28 63 3d 63 3f 49 62 62 28 63 29 3a 6e 75 6c 6c 29 26 26 63 2e 58 4e 61 28 29 3f 28 62 3d 4c 62 62 28 74 68 69 73 2c 61 2c 62 2c 63 29 2c 61 3d 6e 65 77 20 5f 2e 59 61 62 28 61 2c 62 2c 32 29 29 3a 61 3d 5f 2e 62 62 62 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 76 61 72 20 4c 62 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 72 65 74 75 72 6e 20 63 2e 74 68 65 6e 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 4a 62 62 Data Ascii: totype.oa=function(a,b){if(1!=this.Aa.getType(a.yr()))return _.bbb(a);var c=this.wa.ka;(c=c?Ibb(c):null)&&c.XNa()?(b=Lbb(this,a,b,c),a=new _.Yab(a,b,2)):a=_.bbb(a);return a};var Lbb=function(a,b,c,d){return c.then(function(e){return e},function(e){if(Jbb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.17	49801	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:46 UTC	1503	OUT	POST /gen_204?atyp=csi&ei=Kze5ZY_EKtunqtsPm7mdiAw&s=async&astyp=asyncContextualTask&rt=ttfb.461,ft.461&zx=1706637105742&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:47 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-HZoQ-wfOoaIYMaaJt6IOYw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:47 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.17	49804	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:47 UTC	1503	OUT	POST /gen_204?atyp=csi&ei=Kze5ZY_EKtunqtsPm7mdiAw&s=async&astyp=asyncContextualTask&rt=ttfb.439,ft.439&zx=1706637105961&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:47 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-QNNbuIeRVm-c4zAqWlJuUw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:47 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.17	49805	74.125.138.190	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:47 UTC	790	OUT	GET /s/player/6ee8f9ce/www-widgetapi.vflset/www-widgetapi.js HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=MmYKqDmYcs4; VISITOR_INFO1_LIVE=oCH7UytiVXo
2024-01-30 17:51:47 UTC	689	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 221438 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 29 Jan 2024 13:49:17 GMT Expires: Tue, 28 Jan 2025 13:49:17 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 29 Jan 2024 05:16:12 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 100950 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:47 UTC	563	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 76 61 72 20 72 3b 66 75 6e 63 74 69 6f 6e 20 61 61 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 0a 76 61 72 20 62 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 Data Ascii: (function(){'use strict';var r;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype
2024-01-30 17:51:47 UTC	1252	IN	Data Raw: 68 69 73 29 3b 66 75 6e 63 74 69 6f 6e 20 76 28 61 2c 62 29 7b 69 66 28 62 29 61 3a 7b 76 61 72 20 63 3d 64 61 3b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 2d 31 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 61 5b 64 5d 3b 69 66 28 21 28 65 20 69 6e 20 63 29 29 62 72 65 61 6b 20 61 3b 63 3d 63 5b 65 5d 7d 61 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 3b 64 3d 63 5b 61 5d 3b 62 3d 62 28 64 29 3b 62 21 3d 64 26 26 6e 75 6c 6c 21 3d 62 26 26 62 61 28 63 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 62 7d 29 7d 7d 0a 76 28 22 53 79 6d 62 6f 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 66 29 7b 69 66 28 Data Ascii: his);function v(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}v("Symbol",function(a){function b(f){if(
2024-01-30 17:51:47 UTC	1252	IN	Data Raw: 61 62 6c 65 20 6f 72 20 41 72 72 61 79 4c 69 6b 65 22 29 3b 7d 0a 66 75 6e 63 74 69 6f 6e 20 78 28 61 29 7b 69 66 28 21 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 29 7b 61 3d 77 28 61 29 3b 66 6f 72 28 76 61 72 20 62 2c 63 3d 5b 5d 3b 21 28 62 3d 61 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 63 2e 70 75 73 68 28 62 2e 76 61 6c 75 65 29 3b 61 3d 63 7d 72 65 74 75 72 6e 20 61 7d 0a 66 75 6e 63 74 69 6f 6e 20 66 61 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 0a 76 61 72 20 68 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3f 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3a Data Ascii: able or ArrayLike");}function x(a){if(!(a instanceof Array)){a=w(a);for(var b,c=[];!(b=a.next()).done;)c.push(b.value);a=c}return a}function fa(a,b){return Object.prototype.hasOwnProperty.call(a,b)}var ha="function"==typeof Object.assign?Object.assign:
2024-01-30 17:51:47 UTC	1252	IN	Data Raw: 70 72 6f 74 6f 74 79 70 65 2e 4b 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 68 3d 61 7d 3b 0a 66 75 6e 63 74 69 6f 6e 20 75 61 28 61 2c 62 29 7b 61 2e 69 3d 7b 6c 63 3a 62 2c 77 63 3a 21 30 7d 3b 61 2e 67 3d 61 2e 6f 7c 7c 61 2e 75 7d 0a 71 61 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 74 75 72 6e 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 69 3d 7b 72 65 74 75 72 6e 3a 61 7d 3b 74 68 69 73 2e 67 3d 74 68 69 73 2e 75 7d 3b 0a 66 75 6e 63 74 69 6f 6e 20 41 28 61 2c 62 2c 63 29 7b 61 2e 67 3d 63 3b 72 65 74 75 72 6e 7b 76 61 6c 75 65 3a 62 7d 7d 0a 71 61 2e 70 72 6f 74 6f 74 79 70 65 2e 42 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 67 3d 61 7d 3b 0a 66 75 6e 63 74 69 6f 6e 20 76 61 28 61 2c 62 2c 63 29 7b 61 2e 6f 3d 62 3b 76 6f Data Ascii: prototype.K=function(a){this.h=a};function ua(a,b){a.i={lc:b,wc:!0};a.g=a.o\|\|a.u}qa.prototype.return=function(a){this.i={return:a};this.g=this.u};function A(a,b,c){a.g=c;return{value:b}}qa.prototype.B=function(a){this.g=a};function va(a,b,c){a.o=b;vo
2024-01-30 17:51:47 UTC	1252	IN	Data Raw: 72 6e 20 62 7d 3b 0a 74 68 69 73 2e 74 68 72 6f 77 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 74 61 28 61 2e 67 29 3b 61 2e 67 2e 6c 3f 62 3d 41 61 28 61 2c 61 2e 67 2e 6c 5b 22 74 68 72 6f 77 22 5d 2c 62 2c 61 2e 67 2e 4b 29 3a 28 75 61 28 61 2e 67 2c 62 29 2c 62 3d 42 61 28 61 29 29 3b 72 65 74 75 72 6e 20 62 7d 3b 0a 74 68 69 73 2e 72 65 74 75 72 6e 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 7a 61 28 61 2c 62 29 7d 3b 0a 74 68 69 73 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 7d 0a 66 75 6e 63 74 69 6f 6e 20 45 61 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 64 29 7b 72 65 74 75 72 6e 20 61 2e 6e 65 78 74 28 64 29 7d 0a 66 75 6e 63 74 69 6f 6e 20 63 28 64 29 7b Data Ascii: rn b};this.throw=function(b){ta(a.g);a.g.l?b=Aa(a,a.g.l["throw"],b,a.g.K):(ua(a.g,b),b=Ba(a));return b};this.return=function(b){return za(a,b)};this[Symbol.iterator]=function(){return this}}function Ea(a){function b(d){return a.next(d)}function c(d){
2024-01-30 17:51:47 UTC	1252	IN	Data Raw: 6c 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 74 68 69 73 2e 69 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 67 3b 7d 29 7d 3b 0a 62 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 67 28 6b 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6d 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6b 2e 63 61 6c 6c 28 68 2c 6d 29 29 7d 7d 0a 76 61 72 20 68 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 67 28 74 68 69 73 2e 63 62 29 2c 72 65 6a 65 63 74 3a 67 28 74 68 69 73 2e 6f 29 7d 7d 3b 0a 62 2e 70 72 6f 74 6f 74 79 70 65 2e 63 62 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 69 66 28 67 3d 3d 3d 74 68 69 73 29 74 68 69 73 2e 6f 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 41 20 50 72 6f Data Ascii: l=function(g){this.i(function(){throw g;})};b.prototype.l=function(){function g(k){return function(m){l\|\|(l=!0,k.call(h,m))}}var h=this,l=!1;return{resolve:g(this.cb),reject:g(this.o)}};b.prototype.cb=function(g){if(g===this)this.o(new TypeError("A Pro
2024-01-30 17:51:47 UTC	1252	IN	Data Raw: 6f 6d 45 76 65 6e 74 22 29 2c 67 2e 69 6e 69 74 43 75 73 74 6f 6d 45 76 65 6e 74 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 21 31 2c 21 30 2c 67 29 29 3b 67 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 67 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 69 3b 72 65 74 75 72 6e 20 6c 28 67 29 7d 3b 0a 62 2e 70 72 6f 74 6f 74 79 70 65 2e 4f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6e 75 6c 6c 21 3d 74 68 69 73 2e 68 29 7b 66 6f 72 28 76 61 72 20 67 3d 30 3b 67 3c 74 68 69 73 2e 68 2e 6c 65 6e 67 74 68 3b 2b 2b 67 29 66 2e 68 28 74 68 69 73 2e 68 5b 67 5d 29 3b 74 68 69 73 2e 68 3d 6e 75 6c 6c 7d 7d 3b 0a 76 61 72 20 66 3d 6e 65 77 20 63 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 66 62 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 76 61 72 20 68 3d 74 68 Data Ascii: omEvent"),g.initCustomEvent("unhandledrejection",!1,!0,g));g.promise=this;g.reason=this.i;return l(g)};b.prototype.O=function(){if(null!=this.h){for(var g=0;g<this.h.length;++g)f.h(this.h[g]);this.h=null}};var f=new c;b.prototype.fb=function(g){var h=th
2024-01-30 17:51:47 UTC	1252	IN	Data Raw: 29 7d 29 7d 3b 0a 72 65 74 75 72 6e 20 62 7d 29 3b 0a 76 28 22 57 65 61 6b 4d 61 70 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 6c 29 7b 74 68 69 73 2e 67 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 77 28 6c 29 3b 66 6f 72 28 76 61 72 20 6b 3b 21 28 6b 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6b 3d 6b 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6b 5b 30 5d 2c 6b 5b 31 5d 29 7d 7d 0a 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 7d 0a 66 75 6e 63 74 69 6f 6e 20 64 28 6c 29 7b 76 61 72 20 6b 3d 74 79 70 65 6f 66 20 6c 3b 72 65 74 75 72 6e 22 6f 62 6a 65 63 74 22 3d 3d 3d 6b 26 26 6e 75 6c 6c 21 3d 3d 6c 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d Data Ascii: )})};return b});v("WeakMap",function(a){function b(l){this.g=(h+=Math.random()+1).toString();if(l){l=w(l);for(var k;!(k=l.next()).done;)k=k.value,this.set(k[0],k[1])}}function c(){}function d(l){var k=typeof l;return"object"===k&&null!==l\|\|"function"=
2024-01-30 17:51:47 UTC	1252	IN	Data Raw: 6f 6e 20 63 28 68 2c 6c 29 7b 76 61 72 20 6b 3d 68 5b 31 5d 3b 72 65 74 75 72 6e 20 65 61 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6b 29 7b 66 6f 72 28 3b 6b 2e 68 65 61 64 21 3d 68 5b 31 5d 3b 29 6b 3d 6b 2e 70 72 65 76 69 6f 75 73 3b 66 6f 72 28 3b 6b 2e 6e 65 78 74 21 3d 6b 2e 68 65 61 64 3b 29 72 65 74 75 72 6e 20 6b 3d 6b 2e 6e 65 78 74 2c 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 6c 28 6b 29 7d 3b 6b 3d 6e 75 6c 6c 7d 72 65 74 75 72 6e 7b 64 6f 6e 65 3a 21 30 2c 76 61 6c 75 65 3a 76 6f 69 64 20 30 7d 7d 29 7d 0a 66 75 6e 63 74 69 6f 6e 20 64 28 68 2c 6c 29 7b 76 61 72 20 6b 3d 6c 26 26 74 79 70 65 6f 66 20 6c 3b 22 6f 62 6a 65 63 74 22 3d 3d 6b 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 6b 3f 66 2e 68 61 73 28 6c 29 3f 6b 3d 66 2e 67 65 74 28 Data Ascii: on c(h,l){var k=h[1];return ea(function(){if(k){for(;k.head!=h[1];)k=k.previous;for(;k.next!=k.head;)return k=k.next,{done:!1,value:l(k)};k=null}return{done:!0,value:void 0}})}function d(h,l){var k=l&&typeof l;"object"==k\|\|"function"==k?f.has(l)?k=f.get(
2024-01-30 17:51:47 UTC	1252	IN	Data Raw: 6e 74 72 79 29 2c 74 68 69 73 5b 31 5d 2e 70 72 65 76 69 6f 75 73 2e 6e 65 78 74 3d 6b 2e 65 6e 74 72 79 2c 74 68 69 73 5b 31 5d 2e 70 72 65 76 69 6f 75 73 3d 6b 2e 65 6e 74 72 79 2c 74 68 69 73 2e 73 69 7a 65 2b 2b 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 0a 65 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 68 3d 64 28 74 68 69 73 2c 68 29 3b 72 65 74 75 72 6e 20 68 2e 65 6e 74 72 79 26 26 68 2e 6c 69 73 74 3f 28 68 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 68 2e 69 6e 64 65 78 2c 31 29 2c 68 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 68 2e 69 64 5d 2c 68 2e 65 6e 74 72 79 2e 70 72 65 76 69 6f 75 73 2e 6e 65 78 74 3d 68 2e 65 6e 74 72 79 2e 6e 65 78 74 2c 68 2e 65 6e Data Ascii: ntry),this[1].previous.next=k.entry,this[1].previous=k.entry,this.size++);return this};e.prototype.delete=function(h){h=d(this,h);return h.entry&&h.list?(h.list.splice(h.index,1),h.list.length\|\|delete this[0][h.id],h.entry.previous.next=h.entry.next,h.en

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.17	49806	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:47 UTC	1680	OUT	GET /xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=syez,syf0,aLUfP?xjs=s3 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:47 UTC	816	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding, Origin Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="gws-team" Report-To: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]} Content-Length: 1638 Date: Tue, 30 Jan 2024 17:51:47 GMT Expires: Wed, 29 Jan 2025 17:51:47 GMT Cache-Control: public, immutable, max-age=31536000 Last-Modified: Mon, 29 Jan 2024 22:58:53 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:47 UTC	436	IN	Data Raw: 74 68 69 73 2e 5f 73 3d 74 68 69 73 2e 5f 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 6c 72 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 51 6e 3d 61 7d 3b 0a 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 0a 74 72 79 7b 0a 76 61 72 20 6d 72 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 5f 2e 59 6e 2e 63 61 6c 6c 28 74 68 69 73 2c 61 2e 4b 61 29 3b 76 61 72 20 62 3d 74 68 69 73 3b 74 68 69 73 2e 77 69 6e 64 6f 77 3d 61 2e 73 65 72 76 69 63 65 2e 77 69 6e 64 6f 77 2e 67 65 74 28 29 3b 74 68 69 73 2e 77 61 3d 74 68 69 73 2e 51 6e 28 29 3b 74 68 69 73 2e 6f 61 3d 77 69 6e 64 6f 77 2e 6f 72 69 65 6e 74 61 74 69 6f 6e 3b 74 68 Data Ascii: this._s=this._s\|\|{};(function(_){var window=this;try{_.lrb=function(a){this.Qn=a};}catch(e){_._DumpException(e)}try{var mrb=function(a){_.Yn.call(this,a.Ka);var b=this;this.window=a.service.window.get();this.wa=this.Qn();this.oa=window.orientation;th
2024-01-30 17:51:47 UTC	588	IN	Data Raw: 28 29 3b 21 65 2e 64 6f 6e 65 3b 65 3d 64 2e 6e 65 78 74 28 29 29 7b 65 3d 65 2e 76 61 6c 75 65 3b 76 61 72 20 66 3d 6e 65 77 20 5f 2e 6c 72 62 28 63 29 3b 74 72 79 7b 65 28 66 29 7d 63 61 74 63 68 28 67 29 7b 5f 2e 63 61 28 67 29 7d 7d 7d 7d 3b 74 68 69 73 2e 4e 65 3d 6e 65 77 20 53 65 74 3b 74 68 69 73 2e 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 72 65 73 69 7a 65 22 2c 74 68 69 73 2e 6b 61 29 3b 74 68 69 73 2e 42 47 62 28 29 26 26 74 68 69 73 2e 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6f 72 69 65 6e 74 61 74 69 6f 6e 63 68 61 6e 67 65 22 2c 0a 74 68 69 73 2e 6b 61 29 7d 3b 5f 2e 46 28 6d 72 62 2c 5f 2e 59 6e 29 3b 6d 72 62 2e 6e 62 3d 5f 2e 59 6e 2e 6e 62 3b 6d 72 62 2e 47 61 3d 66 75 Data Ascii: ();!e.done;e=d.next()){e=e.value;var f=new _.lrb(c);try{e(f)}catch(g){_.ca(g)}}}};this.Ne=new Set;this.window.addEventListener("resize",this.ka);this.BGb()&&this.window.addEventListener("orientationchange",this.ka)};_.F(mrb,_.Yn);mrb.nb=_.Yn.nb;mrb.Ga=fu
2024-01-30 17:51:47 UTC	614	IN	Data Raw: 28 29 3a 74 68 69 73 2e 77 69 6e 64 6f 77 2e 76 69 73 75 61 6c 56 69 65 77 70 6f 72 74 29 3f 5f 2e 43 6c 28 74 68 69 73 2e 77 69 6e 64 6f 77 29 3a 6e 65 77 20 5f 2e 6a 6c 28 74 68 69 73 2e 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 2c 74 68 69 73 2e 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 48 65 69 67 68 74 29 3b 72 65 74 75 72 6e 20 61 2e 68 65 69 67 68 74 3c 61 2e 77 69 64 74 68 7d 3b 6d 72 62 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 73 74 72 6f 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 77 69 6e 64 6f 77 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 72 65 73 69 7a 65 22 2c 74 68 69 73 2e 6b 61 29 3b 74 68 69 73 2e 77 69 6e 64 6f 77 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6f 72 69 65 6e 74 61 74 Data Ascii: ():this.window.visualViewport)?_.Cl(this.window):new _.jl(this.window.innerWidth,this.window.innerHeight);return a.height<a.width};mrb.prototype.destroy=function(){this.window.removeEventListener("resize",this.ka);this.window.removeEventListener("orientat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.17	49807	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:47 UTC	1503	OUT	POST /gen_204?atyp=csi&ei=Kze5ZY_EKtunqtsPm7mdiAw&s=async&astyp=asyncContextualTask&rt=ttfb.460,ft.461&zx=1706637105983&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:47 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-o6o00-I390_gsYxrLkmXKg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:47 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.17	49808	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:47 UTC	1683	OUT	GET /xjs/_/js/k=xjs.s.en_US.I0W95LBEUe0.O/ck=xjs.s.gMJ68YNNwbg.L.W.O/am=ABAAABUIAAAAAAAAAAAAAABAAAAAgASCZsIhABsgAL5MAIAECAEQwAhYFAIkAAYABAGf_wQAAAAAACYgMACECyBF-B0EAACYgCqAdsAHAAAAEOwHiAEEHhAQAAAG8kMACoXoAIIABUAAAAAAeQCeB8BBCgsAAAAAAAAAAABAAAmCcED6CgIgAAAAAAAAAAAAAJBKEysPAwAE/d=0/dg=2/br=1/ujg=1/rs=ACT90oFZDsl90NCgJVwLue8CtZZoxDzQ2w/m=sy11b,sy11c,dt4g2b?xjs=s3 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:47 UTC	815	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding, Origin Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="gws-team" Report-To: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]} Content-Length: 882 Date: Tue, 30 Jan 2024 17:51:47 GMT Expires: Wed, 29 Jan 2025 17:51:47 GMT Cache-Control: public, immutable, max-age=31536000 Last-Modified: Mon, 29 Jan 2024 22:58:53 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:47 UTC	437	IN	Data Raw: 74 68 69 73 2e 5f 73 3d 74 68 69 73 2e 5f 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 6c 66 28 5f 2e 47 71 29 3b 0a 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 0a 74 72 79 7b 0a 5f 2e 76 61 63 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 2e 69 73 41 76 61 69 6c 61 62 6c 65 28 29 26 26 28 5f 2e 62 61 2e 73 69 6c 6b 3d 5f 2e 62 61 2e 73 69 6c 6b 7c 7c 7b 7d 2c 5f 2e 62 61 2e 73 69 6c 6b 2e 73 3d 5f 2e 62 61 2e 73 69 6c 6b 2e 73 7c 7c 7b 7d 2c 5f 2e 62 61 2e 73 69 6c 6b 2e 73 2e 73 69 73 3d 7b 7d 2c 5f 2e 62 61 2e 73 69 6c 6b 2e 73 2e 73 69 73 2e 63 61 3d 61 2e 6a 46 2e 62 69 6e 64 28 61 29 29 7d 3b 0a 7d 63 61 74 63 68 28 65 29 7b Data Ascii: this._s=this._s\|\|{};(function(_){var window=this;try{_.lf(_.Gq);}catch(e){_._DumpException(e)}try{_.vac=function(a){a.isAvailable()&&(_.ba.silk=_.ba.silk\|\|{},_.ba.silk.s=_.ba.silk.s\|\|{},_.ba.silk.s.sis={},_.ba.silk.s.sis.ca=a.jF.bind(a))};}catch(e){
2024-01-30 17:51:47 UTC	445	IN	Data Raw: 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 76 6f 69 64 20 30 3d 3d 3d 61 3f 7b 7d 3a 61 2c 63 3d 62 2e 64 69 61 3b 61 3d 62 2e 64 6c 61 3b 62 3d 62 2e 57 42 61 3b 76 6f 69 64 20 30 21 3d 3d 63 3f 5f 2e 74 67 28 7b 73 65 72 76 69 63 65 4e 61 6d 65 3a 22 73 69 73 22 2c 6d 65 74 68 6f 64 4e 61 6d 65 3a 22 63 61 22 7d 29 3a 5f 2e 74 67 28 7b 73 65 72 76 69 63 65 4e 61 6d 65 3a 22 73 69 73 22 2c 6d 65 74 68 6f 64 4e 61 6d 65 3a 22 63 61 61 72 22 7d 29 3b 61 3a 73 77 69 74 63 68 28 62 29 7b 63 61 73 65 20 30 3a 62 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 53 65 72 76 69 63 65 4c 6f 67 69 6e 22 3b 62 72 65 61 6b 20 61 3b 64 65 66 61 75 6c 74 3a 62 3d 22 68 74 74 70 73 3a 2f 2f Data Ascii: otype.jF=function(a){var b=void 0===a?{}:a,c=b.dia;a=b.dla;b=b.WBa;void 0!==c?_.tg({serviceName:"sis",methodName:"ca"}):_.tg({serviceName:"sis",methodName:"caar"});a:switch(b){case 0:b="https://accounts.google.com/ServiceLogin";break a;default:b="https://

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.17	49809	172.217.215.190	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:48 UTC	1299	OUT	GET /embed/?enablejsapi=1&rel=0&autoplay=0&playsinline=1&expflag=embeds_enable_muted_autoplay%3Atrue&fs=1 HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.google.com/search?q=directx+runtime&oq=directx&gs_lcrp=EgZjaHJvbWUqDQgBEAAYgwEYsQMYgAQyDwgAEEUYORiDARixAxiABDINCAEQABiDARixAxiABDINCAIQABiDARixAxiABDIKCAMQABixAxiABDIKCAQQABixAxiABDIHCAUQABiABDINCAYQABiDARixAxiABDIHCAcQABiABDINCAgQABiDARixAxiABDINCAkQABiDARixAxiABNIBCDQwNjFqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=MmYKqDmYcs4; VISITOR_INFO1_LIVE=oCH7UytiVXo
2024-01-30 17:51:48 UTC	1862	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 30 Jan 2024 17:51:48 GMT Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube_main" Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Origin-Trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Cross-Origin-Resource-Policy: cross-origin P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF X-XSS-Protection: 0 Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgSw%3D%3D; Domain=.youtube.com; Expires=Sun, 28-Jul-2024 17:51:48 GMT; Path=/; Secure; HttpOnly; SameSite=lax Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:48 UTC	1862	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 20 64 61 74 61 2d 63 61 73 74 2d 61 70 69 2d 65 6e 61 62 6c 65 64 3d 22 74 72 75 65 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 32 46 49 47 41 30 55 6a 6c 46 52 4d 4e 51 52 74 59 57 48 5a 6b 51 22 3e 69 66 20 28 27 75 6e 64 65 66 69 6e 65 64 27 20 3d 3d 20 74 79 70 65 6f 66 20 53 79 Data Ascii: 8000<!DOCTYPE html><html lang="en" dir="ltr" data-cast-api-enabled="true"><head><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noindex"><script nonce="2FIGA0UjlFRMNQRtYWHZkQ">if ('undefined' == typeof Sy
2024-01-30 17:51:48 UTC	1862	IN	Data Raw: 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 34 6d 78 4b 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 30 30 30 2d 30 30 46 46 2c 55 2b 30 31 33 31 2c 55 2b 30 31 35 32 2d 30 31 35 33 2c 55 2b 30 32 42 42 2d 30 32 42 43 2c 55 2b 30 32 43 36 2c 55 2b 30 32 44 41 2c 55 2b 30 32 44 43 2c 55 2b 30 33 30 34 2c 55 2b 30 33 30 38 2c 55 2b 30 33 32 39 2c 55 2b 32 30 30 30 2d 32 30 36 46 2c 55 2b 32 30 37 34 2c 55 2b 32 30 41 43 2c 55 2b 32 31 32 32 2c 55 2b 32 31 39 31 2c 55 2b 32 31 39 33 2c 55 2b 32 32 31 32 2c 55 2b 32 32 31 Data Ascii: t-weight:400;src:url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2)format('woff2');unicode-range:U+0000-00FF,U+0131,U+0152-0153,U+02BB-02BC,U+02C6,U+02DA,U+02DC,U+0304,U+0308,U+0329,U+2000-206F,U+2074,U+20AC,U+2122,U+2191,U+2193,U+2212,U+221
2024-01-30 17:51:48 UTC	1862	IN	Data Raw: 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 30 30 30 2d 30 30 46 46 2c 55 2b 30 31 33 31 2c 55 2b 30 31 35 32 2d 30 31 35 33 2c 55 2b 30 32 42 42 2d 30 32 42 43 2c 55 2b 30 32 43 36 2c 55 2b 30 32 44 41 2c 55 2b 30 32 44 43 2c 55 2b 30 33 30 34 2c 55 2b 30 33 30 38 2c 55 2b 30 33 32 39 2c 55 2b 32 30 30 30 2d 32 30 36 46 2c 55 2b 32 30 37 34 2c 55 2b 32 30 41 43 2c 55 2b 32 31 32 32 2c 55 2b 32 31 39 31 2c 55 2b 32 31 39 33 2c 55 2b 32 32 31 32 2c 55 2b 32 32 31 35 2c 55 2b 46 45 46 46 2c 55 2b 46 46 46 44 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 73 63 72 69 70 74 20 6e 61 6d 65 3d 22 77 77 77 2d 72 6f 62 6f 74 6f 22 20 6e 6f 6e 63 65 3d 22 32 46 49 47 41 30 55 6a 6c 46 52 4d 4e 51 52 74 59 57 48 5a 6b 51 22 3e 69 66 20 28 64 6f 63 75 6d 65 6e 74 2e 66 6f 6e 74 73 Data Ascii: code-range:U+0000-00FF,U+0131,U+0152-0153,U+02BB-02BC,U+02C6,U+02DA,U+02DC,U+0304,U+0308,U+0329,U+2000-206F,U+2074,U+20AC,U+2122,U+2191,U+2193,U+2212,U+2215,U+FEFF,U+FFFD;}</style><script name="www-roboto" nonce="2FIGA0UjlFRMNQRtYWHZkQ">if (document.fonts
2024-01-30 17:51:48 UTC	1862	IN	Data Raw: 2e 70 72 65 4c 6f 67 67 65 64 47 65 6c 49 6e 66 6f 73 2e 70 75 73 68 28 70 29 7d 2c 73 65 74 53 74 61 72 74 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 79 74 63 73 69 2e 74 69 63 6b 28 22 5f 73 74 61 72 74 22 2c 74 2c 6e 29 7d 7d 3b 0a 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 29 7b 66 75 6e 63 74 69 6f 6e 20 69 73 47 65 63 6b 6f 28 29 7b 69 66 28 21 77 2e 6e 61 76 69 67 61 74 6f 72 29 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 74 72 79 7b 69 66 28 77 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 26 26 77 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 2e 62 72 61 6e 64 73 26 26 77 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 2e 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 Data Ascii: .preLoggedGelInfos.push(p)},setStart:function(t,n){ytcsi.tick("_start",t,n)}};(function(w,d){function isGecko(){if(!w.navigator)return false;try{if(w.navigator.userAgentData&&w.navigator.userAgentData.brands&&w.navigator.userAgentData.brands.length){var
2024-01-30 17:51:48 UTC	1862	IN	Data Raw: 22 48 35 5f 65 6e 61 62 6c 65 5f 66 75 6c 6c 5f 70 61 63 66 5f 6c 6f 67 67 69 6e 67 22 3a 74 72 75 65 2c 22 48 35 5f 75 73 65 5f 61 73 79 6e 63 5f 6c 6f 67 67 69 6e 67 22 3a 74 72 75 65 2c 22 61 62 5f 64 65 74 5f 61 70 62 5f 62 22 3a 74 72 75 65 2c 22 61 62 5f 64 65 74 5f 65 6c 5f 68 22 3a 74 72 75 65 2c 22 61 62 5f 64 65 74 5f 66 65 74 5f 77 72 22 3a 74 72 75 65 2c 22 61 62 5f 64 65 74 5f 66 65 74 5f 77 72 5f 65 6e 22 3a 74 72 75 65 2c 22 61 62 5f 64 65 74 5f 67 65 6e 5f 72 65 22 3a 74 72 75 65 2c 22 61 63 74 69 6f 6e 5f 63 6f 6d 70 61 6e 69 6f 6e 5f 63 65 6e 74 65 72 5f 61 6c 69 67 6e 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 74 72 75 65 2c 22 61 6c 6c 6f 77 5f 73 6b 69 70 5f 6e 65 74 77 6f 72 6b 6c 65 73 73 22 3a 74 72 75 65 2c 22 61 6c 77 61 79 73 5f Data Ascii: "H5_enable_full_pacf_logging":true,"H5_use_async_logging":true,"ab_det_apb_b":true,"ab_det_el_h":true,"ab_det_fet_wr":true,"ab_det_fet_wr_en":true,"ab_det_gen_re":true,"action_companion_center_align_description":true,"allow_skip_networkless":true,"always_
2024-01-30 17:51:48 UTC	1862	IN	Data Raw: 6f 6c 6c 5f 70 6c 61 79 65 72 5f 62 79 74 65 73 5f 76 69 64 65 6f 5f 74 76 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 6b 69 70 5f 61 64 5f 67 75 69 64 61 6e 63 65 5f 70 72 6f 6d 70 74 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 6b 69 70 70 61 62 6c 65 5f 61 64 73 5f 66 6f 72 5f 75 6e 70 6c 75 67 67 65 64 5f 61 64 5f 70 6f 64 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 73 6d 65 61 72 69 6e 67 5f 65 78 70 61 6e 73 69 6f 6e 5f 64 61 69 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 74 68 69 72 64 5f 70 61 72 74 79 5f 69 6e 66 6f 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 77 61 74 63 68 5f 6e 65 78 74 5f 70 61 75 73 65 5f 61 75 74 6f 70 6c 61 79 5f 6c 61 63 74 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 5f 77 65 62 5f 74 69 65 72 65 64 5f 67 65 6c 22 Data Ascii: oll_player_bytes_video_tv":true,"enable_skip_ad_guidance_prompt":true,"enable_skippable_ads_for_unplugged_ad_pod":true,"enable_smearing_expansion_dai":true,"enable_third_party_info":true,"enable_watch_next_pause_autoplay_lact":true,"enable_web_tiered_gel"
2024-01-30 17:51:48 UTC	1862	IN	Data Raw: 75 70 64 61 74 65 64 5f 79 74 77 69 6e 64 6f 77 5f 69 6e 5f 73 74 75 64 69 6f 22 3a 74 72 75 65 2c 22 73 63 68 65 64 75 6c 65 72 5f 75 73 65 5f 72 61 66 5f 62 79 5f 64 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 73 65 72 76 69 63 65 5f 77 6f 72 6b 65 72 5f 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 73 65 72 76 69 63 65 5f 77 6f 72 6b 65 72 5f 70 75 73 68 5f 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 73 65 72 76 69 63 65 5f 77 6f 72 6b 65 72 5f 70 75 73 68 5f 68 6f 6d 65 5f 70 61 67 65 5f 70 72 6f 6d 70 74 22 3a 74 72 75 65 2c 22 73 65 72 76 69 63 65 5f 77 6f 72 6b 65 72 5f 70 75 73 68 5f 77 61 74 63 68 5f 70 61 67 65 5f 70 72 6f 6d 70 74 22 3a 74 72 75 65 2c 22 73 68 65 6c 6c 5f 6c 6f 61 64 5f 67 63 66 22 3a 74 72 75 65 2c 22 73 68 6f 72 74 65 6e 5f 69 Data Ascii: updated_ytwindow_in_studio":true,"scheduler_use_raf_by_default":true,"service_worker_enabled":true,"service_worker_push_enabled":true,"service_worker_push_home_page_prompt":true,"service_worker_push_watch_page_prompt":true,"shell_load_gcf":true,"shorten_i
2024-01-30 17:51:48 UTC	1862	IN	Data Raw: 65 64 5f 65 76 65 6e 74 5f 72 61 74 65 5f 6c 69 6d 69 74 22 3a 30 2e 30 32 2c 22 79 74 69 64 62 5f 74 72 61 6e 73 61 63 74 69 6f 6e 5f 65 6e 64 65 64 5f 65 76 65 6e 74 5f 72 61 74 65 5f 6c 69 6d 69 74 5f 73 65 73 73 69 6f 6e 22 3a 30 2e 32 2c 22 79 74 69 64 62 5f 74 72 61 6e 73 61 63 74 69 6f 6e 5f 65 6e 64 65 64 5f 65 76 65 6e 74 5f 72 61 74 65 5f 6c 69 6d 69 74 5f 74 72 61 6e 73 61 63 74 69 6f 6e 22 3a 30 2e 31 2c 22 61 75 74 6f 70 6c 61 79 5f 70 61 75 73 65 5f 62 79 5f 6c 61 63 74 5f 73 65 63 22 3a 30 2c 22 62 6f 74 67 75 61 72 64 5f 61 73 79 6e 63 5f 73 6e 61 70 73 68 6f 74 5f 74 69 6d 65 6f 75 74 5f 6d 73 22 3a 33 30 30 30 2c 22 63 68 65 63 6b 5f 6e 61 76 69 67 61 74 6f 72 5f 61 63 63 75 72 61 63 79 5f 74 69 6d 65 6f 75 74 5f 6d 73 22 3a 30 2c 22 63 Data Ascii: ed_event_rate_limit":0.02,"ytidb_transaction_ended_event_rate_limit_session":0.2,"ytidb_transaction_ended_event_rate_limit_transaction":0.1,"autoplay_pause_by_lact_sec":0,"botguard_async_snapshot_timeout_ms":3000,"check_navigator_accuracy_timeout_ms":0,"c
2024-01-30 17:51:48 UTC	1862	IN	Data Raw: 59 39 5f 31 31 71 63 57 38 22 2c 22 49 4e 4e 45 52 54 55 42 45 5f 41 50 49 5f 56 45 52 53 49 4f 4e 22 3a 22 76 31 22 2c 22 49 4e 4e 45 52 54 55 42 45 5f 43 4c 49 45 4e 54 5f 4e 41 4d 45 22 3a 22 57 45 42 5f 45 4d 42 45 44 44 45 44 5f 50 4c 41 59 45 52 22 2c 22 49 4e 4e 45 52 54 55 42 45 5f 43 4c 49 45 4e 54 5f 56 45 52 53 49 4f 4e 22 3a 22 31 2e 32 30 32 34 30 31 32 38 2e 30 30 2e 30 30 22 2c 22 49 4e 4e 45 52 54 55 42 45 5f 43 4f 4e 54 45 58 54 22 3a 7b 22 63 6c 69 65 6e 74 22 3a 7b 22 68 6c 22 3a 22 65 6e 22 2c 22 67 6c 22 3a 22 55 53 22 2c 22 72 65 6d 6f 74 65 48 6f 73 74 22 3a 22 38 31 2e 31 38 31 2e 35 37 2e 37 34 22 2c 22 64 65 76 69 63 65 4d 61 6b 65 22 3a 22 22 2c 22 64 65 76 69 63 65 4d 6f 64 65 6c 22 3a 22 22 2c 22 76 69 73 69 74 6f 72 44 61 74 Data Ascii: Y9_11qcW8","INNERTUBE_API_VERSION":"v1","INNERTUBE_CLIENT_NAME":"WEB_EMBEDDED_PLAYER","INNERTUBE_CLIENT_VERSION":"1.20240128.00.00","INNERTUBE_CONTEXT":{"client":{"hl":"en","gl":"US","remoteHost":"81.181.57.74","deviceMake":"","deviceModel":"","visitorDat
2024-01-30 17:51:48 UTC	1862	IN	Data Raw: 22 55 53 22 2c 22 49 4e 4e 45 52 54 55 42 45 5f 43 4f 4e 54 45 58 54 5f 48 4c 22 3a 22 65 6e 22 2c 22 4c 41 54 45 53 54 5f 45 43 41 54 43 48 45 52 5f 53 45 52 56 49 43 45 5f 54 52 41 43 4b 49 4e 47 5f 50 41 52 41 4d 53 22 3a 7b 22 63 6c 69 65 6e 74 2e 6e 61 6d 65 22 3a 22 57 45 42 5f 45 4d 42 45 44 44 45 44 5f 50 4c 41 59 45 52 22 7d 2c 22 53 45 52 56 45 52 5f 4e 41 4d 45 22 3a 22 57 65 62 46 45 22 2c 22 53 45 53 53 49 4f 4e 5f 49 4e 44 45 58 22 3a 22 22 2c 22 56 49 53 49 54 4f 52 5f 44 41 54 41 22 3a 22 43 67 74 76 51 30 67 33 56 58 6c 30 61 56 5a 59 62 79 69 30 37 75 53 74 42 6a 49 4b 43 67 4a 56 55 78 49 45 47 67 41 67 53 77 25 33 44 25 33 44 22 2c 22 57 45 42 5f 50 4c 41 59 45 52 5f 43 4f 4e 54 45 58 54 5f 43 4f 4e 46 49 47 53 22 3a 7b 22 57 45 42 5f Data Ascii: "US","INNERTUBE_CONTEXT_HL":"en","LATEST_ECATCHER_SERVICE_TRACKING_PARAMS":{"client.name":"WEB_EMBEDDED_PLAYER"},"SERVER_NAME":"WebFE","SESSION_INDEX":"","VISITOR_DATA":"CgtvQ0g3VXl0aVZYbyi07uStBjIKCgJVUxIEGgAgSw%3D%3D","WEB_PLAYER_CONTEXT_CONFIGS":{"WEB_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.17	49810	172.217.215.190	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:48 UTC	883	OUT	GET /s/player/6ee8f9ce/www-player.css HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.youtube.com/embed/?enablejsapi=1&rel=0&autoplay=0&playsinline=1&expflag=embeds_enable_muted_autoplay%3Atrue&fs=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=MmYKqDmYcs4; VISITOR_INFO1_LIVE=oCH7UytiVXo
2024-01-30 17:51:48 UTC	681	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 367709 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 30 Jan 2024 15:02:06 GMT Expires: Wed, 29 Jan 2025 15:02:06 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 29 Jan 2024 05:16:12 GMT Content-Type: text/css Vary: Accept-Encoding, Origin Age: 10182 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:48 UTC	571	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 2e 68 74 6d 6c 35 2d 76 69 64 65 6f 2d 70 6c 61 79 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 7a 2d 69 6e 64 65 78 3a 30 3b 6f 75 74 6c 69 6e 65 3a 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 59 6f 75 54 75 62 65 20 4e 6f 74 6f 22 2c 52 6f 62 6f 74 6f 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 65 65 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 64 69 72 65 63 74 69 6f 6e 3a 6c 74 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 31 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 33 3b 2d 77 65 62 6b 69 74 2d Data Ascii: @charset "UTF-8";.html5-video-player{position:relative;width:100%;height:100%;overflow:hidden;z-index:0;outline:0;font-family:"YouTube Noto",Roboto,Arial,Helvetica,sans-serif;color:#eee;text-align:left;direction:ltr;font-size:11px;line-height:1.3;-webkit-
2024-01-30 17:51:48 UTC	1252	IN	Data Raw: 62 69 67 2d 6d 6f 64 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 37 70 78 7d 2e 79 74 70 2d 61 75 74 6f 68 69 64 65 7b 63 75 72 73 6f 72 3a 6e 6f 6e 65 7d 2e 68 74 6d 6c 35 2d 76 69 64 65 6f 2d 70 6c 61 79 65 72 20 61 7b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 63 6f 6c 6f 72 20 2e 31 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 2e 32 2c 31 29 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 63 6f 6c 6f 72 20 2e 31 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 2e 32 2c 31 29 3b 6f 75 74 6c 69 6e 65 3a 30 7d 2e 68 74 6d 6c 35 2d 76 69 64 65 6f 2d 70 6c 61 79 65 72 20 61 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 66 66 66 3b 2d 77 65 Data Ascii: big-mode{font-size:17px}.ytp-autohide{cursor:none}.html5-video-player a{color:inherit;text-decoration:none;-webkit-transition:color .1s cubic-bezier(0,0,.2,1);transition:color .1s cubic-bezier(0,0,.2,1);outline:0}.html5-video-player a:hover{color:#fff;-we
2024-01-30 17:51:48 UTC	1252	IN	Data Raw: 6f 76 65 72 2d 76 69 64 65 6f 20 2e 68 74 6d 6c 35 2d 6d 61 69 6e 2d 76 69 64 65 6f 7b 2d 6f 2d 6f 62 6a 65 63 74 2d 66 69 74 3a 63 6f 76 65 72 3b 6f 62 6a 65 63 74 2d 66 69 74 3a 63 6f 76 65 72 7d 2e 68 74 6d 6c 35 2d 6d 61 69 6e 2d 76 69 64 65 6f 5b 64 61 74 61 2d 6e 6f 2d 66 75 6c 6c 73 63 72 65 65 6e 3d 74 72 75 65 5d 3a 3a 2d 77 65 62 6b 69 74 2d 6d 65 64 69 61 2d 63 6f 6e 74 72 6f 6c 73 2d 66 75 6c 6c 73 63 72 65 65 6e 2d 62 75 74 74 6f 6e 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 68 74 6d 6c 35 2d 6d 61 69 6e 2d 76 69 64 65 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 3a 3a 2d 77 65 62 6b 69 74 2d 6d 65 64 69 61 2d 63 6f 6e 74 72 6f 6c 73 2c 2e 68 74 6d 6c 35 2d 6d 61 69 6e 2d 76 69 64 65 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 Data Ascii: over-video .html5-main-video{-o-object-fit:cover;object-fit:cover}.html5-main-video[data-no-fullscreen=true]::-webkit-media-controls-fullscreen-button{display:none}.html5-main-video:not([controls])::-webkit-media-controls,.html5-main-video:not([controls])
2024-01-30 17:51:48 UTC	1252	IN	Data Raw: 6c 61 79 65 72 2d 63 6f 6e 74 65 6e 74 3a 6e 6f 74 28 2e 79 74 70 2d 75 70 6e 65 78 74 29 7b 74 6f 70 3a 38 39 70 78 7d 2e 79 74 70 2d 70 6c 61 79 65 72 2d 63 6f 6e 74 65 6e 74 2e 79 74 70 2d 69 76 2d 70 6c 61 79 65 72 2d 63 6f 6e 74 65 6e 74 7b 6c 65 66 74 3a 31 32 70 78 3b 72 69 67 68 74 3a 31 32 70 78 7d 2e 79 74 70 2d 62 69 67 2d 6d 6f 64 65 20 2e 79 74 70 2d 70 6c 61 79 65 72 2d 63 6f 6e 74 65 6e 74 2e 79 74 70 2d 69 76 2d 70 6c 61 79 65 72 2d 63 6f 6e 74 65 6e 74 7b 6c 65 66 74 3a 32 34 70 78 3b 72 69 67 68 74 3a 32 34 70 78 7d 2e 79 74 70 2d 61 75 74 6f 68 69 64 65 20 2e 79 74 70 2d 70 6c 61 79 65 72 2d 63 6f 6e 74 65 6e 74 3a 6e 6f 74 28 2e 68 74 6d 6c 35 2d 65 6e 64 73 63 72 65 65 6e 29 2c 2e 79 74 70 2d 61 75 74 6f 68 69 64 65 20 2e 79 74 70 2d Data Ascii: layer-content:not(.ytp-upnext){top:89px}.ytp-player-content.ytp-iv-player-content{left:12px;right:12px}.ytp-big-mode .ytp-player-content.ytp-iv-player-content{left:24px;right:24px}.ytp-autohide .ytp-player-content:not(.html5-endscreen),.ytp-autohide .ytp-
2024-01-30 17:51:48 UTC	1252	IN	Data Raw: 68 65 72 69 74 7d 2e 79 74 70 2d 62 75 74 74 6f 6e 3a 66 6f 63 75 73 2c 2e 79 74 70 2d 62 75 74 74 6f 6e 7b 6f 75 74 6c 69 6e 65 3a 30 7d 2e 79 74 70 2d 62 75 74 74 6f 6e 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 7b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 7d 2e 68 74 6d 6c 35 2d 76 69 64 65 6f 2d 70 6c 61 79 65 72 20 2e 79 74 70 2d 62 75 74 74 6f 6e 5b 61 72 69 61 2d 64 69 73 61 62 6c 65 64 3d 74 72 75 65 5d 2c 2e 68 74 6d 6c 35 2d 76 69 64 65 6f 2d 70 6c 61 79 65 72 20 2e 79 74 70 2d 62 75 74 74 6f 6e 5b 64 69 73 61 62 6c 65 64 5d 7b 6f 70 61 63 69 74 79 3a 2e 35 7d 2e 79 74 70 2d 62 75 74 74 6f 6e 3a 6e 6f 74 28 5b 61 72 69 61 2d 64 69 73 61 62 6c 65 64 3d 74 72 75 65 5d 29 3a 6e 6f 74 28 5b 64 69 73 61 62 6c 65 64 5d 29 3a 6e Data Ascii: herit}.ytp-button:focus,.ytp-button{outline:0}.ytp-button::-moz-focus-inner{padding:0;border:0}.html5-video-player .ytp-button[aria-disabled=true],.html5-video-player .ytp-button[disabled]{opacity:.5}.ytp-button:not([aria-disabled=true]):not([disabled]):n
2024-01-30 17:51:48 UTC	1252	IN	Data Raw: 79 74 70 2d 63 68 72 6f 6d 65 2d 62 6f 74 74 6f 6d 2c 2e 79 74 70 2d 65 6d 62 65 64 2e 79 74 70 2d 65 6d 62 65 64 2d 6d 6f 62 69 6c 65 2e 79 74 70 2d 73 6d 61 6c 6c 2d 6d 6f 64 65 20 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 62 6f 74 74 6f 6d 2c 2e 79 74 70 2d 65 6d 62 65 64 2e 79 74 70 2d 65 6d 62 65 64 2d 6d 6f 62 69 6c 65 20 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 62 6f 74 74 6f 6d 20 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 63 6f 6e 74 72 6f 6c 73 2c 2e 79 74 70 2d 65 6d 62 65 64 2e 79 74 70 2d 65 6d 62 65 64 2d 6d 6f 62 69 6c 65 2e 79 74 70 2d 73 6d 61 6c 6c 2d 6d 6f 64 65 20 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 62 6f 74 74 6f 6d 20 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 63 6f 6e 74 72 6f 6c 73 7b 68 65 69 67 68 74 3a 34 38 70 78 7d 2e 79 74 70 2d 62 69 67 2d 6d 6f 64 Data Ascii: ytp-chrome-bottom,.ytp-embed.ytp-embed-mobile.ytp-small-mode .ytp-chrome-bottom,.ytp-embed.ytp-embed-mobile .ytp-chrome-bottom .ytp-chrome-controls,.ytp-embed.ytp-embed-mobile.ytp-small-mode .ytp-chrome-bottom .ytp-chrome-controls{height:48px}.ytp-big-mod
2024-01-30 17:51:48 UTC	1252	IN	Data Raw: 6f 6e 2c 2e 79 74 70 2d 65 6d 62 65 64 20 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 63 6f 6e 74 72 6f 6c 73 20 2e 79 74 70 2d 62 75 74 74 6f 6e 2e 79 74 70 2d 6d 69 6e 69 70 6c 61 79 65 72 2d 62 75 74 74 6f 6e 2c 2e 79 74 70 2d 65 6d 62 65 64 20 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 63 6f 6e 74 72 6f 6c 73 20 2e 79 74 70 2d 62 75 74 74 6f 6e 2e 79 74 70 2d 72 65 6d 6f 74 65 2d 62 75 74 74 6f 6e 7b 70 61 64 64 69 6e 67 3a 30 7d 2e 79 74 70 2d 65 6d 62 65 64 2e 79 74 70 2d 65 6d 62 65 64 2d 6d 6f 62 69 6c 65 20 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 63 6f 6e 74 72 6f 6c 73 20 2e 79 74 70 2d 62 75 74 74 6f 6e 2c 2e 79 74 70 2d 65 6d 62 65 64 2e 79 74 70 2d 65 6d 62 65 64 2d 6d 6f 62 69 6c 65 2e 79 74 70 2d 73 6d 61 6c 6c 2d 6d 6f 64 65 20 2e 79 74 70 2d 63 68 72 6f 6d Data Ascii: on,.ytp-embed .ytp-chrome-controls .ytp-button.ytp-miniplayer-button,.ytp-embed .ytp-chrome-controls .ytp-button.ytp-remote-button{padding:0}.ytp-embed.ytp-embed-mobile .ytp-chrome-controls .ytp-button,.ytp-embed.ytp-embed-mobile.ytp-small-mode .ytp-chrom
2024-01-30 17:51:48 UTC	1252	IN	Data Raw: 73 20 2e 79 74 70 2d 62 75 74 74 6f 6e 3a 6e 6f 74 28 5b 61 72 69 61 2d 64 69 73 61 62 6c 65 64 3d 74 72 75 65 5d 29 3a 6e 6f 74 28 5b 64 69 73 61 62 6c 65 64 5d 29 3a 68 6f 76 65 72 2c 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 63 6f 6e 74 72 6f 6c 73 20 2e 79 74 70 2d 62 75 74 74 6f 6e 5b 61 72 69 61 2d 65 78 70 61 6e 64 65 64 3d 74 72 75 65 5d 2c 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 63 6f 6e 74 72 6f 6c 73 20 2e 79 74 70 2d 62 75 74 74 6f 6e 5b 61 72 69 61 2d 70 72 65 73 73 65 64 3d 74 72 75 65 5d 2c 2e 79 74 70 2d 72 65 70 6c 61 79 2d 62 75 74 74 6f 6e 3a 68 6f 76 65 72 7b 6f 70 61 63 69 74 79 3a 31 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 6f 70 61 63 69 74 79 20 2e 31 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 2e 32 2c 31 29 Data Ascii: s .ytp-button:not([aria-disabled=true]):not([disabled]):hover,.ytp-chrome-controls .ytp-button[aria-expanded=true],.ytp-chrome-controls .ytp-button[aria-pressed=true],.ytp-replay-button:hover{opacity:1;-webkit-transition:opacity .1s cubic-bezier(0,0,.2,1)
2024-01-30 17:51:48 UTC	1252	IN	Data Raw: 79 74 70 2d 62 75 74 74 6f 6e 5b 61 72 69 61 2d 70 72 65 73 73 65 64 5d 3a 61 66 74 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 63 6f 6e 74 72 6f 6c 73 20 2e 79 74 70 2d 62 75 74 74 6f 6e 5b 61 72 69 61 2d 70 72 65 73 73 65 64 3d 74 72 75 65 5d 3a 61 66 74 65 72 7b 77 69 64 74 68 3a 32 34 70 78 3b 6c 65 66 74 3a 31 32 70 78 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 6c 65 66 74 20 2e 32 35 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 2e 32 2c 31 29 2c 77 69 64 74 68 20 2e 32 35 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 2e 32 2c 31 29 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 6c 65 66 74 20 2e 32 35 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 Data Ascii: ytp-button[aria-pressed]:after{background-color:#fff}.ytp-chrome-controls .ytp-button[aria-pressed=true]:after{width:24px;left:12px;-webkit-transition:left .25s cubic-bezier(0,0,.2,1),width .25s cubic-bezier(0,0,.2,1);transition:left .25s cubic-bezier(0,0
2024-01-30 17:51:48 UTC	1252	IN	Data Raw: 70 2d 73 68 61 72 65 2d 62 75 74 74 6f 6e 2d 76 69 73 69 62 6c 65 29 2c 2e 79 74 70 2d 63 6f 70 79 6c 69 6e 6b 2d 62 75 74 74 6f 6e 3a 6e 6f 74 28 2e 79 74 70 2d 63 6f 70 79 6c 69 6e 6b 2d 62 75 74 74 6f 6e 2d 76 69 73 69 62 6c 65 29 2c 2e 79 74 70 2d 6f 76 65 72 66 6c 6f 77 2d 62 75 74 74 6f 6e 3a 6e 6f 74 28 2e 79 74 70 2d 6f 76 65 72 66 6c 6f 77 2d 62 75 74 74 6f 6e 2d 76 69 73 69 62 6c 65 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 79 74 70 2d 65 78 70 2d 62 6f 74 74 6f 6d 2d 63 6f 6e 74 72 6f 6c 2d 66 6c 65 78 62 6f 78 20 2e 79 74 70 2d 63 68 72 6f 6d 65 2d 63 6f 6e 74 72 6f 6c 73 7b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 7d 2e Data Ascii: p-share-button-visible),.ytp-copylink-button:not(.ytp-copylink-button-visible),.ytp-overflow-button:not(.ytp-overflow-button-visible){display:none}.ytp-exp-bottom-control-flexbox .ytp-chrome-controls{display:-webkit-box;display:-webkit-flex;display:flex}.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.17	49811	172.217.215.190	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:48 UTC	887	OUT	GET /s/player/6ee8f9ce/player_ias.vflset/en_US/embed.js HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/embed/?enablejsapi=1&rel=0&autoplay=0&playsinline=1&expflag=embeds_enable_muted_autoplay%3Atrue&fs=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=MmYKqDmYcs4; VISITOR_INFO1_LIVE=oCH7UytiVXo
2024-01-30 17:51:49 UTC	686	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 54875 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 30 Jan 2024 15:51:31 GMT Expires: Wed, 29 Jan 2025 15:51:31 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 29 Jan 2024 05:16:12 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 7218 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:49 UTC	566	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 67 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 2f 2a 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 0a 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 47 6f 6f 67 6c 65 20 4c 4c 43 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2e 0a 0a 20 55 73 65 20 6f 66 20 74 68 69 73 20 73 6f 75 72 63 65 20 63 6f 64 65 20 69 73 20 67 6f 76 65 72 6e 65 64 20 62 79 20 61 6e 20 4d 49 54 2d 73 74 79 6c 65 20 6c 69 63 65 6e 73 65 20 74 68 61 74 20 63 61 6e 20 62 65 0a 20 66 6f 75 6e 64 20 69 6e 20 74 68 65 20 4c 49 43 45 4e 53 45 20 66 69 6c 65 20 61 74 20 68 74 74 70 73 3a 2f 2f 61 6e 67 75 6c 61 72 2e 69 6f 2f 6c 69 63 65 6e 73 65 0a 2a 2f 0a 2f 2a Data Ascii: (function(g){var window=this;/* SPDX-License-Identifier: Apache-2.0 // Copyright Google LLC All Rights Reserved. Use of this source code is governed by an MIT-style license that can be found in the LICENSE file at https://angular.io/license//
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 73 76 67 2d 66 69 6c 6c 22 2c 59 3a 7b 64 3a 22 4d 20 31 36 2e 36 38 2c 2e 39 39 20 43 20 31 33 2e 35 35 2c 31 2e 30 33 20 37 2e 30 32 2c 31 2e 31 36 20 34 2e 39 39 2c 31 2e 36 38 20 63 20 2d 31 2e 34 39 2c 2e 34 20 2d 32 2e 35 39 2c 31 2e 36 20 2d 32 2e 39 39 2c 33 20 2d 30 2e 36 39 2c 32 2e 37 20 2d 30 2e 36 38 2c 38 2e 33 31 20 2d 30 2e 36 38 2c 38 2e 33 31 20 30 2c 30 20 2d 30 2e 30 31 2c 35 2e 36 31 20 2e 36 38 2c 38 2e 33 31 20 2e 33 39 2c 31 2e 35 20 31 2e 35 39 2c 32 2e 36 20 32 2e 39 39 2c 33 20 32 2e 36 39 2c 2e 37 20 31 33 2e 34 30 2c 2e 36 38 20 31 33 2e 34 30 2c 2e 36 38 20 30 2c 30 20 31 30 2e 37 30 2c 2e 30 31 20 31 33 2e 34 30 2c 2d 30 2e 36 38 20 31 2e 35 2c 2d 30 2e 34 20 32 2e 35 39 2c 2d 31 2e 36 20 32 2e 39 39 2c 2d 33 20 2e 36 39 2c Data Ascii: svg-fill",Y:{d:"M 16.68,.99 C 13.55,1.03 7.02,1.16 4.99,1.68 c -1.49,.4 -2.59,1.6 -2.99,3 -0.69,2.7 -0.68,8.31 -0.68,8.31 0,0 -0.01,5.61 .68,8.31 .39,1.5 1.59,2.6 2.99,3 2.69,.7 13.40,.68 13.40,.68 0,0 10.70,.01 13.40,-0.68 1.5,-0.4 2.59,-1.6 2.99,-3 .69,
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 32 2e 39 30 2c 2d 30 2e 32 31 20 63 20 30 2c 31 20 2d 30 2e 30 38 2c 31 2e 36 20 2d 30 2e 32 38 2c 32 20 2d 30 2e 31 2c 2e 34 20 2d 30 2e 35 2c 2e 36 32 20 2d 31 2c 2e 36 32 20 2d 30 2e 33 2c 30 20 2d 30 2e 36 31 2c 2d 30 2e 31 31 20 2d 30 2e 38 31 2c 2d 30 2e 33 31 20 2d 30 2e 32 2c 2d 30 2e 33 20 2d 30 2e 33 30 2c 2d 30 2e 35 39 20 2d 30 2e 34 30 2c 2d 31 2e 30 39 20 2d 30 2e 31 2c 2d 30 2e 35 20 2d 30 2e 30 39 2c 2d 31 2e 32 31 20 2d 30 2e 30 39 2c 2d 32 2e 32 31 20 6c 20 30 2c 2d 30 2e 37 38 20 35 2e 37 31 2c 2d 30 2e 30 39 20 30 2c 2d 32 2e 36 32 20 63 20 30 2c 2d 31 2e 36 20 2d 30 2e 31 30 2c 2d 32 2e 37 38 20 2d 30 2e 34 30 2c 2d 33 2e 36 38 20 2d 30 2e 32 2c 2d 30 2e 38 39 20 2d 30 2e 37 31 2c 2d 31 2e 35 39 20 2d 31 2e 33 31 2c 2d 31 2e 39 39 20 Data Ascii: 2.90,-0.21 c 0,1 -0.08,1.6 -0.28,2 -0.1,.4 -0.5,.62 -1,.62 -0.3,0 -0.61,-0.11 -0.81,-0.31 -0.2,-0.3 -0.30,-0.59 -0.40,-1.09 -0.1,-0.5 -0.09,-1.21 -0.09,-2.21 l 0,-0.78 5.71,-0.09 0,-2.62 c 0,-1.6 -0.10,-2.78 -0.40,-3.68 -0.2,-0.89 -0.71,-1.59 -1.31,-1.99
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 31 34 2e 39 39 20 63 20 30 2c 30 20 2d 33 2e 34 30 2c 2e 30 30 20 2d 33 2e 34 30 2c 2d 30 2e 30 39 20 7a 20 6d 20 32 30 2e 39 30 2c 32 2e 30 39 20 63 20 2e 34 2c 30 20 2e 35 38 2c 2e 31 31 20 2e 37 38 2c 2e 33 31 20 2e 32 2c 2e 33 20 2e 33 30 2c 2e 35 39 20 2e 34 30 2c 31 2e 30 39 20 2e 31 2c 2e 35 20 2e 30 39 2c 31 2e 32 31 20 2e 30 39 2c 32 2e 32 31 20 6c 20 30 2c 31 2e 30 39 20 2d 32 2e 35 2c 30 20 30 2c 2d 31 2e 30 39 20 63 20 30 2c 2d 31 20 2d 30 2e 30 30 2c 2d 31 2e 37 31 20 2e 30 39 2c 2d 32 2e 32 31 20 30 2c 2d 30 2e 34 20 2e 31 31 2c 2d 30 2e 38 20 2e 33 31 2c 2d 31 20 2e 32 2c 2d 30 2e 33 20 2e 35 31 2c 2d 30 2e 34 30 20 2e 38 31 2c 2d 30 2e 34 30 20 7a 20 6d 20 2d 35 30 2e 34 39 2c 2e 31 32 20 63 20 2e 35 2c 30 20 2e 38 2c 2e 31 38 20 31 2c 2e Data Ascii: 14.99 c 0,0 -3.40,.00 -3.40,-0.09 z m 20.90,2.09 c .4,0 .58,.11 .78,.31 .2,.3 .30,.59 .40,1.09 .1,.5 .09,1.21 .09,2.21 l 0,1.09 -2.5,0 0,-1.09 c 0,-1 -0.00,-1.71 .09,-2.21 0,-0.4 .11,-0.8 .31,-1 .2,-0.3 .51,-0.40 .81,-0.40 z m -50.49,.12 c .5,0 .8,.18 1,.
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 69 66 28 6e 75 6c 6c 3d 3d 63 29 61 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 62 29 3b 0a 65 6c 73 65 7b 76 61 72 20 64 3d 30 3d 3d 3d 62 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 22 78 6d 6c 3a 22 2c 30 29 3f 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 58 4d 4c 2f 31 39 39 38 2f 6e 61 6d 65 73 70 61 63 65 22 3a 30 3d 3d 3d 62 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 22 78 6c 69 6e 6b 3a 22 2c 30 29 3f 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 3a 6e 75 6c 6c 3b 64 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 4e 53 28 64 2c 62 2c 63 29 3a 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 62 2c 63 29 7d 7d 2c 58 6f 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 61 3d 61 2e 73 74 79 6c 65 3b Data Ascii: if(null==c)a.removeAttribute(b);else{var d=0===b.lastIndexOf("xml:",0)?"http://www.w3.org/XML/1998/namespace":0===b.lastIndexOf("xlink:",0)?"http://www.w3.org/1999/xlink":null;d?a.setAttributeNS(d,b,c):a.setAttribute(b,c)}},Xob=function(a,b,c){a=a.style;
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 78 74 53 69 62 6c 69 6e 67 3b 0a 62 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 63 29 3b 41 35 2e 6a 2e 70 75 73 68 28 63 29 3b 63 3d 64 7d 7d 2c 7a 35 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 43 35 3f 43 35 2e 6e 65 78 74 53 69 62 6c 69 6e 67 3a 79 35 2e 66 69 72 73 74 43 68 69 6c 64 7d 2c 65 70 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 43 35 3d 7a 35 28 29 3b 0a 76 61 72 20 63 3b 61 3a 7b 69 66 28 63 3d 43 35 29 7b 64 6f 7b 76 61 72 20 64 3d 63 2c 65 3d 61 2c 66 3d 62 2c 68 3d 78 35 28 64 2c 66 29 3b 69 66 28 44 35 28 64 2c 65 2c 68 2e 42 2c 66 2c 68 2e 6b 65 79 29 29 62 72 65 61 6b 20 61 7d 77 68 69 6c 65 28 62 26 26 28 63 3d 63 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 29 7d 63 3d 6e 75 6c 6c 7d 63 7c 7c 28 22 23 74 65 78 74 22 3d 3d 3d Data Ascii: xtSibling;b.removeChild(c);A5.j.push(c);c=d}},z5=function(){return C5?C5.nextSibling:y5.firstChild},epb=function(a,b){C5=z5();var c;a:{if(c=C5){do{var d=c,e=a,f=b,h=x5(d,f);if(D5(d,e,h.B,f,h.key))break a}while(b&&(c=c.nextSibling))}c=null}c\|\|("#text"===
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 71 2c 46 35 3d 6d 7d 7d 7d 2c 69 70 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 49 35 2e 70 75 73 68 28 24 6f 62 29 3b 0a 49 35 2e 70 75 73 68 28 61 29 3b 49 35 2e 70 75 73 68 28 62 29 3b 49 35 2e 70 75 73 68 28 63 29 3b 49 35 2e 70 75 73 68 28 64 29 7d 2c 6a 70 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 65 70 62 28 22 23 74 65 78 74 22 2c 6e 75 6c 6c 29 3b 0a 76 61 72 20 62 3d 43 35 3b 76 61 72 20 63 3d 78 35 28 62 29 3b 69 66 28 63 2e 74 65 78 74 21 3d 3d 61 29 7b 63 3d 63 2e 74 65 78 74 3d 61 3b 66 6f 72 28 76 61 72 20 64 3d 31 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 3d 31 29 63 3d 28 30 2c 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 28 63 29 3b 62 2e 64 61 74 61 21 3d 3d 63 26 26 28 62 2e 64 61 74 61 3d 63 29 7d 7d Data Ascii: q,F5=m}}},ipb=function(a,b,c,d){I5.push($ob);I5.push(a);I5.push(b);I5.push(c);I5.push(d)},jpb=function(a){epb("#text",null);var b=C5;var c=x5(b);if(c.text!==a){c=c.text=a;for(var d=1;d<arguments.length;d+=1)c=(0,arguments[d])(c);b.data!==c&&(b.data=c)}}
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 5b 63 5d 29 3b 63 3d 61 2e 67 6b 2e 6c 65 6e 67 74 68 2d 31 3b 61 2e 67 6b 5b 62 5d 3d 61 2e 67 6b 5b 63 5d 3b 61 2e 64 77 5b 62 5d 3d 61 2e 64 77 5b 63 5d 3b 61 2e 67 6b 2e 6c 65 6e 67 74 68 2d 2d 3b 61 2e 64 77 2e 6c 65 6e 67 74 68 2d 2d 3b 62 3c 61 2e 67 6b 2e 6c 65 6e 67 74 68 26 26 28 63 3d 61 2e 64 77 5b 62 5d 2c 61 3d 61 2e 67 6b 5b 62 5d 2c 4d 35 28 61 29 2c 61 2e 6c 72 5b 63 5d 3d 62 29 7d 2c 71 70 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 2c 63 3b 0a 72 65 74 75 72 6e 20 61 2e 79 56 7c 7c 30 3c 28 6e 75 6c 6c 21 3d 28 63 3d 6e 75 6c 6c 3d 3d 61 3f 76 6f 69 64 20 30 3a 6e 75 6c 6c 3d 3d 28 62 3d 61 2e 67 6b 29 3f 76 6f 69 64 20 30 3a 62 2e 6c 65 6e 67 74 68 29 3f 63 3a 30 29 7d 2c 4d 35 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6e 75 Data Ascii: [c]);c=a.gk.length-1;a.gk[b]=a.gk[c];a.dw[b]=a.dw[c];a.gk.length--;a.dw.length--;b<a.gk.length&&(c=a.dw[b],a=a.gk[b],M5(a),a.lr[c]=b)},qpb=function(a){var b,c;return a.yV\|\|0<(null!=(c=null==a?void 0:null==(b=a.gk)?void 0:b.length)?c:0)},M5=function(a){nu
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 70 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3b 0a 6e 75 6c 6c 3d 3d 28 62 3d 61 2e 49 45 29 7c 7c 62 2e 66 6f 72 45 61 63 68 28 7a 70 62 29 3b 61 2e 49 45 26 26 28 61 2e 49 45 3d 5b 5d 29 3b 69 66 28 61 2e 45 43 29 7b 62 3d 67 2e 75 28 61 2e 45 43 29 3b 66 6f 72 28 76 61 72 20 63 3d 62 2e 6e 65 78 74 28 29 3b 21 63 2e 64 6f 6e 65 3b 63 3d 62 2e 6e 65 78 74 28 29 29 63 3d 63 2e 76 61 6c 75 65 2c 63 28 29 3b 61 2e 45 43 3d 5b 5d 7d 7d 2c 7a 70 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 69 73 44 69 73 70 6f 73 65 64 29 7b 61 2e 69 73 44 69 73 70 6f 73 65 64 3d 21 30 3b 0a 76 61 72 20 62 3b 6e 75 6c 6c 3d 3d 28 62 3d 61 2e 42 39 29 7c 7c 62 2e 63 61 6c 6c 28 61 29 3b 42 70 62 28 61 29 7d 7d 2c 44 70 62 3d 66 75 6e 63 74 69 6f Data Ascii: pb=function(a){var b;null==(b=a.IE)\|\|b.forEach(zpb);a.IE&&(a.IE=[]);if(a.EC){b=g.u(a.EC);for(var c=b.next();!c.done;c=b.next())c=c.value,c();a.EC=[]}},zpb=function(a){if(!a.isDisposed){a.isDisposed=!0;var b;null==(b=a.B9)\|\|b.call(a);Bpb(a)}},Dpb=functio
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 29 7b 76 61 72 20 62 3b 0a 6e 75 6c 6c 3d 3d 28 62 3d 61 2e 5f 64 69 73 70 6f 73 65 52 65 66 29 7c 7c 62 2e 63 61 6c 6c 28 61 29 3b 76 61 72 20 63 3b 6e 75 6c 6c 3d 3d 28 63 3d 61 2e 70 43 29 7c 7c 63 2e 63 61 6c 6c 28 61 29 3b 69 66 28 61 2e 5f 5f 69 6e 73 74 61 6e 63 65 29 7b 62 3d 61 2e 5f 5f 69 6e 73 74 61 6e 63 65 3b 48 70 62 28 62 2c 61 29 3b 76 61 72 20 64 3b 6e 75 6c 6c 3d 3d 28 64 3d 62 2e 47 29 7c 7c 64 2e 63 61 6c 6c 28 62 29 7d 66 6f 72 28 64 3d 30 3b 64 3c 61 2e 63 68 69 6c 64 4e 6f 64 65 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 4a 70 62 28 61 2e 63 68 69 6c 64 4e 6f 64 65 73 5b 64 5d 29 7d 7d 2c 4c 70 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 31 3d 3d 3d 4b 70 62 2e 70 75 73 68 28 61 29 26 26 Data Ascii: =function(a){if(a){var b;null==(b=a._disposeRef)\|\|b.call(a);var c;null==(c=a.pC)\|\|c.call(a);if(a.__instance){b=a.__instance;Hpb(b,a);var d;null==(d=b.G)\|\|d.call(b)}for(d=0;d<a.childNodes.length;d++)Jpb(a.childNodes[d])}},Lpb=function(a){1===Kpb.push(a)&&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.17	49812	172.217.215.190	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:48 UTC	898	OUT	GET /s/player/6ee8f9ce/www-embed-player.vflset/www-embed-player.js HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/embed/?enablejsapi=1&rel=0&autoplay=0&playsinline=1&expflag=embeds_enable_muted_autoplay%3Atrue&fs=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=MmYKqDmYcs4; VISITOR_INFO1_LIVE=oCH7UytiVXo
2024-01-30 17:51:49 UTC	687	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 326162 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 30 Jan 2024 15:14:05 GMT Expires: Wed, 29 Jan 2025 15:14:05 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 29 Jan 2024 05:16:12 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 9464 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:49 UTC	565	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 76 61 72 20 6d 3b 66 75 6e 63 74 69 6f 6e 20 61 61 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 0a 76 61 72 20 62 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 Data Ascii: (function(){'use strict';var m;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 73 29 3b 66 75 6e 63 74 69 6f 6e 20 75 28 61 2c 62 29 7b 69 66 28 62 29 61 3a 7b 76 61 72 20 63 3d 64 61 3b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 2d 31 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 61 5b 64 5d 3b 69 66 28 21 28 65 20 69 6e 20 63 29 29 62 72 65 61 6b 20 61 3b 63 3d 63 5b 65 5d 7d 61 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 3b 64 3d 63 5b 61 5d 3b 62 3d 62 28 64 29 3b 62 21 3d 64 26 26 6e 75 6c 6c 21 3d 62 26 26 62 61 28 63 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 62 7d 29 7d 7d 0a 75 28 22 53 79 6d 62 6f 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 66 29 7b 69 66 28 74 68 Data Ascii: s);function u(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}u("Symbol",function(a){function b(f){if(th
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 61 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 53 74 72 69 6e 67 28 61 29 2b 22 20 69 73 20 6e 6f 74 20 61 6e 20 69 74 65 72 61 62 6c 65 20 6f 72 20 41 72 72 61 79 4c 69 6b 65 22 29 3b 7d 0a 66 75 6e 63 74 69 6f 6e 20 6b 61 28 61 29 7b 69 66 28 21 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 29 7b 61 3d 76 28 61 29 3b 66 6f 72 28 76 61 72 20 62 2c 63 3d 5b 5d 3b 21 28 62 3d 61 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 63 2e 70 75 73 68 28 62 2e 76 61 6c 75 65 29 3b 61 3d 63 7d 72 65 74 75 72 6e 20 61 7d 0a 66 75 6e 63 74 69 6f 6e 20 6c 61 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e Data Ascii: length)return{next:aa(a)};throw Error(String(a)+" is not an iterable or ArrayLike");}function ka(a){if(!(a instanceof Array)){a=v(a);for(var b,c=[];!(b=a.next()).done;)c.push(b.value);a=c}return a}function la(a,b){return Object.prototype.hasOwnProperty.
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 79 70 65 45 72 72 6f 72 28 61 2b 22 20 69 73 20 6e 6f 74 20 65 78 74 65 6e 73 69 62 6c 65 22 29 3b 72 65 74 75 72 6e 20 61 7d 3a 6e 75 6c 6c 7d 76 61 72 20 76 61 3d 72 61 3b 0a 66 75 6e 63 74 69 6f 6e 20 78 28 61 2c 62 29 7b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 70 61 28 62 2e 70 72 6f 74 6f 74 79 70 65 29 3b 61 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 61 3b 69 66 28 76 61 29 76 61 28 61 2c 62 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 63 20 69 6e 20 62 29 69 66 28 22 70 72 6f 74 6f 74 79 70 65 22 21 3d 63 29 69 66 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 29 7b 76 61 72 20 64 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 62 2c 63 29 3b 64 26 26 Data Ascii: ypeError(a+" is not extensible");return a}:null}var va=ra;function x(a,b){a.prototype=pa(b.prototype);a.prototype.constructor=a;if(va)va(a,b);else for(var c in b)if("prototype"!=c)if(Object.defineProperties){var d=Object.getOwnPropertyDescriptor(b,c);d&&
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 49 74 65 72 61 74 6f 72 20 72 65 73 75 6c 74 20 22 2b 65 2b 22 20 69 73 20 6e 6f 74 20 61 6e 20 6f 62 6a 65 63 74 22 29 3b 69 66 28 21 65 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 61 2e 68 2e 41 3d 21 31 2c 65 3b 76 61 72 20 66 3d 65 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 67 29 7b 72 65 74 75 72 6e 20 61 2e 68 2e 76 3d 6e 75 6c 6c 2c 79 61 28 61 2e 68 2c 67 29 2c 46 61 28 61 29 7d 61 2e 68 2e 76 3d 6e 75 6c 6c 3b 64 2e 63 61 6c 6c 28 61 2e 68 2c 66 29 3b 72 65 74 75 72 6e 20 46 61 28 61 29 7d 0a 66 75 6e 63 74 69 6f 6e 20 46 61 28 61 29 7b 66 6f 72 28 3b 61 2e 68 2e 68 3b 29 74 72 79 7b 76 61 72 20 62 3d 61 2e 69 28 61 2e 68 29 3b 69 66 28 62 29 72 65 74 75 72 6e 20 61 2e 68 2e 41 3d 21 31 2c Data Ascii: )throw new TypeError("Iterator result "+e+" is not an object");if(!e.done)return a.h.A=!1,e;var f=e.value}catch(g){return a.h.v=null,ya(a.h,g),Fa(a)}a.h.v=null;d.call(a.h,f);return Fa(a)}function Fa(a){for(;a.h.h;)try{var b=a.i(a.h);if(b)return a.h.A=!1,
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 21 30 7d 63 61 74 63 68 28 64 29 7b 72 65 74 75 72 6e 21 31 7d 7d 3a 6e 75 6c 6c 7d 29 3b 0a 75 28 22 50 72 6f 6d 69 73 65 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 67 29 7b 74 68 69 73 2e 68 3d 30 3b 74 68 69 73 2e 6a 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 69 3d 5b 5d 3b 74 68 69 73 2e 41 3d 21 31 3b 76 61 72 20 68 3d 74 68 69 73 2e 6c 28 29 3b 74 72 79 7b 67 28 68 2e 72 65 73 6f 6c 76 65 2c 68 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6b 29 7b 68 2e 72 65 6a 65 63 74 28 6b 29 7d 7d 0a 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 74 68 69 73 2e 68 3d 6e 75 6c 6c 7d 0a 66 75 6e 63 74 69 6f 6e 20 64 28 67 29 7b 72 65 74 75 72 6e 20 67 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 3f 67 3a 6e 65 77 20 62 28 66 75 6e 63 74 69 6f 6e 28 Data Ascii: !0}catch(d){return!1}}:null});u("Promise",function(a){function b(g){this.h=0;this.j=void 0;this.i=[];this.A=!1;var h=this.l();try{g(h.resolve,h.reject)}catch(k){h.reject(k)}}function c(){this.h=null}function d(g){return g instanceof b?g:new b(function(
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 6e 63 74 69 6f 6e 28 67 29 7b 74 68 69 73 2e 44 28 31 2c 67 29 7d 3b 0a 62 2e 70 72 6f 74 6f 74 79 70 65 2e 44 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 69 66 28 30 21 3d 74 68 69 73 2e 68 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 73 65 74 74 6c 65 28 22 2b 67 2b 22 2c 20 22 2b 68 2b 22 29 3a 20 50 72 6f 6d 69 73 65 20 61 6c 72 65 61 64 79 20 73 65 74 74 6c 65 64 20 69 6e 20 73 74 61 74 65 22 2b 74 68 69 73 2e 68 29 3b 74 68 69 73 2e 68 3d 67 3b 74 68 69 73 2e 6a 3d 68 3b 32 3d 3d 3d 74 68 69 73 2e 68 26 26 74 68 69 73 2e 65 61 28 29 3b 74 68 69 73 2e 50 28 29 7d 3b 0a 62 2e 70 72 6f 74 6f 74 79 70 65 2e 65 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 67 3d 74 68 69 73 3b 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 67 2e Data Ascii: nction(g){this.D(1,g)};b.prototype.D=function(g,h){if(0!=this.h)throw Error("Cannot settle("+g+", "+h+"): Promise already settled in state"+this.h);this.h=g;this.j=h;2===this.h&&this.ea();this.P()};b.prototype.ea=function(){var g=this;e(function(){if(g.
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 20 30 2c 67 29 7d 3b 0a 62 2e 70 72 6f 74 6f 74 79 70 65 2e 55 62 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 66 75 6e 63 74 69 6f 6e 20 6b 28 29 7b 73 77 69 74 63 68 28 6c 2e 68 29 7b 63 61 73 65 20 31 3a 67 28 6c 2e 6a 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 68 28 6c 2e 6a 29 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 74 68 72 6f 77 20 45 72 72 6f 72 28 22 55 6e 65 78 70 65 63 74 65 64 20 73 74 61 74 65 3a 20 22 2b 6c 2e 68 29 3b 7d 7d 0a 76 61 72 20 6c 3d 74 68 69 73 3b 6e 75 6c 6c 3d 3d 74 68 69 73 2e 69 3f 66 2e 69 28 6b 29 3a 74 68 69 73 2e 69 2e 70 75 73 68 28 6b 29 3b 74 68 69 73 2e 41 3d 21 30 7d 3b 0a 62 2e 72 65 73 6f 6c 76 65 3d 64 3b 62 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 62 28 Data Ascii: 0,g)};b.prototype.Ub=function(g,h){function k(){switch(l.h){case 1:g(l.j);break;case 2:h(l.j);break;default:throw Error("Unexpected state: "+l.h);}}var l=this;null==this.i?f.i(k):this.i.push(k);this.A=!0};b.resolve=d;b.reject=function(g){return new b(
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 34 3d 3d 6e 2e 67 65 74 28 6c 29 7d 63 61 74 63 68 28 70 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 0a 76 61 72 20 67 3d 22 24 6a 73 63 6f 6d 70 5f 68 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 66 28 22 66 72 65 65 7a 65 22 29 3b 66 28 22 70 72 65 76 65 6e 74 45 78 74 65 6e 73 69 6f 6e 73 22 29 3b 66 28 22 73 65 61 6c 22 29 3b 76 61 72 20 68 3d 30 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 69 66 28 21 64 28 6b 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 49 6e 76 61 6c 69 64 20 57 65 61 6b 4d 61 70 20 6b 65 79 22 29 3b 65 28 6b 29 3b 69 66 28 21 6c 61 28 6b 2c 67 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 57 65 61 6b 4d 61 70 20 6b 65 79 20 66 61 69 6c Data Ascii: 4==n.get(l)}catch(p){return!1}}())return a;var g="$jscomp_hidden_"+Math.random();f("freeze");f("preventExtensions");f("seal");var h=0;b.prototype.set=function(k,l){if(!d(k))throw Error("Invalid WeakMap key");e(k);if(!la(k,g))throw Error("WeakMap key fail
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 20 61 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 68 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 6b 3d 6e 65 77 20 61 28 76 28 5b 5b 68 2c 22 73 22 5d 5d 29 29 3b 69 66 28 22 73 22 21 3d 6b 2e 67 65 74 28 68 29 7c 7c 31 21 3d 6b 2e 73 69 7a 65 7c 7c 6b 2e 67 65 74 28 7b 78 3a 34 7d 29 7c 7c 6b 2e 73 65 74 28 7b 78 3a 34 7d 2c 22 74 22 29 21 3d 6b 7c 7c 32 21 3d 6b 2e 73 69 7a 65 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 6c 3d 6b 2e 65 6e 74 72 69 65 73 28 29 2c 6e 3d 6c 2e 6e 65 78 74 28 29 3b 69 66 28 6e 2e 64 6f 6e 65 7c 7c 6e 2e 76 61 6c 75 65 5b 30 5d 21 3d 68 7c 7c Data Ascii: a\|\|!a.prototype.entries\|\|"function"!=typeof Object.seal)return!1;try{var h=Object.seal({x:4}),k=new a(v([[h,"s"]]));if("s"!=k.get(h)\|\|1!=k.size\|\|k.get({x:4})\|\|k.set({x:4},"t")!=k\|\|2!=k.size)return!1;var l=k.entries(),n=l.next();if(n.done\|\|n.value[0]!=h\|\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.17	49813	172.217.215.190	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:49 UTC	886	OUT	GET /s/player/6ee8f9ce/player_ias.vflset/en_US/base.js HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/embed/?enablejsapi=1&rel=0&autoplay=0&playsinline=1&expflag=embeds_enable_muted_autoplay%3Atrue&fs=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=MmYKqDmYcs4; VISITOR_INFO1_LIVE=oCH7UytiVXo
2024-01-30 17:51:49 UTC	689	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 2484713 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 30 Jan 2024 15:04:05 GMT Expires: Wed, 29 Jan 2025 15:04:05 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 29 Jan 2024 05:16:12 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 10064 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:49 UTC	563	IN	Data Raw: 76 61 72 20 5f 79 74 5f 70 6c 61 79 65 72 3d 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 67 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 2f 2a 0a 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 2f 2a 0a 0a 20 28 54 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 32 30 31 34 20 62 79 20 56 69 74 61 6c 79 20 50 75 7a 72 69 6e 0a 0a 20 50 65 72 6d 69 73 73 69 6f 6e 20 69 73 20 68 65 72 Data Ascii: var _yt_player={};(function(g){var window=this;/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0// SPDX-License-Identifier: Apache-2.0// (The MIT License) Copyright (C) 2014 by Vitaly Puzrin Permission is her
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 6f 66 74 77 61 72 65 2c 20 61 6e 64 20 74 6f 20 70 65 72 6d 69 74 20 70 65 72 73 6f 6e 73 20 74 6f 20 77 68 6f 6d 20 74 68 65 20 53 6f 66 74 77 61 72 65 20 69 73 0a 20 66 75 72 6e 69 73 68 65 64 20 74 6f 20 64 6f 20 73 6f 2c 20 73 75 62 6a 65 63 74 20 74 6f 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 63 6f 6e 64 69 74 69 6f 6e 73 3a 0a 0a 20 54 68 65 20 61 62 6f 76 65 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 6e 64 20 74 68 69 73 20 70 65 72 6d 69 73 73 69 6f 6e 20 6e 6f 74 69 63 65 20 73 68 61 6c 6c 20 62 65 20 69 6e 63 6c 75 64 65 64 20 69 6e 0a 20 61 6c 6c 20 63 6f 70 69 65 73 20 6f 72 20 73 75 62 73 74 61 6e 74 69 61 6c 20 70 6f 72 74 69 6f 6e 73 20 6f 66 20 74 68 65 20 53 6f 66 74 77 61 72 65 2e 0a 0a 20 54 48 45 20 53 4f 46 54 57 41 Data Ascii: oftware, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWA
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 20 50 65 72 6d 69 73 73 69 6f 6e 20 69 73 20 67 72 61 6e 74 65 64 20 74 6f 20 61 6e 79 6f 6e 65 20 74 6f 20 75 73 65 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 66 6f 72 20 61 6e 79 20 70 75 72 70 6f 73 65 2c 0a 20 20 20 69 6e 63 6c 75 64 69 6e 67 20 63 6f 6d 6d 65 72 63 69 61 6c 20 61 70 70 6c 69 63 61 74 69 6f 6e 73 2c 20 61 6e 64 20 74 6f 20 61 6c 74 65 72 20 69 74 20 61 6e 64 20 72 65 64 69 73 74 72 69 62 75 74 65 20 69 74 0a 20 20 20 66 72 65 65 6c 79 2c 20 73 75 62 6a 65 63 74 20 74 6f 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 72 65 73 74 72 69 63 74 69 6f 6e 73 3a 0a 20 20 20 31 2e 20 54 68 65 20 6f 72 69 67 69 6e 20 6f 66 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 6d 69 73 72 65 70 72 65 73 65 6e 74 65 64 Data Ascii: Permission is granted to anyone to use this software for any purpose, including commercial applications, and to alter it and redistribute it freely, subject to the following restrictions: 1. The origin of this software must not be misrepresented
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 63 6c 75 64 69 6e 67 20 77 69 74 68 6f 75 74 20 6c 69 6d 69 74 61 74 69 6f 6e 20 74 68 65 20 72 69 67 68 74 73 0a 20 74 6f 20 75 73 65 2c 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 6d 65 72 67 65 2c 20 70 75 62 6c 69 73 68 2c 20 64 69 73 74 72 69 62 75 74 65 2c 20 73 75 62 6c 69 63 65 6e 73 65 2c 20 61 6e 64 2f 6f 72 20 73 65 6c 6c 0a 20 63 6f 70 69 65 73 20 6f 66 20 74 68 65 20 53 6f 66 74 77 61 72 65 2c 20 61 6e 64 20 74 6f 20 70 65 72 6d 69 74 20 70 65 72 73 6f 6e 73 20 74 6f 20 77 68 6f 6d 20 74 68 65 20 53 6f 66 74 77 61 72 65 20 69 73 0a 20 66 75 72 6e 69 73 68 65 64 20 74 6f 20 64 6f 20 73 6f 2c 20 73 75 62 6a 65 63 74 20 74 6f 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 63 6f 6e 64 69 74 69 6f 6e 73 3a 0a 0a 20 54 68 65 20 61 62 6f 76 65 20 63 Data Ascii: cluding without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above c
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 75 62 61 2c 77 62 61 2c 6e 65 2c 44 62 61 2c 42 62 61 2c 43 62 61 2c 46 62 61 2c 47 62 61 2c 77 65 2c 49 62 61 2c 4a 62 61 2c 4d 62 61 2c 4e 62 61 2c 7a 65 2c 43 65 2c 4c 65 2c 4f 65 2c 50 65 2c 4f 62 61 2c 50 62 61 2c 51 62 61 2c 52 62 61 2c 58 65 2c 59 65 2c 65 66 2c 55 62 61 2c 0a 57 62 61 2c 56 62 61 2c 6e 66 2c 73 66 2c 58 62 61 2c 6f 66 2c 78 66 2c 53 65 2c 46 66 2c 5a 62 61 2c 4c 66 2c 4b 66 2c 52 65 2c 4e 66 2c 24 62 61 2c 4f 66 2c 50 66 2c 51 66 2c 61 63 61 2c 63 63 61 2c 65 63 61 2c 5a 66 2c 24 66 2c 61 67 2c 69 63 61 2c 6b 63 61 2c 63 67 2c 6c 63 61 2c 62 67 2c 70 63 61 2c 58 66 2c 67 63 61 2c 72 63 61 2c 6f 63 61 2c 6d 63 61 2c 6e 63 61 2c 73 63 61 2c 71 63 61 2c 64 67 2c 6a 63 61 2c 67 67 2c 75 63 61 2c 76 63 61 2c 77 63 61 2c 78 63 61 2c 79 Data Ascii: uba,wba,ne,Dba,Bba,Cba,Fba,Gba,we,Iba,Jba,Mba,Nba,ze,Ce,Le,Oe,Pe,Oba,Pba,Qba,Rba,Xe,Ye,ef,Uba,Wba,Vba,nf,sf,Xba,of,xf,Se,Ff,Zba,Lf,Kf,Re,Nf,$ba,Of,Pf,Qf,aca,cca,eca,Zf,$f,ag,ica,kca,cg,lca,bg,pca,Xf,gca,rca,oca,mca,nca,sca,qca,dg,jca,gg,uca,vca,wca,xca,y
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 78 66 61 2c 7a 66 61 2c 65 6e 2c 41 66 61 2c 4d 6e 2c 51 6e 2c 52 6e 2c 53 6e 2c 54 6e 2c 44 66 61 2c 55 6e 2c 56 6e 2c 57 6e 2c 45 66 61 2c 46 66 61 2c 47 66 61 2c 58 6e 2c 49 66 61 2c 59 6e 2c 4a 66 61 2c 4b 66 61 2c 4e 66 61 2c 4d 66 61 2c 4c 66 61 2c 4f 66 61 2c 50 66 61 2c 51 66 61 2c 52 66 61 2c 53 66 61 2c 56 66 61 2c 54 66 61 2c 24 6e 2c 62 6f 2c 63 6f 2c 65 6f 2c 61 6f 2c 57 66 61 2c 58 66 61 2c 66 6f 2c 68 6f 2c 59 66 61 2c 69 6f 2c 6a 6f 2c 6b 6f 2c 24 66 61 2c 6d 6f 2c 63 67 61 2c 64 67 61 2c 65 67 61 2c 66 67 61 2c 70 6f 2c 72 6f 2c 67 67 61 2c 68 67 61 2c 69 67 61 2c 74 6f 2c 6a 67 61 2c 6c 67 61 2c 6b 67 61 2c 6d 67 61 2c 6e 67 61 2c 71 67 61 2c 75 6f 2c 76 6f 2c 77 6f 2c 78 6f 2c 79 6f 2c 7a 6f 2c 41 6f 2c 42 6f 2c 72 67 61 2c 43 6f 2c 44 Data Ascii: xfa,zfa,en,Afa,Mn,Qn,Rn,Sn,Tn,Dfa,Un,Vn,Wn,Efa,Ffa,Gfa,Xn,Ifa,Yn,Jfa,Kfa,Nfa,Mfa,Lfa,Ofa,Pfa,Qfa,Rfa,Sfa,Vfa,Tfa,$n,bo,co,eo,ao,Wfa,Xfa,fo,ho,Yfa,io,jo,ko,$fa,mo,cga,dga,ega,fga,po,ro,gga,hga,iga,to,jga,lga,kga,mga,nga,qga,uo,vo,wo,xo,yo,zo,Ao,Bo,rga,Co,D
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 2c 52 74 2c 7a 6a 61 2c 41 6a 61 2c 42 6a 61 2c 44 6a 61 2c 43 6a 61 2c 45 6a 61 2c 53 74 2c 46 6a 61 2c 47 6a 61 2c 55 74 2c 48 6a 61 2c 49 6a 61 2c 4a 6a 61 2c 4b 6a 61 2c 56 74 2c 4c 6a 61 2c 57 74 2c 4d 6a 61 2c 58 74 2c 59 74 2c 4f 6a 61 2c 5a 74 2c 50 6a 61 2c 24 74 2c 61 75 2c 51 6a 61 2c 52 6a 61 2c 0a 62 75 2c 64 75 2c 54 6a 61 2c 65 75 2c 53 6a 61 2c 55 6a 61 2c 56 6a 61 2c 57 6a 61 2c 59 6a 61 2c 66 75 2c 5a 6a 61 2c 69 75 2c 6a 75 2c 61 6b 61 2c 62 6b 61 2c 65 6b 61 2c 66 6b 61 2c 6b 75 2c 6c 75 2c 6d 75 2c 6e 75 2c 6f 75 2c 70 75 2c 71 75 2c 72 75 2c 74 75 2c 75 75 2c 76 75 2c 77 75 2c 78 75 2c 6a 6b 61 2c 69 6b 61 2c 6b 6b 61 2c 6d 6b 61 2c 6c 6b 61 2c 6f 6b 61 2c 68 6b 61 2c 6e 6b 61 2c 67 6b 61 2c 79 75 2c 7a 75 2c 71 6b 61 2c 72 6b 61 2c Data Ascii: ,Rt,zja,Aja,Bja,Dja,Cja,Eja,St,Fja,Gja,Ut,Hja,Ija,Jja,Kja,Vt,Lja,Wt,Mja,Xt,Yt,Oja,Zt,Pja,$t,au,Qja,Rja,bu,du,Tja,eu,Sja,Uja,Vja,Wja,Yja,fu,Zja,iu,ju,aka,bka,eka,fka,ku,lu,mu,nu,ou,pu,qu,ru,tu,uu,vu,wu,xu,jka,ika,kka,mka,lka,oka,hka,nka,gka,yu,zu,qka,rka,
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 2c 6d 41 2c 70 41 2c 71 41 2c 72 41 2c 6e 6d 61 2c 73 41 2c 74 41 2c 75 41 2c 6f 6d 61 2c 76 41 2c 77 41 2c 78 41 2c 79 41 2c 70 6d 61 2c 7a 41 2c 41 41 2c 42 41 2c 43 41 2c 44 41 2c 71 6d 61 2c 45 41 2c 72 6d 61 2c 46 41 2c 73 6d 61 2c 47 41 2c 48 41 2c 74 6d 61 2c 49 41 2c 4a 41 2c 4b 41 2c 75 6d 61 2c 76 6d 61 2c 77 6d 61 2c 78 6d 61 2c 4c 41 2c 4d 41 2c 79 6d 61 2c 4e 41 2c 7a 6d 61 2c 41 6d 61 2c 42 6d 61 2c 43 6d 61 2c 44 6d 61 2c 4f 41 2c 50 41 2c 45 6d 61 2c 46 6d 61 2c 51 41 2c 52 41 2c 47 6d 61 2c 53 41 2c 48 6d 61 2c 49 6d 61 2c 54 41 2c 4a 6d 61 2c 4b 6d 61 2c 4c 6d 61 2c 4d 6d 61 2c 55 41 2c 56 41 2c 57 41 2c 58 41 2c 4e 6d 61 2c 4f 6d 61 2c 59 41 2c 50 6d 61 2c 51 6d 61 2c 52 6d 61 2c 53 6d 61 2c 5a 41 2c 54 6d 61 2c 55 6d 61 2c 56 6d 61 2c Data Ascii: ,mA,pA,qA,rA,nma,sA,tA,uA,oma,vA,wA,xA,yA,pma,zA,AA,BA,CA,DA,qma,EA,rma,FA,sma,GA,HA,tma,IA,JA,KA,uma,vma,wma,xma,LA,MA,yma,NA,zma,Ama,Bma,Cma,Dma,OA,PA,Ema,Fma,QA,RA,Gma,SA,Hma,Ima,TA,Jma,Kma,Lma,Mma,UA,VA,WA,XA,Nma,Oma,YA,Pma,Qma,Rma,Sma,ZA,Tma,Uma,Vma,
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 71 61 2c 56 71 61 2c 57 71 61 2c 58 71 61 2c 59 71 61 2c 5a 71 61 2c 24 71 61 2c 61 72 61 2c 6b 45 2c 62 72 61 2c 6d 45 2c 64 72 61 2c 65 72 61 2c 66 72 61 2c 67 72 61 2c 68 72 61 2c 69 72 61 2c 72 45 2c 6c 72 61 2c 6f 72 61 2c 73 45 2c 70 72 61 2c 72 72 61 2c 6b 72 61 2c 73 72 61 2c 74 72 61 2c 75 72 61 2c 6d 72 61 2c 6e 72 61 2c 6e 45 2c 6a 72 61 2c 0a 71 45 2c 71 72 61 2c 70 45 2c 6f 45 2c 76 72 61 2c 77 72 61 2c 78 72 61 2c 79 72 61 2c 7a 72 61 2c 41 72 61 2c 47 72 61 2c 42 72 61 2c 76 45 2c 77 45 2c 78 45 2c 4a 72 61 2c 4c 72 61 2c 4b 72 61 2c 48 72 61 2c 4d 72 61 2c 4f 72 61 2c 41 45 2c 51 72 61 2c 54 72 61 2c 44 45 2c 53 72 61 2c 63 73 61 2c 55 72 61 2c 62 73 61 2c 48 45 2c 64 73 61 2c 67 73 61 2c 49 45 2c 47 45 2c 65 73 61 2c 66 73 61 2c 68 73 61 Data Ascii: qa,Vqa,Wqa,Xqa,Yqa,Zqa,$qa,ara,kE,bra,mE,dra,era,fra,gra,hra,ira,rE,lra,ora,sE,pra,rra,kra,sra,tra,ura,mra,nra,nE,jra,qE,qra,pE,oE,vra,wra,xra,yra,zra,Ara,Gra,Bra,vE,wE,xE,Jra,Lra,Kra,Hra,Mra,Ora,AE,Qra,Tra,DE,Sra,csa,Ura,bsa,HE,dsa,gsa,IE,GE,esa,fsa,hsa
2024-01-30 17:51:49 UTC	1252	IN	Data Raw: 78 61 2c 64 78 61 2c 66 78 61 2c 68 78 61 2c 6a 78 61 2c 47 48 2c 6b 78 61 2c 48 48 2c 6c 78 61 2c 6f 78 61 2c 70 78 61 2c 4a 48 2c 72 78 61 2c 73 78 61 2c 4c 48 2c 4d 48 2c 4e 48 2c 75 78 61 2c 4f 48 2c 50 48 2c 51 48 2c 76 78 61 2c 52 48 2c 74 78 61 2c 77 78 61 2c 53 48 2c 79 78 61 2c 78 78 61 2c 54 48 2c 41 78 61 2c 55 48 2c 56 48 2c 58 48 2c 42 78 61 2c 43 78 61 2c 5a 48 2c 24 48 2c 62 49 2c 6e 49 2c 6d 49 2c 45 78 61 2c 61 49 2c 48 78 61 2c 49 78 61 2c 4c 78 61 2c 4d 78 61 2c 4e 78 61 2c 50 78 61 2c 4b 78 61 2c 51 78 61 2c 52 78 61 2c 53 78 61 2c 6f 49 2c 47 78 61 2c 4a 78 61 2c 70 49 2c 57 78 61 2c 59 78 61 2c 73 49 2c 5a 78 61 2c 74 49 2c 24 78 61 2c 71 49 2c 61 79 61 2c 75 49 2c 62 79 61 2c 58 78 61 2c 76 49 2c 64 79 61 2c 77 49 2c 69 79 61 2c 67 Data Ascii: xa,dxa,fxa,hxa,jxa,GH,kxa,HH,lxa,oxa,pxa,JH,rxa,sxa,LH,MH,NH,uxa,OH,PH,QH,vxa,RH,txa,wxa,SH,yxa,xxa,TH,Axa,UH,VH,XH,Bxa,Cxa,ZH,$H,bI,nI,mI,Exa,aI,Hxa,Ixa,Lxa,Mxa,Nxa,Pxa,Kxa,Qxa,Rxa,Sxa,oI,Gxa,Jxa,pI,Wxa,Yxa,sI,Zxa,tI,$xa,qI,aya,uI,bya,Xxa,vI,dya,wI,iya,g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.17	49820	172.217.215.190	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:50 UTC	888	OUT	GET /s/player/6ee8f9ce/player_ias.vflset/en_US/remote.js HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/embed/?enablejsapi=1&rel=0&autoplay=0&playsinline=1&expflag=embeds_enable_muted_autoplay%3Atrue&fs=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=MmYKqDmYcs4; VISITOR_INFO1_LIVE=oCH7UytiVXo
2024-01-30 17:51:50 UTC	687	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube" Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} Content-Length: 119837 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 30 Jan 2024 16:29:23 GMT Expires: Wed, 29 Jan 2025 16:29:23 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 29 Jan 2024 05:16:12 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 4947 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:50 UTC	565	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 67 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 27 75 73 65 20 73 74 72 69 63 74 27 3b 76 61 72 20 61 38 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 67 2e 48 70 28 61 2c 22 7a 78 22 2c 4d 61 74 68 2e 66 6c 6f 6f 72 28 32 31 34 37 34 38 33 36 34 38 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 29 2e 74 6f 53 74 72 69 6e 67 28 33 36 29 2b 4d 61 74 68 2e 61 62 73 28 4d 61 74 68 2e 66 6c 6f 6f 72 28 32 31 34 37 34 38 33 36 34 38 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 29 5e 67 2e 6f 62 28 29 29 2e 74 6f 53 74 72 69 6e 67 28 33 36 29 29 3b 72 65 74 75 72 6e 20 61 7d 2c 62 38 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 63 29 7c 7c 28 63 3d 5b 53 74 72 69 6e 67 28 63 29 5d 29 3b 0a Data Ascii: (function(g){var window=this;'use strict';var a8=function(a){g.Hp(a,"zx",Math.floor(2147483648Math.random()).toString(36)+Math.abs(Math.floor(2147483648Math.random())^g.ob()).toString(36));return a},b8=function(a,b,c){Array.isArray(c)\|\|(c=[String(c)]);
2024-01-30 17:51:50 UTC	1252	IN	Data Raw: 29 3b 0a 65 6c 73 65 20 66 6f 72 28 61 3d 72 79 62 28 61 29 3b 3b 29 7b 76 61 72 20 64 3d 61 2e 6e 65 78 74 28 29 3b 69 66 28 64 2e 64 6f 6e 65 29 62 72 65 61 6b 3b 62 2e 63 61 6c 6c 28 63 2c 64 2e 76 61 6c 75 65 2c 76 6f 69 64 20 30 2c 61 29 7d 7d 2c 74 79 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 5b 5d 3b 0a 73 79 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 64 29 7b 74 72 79 7b 76 61 72 20 65 3d 67 2e 4d 76 2e 70 72 6f 74 6f 74 79 70 65 2e 42 2e 63 61 6c 6c 28 74 68 69 73 2c 64 2c 21 30 29 7d 63 61 74 63 68 28 66 29 7b 69 66 28 22 53 74 6f 72 61 67 65 3a 20 49 6e 76 61 6c 69 64 20 76 61 6c 75 65 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 22 3d 3d 66 29 72 65 74 75 72 6e 3b 74 68 72 6f 77 20 66 3b 7d 76 6f 69 64 20 30 3d 3d 3d 65 Data Ascii: );else for(a=ryb(a);;){var d=a.next();if(d.done)break;b.call(c,d.value,void 0,a)}},tyb=function(a,b){var c=[];syb(b,function(d){try{var e=g.Mv.prototype.B.call(this,d,!0)}catch(f){if("Storage: Invalid value was encountered"==f)return;throw f;}void 0===e
2024-01-30 17:51:50 UTC	1252	IN	Data Raw: 72 65 74 75 72 6e 20 7a 79 62 28 61 29 7d 2c 41 79 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 2e 58 6c 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 61 2e 58 6c 29 72 65 74 75 72 6e 20 61 2e 58 6c 28 29 3b 0a 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 4d 61 70 26 26 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 4d 61 70 7c 7c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 53 65 74 26 26 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 65 74 29 72 65 74 75 72 6e 20 41 72 72 61 79 2e 66 72 6f 6d 28 61 2e 76 61 6c 75 65 73 28 29 29 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 3d 74 79 70 65 6f 66 20 61 29 72 65 74 75 72 6e 20 61 2e 73 70 6c 69 74 28 22 22 29 3b 69 66 28 67 2e 62 62 28 61 29 29 7b 66 6f Data Ascii: return zyb(a)},Ayb=function(a){if(a.Xl&&"function"==typeof a.Xl)return a.Xl();if("undefined"!==typeof Map&&a instanceof Map\|\|"undefined"!==typeof Set&&a instanceof Set)return Array.from(a.values());if("string"===typeof a)return a.split("");if(g.bb(a)){fo
2024-01-30 17:51:50 UTC	1252	IN	Data Raw: 43 6b 28 22 2f 63 6c 69 65 6e 74 5f 73 74 72 65 61 6d 7a 2f 79 6f 75 74 75 62 65 2f 6c 69 76 69 6e 67 5f 72 6f 6f 6d 2f 6d 64 78 2f 63 68 61 6e 6e 65 6c 2f 63 6c 6f 73 65 64 22 2c 7b 58 65 3a 33 2c 57 65 3a 22 63 68 61 6e 6e 65 6c 5f 74 79 70 65 22 7d 29 7d 2c 48 79 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 2e 6a 2e 4d 6d 28 22 2f 63 6c 69 65 6e 74 5f 73 74 72 65 61 6d 7a 2f 79 6f 75 74 75 62 65 2f 6c 69 76 69 6e 67 5f 72 6f 6f 6d 2f 6d 64 78 2f 63 68 61 6e 6e 65 6c 2f 63 6c 6f 73 65 64 22 2c 62 29 7d 2c 49 79 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6a 3d 64 38 28 29 3b 0a 74 68 69 73 2e 6a 2e 43 6b 28 22 2f 63 6c 69 65 6e 74 5f 73 74 72 65 61 6d 7a 2f 79 6f 75 74 75 62 65 2f 6c 69 76 69 6e 67 5f 72 6f 6f 6d 2f 6d 64 78 2f 63 68 61 Data Ascii: Ck("/client_streamz/youtube/living_room/mdx/channel/closed",{Xe:3,We:"channel_type"})},Hyb=function(a,b){a.j.Mm("/client_streamz/youtube/living_room/mdx/channel/closed",b)},Iyb=function(){this.j=d8();this.j.Ck("/client_streamz/youtube/living_room/mdx/cha
2024-01-30 17:51:50 UTC	1252	IN	Data Raw: 69 64 7c 7c 61 2e 6e 61 6d 65 2c 74 68 69 73 2e 6e 61 6d 65 3d 61 2e 6e 61 6d 65 2c 74 68 69 73 2e 63 6c 69 65 6e 74 4e 61 6d 65 3d 61 2e 63 6c 69 65 6e 74 4e 61 6d 65 3f 61 2e 63 6c 69 65 6e 74 4e 61 6d 65 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 3a 22 55 4e 4b 4e 4f 57 4e 5f 49 4e 54 45 52 46 41 43 45 22 2c 74 68 69 73 2e 61 70 70 3d 61 2e 61 70 70 2c 74 68 69 73 2e 74 79 70 65 3d 0a 61 2e 74 79 70 65 7c 7c 22 52 45 4d 4f 54 45 5f 43 4f 4e 54 52 4f 4c 22 2c 74 68 69 73 2e 75 73 65 72 6e 61 6d 65 3d 61 2e 75 73 65 72 7c 7c 22 22 2c 74 68 69 73 2e 61 76 61 74 61 72 3d 61 2e 75 73 65 72 41 76 61 74 61 72 55 72 69 7c 7c 22 22 2c 74 68 69 73 2e 6f 62 66 75 73 63 61 74 65 64 47 61 69 61 49 64 3d 61 2e 6f 62 66 75 73 63 61 74 65 64 47 61 69 61 49 64 7c 7c 22 Data Ascii: id\|\|a.name,this.name=a.name,this.clientName=a.clientName?a.clientName.toUpperCase():"UNKNOWN_INTERFACE",this.app=a.app,this.type=a.type\|\|"REMOTE_CONTROL",this.username=a.user\|\|"",this.avatar=a.userAvatarUri\|\|"",this.obfuscatedGaiaId=a.obfuscatedGaiaId\|\|"
2024-01-30 17:51:50 UTC	1252	IN	Data Raw: 28 63 29 7b 61 2e 65 78 70 65 72 69 6d 65 6e 74 73 2e 61 64 64 28 63 29 7d 29 7d 2c 65 38 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 61 7c 7c 7b 7d 3b 0a 74 68 69 73 2e 6e 61 6d 65 3d 61 2e 6e 61 6d 65 7c 7c 22 22 3b 74 68 69 73 2e 69 64 3d 61 2e 69 64 7c 7c 61 2e 73 63 72 65 65 6e 49 64 7c 7c 22 22 3b 74 68 69 73 2e 74 6f 6b 65 6e 3d 61 2e 74 6f 6b 65 6e 7c 7c 61 2e 6c 6f 75 6e 67 65 54 6f 6b 65 6e 7c 7c 22 22 3b 74 68 69 73 2e 75 75 69 64 3d 61 2e 75 75 69 64 7c 7c 61 2e 64 69 61 6c 49 64 7c 7c 22 22 3b 74 68 69 73 2e 69 64 54 79 70 65 3d 61 2e 73 63 72 65 65 6e 49 64 54 79 70 65 7c 7c 22 6e 6f 72 6d 61 6c 22 7d 2c 66 38 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 21 21 62 26 26 28 61 2e 69 64 3d 3d 62 7c 7c 61 2e 75 75 69 64 3d 3d Data Ascii: (c){a.experiments.add(c)})},e8=function(a){a=a\|\|{};this.name=a.name\|\|"";this.id=a.id\|\|a.screenId\|\|"";this.token=a.token\|\|a.loungeToken\|\|"";this.uuid=a.uuid\|\|a.dialId\|\|"";this.idType=a.screenIdType\|\|"normal"},f8=function(a,b){return!!b&&(a.id==b\|\|a.uuid==
2024-01-30 17:51:50 UTC	1252	IN	Data Raw: 28 30 3d 3d 61 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 5b 5d 3b 0a 76 61 72 20 62 3d 61 5b 30 5d 2e 69 6e 64 65 78 4f 66 28 22 23 22 29 2c 63 3d 2d 31 3d 3d 62 3f 61 5b 30 5d 3a 61 5b 30 5d 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 62 29 3b 72 65 74 75 72 6e 20 67 2e 4c 72 28 61 2c 66 75 6e 63 74 69 6f 6e 28 64 2c 65 29 7b 72 65 74 75 72 6e 20 30 3d 3d 65 3f 64 3a 64 2e 73 75 62 73 74 72 69 6e 67 28 63 2e 6c 65 6e 67 74 68 29 7d 29 7d 2c 63 7a 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 67 2e 6a 44 28 22 79 74 2d 72 65 6d 6f 74 65 2d 63 6f 6e 6e 65 63 74 65 64 2d 64 65 76 69 63 65 73 22 2c 61 2c 38 36 34 30 30 29 7d 2c 6a 38 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 64 7a 62 29 72 65 74 75 72 6e 20 64 7a 62 3b 0a 76 61 72 20 61 3d 67 2e 6b 44 28 22 79 74 Data Ascii: (0==a.length)return[];var b=a[0].indexOf("#"),c=-1==b?a[0]:a[0].substring(0,b);return g.Lr(a,function(d,e){return 0==e?d:d.substring(c.length)})},czb=function(a){g.jD("yt-remote-connected-devices",a,86400)},j8=function(){if(dzb)return dzb;var a=g.kD("yt
2024-01-30 17:51:50 UTC	1252	IN	Data Raw: 74 69 6f 6e 28 61 2c 62 29 7b 67 2e 58 45 5b 61 5d 3d 21 30 3b 0a 76 61 72 20 63 3d 67 2e 56 45 28 29 3b 63 26 26 63 2e 70 75 62 6c 69 73 68 2e 61 70 70 6c 79 28 63 2c 61 72 67 75 6d 65 6e 74 73 29 3b 67 2e 58 45 5b 61 5d 3d 21 31 7d 2c 6c 7a 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 64 38 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 6e 38 29 7b 6e 38 3d 6e 65 77 20 67 2e 71 67 28 6e 65 77 20 6c 7a 62 29 3b 0a 76 61 72 20 61 3d 67 2e 59 42 28 22 63 6c 69 65 6e 74 5f 73 74 72 65 61 6d 7a 5f 77 65 62 5f 66 6c 75 73 68 5f 63 6f 75 6e 74 22 2c 2d 31 29 3b 2d 31 21 3d 3d 61 26 26 28 6e 38 2e 44 3d 61 29 7d 72 65 74 75 72 6e 20 6e 38 7d 2c 6d 7a 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 77 69 6e 64 6f 77 2e 6e 61 76 69 67 61 74 6f 72 2e 75 Data Ascii: tion(a,b){g.XE[a]=!0;var c=g.VE();c&&c.publish.apply(c,arguments);g.XE[a]=!1},lzb=function(){},d8=function(){if(!n8){n8=new g.qg(new lzb);var a=g.YB("client_streamz_web_flush_count",-1);-1!==a&&(n8.D=a)}return n8},mzb=function(){var a=window.navigator.u
2024-01-30 17:51:50 UTC	1252	IN	Data Raw: 65 6e 64 65 72 2f 31 2e 30 2f 63 61 73 74 5f 66 72 61 6d 65 77 6f 72 6b 2e 6a 73 22 2c 71 7a 62 2c 63 29 7d 7d 2c 76 7a 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 75 7a 62 28 29 3b 0a 76 61 72 20 61 3d 73 7a 62 28 29 3b 61 2e 70 75 73 68 28 22 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 65 75 72 65 6b 61 2f 63 6c 61 6e 6b 2f 63 61 73 74 5f 73 65 6e 64 65 72 2e 6a 73 22 29 3b 6f 38 28 61 29 7d 2c 78 7a 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 75 7a 62 28 29 3b 0a 76 61 72 20 61 3d 73 7a 62 28 29 3b 61 2e 70 75 73 68 2e 61 70 70 6c 79 28 61 2c 67 2e 6f 61 28 77 7a 62 2e 6d 61 70 28 72 7a 62 29 29 29 3b 61 2e 70 75 73 68 28 22 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 65 75 72 65 6b 61 2f 63 6c 61 6e 6b 2f 63 61 73 74 5f 73 65 6e 64 65 72 2e Data Ascii: ender/1.0/cast_framework.js",qzb,c)}},vzb=function(){uzb();var a=szb();a.push("//www.gstatic.com/eureka/clank/cast_sender.js");o8(a)},xzb=function(){uzb();var a=szb();a.push.apply(a,g.oa(wzb.map(rzb)));a.push("//www.gstatic.com/eureka/clank/cast_sender.
2024-01-30 17:51:50 UTC	1252	IN	Data Raw: 7d 2c 77 38 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 74 68 69 73 2e 47 3d 61 3b 0a 74 68 69 73 2e 44 3d 62 3b 74 68 69 73 2e 4a 63 3d 63 3b 74 68 69 73 2e 61 63 3d 64 7c 7c 31 3b 74 68 69 73 2e 62 62 3d 6e 65 77 20 67 2e 4d 70 28 74 68 69 73 29 3b 74 68 69 73 2e 75 62 3d 34 35 45 33 3b 61 3d 67 2e 49 53 3f 31 32 35 3a 76 6f 69 64 20 30 3b 74 68 69 73 2e 6a 62 3d 6e 65 77 20 67 2e 65 67 28 61 29 3b 74 68 69 73 2e 4e 61 3d 6e 75 6c 6c 3b 74 68 69 73 2e 43 3d 21 31 3b 74 68 69 73 2e 57 3d 74 68 69 73 2e 5a 61 3d 74 68 69 73 2e 5a 3d 74 68 69 73 2e 54 61 3d 74 68 69 73 2e 42 61 3d 74 68 69 73 2e 4a 62 3d 74 68 69 73 2e 6d 61 3d 6e 75 6c 6c 3b 74 68 69 73 2e 72 61 3d 5b 5d 3b 74 68 69 73 2e 6a 3d 6e 75 6c 6c 3b 74 68 69 73 2e 4b 3d 30 3b 74 68 Data Ascii: },w8=function(a,b,c,d){this.G=a;this.D=b;this.Jc=c;this.ac=d\|\|1;this.bb=new g.Mp(this);this.ub=45E3;a=g.IS?125:void 0;this.jb=new g.eg(a);this.Na=null;this.C=!1;this.W=this.Za=this.Z=this.Ta=this.Ba=this.Jb=this.ma=null;this.ra=[];this.j=null;this.K=0;th

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.17	49821	142.250.9.157	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:50 UTC	729	OUT	GET /pagead/id HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:51:50 UTC	766	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://www.youtube.com Date: Tue, 30 Jan 2024 17:51:50 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.17	49822	74.125.138.148	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:50 UTC	707	OUT	GET /instream/ad_status.js HTTP/1.1 Host: static.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:51:50 UTC	744	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="ads-doubleclick-media" Report-To: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} Timing-Allow-Origin: * Content-Length: 29 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 30 Jan 2024 17:46:17 GMT Expires: Tue, 30 Jan 2024 18:01:17 GMT Cache-Control: public, max-age=900 Age: 333 Last-Modified: Thu, 12 Dec 2013 23:40:16 GMT Content-Type: text/javascript Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:51:50 UTC	29	IN	Data Raw: 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 5f 61 64 5f 73 74 61 74 75 73 20 3d 20 31 3b 0a Data Ascii: window.google_ad_status = 1;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.17	49824	142.250.9.157	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:50 UTC	738	OUT	GET /pagead/id?slf_rd=1 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:51:51 UTC	808	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://www.youtube.com Content-Type: application/json; charset=UTF-8 Date: Tue, 30 Jan 2024 17:51:51 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:51 UTC	106	IN	Data Raw: 36 34 0d 0a 29 5d 7d 27 0a 0a 7b 22 69 64 22 3a 22 41 4e 79 50 78 4b 71 71 30 43 45 76 38 41 73 72 65 76 33 68 43 66 69 7a 53 64 48 38 6b 4b 72 36 69 2d 6e 37 78 4e 70 64 6e 2d 79 6a 4a 33 4f 6a 33 5f 65 4a 64 72 57 77 6d 63 36 65 70 4e 53 45 77 49 37 2d 76 7a 76 7a 39 33 65 7a 22 2c 22 74 79 70 65 22 3a 34 7d 0d 0a Data Ascii: 64)]}'{"id":"ANyPxKqq0CEv8Asrev3hCfizSdH8kKr6i-n7xNpdn-yjJ3Oj3_eJdrWwmc6epNSEwI7-vzvz93ez","type":4}
2024-01-30 17:51:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.17	49833	172.217.215.190	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:52 UTC	1468	OUT	POST /youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8 HTTP/1.1 Host: www.youtube.com Connection: keep-alive Content-Length: 14878 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-YouTube-Ad-Signals: dt=1706637108796&flash=0&frm=2&u_tz=60&u_his=2&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C0%2C0&vis=1&wgl=true&ca_type=image sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Goog-Request-Time: 1706637111475 Content-Type: application/json X-YouTube-Utc-Offset: 60 X-YouTube-Client-Name: 56 X-YouTube-Client-Version: 1.20240128.00.00 X-YouTube-Time-Zone: Europe/Zurich X-Goog-Visitor-Id: CgtvQ0g3VXl0aVZYbyi07uStBjIKCgJVUxIEGgAgSw%3D%3D sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/embed/?enablejsapi=1&rel=0&autoplay=0&playsinline=1&expflag=embeds_enable_muted_autoplay%3Atrue&fs=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=MmYKqDmYcs4; VISITOR_INFO1_LIVE=oCH7UytiVXo
2024-01-30 17:51:52 UTC	14878	OUT	Data Raw: 7b 22 63 6f 6e 74 65 78 74 22 3a 7b 22 63 6c 69 65 6e 74 22 3a 7b 22 68 6c 22 3a 22 65 6e 22 2c 22 67 6c 22 3a 22 55 53 22 2c 22 63 6c 69 65 6e 74 4e 61 6d 65 22 3a 35 36 2c 22 63 6c 69 65 6e 74 56 65 72 73 69 6f 6e 22 3a 22 31 2e 32 30 32 34 30 31 32 38 2e 30 30 2e 30 30 22 2c 22 63 6f 6e 66 69 67 49 6e 66 6f 22 3a 7b 22 61 70 70 49 6e 73 74 61 6c 6c 44 61 74 61 22 3a 22 43 4c 54 75 35 4b 30 47 45 4c 32 32 72 67 55 51 6c 34 7a 5f 45 68 44 2d 70 37 41 46 45 4f 32 69 73 41 55 51 70 6f 47 77 42 52 43 33 37 36 38 46 45 4c 69 4c 72 67 55 51 36 35 4f 75 42 52 43 61 38 4b 38 46 45 4b 79 6c 73 41 55 51 7a 5a 57 77 42 52 44 77 6e 4c 41 46 45 4c 69 71 73 41 55 51 74 71 36 77 42 52 44 31 2d 61 38 46 45 50 79 46 73 41 55 51 32 63 6d 76 42 52 43 6c 77 76 34 53 45 4c Data Ascii: {"context":{"client":{"hl":"en","gl":"US","clientName":56,"clientVersion":"1.20240128.00.00","configInfo":{"appInstallData":"CLTu5K0GEL22rgUQl4z_EhD-p7AFEO2isAUQpoGwBRC3768FELiLrgUQ65OuBRCa8K8FEKylsAUQzZWwBRDwnLAFELiqsAUQtq6wBRD1-a8FEPyFsAUQ2cmvBRClwv4SEL
2024-01-30 17:51:52 UTC	432	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Vary: X-Origin Vary: Referer Date: Tue, 30 Jan 2024 17:51:52 GMT Server: scaffolding on HTTPServer2 Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Origin,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:52 UTC	34	IN	Data Raw: 31 63 0d 0a 7b 0a 20 20 22 72 65 73 70 6f 6e 73 65 43 6f 6e 74 65 78 74 22 3a 20 7b 7d 0a 7d 0a 0d 0a Data Ascii: 1c{ "responseContext": {}}
2024-01-30 17:51:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.17	49834	172.217.215.190	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:54 UTC	1467	OUT	POST /youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8 HTTP/1.1 Host: www.youtube.com Connection: keep-alive Content-Length: 1641 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-YouTube-Ad-Signals: dt=1706637108796&flash=0&frm=2&u_tz=60&u_his=2&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C0%2C0&vis=1&wgl=true&ca_type=image sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Goog-Request-Time: 1706637113675 Content-Type: application/json X-YouTube-Utc-Offset: 60 X-YouTube-Client-Name: 56 X-YouTube-Client-Version: 1.20240128.00.00 X-YouTube-Time-Zone: Europe/Zurich X-Goog-Visitor-Id: CgtvQ0g3VXl0aVZYbyi07uStBjIKCgJVUxIEGgAgSw%3D%3D sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/embed/?enablejsapi=1&rel=0&autoplay=0&playsinline=1&expflag=embeds_enable_muted_autoplay%3Atrue&fs=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=MmYKqDmYcs4; VISITOR_INFO1_LIVE=oCH7UytiVXo
2024-01-30 17:51:54 UTC	1641	OUT	Data Raw: 7b 22 63 6f 6e 74 65 78 74 22 3a 7b 22 63 6c 69 65 6e 74 22 3a 7b 22 68 6c 22 3a 22 65 6e 22 2c 22 67 6c 22 3a 22 55 53 22 2c 22 63 6c 69 65 6e 74 4e 61 6d 65 22 3a 35 36 2c 22 63 6c 69 65 6e 74 56 65 72 73 69 6f 6e 22 3a 22 31 2e 32 30 32 34 30 31 32 38 2e 30 30 2e 30 30 22 2c 22 63 6f 6e 66 69 67 49 6e 66 6f 22 3a 7b 22 61 70 70 49 6e 73 74 61 6c 6c 44 61 74 61 22 3a 22 43 4c 54 75 35 4b 30 47 45 4c 32 32 72 67 55 51 6c 34 7a 5f 45 68 44 2d 70 37 41 46 45 4f 32 69 73 41 55 51 70 6f 47 77 42 52 43 33 37 36 38 46 45 4c 69 4c 72 67 55 51 36 35 4f 75 42 52 43 61 38 4b 38 46 45 4b 79 6c 73 41 55 51 7a 5a 57 77 42 52 44 77 6e 4c 41 46 45 4c 69 71 73 41 55 51 74 71 36 77 42 52 44 31 2d 61 38 46 45 50 79 46 73 41 55 51 32 63 6d 76 42 52 43 6c 77 76 34 53 45 4c Data Ascii: {"context":{"client":{"hl":"en","gl":"US","clientName":56,"clientVersion":"1.20240128.00.00","configInfo":{"appInstallData":"CLTu5K0GEL22rgUQl4z_EhD-p7AFEO2isAUQpoGwBRC3768FELiLrgUQ65OuBRCa8K8FEKylsAUQzZWwBRDwnLAFELiqsAUQtq6wBRD1-a8FEPyFsAUQ2cmvBRClwv4SEL
2024-01-30 17:51:54 UTC	432	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Vary: X-Origin Vary: Referer Date: Tue, 30 Jan 2024 17:51:54 GMT Server: scaffolding on HTTPServer2 Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Origin,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:54 UTC	34	IN	Data Raw: 31 63 0d 0a 7b 0a 20 20 22 72 65 73 70 6f 6e 73 65 43 6f 6e 74 65 78 74 22 3a 20 7b 7d 0a 7d 0a 0d 0a Data Ascii: 1c{ "responseContext": {}}
2024-01-30 17:51:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.17	49839	173.194.219.103	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:56 UTC	2129	OUT	POST /gen_204?atyp=i&ei=Kze5ZY_EKtunqtsPm7mdiAw&ct=slh&v=t1&im=M&pv=0.518824515729305&me=160:1706637105586,B,2610:0,R,1,CCgQAA,735,165,393,1297:0,R,1,CCgQBg,736,237,392,1174:0,R,1,CC0QAA,736,237,392,1174:0,R,1,CEQQAA,756,237,372,187:0,R,1,CD4QAA,756,237,372,168:0,R,1,CD4QAQ,756,237,372,168:0,R,1,CD8QAA,756,237,372,168:0,R,1,CD8QAg,1009,373,119,32:0,R,1,CEUQAA,756,448,372,509:0,R,1,CEEQAA,756,448,372,488:0,R,1,CDEQAA,756,448,372,133:0,R,1,CDEQAQ,756,448,372,133:0,R,1,CDMQAA,756,581,372,29:0,R,1,CC4QAA,756,610,372,29:0,R,1,CC8QAA,756,639,372,29:0,R,1,CDAQAA,756,668,372,51:0,R,1,CDIQAA,756,735,372,201:0,R,1,CDIQAQ,756,736,372,66:0,R,1,CDIQBg,756,803,372,66:0,R,1,CDIQCw,756,870,372,66:9891,h,1,CAcQAA,o:0,h,1,CAUQGQ,o:4,e,B&zx=1706637115482&opi=89978449 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; AEC=Ae3NU9ONEW9nRwAXRbxxkxRHWsjNmTt-wvvNOHnf7BJSZX_Z2eAsfhmByQ; GZ=Z=0; DV=U668bcM7gEwXUJHHJ0xN1v-ETPi31Rg; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:51:56 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-DzfDEvJo53xF7u5XNG9KkA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 30 Jan 2024 17:51:56 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.17	49840	172.217.215.190	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:56 UTC	1467	OUT	POST /youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8 HTTP/1.1 Host: www.youtube.com Connection: keep-alive Content-Length: 1308 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-YouTube-Ad-Signals: dt=1706637108796&flash=0&frm=2&u_tz=60&u_his=2&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C0%2C0&vis=1&wgl=true&ca_type=image sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Goog-Request-Time: 1706637115484 Content-Type: application/json X-YouTube-Utc-Offset: 60 X-YouTube-Client-Name: 56 X-YouTube-Client-Version: 1.20240128.00.00 X-YouTube-Time-Zone: Europe/Zurich X-Goog-Visitor-Id: CgtvQ0g3VXl0aVZYbyi07uStBjIKCgJVUxIEGgAgSw%3D%3D sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/embed/?enablejsapi=1&rel=0&autoplay=0&playsinline=1&expflag=embeds_enable_muted_autoplay%3Atrue&fs=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=MmYKqDmYcs4; VISITOR_INFO1_LIVE=oCH7UytiVXo
2024-01-30 17:51:56 UTC	1308	OUT	Data Raw: 7b 22 63 6f 6e 74 65 78 74 22 3a 7b 22 63 6c 69 65 6e 74 22 3a 7b 22 68 6c 22 3a 22 65 6e 22 2c 22 67 6c 22 3a 22 55 53 22 2c 22 63 6c 69 65 6e 74 4e 61 6d 65 22 3a 35 36 2c 22 63 6c 69 65 6e 74 56 65 72 73 69 6f 6e 22 3a 22 31 2e 32 30 32 34 30 31 32 38 2e 30 30 2e 30 30 22 2c 22 63 6f 6e 66 69 67 49 6e 66 6f 22 3a 7b 22 61 70 70 49 6e 73 74 61 6c 6c 44 61 74 61 22 3a 22 43 4c 54 75 35 4b 30 47 45 4c 32 32 72 67 55 51 6c 34 7a 5f 45 68 44 2d 70 37 41 46 45 4f 32 69 73 41 55 51 70 6f 47 77 42 52 43 33 37 36 38 46 45 4c 69 4c 72 67 55 51 36 35 4f 75 42 52 43 61 38 4b 38 46 45 4b 79 6c 73 41 55 51 7a 5a 57 77 42 52 44 77 6e 4c 41 46 45 4c 69 71 73 41 55 51 74 71 36 77 42 52 44 31 2d 61 38 46 45 50 79 46 73 41 55 51 32 63 6d 76 42 52 43 6c 77 76 34 53 45 4c Data Ascii: {"context":{"client":{"hl":"en","gl":"US","clientName":56,"clientVersion":"1.20240128.00.00","configInfo":{"appInstallData":"CLTu5K0GEL22rgUQl4z_EhD-p7AFEO2isAUQpoGwBRC3768FELiLrgUQ65OuBRCa8K8FEKylsAUQzZWwBRDwnLAFELiqsAUQtq6wBRD1-a8FEPyFsAUQ2cmvBRClwv4SEL
2024-01-30 17:51:56 UTC	432	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Vary: X-Origin Vary: Referer Date: Tue, 30 Jan 2024 17:51:56 GMT Server: scaffolding on HTTPServer2 Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Origin,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-30 17:51:56 UTC	34	IN	Data Raw: 31 63 0d 0a 7b 0a 20 20 22 72 65 73 70 6f 6e 73 65 43 6f 6e 74 65 78 74 22 3a 20 7b 7d 0a 7d 0a 0d 0a Data Ascii: 1c{ "responseContext": {}}
2024-01-30 17:51:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.17	49855	13.107.213.41	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:57 UTC	549	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:51:57 UTC	712	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:51:57 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 2601 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 7ba247d1-e01e-0049-2b9e-539771000000 x-ms-version: 2009-09-19 x-azure-ref: 20240130T175157Z-mgfhnfww31147bgz2bh0atbnrg00000002r000000000pym4 Accept-Ranges: bytes
2024-01-30 17:51:57 UTC	15672	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-01-30 17:51:57 UTC	711	IN	Data Raw: 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 65 Data Ascii: {return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cookie
2024-01-30 17:51:57 UTC	16383	IN	Data Raw: 61 2d 6c 61 62 65 6c 3d 22 27 2b 69 2e 65 73 63 61 70 65 48 74 6d 6c 28 74 68 69 73 2e 74 65 78 74 52 65 73 6f 75 72 63 65 73 2e 70 72 65 66 65 72 65 6e 63 65 73 44 69 61 6c 6f 67 43 6c 6f 73 65 4c 61 62 65 6c 29 2b 27 22 20 63 6c 61 73 73 3d 22 27 2b 61 2e 63 6c 6f 73 65 4d 6f 64 61 6c 49 63 6f 6e 2b 27 22 20 74 61 62 69 6e 64 65 78 3d 22 30 22 3e 26 23 78 32 37 31 35 3b 3c 2f 62 75 74 74 6f 6e 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 72 6f 6c 65 3d 22 64 6f 63 75 6d 65 6e 74 22 20 63 6c 61 73 73 3d 22 27 2b 61 2e 6d 6f 64 61 6c 42 6f 64 79 2b 27 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 27 2b 61 2e 6d 6f Data Ascii: a-label="'+i.escapeHtml(this.textResources.preferencesDialogCloseLabel)+'" class="'+a.closeModalIcon+'" tabindex="0">✕</button>\n <div role="document" class="'+a.modalBody+'">\n <div>\n <h1 class="'+a.mo
2024-01-30 17:51:57 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 7d 2c 65 7d 28 29 2c 64 3d 5b 22 61 72 22 2c 22 68 65 22 2c 22 70 73 22 2c 22 75 72 22 2c 22 66 61 22 2c 22 70 61 22 2c 22 73 64 22 2c 22 74 6b 22 2c 22 75 67 22 2c 22 79 69 22 2c 22 73 79 72 22 2c 22 6b 73 2d 61 72 61 62 22 5d 2c 75 3d 7b 22 63 6c 6f 73 65 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 22 3a 22 23 36 36 36 36 36 36 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 6f 70 61 63 69 74 79 22 3a 22 31 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f Data Ascii: background-color: "+e["radio-button-disabled-color"]+" !important;\n }"},e}(),d=["ar","he","ps","ur","fa","pa","sd","tk","ug","yi","syr","ks-arab"],u={"close-button-color":"#666666","secondary-button-disabled-opacity":"1","secondary-butto
2024-01-30 17:51:57 UTC	3567	IN	Data Raw: 28 22 2d 22 29 5b 30 5d 3b 6f 3d 65 2e 73 70 6c 69 74 28 22 2d 22 29 5b 30 5d 3d 3d 3d 6e 7d 72 65 74 75 72 6e 20 6f 7d 28 65 2c 63 29 7d 29 29 3b 73 26 26 30 3d 3d 3d 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 22 65 6e 2d 55 53 22 29 2c 6f 2e 70 6c 61 63 65 68 6f 6c 64 65 72 45 6c 65 6d 65 6e 74 3d 6c 2c 72 26 26 6f 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 43 61 6c 6c 62 61 63 6b 73 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 28 72 29 2c 6f 2e 73 61 76 65 43 6f 6f 6b 69 65 28 29 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 3d 6e 65 77 20 66 28 21 31 29 2c 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 28 76 6f 69 64 20 30 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 29 2c 6f 2e 69 73 49 6e 69 74 52 65 61 64 79 3d 21 30 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 43 68 61 6e Data Ascii: ("-")[0];o=e.split("-")[0]===n}return o}(e,c)}));s&&0===s.length&&(e="en-US"),o.placeholderElement=l,r&&o.consentChangedCallbacks.registerCallback(r),o.saveCookie(),o.siteConsent=new f(!1),null==n\|\|n(void 0,o.siteConsent),o.isInitReady=!0,this.consentChan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.17	49857	13.107.213.40	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:57 UTC	553	OUT	GET /meversion?partner=MSDLC&market=en-us&uhf=1 HTTP/1.1 Host: mem.gfx.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:51:57 UTC	672	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:51:57 GMT Content-Type: application/javascript Content-Length: 30210 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, no-transform, max-age=7200 Expires: Tue, 30 Jan 2024 19:51:57 GMT X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains x-azure-ref: 20240130T175157Z-mu9abdptx91hf5phgwuf0ap8p400000001000000000012p3 x-fd-int-roxy-purgeid: 38334287 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-01-30 17:51:57 UTC	15712	IN	Data Raw: 77 69 6e 64 6f 77 2e 4d 53 41 3d 77 69 6e 64 6f 77 2e 4d 53 41 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 3d 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 2e 43 6f 6e 66 69 67 3d 7b 22 76 65 72 22 3a 22 31 30 2e 32 33 33 34 37 2e 32 22 2c 22 6d 6b 74 22 3a 22 65 6e 2d 55 53 22 2c 22 70 74 6e 22 3a 22 6d 73 64 6c 63 22 2c 22 67 66 78 22 3a 22 68 74 74 70 73 3a 2f 2f 61 6d 63 64 6e 2e 6d 73 66 74 61 75 74 68 2e 6e 65 74 22 2c 22 64 62 67 22 3a 66 61 6c 73 65 2c 22 61 61 64 22 3a 74 72 75 65 2c 22 69 6e 74 22 3a 66 61 6c 73 65 2c 22 70 78 79 22 3a 74 72 75 65 2c 22 6d 73 54 78 74 22 3a 66 61 6c 73 65 2c 22 72 77 64 22 3a 74 72 75 65 2c 22 Data Ascii: window.MSA=window.MSA\|\|{};window.MSA.MeControl=window.MSA.MeControl\|\|{};window.MSA.MeControl.Config={"ver":"10.23347.2","mkt":"en-US","ptn":"msdlc","gfx":"https://amcdn.msftauth.net","dbg":false,"aad":true,"int":false,"pxy":true,"msTxt":false,"rwd":true,"
2024-01-30 17:51:57 UTC	14498	IN	Data Raw: 76 65 28 29 2e 74 68 65 6e 28 65 29 7d 29 2c 53 65 2e 5f 75 6e 68 61 6e 64 6c 65 64 52 65 6a 65 63 74 69 6f 6e 46 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6a 65 28 7b 65 76 65 6e 74 54 79 70 65 3a 22 43 6c 69 65 6e 74 45 72 72 6f 72 22 2c 69 73 43 72 69 74 69 63 61 6c 3a 21 30 2c 6e 61 6d 65 3a 65 2e 6d 65 73 73 61 67 65 7c 7c 22 28 66 61 6c 73 65 79 20 6d 65 73 73 61 67 65 20 70 72 6f 70 65 72 74 79 20 6f 6e 20 65 72 72 6f 72 29 22 2c 74 79 70 65 3a 22 55 6e 68 61 6e 64 6c 65 64 50 72 6f 6d 69 73 65 52 65 6a 65 63 74 69 6f 6e 22 2c 64 65 74 61 69 6c 73 3a 65 2e 73 74 61 63 6b 7c 7c 22 22 2c 64 69 73 70 6c 61 79 65 64 3a 21 31 2c 73 65 76 65 72 69 74 79 3a 65 2e 6d 63 49 73 54 69 6d 65 6f 75 74 3f 33 3a 32 7d 29 7d 3b 76 61 72 20 71 65 3d 5b 5d 3b 76 61 Data Ascii: ve().then(e)}),Se._unhandledRejectionFn=function(e){je({eventType:"ClientError",isCritical:!0,name:e.message\|\|"(falsey message property on error)",type:"UnhandledPromiseRejection",details:e.stack\|\|"",displayed:!1,severity:e.mcIsTimeout?3:2})};var qe=[];va

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.17	49875	204.79.197.222	443

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:51:58 UTC	1018	OUT	GET /r.gif?MonitorID=asgw&rid=805a442ee6889251004cff56e5e99d89&w3c=true&prot=https:&v=20190506&DATA=[{%22RequestID%22:%22afdxtest.z01.azurefd.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:638,%22T%22:1},{%22RequestID%22:%22afdxtest.z01.azurefd.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:152,%22T%22:1},{%22RequestID%22:%22fp.msedge.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:-1,%22T%22:1},{%22RequestID%22:%22ed3269487071b07864828ad1169325d0%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:-1,%22T%22:128}] HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: fp.msedge.net Connection: Keep-Alive
2024-01-30 17:51:58 UTC	310	IN	HTTP/1.1 200 OK Cache-Control: no-store Transfer-Encoding: chunked Content-Type: image/gif Access-Control-Allow-Origin: https://www.bing.com X-MSEdge-Ref: Ref A: 627D370BB8E44C6696A0B0B603CB17F0 Ref B: ATL331000104049 Ref C: 2024-01-30T17:51:58Z Date: Tue, 30 Jan 2024 17:51:58 GMT Connection: close
2024-01-30 17:51:58 UTC	12	IN	Data Raw: 37 0d 0a 47 49 46 38 39 61 01 0d 0a Data Ascii: 7GIF89a
2024-01-30 17:51:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.17	49887	13.107.213.41	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:00 UTC	602	OUT	GET /scripts/c/ms.shared.analytics.mectrl-3.gbl.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:00 UTC	968	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:00 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 91640 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=1800, immutable, no-transform Last-Modified: Thu, 21 Sep 2023 19:27:17 GMT ETag: 0x8DBBAD8C47A3BAE x-ms-request-id: 1efc9894-701e-002d-6a15-53d6a3000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 3.2.14 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.shared.analytics.mectrl-3.2.14.gbl.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240130T175200Z-bd4at6s9xh0s5ehundcb5ap98000000000ng000000003ft7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-01-30 17:52:00 UTC	15416	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 20 53 44 4b 20 53 68 61 72 65 64 20 41 6e 61 6c 79 74 69 63 73 2c 20 33 2e 32 2e 31 34 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 76 61 72 20 74 2c 72 3d 7b 7d 2c 69 3d 22 5f 5f 6d 73 24 6d 6f 64 5f 5f 22 2c 6f 3d 7b 7d 2c 61 3d 6f 2e 65 73 6d 5f 6d 73 5f 73 68 61 72 65 64 5f 61 6e 61 6c 79 74 69 63 73 5f 6d 65 63 74 72 6c 5f 33 5f 32 5f 31 34 3d 7b 7d 2c 75 3d 22 33 2e 32 2e 31 34 22 2c 73 3d 22 6f 6e 65 44 73 4d 65 43 Data Ascii: /! 1DS JS SDK Shared Analytics, 3.2.14 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,n){var t,r={},i="__ms$mod__",o={},a=o.esm_ms_shared_analytics_mectrl_3_2_14={},u="3.2.14",s="oneDsMeC
2024-01-30 17:52:00 UTC	16384	IN	Data Raw: 72 3d 22 63 6f 6f 6b 69 65 22 2c 6a 72 3d 22 65 78 70 69 72 65 73 22 2c 58 72 3d 22 65 6e 61 62 6c 65 64 22 2c 47 72 3d 22 69 73 43 6f 6f 6b 69 65 55 73 65 44 69 73 61 62 6c 65 64 22 2c 51 72 3d 22 64 69 73 61 62 6c 65 43 6f 6f 6b 69 65 73 55 73 61 67 65 22 2c 4a 72 3d 22 5f 63 6b 4d 67 72 22 2c 24 72 3d 6e 75 6c 6c 2c 5a 72 3d 6e 75 6c 6c 2c 59 72 3d 6e 75 6c 6c 2c 65 69 3d 4a 74 28 29 2c 6e 69 3d 7b 7d 2c 74 69 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 72 69 28 65 29 7b 72 65 74 75 72 6e 21 65 7c 7c 65 2e 69 73 45 6e 61 62 6c 65 64 28 29 7d 66 75 6e 63 74 69 6f 6e 20 69 69 28 65 2c 6e 29 7b 72 65 74 75 72 6e 20 6e 26 26 65 26 26 72 65 28 65 2e 69 67 6e 6f 72 65 43 6f 6f 6b 69 65 73 29 26 26 2d 31 21 3d 3d 65 2e 69 67 6e 6f 72 65 43 6f 6f 6b 69 65 73 5b 6e Data Ascii: r="cookie",jr="expires",Xr="enabled",Gr="isCookieUseDisabled",Qr="disableCookiesUsage",Jr="_ckMgr",$r=null,Zr=null,Yr=null,ei=Jt(),ni={},ti={};function ri(e){return!e\|\|e.isEnabled()}function ii(e,n){return n&&e&&re(e.ignoreCookies)&&-1!==e.ignoreCookies[n
2024-01-30 17:52:00 UTC	16384	IN	Data Raw: 26 26 30 3c 72 5b 6e 65 5d 26 26 28 65 3d 72 2c 72 3d 5b 5d 2c 69 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 79 28 29 5b 46 5d 28 65 29 7d 29 29 7d 2c 70 2e 70 6f 6c 6c 49 6e 74 65 72 6e 61 6c 4c 6f 67 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 50 3d 65 7c 7c 6e 75 6c 6c 2c 4e 3d 21 31 2c 41 26 26 28 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 41 29 2c 41 3d 6e 75 6c 6c 29 2c 68 28 21 30 29 7d 2c 70 5b 46 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 4e 3d 21 30 2c 41 26 26 28 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 41 29 2c 41 3d 30 2c 66 28 29 29 7d 2c 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 45 7d 2c 65 3d 5b 22 61 64 64 54 65 6c 65 6d 65 74 72 79 49 6e 69 74 69 61 6c 69 7a 65 72 22 5d 2c 28 6e 3d 70 29 26 26 72 Data Ascii: &&0<r[ne]&&(e=r,r=[],ie(e,function(e){y()[F](e)}))},p.pollInternalLogs=function(e){return P=e\|\|null,N=!1,A&&(clearInterval(A),A=null),h(!0)},p[Fe]=function(){N=!0,A&&(clearInterval(A),A=0,f())},t=function(){return E},e=["addTelemetryInitializer"],(n=p)&&r
2024-01-30 17:52:00 UTC	16384	IN	Data Raw: 3a 22 55 6e 69 78 22 7d 2c 7b 73 3a 22 62 6c 61 63 6b 62 65 72 72 79 22 2c 6f 73 3a 22 42 6c 61 63 6b 42 65 72 72 79 22 7d 2c 7b 73 3a 22 73 79 6d 62 69 61 6e 22 2c 6f 73 3a 22 53 79 6d 62 69 61 6e 22 7d 2c 7b 73 3a 22 6e 6f 6b 69 61 22 2c 6f 73 3a 22 4e 6f 6b 69 61 22 7d 2c 7b 72 3a 73 2e 4f 53 58 2c 6f 73 3a 22 4d 61 63 20 4f 53 20 58 22 7d 5d 3b 66 75 6e 63 74 69 6f 6e 20 4b 61 28 65 2c 6e 29 7b 6e 3d 65 2e 6d 61 74 63 68 28 52 65 67 45 78 70 28 6e 2b 22 20 22 2b 4e 61 29 29 3b 72 65 74 75 72 6e 20 6e 3f 41 61 5b 6e 5b 31 5d 5d 7c 7c 6e 5b 31 5d 3a 55 61 7d 66 75 6e 63 74 69 6f 6e 20 7a 61 28 65 29 7b 72 65 74 75 72 6e 7e 65 2e 69 6e 64 65 78 4f 66 28 22 2e 22 29 3f 22 2e 22 3a 7e 65 2e 69 6e 64 65 78 4f 66 28 22 5f 22 29 3f 22 5f 22 3a 6e 75 6c 6c 7d Data Ascii: :"Unix"},{s:"blackberry",os:"BlackBerry"},{s:"symbian",os:"Symbian"},{s:"nokia",os:"Nokia"},{r:s.OSX,os:"Mac OS X"}];function Ka(e,n){n=e.match(RegExp(n+" "+Na));return n?Aa[n[1]]\|\|n[1]:Ua}function za(e){return~e.indexOf(".")?".":~e.indexOf("_")?"_":null}
2024-01-30 17:52:00 UTC	16384	IN	Data Raw: 73 2d 31 5d 7d 7d 28 65 3d 76 26 26 28 28 74 3d 62 5b 65 3d 72 5d 29 3d 3d 3d 75 6e 64 65 66 69 6e 65 64 26 26 28 37 3c 3d 65 2e 6c 65 6e 67 74 68 26 26 28 74 3d 6f 74 28 65 2c 22 65 78 74 2e 6d 65 74 61 64 61 74 61 22 29 7c 7c 6f 74 28 65 2c 22 65 78 74 2e 77 65 62 22 29 29 2c 62 5b 65 5d 3d 74 29 2c 74 29 7c 7c 21 53 7c 7c 21 53 2e 68 61 6e 64 6c 65 46 69 65 6c 64 28 72 2c 69 29 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 21 65 26 26 21 6a 6f 28 65 29 7c 7c 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 69 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 74 79 70 65 6f 66 20 65 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 7c 7c 22 6e 75 6d 62 65 72 22 3d 3d 74 7c 7c 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 7c 7c 72 65 28 65 29 29 65 3d Data Ascii: s-1]}}(e=v&&((t=b[e=r])===undefined&&(7<=e.length&&(t=ot(e,"ext.metadata")\|\|ot(e,"ext.web")),b[e]=t),t)\|\|!S\|\|!S.handleField(r,i)?function(e,n){if(!e&&!jo(e)\|\|"string"!=typeof i)return null;var t=typeof e;if("string"==t\|\|"number"==t\|\|"boolean"==t\|\|re(e))e=
2024-01-30 17:52:00 UTC	10688	IN	Data Raw: 5b 36 2c 33 2c 30 5d 2c 42 45 53 54 5f 45 46 46 4f 52 54 3a 5b 31 38 2c 39 2c 30 5d 7d 7d 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 6e 29 7b 76 61 72 20 74 3d 5b 5d 2c 72 3d 24 3f 59 3a 5a 3b 69 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 30 3c 65 2e 63 6f 75 6e 74 28 29 26 26 69 65 28 65 2e 65 76 65 6e 74 73 28 29 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 28 65 2e 73 79 6e 63 26 26 28 65 2e 6c 61 74 65 6e 63 79 3d 34 2c 65 2e 73 79 6e 63 3d 21 31 29 2c 65 2e 73 65 6e 64 41 74 74 65 6d 70 74 3c 72 3f 28 59 6f 28 65 2c 70 2e 69 64 65 6e 74 69 66 69 65 72 29 2c 69 28 65 2c 21 31 29 29 3a 74 2e 70 75 73 68 28 65 29 29 7d 29 7d 29 2c 30 3c 74 2e 6c 65 6e 67 74 68 26 26 43 28 46 73 2c 74 2c 45 74 2e 4e 6f 6e 52 65 74 72 79 61 62 6c 65 53 74 61 Data Ascii: [6,3,0],BEST_EFFORT:[18,9,0]}}function e(e,n){var t=[],r=$?Y:Z;ie(e,function(e){e&&0<e.count()&&ie(e.events(),function(e){e&&(e.sync&&(e.latency=4,e.sync=!1),e.sendAttempt<r?(Yo(e,p.identifier),i(e,!1)):t.push(e))})}),0<t.length&&C(Fs,t,Et.NonRetryableSta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.17	49888	13.107.213.40	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:00 UTC	594	OUT	GET /scripts/me/MeControl/10.23347.2/en-US/meBoot.min.js HTTP/1.1 Host: mem.gfx.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:00 UTC	608	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:00 GMT Content-Type: application/javascript Content-Length: 181223 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Wed, 24 Jan 2024 08:13:26 GMT ETag: "1da4ee042b894e7" X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains x-azure-ref: 20240130T175200Z-5zz6gxysqh4v1ec5fvwasndcrs00000001wg00000000k8zc x-fd-int-roxy-purgeid: 38334287 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-01-30 17:52:00 UTC	15776	IN	Data Raw: 4d 65 43 6f 6e 74 72 6f 6c 44 65 66 69 6e 65 28 22 6d 65 42 6f 6f 74 22 2c 5b 22 65 78 70 6f 72 74 73 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 69 6e 6c 69 6e 65 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 53 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 63 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 69 3d 7b 7d 2c 75 3d 5b 5d 2c 70 3d 5b 5d 3b 66 75 6e 63 74 69 6f 6e 20 4f 28 74 2c 65 29 7b 76 61 72 20 72 2c 6e 2c 6f 2c 69 2c 61 3d 70 3b 66 6f 72 28 69 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 32 3c 69 2d 2d 3b 29 75 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 5b 69 5d 29 3b 66 6f 72 28 65 26 26 6e 75 6c 6c 21 3d 65 2e 63 68 69 6c 64 72 65 6e 26 26 28 75 2e 6c 65 6e 67 74 68 7c 7c 75 2e 70 75 73 68 28 65 2e 63 68 69 6c 64 Data Ascii: MeControlDefine("meBoot",["exports","@mecontrol/web-inline"],function(t,S){"use strict";var c=function(){},i={},u=[],p=[];function O(t,e){var r,n,o,i,a=p;for(i=arguments.length;2<i--;)u.push(arguments[i]);for(e&&null!=e.children&&(u.length\|\|u.push(e.child
2024-01-30 17:52:00 UTC	16384	IN	Data Raw: 3d 61 72 67 75 6d 65 6e 74 73 5b 72 5d 3b 72 65 74 75 72 6e 20 30 3d 3d 3d 65 2e 6c 65 6e 67 74 68 3f 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 7d 3a 31 3d 3d 3d 65 2e 6c 65 6e 67 74 68 3f 65 5b 30 5d 3a 65 2e 72 65 64 75 63 65 28 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 65 2e 61 70 70 6c 79 28 76 6f 69 64 20 30 2c 61 72 67 75 6d 65 6e 74 73 29 29 7d 7d 29 7d 76 61 72 20 74 74 3d 41 72 72 61 79 2e 69 73 41 72 72 61 79 3b 66 75 6e 63 74 69 6f 6e 20 65 74 28 74 29 7b 76 61 72 20 65 2c 72 2c 6e 2c 6f 3d 22 22 2c 69 3d 74 79 70 65 6f 66 20 74 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 69 7c 7c 22 6e 75 6d 62 65 72 22 3d 3d 69 29 72 65 74 75 72 6e 20 74 7c 7c 22 Data Ascii: =arguments[r];return 0===e.length?function(t){return t}:1===e.length?e[0]:e.reduce(function(t,e){return function(){return t(e.apply(void 0,arguments))}})}var tt=Array.isArray;function et(t){var e,r,n,o="",i=typeof t;if("string"==i\|\|"number"==i)return t\|\|"
2024-01-30 17:52:00 UTC	16384	IN	Data Raw: 7c 7c 21 77 65 2e 74 65 73 74 28 74 29 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 4f 65 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 31 3b 72 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 65 5b 72 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 72 5d 3b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 6f 3d 65 3b 6e 3c 6f 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 69 3d 6f 5b 6e 5d 3b 66 6f 72 28 76 61 72 20 61 20 69 6e 20 69 29 69 66 28 53 2e 68 61 73 4f 77 6e 28 69 2c 61 29 29 7b 76 61 72 20 73 3d 69 5b 61 5d 3b 6e 75 6c 6c 3d 3d 73 7c 7c 53 65 28 73 29 7c 7c 28 74 5b 61 5d 3d 73 29 7d 7d 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 62 65 28 74 2c 65 2c 72 29 7b 76 61 72 20 6e 3d 53 Data Ascii: \|\|!we.test(t);default:return!1}}function Oe(t){for(var e=[],r=1;r<arguments.length;r++)e[r-1]=arguments[r];for(var n=0,o=e;n<o.length;n++){var i=o[n];for(var a in i)if(S.hasOwn(i,a)){var s=i[a];null==s\|\|Se(s)\|\|(t[a]=s)}}return t}function be(t,e,r){var n=S
2024-01-30 17:52:00 UTC	16384	IN	Data Raw: 73 2c 6e 3d 65 2e 63 68 69 6c 64 72 65 6e 2c 6f 3d 74 68 69 73 2e 73 74 61 74 65 2e 61 63 74 69 76 61 74 65 64 3b 72 65 74 75 72 6e 20 4f 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 3a 65 74 28 5b 72 2c 28 74 3d 7b 7d 2c 74 2e 6d 65 63 74 72 6c 5f 66 6f 63 75 73 5f 76 69 73 69 62 6c 65 3d 6f 2c 74 29 5d 29 7d 2c 6e 29 7d 2c 66 72 29 3b 66 75 6e 63 74 69 6f 6e 20 66 72 28 74 29 7b 76 61 72 20 65 3d 75 72 2e 63 61 6c 6c 28 74 68 69 73 2c 74 29 7c 7c 74 68 69 73 3b 72 65 74 75 72 6e 20 65 2e 73 74 61 74 65 3d 7b 61 63 74 69 76 61 74 65 64 3a 21 21 74 2e 76 69 73 69 62 6c 65 4f 6e 53 74 61 72 74 7d 2c 65 2e 68 61 73 52 65 63 65 6e 74 4b 65 79 62 6f 61 72 64 41 63 74 69 6f 6e 3d 21 31 2c 65 2e 6b 65 79 64 6f 77 6e 48 61 6e 64 6c 65 72 3d 65 2e 6b 65 79 64 6f 77 6e Data Ascii: s,n=e.children,o=this.state.activated;return O("div",{class:et([r,(t={},t.mectrl_focus_visible=o,t)])},n)},fr);function fr(t){var e=ur.call(this,t)\|\|this;return e.state={activated:!!t.visibleOnStart},e.hasRecentKeyboardAction=!1,e.keydownHandler=e.keydown
2024-01-30 17:52:00 UTC	16384	IN	Data Raw: 49 64 70 22 3a 72 65 74 75 72 6e 21 31 3b 63 61 73 65 22 73 69 67 6e 4f 75 74 41 6e 64 46 6f 72 67 65 74 46 72 6f 6d 49 64 70 22 3a 72 65 74 75 72 6e 20 78 74 28 6e 75 6c 6c 3d 3d 3d 28 72 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 6d 73 61 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 72 3f 76 6f 69 64 20 30 3a 72 2e 73 69 67 6e 4f 75 74 41 6e 64 46 6f 72 67 65 74 55 72 6c 29 3b 63 61 73 65 22 73 77 69 74 63 68 22 3a 72 65 74 75 72 6e 20 78 74 28 74 68 69 73 2e 63 6f 6e 66 69 67 2e 61 70 70 53 77 69 74 63 68 55 72 6c 29 3b 63 61 73 65 22 73 77 69 74 63 68 54 6f 22 3a 72 65 74 75 72 6e 20 78 74 28 74 68 69 73 2e 63 6f 6e 66 69 67 2e 61 70 70 53 77 69 74 63 68 54 6f 55 72 6c 29 3b 63 61 73 65 22 67 65 74 52 65 6d 65 6d 62 65 72 65 64 41 63 63 6f 75 6e 74 73 22 3a 72 65 Data Ascii: Idp":return!1;case"signOutAndForgetFromIdp":return xt(null===(r=this.config.msa)\|\|void 0===r?void 0:r.signOutAndForgetUrl);case"switch":return xt(this.config.appSwitchUrl);case"switchTo":return xt(this.config.appSwitchToUrl);case"getRememberedAccounts":re
2024-01-30 17:52:00 UTC	16384	IN	Data Raw: 3c 6d 74 28 74 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 69 6e 64 65 78 4f 66 28 22 6c 6f 67 69 6e 2e 6c 69 76 65 2e 63 6f 6d 22 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 79 6e 28 74 29 7d 76 61 72 20 79 6e 3d 28 76 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 70 70 6f 72 74 73 4d 73 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 6d 73 61 6c 4a 73 57 69 74 68 4d 73 61 22 3d 3d 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 74 79 70 65 7d 2c 76 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 4f 70 65 72 61 74 69 6f 6e 53 75 70 70 6f 72 74 65 64 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 2c 6e 2c 6f 3b 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 22 73 69 67 6e 4f 75 74 46 72 6f 6d 49 64 70 22 3a 72 Data Ascii: <mt(t).toLowerCase().indexOf("login.live.com")}function mn(t){return new yn(t)}var yn=(vn.prototype.supportsMsa=function(){return"msalJsWithMsa"===this.config.type},vn.prototype.isOperationSupported=function(t,e){var r,n,o;switch(t){case"signOutFromIdp":r
2024-01-30 17:52:00 UTC	16384	IN	Data Raw: 3b 66 3c 64 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 7b 69 66 28 79 3d 6c 5b 6e 75 6c 6c 21 3d 28 6f 3d 64 5b 66 5d 2e 61 63 63 6f 75 6e 74 49 64 29 3f 6f 3a 64 5b 66 5d 2e 70 61 79 6c 6f 61 64 2e 6b 65 79 5d 29 7b 76 61 72 20 68 3d 64 5b 66 5d 2e 70 61 79 6c 6f 61 64 3b 79 2e 70 69 63 74 75 72 65 55 72 6c 3d 6e 75 6c 6c 21 3d 28 69 3d 79 2e 70 69 63 74 75 72 65 55 72 6c 29 3f 69 3a 68 2e 72 65 73 6f 75 72 63 65 2c 79 2e 63 61 63 68 65 4d 65 74 61 3f 79 2e 63 61 63 68 65 4d 65 74 61 2e 70 69 63 74 75 72 65 55 72 6c 3d 68 2e 72 65 73 6f 75 72 63 65 45 54 61 67 3a 79 2e 63 61 63 68 65 4d 65 74 61 3d 28 28 72 3d 7b 7d 29 2e 70 69 63 74 75 72 65 55 72 6c 3d 68 2e 72 65 73 6f 75 72 63 65 45 54 61 67 2c 72 29 7d 7d 72 65 74 75 72 6e 20 48 28 7b 7d 2c 6c 29 3b 63 61 Data Ascii: ;f<d.length;f++){if(y=l[null!=(o=d[f].accountId)?o:d[f].payload.key]){var h=d[f].payload;y.pictureUrl=null!=(i=y.pictureUrl)?i:h.resource,y.cacheMeta?y.cacheMeta.pictureUrl=h.resourceETag:y.cacheMeta=((r={}).pictureUrl=h.resourceETag,r)}}return H({},l);ca
2024-01-30 17:52:00 UTC	16384	IN	Data Raw: 33 61 32 70 78 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 33 62 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 5c 78 33 61 2d 32 70 78 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 37 64 2e 6d 65 63 74 72 6c 5f 67 6c 79 70 68 5c 78 37 62 6f 76 65 72 66 6c 6f 77 5c 78 33 61 68 69 64 64 65 6e 5c 78 33 62 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 5c 78 33 61 63 6f 76 65 72 5c 78 33 62 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 5c 78 33 61 63 65 6e 74 65 72 20 63 65 6e 74 65 72 5c 78 33 62 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 5c 78 33 61 6e 6f 2d 72 65 70 65 61 74 5c 78 37 64 2e 67 6c 79 70 68 5f 6d 6f 72 65 5c 78 37 62 77 69 64 74 68 5c 78 33 61 32 34 70 78 5c 78 33 62 68 65 69 67 68 74 5c 78 33 61 32 34 70 78 5c 78 37 64 2e 67 6c Data Ascii: 3a2px\x21important\x3boutline-offset\x3a-2px\x21important\x7d.mectrl_glyph\x7boverflow\x3ahidden\x3bbackground-size\x3acover\x3bbackground-position\x3acenter center\x3bbackground-repeat\x3ano-repeat\x7d.glyph_more\x7bwidth\x3a24px\x3bheight\x3a24px\x7d.gl
2024-01-30 17:52:00 UTC	16384	IN	Data Raw: 2e 32 35 5c 78 32 37 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 5c 78 33 64 5c 78 32 37 31 2e 35 5c 78 32 37 5c 78 32 66 5c 78 32 35 33 45 5c 78 32 35 33 43 67 20 74 72 61 6e 73 66 6f 72 6d 5c 78 33 64 5c 78 32 37 6d 61 74 72 69 78 5c 78 32 38 2e 39 20 30 20 30 20 2e 39 20 31 30 2e 34 33 31 20 31 30 2e 34 33 31 5c 78 32 39 5c 78 32 37 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 5c 78 33 64 5c 78 32 37 32 5c 78 32 37 5c 78 32 35 33 45 5c 78 32 35 33 43 63 69 72 63 6c 65 20 63 78 5c 78 33 64 5c 78 32 37 32 34 2e 32 35 5c 78 32 37 20 63 79 5c 78 33 64 5c 78 32 37 31 38 5c 78 32 37 20 72 5c 78 33 64 5c 78 32 37 39 5c 78 32 37 5c 78 32 66 5c 78 32 35 33 45 5c 78 32 35 33 43 70 61 74 68 20 64 5c 78 33 64 5c 78 32 37 4d 31 31 2e 32 20 34 30 61 31 20 31 20 30 20 31 31 32 Data Ascii: .25\x27 stroke-width\x3d\x271.5\x27\x2f\x253E\x253Cg transform\x3d\x27matrix\x28.9 0 0 .9 10.431 10.431\x29\x27 stroke-width\x3d\x272\x27\x253E\x253Ccircle cx\x3d\x2724.25\x27 cy\x3d\x2718\x27 r\x3d\x279\x27\x2f\x253E\x253Cpath d\x3d\x27M11.2 40a1 1 0 112
2024-01-30 17:52:00 UTC	16384	IN	Data Raw: 35 37 6d 31 20 35 2e 32 35 34 61 35 2e 33 35 35 20 35 2e 33 35 35 20 30 20 30 31 31 2e 33 38 37 2d 33 2e 38 38 37 20 35 2e 31 20 35 2e 31 20 30 20 30 31 33 2e 38 35 2d 31 2e 34 33 34 20 34 2e 37 34 31 20 34 2e 37 34 31 20 30 20 30 31 33 2e 36 32 33 20 31 2e 33 38 31 20 35 2e 32 30 38 20 35 2e 32 30 38 20 30 20 30 31 31 2e 33 20 33 2e 37 32 39 20 35 2e 32 35 39 20 35 2e 32 35 39 20 30 20 30 31 2d 31 2e 33 38 35 20 33 2e 38 33 20 35 2e 30 32 20 35 2e 30 32 20 30 20 30 31 2d 33 2e 37 37 33 20 31 2e 34 32 34 20 34 2e 39 33 31 20 34 2e 39 33 31 20 30 20 30 31 2d 33 2e 36 35 32 2d 31 2e 33 35 32 20 34 2e 39 38 34 20 34 2e 39 38 34 20 30 20 30 31 2d 31 2e 33 34 39 2d 33 2e 36 38 38 6d 32 2e 34 32 36 2d 2e 30 37 36 61 33 2e 35 33 20 33 2e 35 33 20 30 20 30 30 2e Data Ascii: 57m1 5.254a5.355 5.355 0 011.387-3.887 5.1 5.1 0 013.85-1.434 4.741 4.741 0 013.623 1.381 5.208 5.208 0 011.3 3.729 5.259 5.259 0 01-1.385 3.83 5.02 5.02 0 01-3.773 1.424 4.931 4.931 0 01-3.652-1.352 4.984 4.984 0 01-1.349-3.688m2.426-.076a3.53 3.53 0 00.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.17	49861	13.249.39.8	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:01 UTC	570	OUT	GET /www32/ptc/05d32363-d534-4d93-9b65-cde674775e71.js HTTP/1.1 Host: cdnssl.clicktale.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:01 UTC	664	IN	HTTP/1.1 200 OK Content-Type: application/javascript;charset=utf-8 Content-Length: 101502 Connection: close Date: Tue, 30 Jan 2024 17:52:02 GMT Last-Modified: Tue, 30 Jan 2024 12:14:40 GMT ETag: "d0f7df5a7dd1231fa0f17aa1f4c84643" x-amz-server-side-encryption: AES256 Cache-Control: max-age=900 Content-Encoding: gzip x-amz-version-id: ol5bLhAyuBdwD1YYE5QTnDpEMUtC5Dgw Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 824fe21e467658628899bdd8725649ee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: QqDiF6eaP81lUrW7Iu1YKta0Jw9TaCL4BxHolAvMeIITZdie_WcpsQ== Timing-Allow-Origin: * age: 0 Vary: Origin
2024-01-30 17:52:01 UTC	16384	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd 6b 5b db c8 b2 28 fc 7d ff 0a a3 cd 30 52 10 06 27 99 99 35 76 14 6f 02 4e c2 84 db 60 c8 cd 38 44 d8 0d 56 62 24 47 6a 43 88 ad f3 db 4f 55 f5 45 ad 8b 81 cc 5a fb 3c ef 87 77 f6 da c1 ea 7b 57 57 55 57 55 57 57 5f fb 71 6d ab 7b b6 75 b0 ff d2 9b 59 93 38 fa c2 06 7c 67 68 35 1f 3f 7d fc d8 b5 12 ee f3 69 62 35 1b ae 35 8a 12 1e fa 57 0c be 7a d6 55 30 88 a3 24 ba e0 f5 41 74 65 b9 d6 4d 10 0e a3 9b 44 7e f9 3f a6 31 bb 61 e7 49 c0 59 52 0f 19 87 34 5d 23 e1 51 cc b0 60 7d 10 aa b2 f5 62 7b c9 e4 87 bf 36 f0 43 3f be 95 f5 45 39 91 7b 31 8e 6e a0 f9 35 18 dd 65 10 5e d6 c3 c4 e7 03 2a d7 77 2d 6c 28 d9 8e ae fc 20 3c 8e fd c1 57 28 60 35 37 72 e9 5d 48 1b b3 9d 8b 18 a6 93 2f 13 85 09 0b f9 11 fb 36 0d 62 36 a4 34 7f Data Ascii: k[(}0R'5voN`8DVb$GjCOUEZ<w{WWUWUWW_qm{uY8\|gh5?}ib55WzU0$AteMD~?1aIYR4]#Q`}b{6C?E9{1n5e^*w-l( <W(`57r]H/6b64
2024-01-30 17:52:01 UTC	16384	IN	Data Raw: 57 06 ac 10 6d d0 b1 5b df 1d 0a 34 d9 61 2a e5 1f 56 3b 2a 97 07 54 bd a8 7a 3c e9 a1 e9 4f 87 5b 91 3c c8 a3 4b 76 76 c3 6d 38 2d 0c 2a 37 8e fc a1 f7 d1 c5 9f 82 83 7c 74 cb 57 f6 92 78 a0 7c 45 d4 0e ae a9 2b 55 5b 3a 50 57 fb f3 ba f1 95 92 67 44 1b 77 3e d8 f8 76 04 9b 89 ab 4e f6 8c d0 b2 d0 7e ee 28 2d fd ec 3e 76 ff a5 77 8d 78 11 b5 bf 55 54 be 55 d8 35 f6 69 f2 a1 8c 2f f6 b6 9e 17 d2 a5 26 b6 5f bf 9b b0 b1 90 6c 5e 62 8d a2 f3 03 d5 2f 36 81 d8 74 8f 14 e4 8b 2d e5 00 0f 85 dd b1 fa 18 d3 a1 d5 95 fa 94 57 84 dc 44 25 80 14 38 f8 8a 82 2e 4b 95 d3 d8 88 7b eb 59 fc da fa d9 2f ab 6b 7d 7c cb e3 7f e6 bf 3c dd 98 ff f2 f8 b7 a7 1b 8e 91 ff cb da 19 64 8b e7 3a 7e 79 dc 63 9d be 91 0b 35 1d 7c 7d 33 ca b5 b9 7a b6 d6 2f 34 b8 ee 0e b8 67 d9 bd Data Ascii: Wm[4aV;Tz<O[<Kvvm8-*7\|tWx\|E+U[:PWgDw>vN~(->vwxUTU5i/&_l^b/6t-WD%8.K{Y/k}\|<d:~yc5\|}3z/4g
2024-01-30 17:52:01 UTC	15202	IN	Data Raw: 6b 9f bc 67 2f 1a a9 38 a6 04 0b e3 d9 17 8b 63 0b 54 31 ea 3e 47 19 c7 55 fa bc f1 f3 df e4 d8 0b 5a 09 b0 b7 27 14 e4 de 05 b1 01 88 47 4d 74 eb 86 ca f9 86 4e 1b 8c d6 e1 6e 1c dd 22 9a 29 8a 55 9c f9 b1 91 8d c3 e0 2d 77 a9 4f c1 b0 58 c2 8b 70 39 70 ef 6f 67 ab 63 bc 58 9c 71 3d f4 e9 f1 c5 be e9 ac 91 08 6d 91 08 9d ac 68 0e 45 af cf a9 2b ea d5 c4 3b 9a f6 e4 84 4f 06 37 29 6d 89 43 23 18 24 d0 14 c0 39 e9 f2 cb 31 c8 7c 88 6a e3 9e 97 90 d5 b6 7d c2 96 91 d6 2a 19 50 d1 62 27 26 69 14 e7 25 5e 8a 1e 3e 3b d7 14 ed 2c 5b 01 cb 09 47 ee 6c 6c 11 a3 4c 9a 6f 0a e8 99 a9 ad cb dc 03 d7 03 0d 74 27 04 86 ad e5 cd 31 54 c8 15 22 5a 9c 0b 5a 44 f3 87 83 a8 99 67 68 b7 a6 f5 1a a5 e9 4b cb 7b 04 76 4c eb b1 25 b9 3e 12 97 61 1f 6d 66 75 79 64 08 d3 82 91 Data Ascii: kg/8cT1>GUZ'GMtNn")U-wOXp9pogcXq=mhE+;O7)mC#$91\|j}*Pb'&i%^>;,[GllLot'1T"ZZDghK{vL%>amfuyd
2024-01-30 17:52:01 UTC	16384	IN	Data Raw: b8 13 9d 9b 67 96 bb 49 8c 08 68 ce de 62 ee de a2 e2 d1 a5 45 98 87 d5 8b 03 63 ff 54 4d 2a 5a d6 4c ee 16 68 e9 07 c5 d8 9c 68 a1 0f c8 ed 99 a5 bd 37 b2 76 41 cd 78 5c ae 71 70 9f a1 53 d9 7b a5 a6 c6 94 d2 50 63 07 61 f0 98 f6 93 1b 60 7b 9b 2f 7f ce a4 54 ba 6f de b9 f2 02 6a 58 0b 48 1f c5 21 9d 6c 83 50 3d 7d 9d a1 9d 49 7a 2e 77 fa d6 48 29 7c fc 39 52 f6 33 5f 46 ca cb d1 de 28 90 f4 fc 47 a9 29 f5 65 d4 50 4d 99 21 ef 76 01 cf 72 7e 12 b4 f5 a1 0f 10 4d 2d 59 79 d9 ed 81 54 8b 24 34 45 8a 6a fa 92 1e ac 52 2f 57 71 09 11 2b 2b ff 97 2a 76 8b 15 83 a6 51 13 49 7d 53 af 15 d3 0e 89 73 53 7a 6d f6 95 cf 09 69 27 30 32 97 db a3 0d fc 23 71 e8 a4 73 05 03 68 27 c8 58 29 3f 41 75 1d 23 13 80 30 44 95 78 cc 5c a1 c3 de 48 fb 8f fa 13 4f fa 59 6c 98 b6 Data Ascii: gIhbEcTMZLhh7vAx\qpS{Pca`{/TojXH!lP=}Iz.wH)\|9R3_F(G)ePM!vr~M-YyT$4EjR/Wq++vQI}SsSzmi'02#qsh'X)?Au#0Dx\HOYl
2024-01-30 17:52:01 UTC	4640	IN	Data Raw: d3 b6 61 bb c5 04 76 2f 7b 0b 87 ff 18 c6 44 41 ea 2c 3d a9 4f 79 71 30 2a 73 2f 9f 72 1d cd 55 4a 28 51 4d 48 da 0a 55 81 31 93 c0 18 15 7e 6e 70 28 28 97 22 c3 54 1c de a3 9a 9f a4 cf 94 20 b2 a1 67 2c 35 d1 79 95 5a c5 ad 55 55 a0 b3 f9 6b f3 de 7c 75 3b f7 38 4d 50 f6 8b 27 0c 45 a1 49 2f 18 f1 32 21 81 21 7c 8f 88 62 9e c3 a1 a7 f6 27 64 d5 14 23 34 2b a3 a8 98 97 53 2d b4 55 e5 da ee cc 15 47 40 b8 d5 23 69 2d b9 2d 5a 45 04 92 f9 3c 2c 12 cb 21 1d 2c 8e 3d 1c 9a 30 4d 61 9e 9f 77 f9 74 a0 43 1e 38 2a 0b 56 b7 ff 8a 17 e4 7f 4d 7c c1 7e 2e 17 a5 58 5d 10 16 14 78 34 5b 9f 5b c5 00 ad 2b 46 0f 92 c6 14 3a 83 65 ab aa e7 ee 35 3e 1c 49 e8 ff 0a bf 6c 1b cc fd 10 d6 b3 a7 b8 cd 9b 08 69 c7 d9 16 9e 37 91 a4 20 b1 06 3f 23 1c 22 cf be bd 71 c4 9a d4 a3 Data Ascii: av/{DA,=Oyq0s/rUJ(QMHU1~np(("T g,5yZUUk\|u;8MP'EI/2!!\|b'd#4+S-UG@#i--ZE<,!,=0MawtC8VM\|~.X]x4[[+F:e5>Ili7 ?#"q
2024-01-30 17:52:01 UTC	16384	IN	Data Raw: 96 81 7f 62 00 ac 8c b3 04 97 05 12 3c f8 2e 28 f4 47 f2 50 3c c4 19 c6 c2 67 ed 09 4d c9 2e c6 f1 5d c5 a1 0b 2b 87 ae c2 8a ab 40 81 7d 61 51 c9 03 d8 ba 1f 47 69 a8 29 90 b8 0f 14 48 d9 b1 8a 0a 65 9f f5 99 a7 7c b6 6c f3 94 67 8a bc d2 c8 58 98 a6 6a ab 14 2e 38 46 37 82 68 dc d6 0d 07 f8 0c cb 26 fa 18 80 4e de 45 aa 7f 22 05 91 96 22 59 21 32 ea 82 d5 4d 29 42 44 87 1d 77 f4 d5 cd a7 a7 c8 26 a0 5a 2c 48 f3 f6 ea 06 8b 94 9c db ff cc e3 cc 79 ce 33 bd 67 2b ad b5 67 b5 b3 eb b0 35 eb 41 78 a7 9a 7d 54 e3 2f 52 83 98 3c ce e5 a4 81 85 b6 af 81 a4 ff c7 7f 84 ff 10 52 fd 38 f1 d2 44 4b 00 87 89 ed 74 26 b8 de 0c c7 a3 e4 01 e9 a3 fd a4 8f 8f fb 71 d2 de 9c 04 a3 0d f1 c0 44 a3 c3 55 40 f5 d5 b9 8a 17 a5 57 04 26 b0 8e bf 4d 82 34 c4 08 ee 07 27 5b 07 Data Ascii: b<.(GP<gM.]+@}aQGi)He\|lgXj.8F7h&NE""Y!2M)BDw&Z,Hy3g+g5Ax}T/R<R8DKt&qDU@W&M4'[
2024-01-30 17:52:01 UTC	16124	IN	Data Raw: 7c fc 43 45 59 47 59 7c de 55 53 fd 9d 67 e3 fa ce d4 0b 65 25 17 99 f2 d7 98 f0 5a d7 9c 3b 7e b2 dd d9 ae 04 a6 d4 d5 86 66 de 1c 1c ed be eb ec 5d be f9 7a b9 7b 74 78 82 ae 21 e6 d9 14 d5 a3 1b 95 33 bb 30 fb ea a2 c1 30 38 b0 8e ce 2f a7 c6 fe 14 91 82 68 32 d8 bb da 08 5f ba 0f 12 17 4f e1 b6 8a 23 e2 e1 d7 32 f7 03 8c fc 27 6c 3f 59 c8 bf bc e5 a7 3d d7 a1 ff eb 90 95 98 83 9a 25 ed 0f dd c1 0f 17 4d 7c 32 a6 f1 82 b0 cf 8e 35 c0 6c 1a e0 4e 12 3d 15 b0 71 2b 4d 12 b6 7c c6 a7 2e b0 fb 91 2e 46 4f 21 4f bb 99 27 c6 7c c2 94 9b 6e 0b 4c ee 5c c7 9d e2 35 5a 5a 46 25 44 9b 5d f0 9d 93 df 5c 88 e8 4b 9b cd 51 40 bb 98 d4 d4 c9 75 11 fa 28 79 c8 e6 7f 91 40 fe db 28 84 ea eb 81 1d 8c 38 15 5c 92 2a 0f 45 61 ea 26 82 81 8b 27 61 d4 1c e1 03 1c 71 c9 7b Data Ascii: \|CEYGY\|USge%Z;~f]z{tx!3008/h2_O#2'l?Y=%M\|25lN=q+M\|..FO!O'\|nL\5ZZF%D]\KQ@u(y@(8\*Ea&'aq{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.17	49892	13.107.213.40	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:01 UTC	594	OUT	GET /scripts/me/MeControl/10.23347.2/en-US/meCore.min.js HTTP/1.1 Host: mem.gfx.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:01 UTC	608	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:01 GMT Content-Type: application/javascript Content-Length: 100769 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Wed, 24 Jan 2024 08:13:30 GMT ETag: "1da4ee0451d38a1" X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains x-azure-ref: 20240130T175201Z-667zcwatsd4kf6p99kcpxt9x6c00000000a000000000at1c x-fd-int-roxy-purgeid: 38334287 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-01-30 17:52:01 UTC	15776	IN	Data Raw: 4d 65 43 6f 6e 74 72 6f 6c 44 65 66 69 6e 65 28 22 6d 65 43 6f 72 65 22 2c 5b 22 65 78 70 6f 72 74 73 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 69 6e 6c 69 6e 65 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 62 6f 6f 74 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 66 2c 68 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 72 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 26 26 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 74 7d 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 74 29 Data Ascii: MeControlDefine("meCore",["exports","@mecontrol/web-inline","@mecontrol/web-boot"],function(e,f,h){"use strict";var r=function(e,t){return(r=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var n in t)
2024-01-30 17:52:01 UTC	16384	IN	Data Raw: 6e 63 65 28 74 2e 65 78 70 61 6e 64 65 64 53 63 72 6f 6c 6c 48 61 6e 64 6c 65 72 2e 62 69 6e 64 28 74 29 29 2c 74 2e 73 74 61 74 65 3d 7b 65 78 70 61 6e 64 65 64 3a 21 31 7d 2c 74 7d 66 75 6e 63 74 69 6f 6e 20 24 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 6e 65 77 20 66 2e 53 79 6e 74 68 65 74 69 63 45 76 65 6e 74 28 22 63 6f 6d 6d 61 6e 64 63 6c 69 63 6b 22 2c 7b 63 6f 6d 6d 61 6e 64 49 64 3a 74 2e 69 64 2c 63 75 72 72 65 6e 74 41 63 63 6f 75 6e 74 3a 6e 7d 29 2c 6f 3d 66 2e 67 65 74 4f 70 74 69 6f 6e 73 28 29 3b 6f 26 26 28 6f 2e 73 79 6e 74 68 65 74 69 63 45 76 65 6e 74 54 61 72 67 65 74 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 72 29 7c 7c 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 29 2c 74 2e 6f 6e 43 6c 69 63 6b 26 26 28 74 2e 6f 6e 43 Data Ascii: nce(t.expandedScrollHandler.bind(t)),t.state={expanded:!1},t}function $(e,t,n){var r=new f.SyntheticEvent("commandclick",{commandId:t.id,currentAccount:n}),o=f.getOptions();o&&(o.syntheticEventTarget.dispatchEvent(r)\|\|e.preventDefault()),t.onClick&&(t.onC
2024-01-30 17:52:01 UTC	16384	IN	Data Raw: 7b 70 61 72 74 41 3a 6e 2c 70 61 72 74 42 3a 7b 76 65 72 3a 22 31 2e 30 22 2c 69 6d 70 72 65 73 73 69 6f 6e 47 75 69 64 3a 74 2e 69 6d 70 72 65 73 73 69 6f 6e 47 75 69 64 2c 6d 61 72 6b 65 74 3a 66 2e 4d 45 2e 43 6f 6e 66 69 67 2e 6d 6b 74 2c 70 61 67 65 54 61 67 73 3a 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 66 2e 67 65 74 50 61 67 65 54 61 67 73 28 74 2e 61 63 63 6f 75 6e 74 73 2e 63 6f 75 6e 74 73 2c 74 2e 61 63 63 6f 75 6e 74 73 2e 63 75 72 72 65 6e 74 29 29 2c 63 6f 6e 74 65 6e 74 56 65 72 3a 22 32 2e 30 22 2c 63 6f 6e 74 65 6e 74 3a 22 5b 22 2b 72 2b 22 5d 22 7d 2c 70 61 72 74 43 3a 7b 62 61 73 65 54 79 70 65 3a 46 65 2c 70 61 67 65 4c 6f 61 64 54 69 6d 65 3a 4d 61 74 68 2e 72 6f 75 6e 64 28 65 2e 6c 6f 61 64 54 69 6d 65 29 2c 74 69 6d 69 6e 67 Data Ascii: {partA:n,partB:{ver:"1.0",impressionGuid:t.impressionGuid,market:f.ME.Config.mkt,pageTags:JSON.stringify(f.getPageTags(t.accounts.counts,t.accounts.current)),contentVer:"2.0",content:"["+r+"]"},partC:{baseType:Fe,pageLoadTime:Math.round(e.loadTime),timing
2024-01-30 17:52:01 UTC	16384	IN	Data Raw: 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 33 62 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 66 66 66 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 33 62 66 69 6c 6c 5c 78 33 61 5c 78 32 33 66 66 66 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 33 62 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 5c 78 33 61 70 75 72 70 6c 65 5c 78 37 64 2e 6d 65 63 74 72 6c 5f 74 68 65 6d 65 5f 61 7a 75 72 65 5f 68 63 6c 69 67 68 74 20 2e 6d 65 63 74 72 6c 5f 63 75 72 72 65 6e 74 41 63 63 6f 75 6e 74 20 61 2e 6d 65 63 74 72 6c 5f 73 69 67 6e 6f 75 74 5c 78 33 61 61 63 74 69 76 65 5c 78 37 62 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 2d 61 64 6a 75 73 74 5c 78 33 61 6e 6f 6e 65 5c 78 33 62 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 66 66 66 5c 78 32 31 Data Ascii: 21important\x3boutline-color\x3a\x23fff\x21important\x3bfill\x3a\x23fff\x21important\x3bbackground-color\x3apurple\x7d.mectrl_theme_azure_hclight .mectrl_currentAccount a.mectrl_signout\x3aactive\x7b-ms-high-contrast-adjust\x3anone\x3bcolor\x3a\x23fff\x21
2024-01-30 17:52:01 UTC	16384	IN	Data Raw: 74 72 6c 5f 6d 65 6e 75 20 75 6c 20 6c 69 20 61 2c 2e 6d 65 63 74 72 6c 5f 6d 65 6e 75 20 75 6c 20 6c 69 20 62 75 74 74 6f 6e 5c 78 37 62 62 6f 72 64 65 72 5c 78 33 61 73 6f 6c 69 64 20 31 70 78 5c 78 37 64 5c 78 37 64 2e 6d 65 63 74 72 6c 5f 6d 65 6e 75 2e 66 69 78 65 64 2d 6d 65 6e 75 20 75 6c 5c 78 37 62 70 6f 73 69 74 69 6f 6e 5c 78 33 61 66 69 78 65 64 5c 78 37 64 2e 6d 65 63 74 72 6c 5f 6d 65 6e 75 20 75 6c 5c 78 37 62 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 33 33 33 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 33 62 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 66 66 66 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 37 64 2e 6d 65 63 74 72 6c 5f 6d 65 6e 75 20 75 6c 20 61 5c 78 33 61 66 6f 63 75 73 2c 2e 6d 65 63 74 72 6c 5f Data Ascii: trl_menu ul li a,.mectrl_menu ul li button\x7bborder\x3asolid 1px\x7d\x7d.mectrl_menu.fixed-menu ul\x7bposition\x3afixed\x7d.mectrl_menu ul\x7bcolor\x3a\x23333\x21important\x3bbackground-color\x3a\x23fff\x21important\x7d.mectrl_menu ul a\x3afocus,.mectrl_
2024-01-30 17:52:02 UTC	16384	IN	Data Raw: 69 6f 6e 2e 73 69 67 6e 49 6e 5c 78 37 62 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 30 66 66 5c 78 37 64 5c 78 37 64 5c 78 34 30 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 5c 78 32 38 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 5c 78 33 61 62 6c 61 63 6b 2d 6f 6e 2d 77 68 69 74 65 5c 78 32 39 5c 78 37 62 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 49 74 65 6d 20 2e 70 72 69 6d 61 72 79 41 63 74 69 6f 6e 2e 65 78 70 61 6e 64 65 64 2e 73 69 67 6e 49 6e 2c 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 49 74 65 6d 5c 78 33 61 68 6f 76 65 72 20 2e 70 72 69 6d 61 72 79 41 63 74 69 6f 6e 2e 73 69 67 6e 49 6e 5c 78 37 62 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 5c 78 33 61 69 6e 64 69 67 6f 5c 78 37 64 5c 78 37 Data Ascii: ion.signIn\x7bbackground-color\x3a\x230ff\x7d\x7d\x40media screen and \x28-ms-high-contrast\x3ablack-on-white\x29\x7b.mectrl_accountItem .primaryAction.expanded.signIn,.mectrl_accountItem\x3ahover .primaryAction.signIn\x7bbackground-color\x3aindigo\x7d\x7
2024-01-30 17:52:02 UTC	3073	IN	Data Raw: 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 41 63 74 69 6f 6e 73 20 2e 6d 65 63 74 72 6c 5f 74 72 69 67 67 65 72 2e 65 78 70 61 6e 64 65 64 2c 2e 6d 65 63 74 72 6c 5f 74 68 65 6d 65 5f 61 7a 75 72 65 5f 68 63 6c 69 67 68 74 20 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 41 63 74 69 6f 6e 73 20 2e 6d 65 63 74 72 6c 5f 74 72 69 67 67 65 72 5c 78 33 61 68 6f 76 65 72 5c 78 37 62 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 2d 61 64 6a 75 73 74 5c 78 33 61 6e 6f 6e 65 5c 78 33 62 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 66 66 66 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 33 62 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 66 66 66 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 33 62 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 5c 78 33 61 5c 78 Data Ascii: .mectrl_accountActions .mectrl_trigger.expanded,.mectrl_theme_azure_hclight .mectrl_accountActions .mectrl_trigger\x3ahover\x7b-ms-high-contrast-adjust\x3anone\x3bcolor\x3a\x23fff\x21important\x3bborder-color\x3a\x23fff\x21important\x3boutline-color\x3a\x

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.17	49899	13.249.39.8	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:01 UTC	596	OUT	GET /ptc/05d32363-d534-4d93-9b65-cde674775e71.js HTTP/1.1 Host: cdnssl.clicktale.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:02 UTC	680	IN	HTTP/1.1 200 OK Content-Type: application/javascript;charset=utf-8 Content-Length: 8974 Connection: close Date: Tue, 30 Jan 2024 17:52:03 GMT Last-Modified: Thu, 11 May 2023 10:12:31 GMT ETag: "622f24308eaf40bf90ba625e020082d3" x-amz-server-side-encryption: AES256 Content-Encoding: gzip x-amz-version-id: fYD1i0O1lPkoncNABFgGTGngT2QcdrTe Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 841dfa6074cf4b3b0718988f088a4ac2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: elygZY3aMfq7sxVeROVNJLqpDoVJjvqPsyAwclBiW5WoE4ksOd24QA== Timing-Allow-Origin: * age: 0 cache-control: max-age=900 Access-Control-Allow-Origin: *
2024-01-30 17:52:02 UTC	8974	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 dd 3d 6b 57 db c8 92 9f c9 39 f3 1f 84 ee 5e 6c 07 59 7e 40 92 c1 8c 93 e5 91 0c e4 42 60 b1 c3 dc c3 e3 e6 08 a9 6d 6b 90 25 8f 24 db 78 c0 ff 7d ab fa 21 b5 a4 96 21 f3 d8 0f ab 9c 80 d4 5d 5d 5d 5d 5d 5d 5d 55 fd a0 d1 d0 0e 82 c9 22 74 87 a3 58 6b 37 9b 6f eb ed 66 7b 4b 3b f0 5c fb be 6f 79 44 3b 89 1d d3 d0 be f6 b4 73 2b 26 7e ac 9d 13 df 71 fd e1 0f af 7e 78 35 77 7d 27 98 9b 09 ec cf 5e 70 67 79 5a 57 2b c9 78 7a d2 1e 97 bb c5 72 3d 12 c7 80 32 52 94 4c b2 44 d9 1f 5e e5 b0 9a ae ef c6 50 52 99 2c 4a e5 33 23 3b 74 27 71 a4 28 26 72 9e 29 69 ce 48 18 b9 81 8f 28 1e f5 79 a8 77 34 fd 2e 74 9d 21 a9 ff 72 d1 6a 35 cd 5f 23 dd d0 f4 89 6d 63 4e f3 8d b3 d5 de 7a bb 55 77 de 6c 6d d7 b7 9d 9d ad fa ce dd db 37 75 db 21 Data Ascii: =kW9^lY~@B`mk%$x}!!]]]]]]]U"tXk7of{K;\oyD;s+&~q~x5w}'^pgyZW+xzr=2RLD^PR,J3#;t'q(&r)iH(yw4.t!rj5_#mcNzUwlm7u!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.17	49860	35.186.249.72	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:02 UTC	565	OUT	GET /A1133099-331c-4cdf-89b0-06dc20e168021.js HTTP/1.1 Host: d.impactradius-event.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:02 UTC	907	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ABPtcPrqOoqPM1nhe8b-XioecZZZZl3ynyimLFfeK0VBNT5oVX4nnX9XTkMlsH9_i7YRaGlZhoZvmEscJA Date: Tue, 30 Jan 2024 17:52:02 GMT Cache-Control: public,max-age=900,s-maxage=300 Expires: Tue, 30 Jan 2024 17:57:02 GMT Last-Modified: Wed, 21 Jun 2023 05:00:54 GMT ETag: W/"c5213aa0c5ce08f257e44e7481d1d715" Vary: Accept-Encoding x-goog-generation: 1687323654495303 x-goog-metageneration: 1 x-goog-stored-content-encoding: gzip x-goog-stored-content-length: 14108 Content-Type: text/javascript; charset=utf-8 x-goog-hash: crc32c=k4rq6w== x-goog-hash: md5=xSE6oMXOCPJX5E50gdHXFQ== x-goog-storage-class: MULTI_REGIONAL Access-Control-Allow-Origin: * X-GUploader-Response-Body-Transformations: gunzipped Warning: 214 UploadServer gunzipped Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2024-01-30 17:52:02 UTC	345	IN	Data Raw: 61 37 30 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 29 7b 76 61 72 20 69 6f 3d 7b 75 74 69 6c 3a 7b 67 65 74 51 75 65 72 79 50 61 72 61 6d 3a 66 75 6e 63 74 69 6f 6e 28 70 29 7b 76 61 72 20 75 72 6c 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 2c 6d 61 74 63 68 3b 69 66 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 69 6e 64 65 78 4f 66 28 22 23 22 29 21 3d 3d 2d 31 29 7b 75 72 6c 2b 3d 22 26 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 73 70 6c 69 74 28 22 23 22 29 5b 31 5d 7d 6d 61 74 63 68 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5b 3f 26 5d 22 2b 70 2b 22 3d 28 5b 5e 26 5d 2a 29 22 2c 22 69 22 29 2e 65 78 65 63 28 75 72 6c 29 3b 72 65 74 75 72 6e 20 6d 61 74 63 68 3f 69 6f 2e 75 74 69 Data Ascii: a70(function(w,d){var io={util:{getQueryParam:function(p){var url=window.location.search,match;if(window.location.href.indexOf("#")!==-1){url+="&"+window.location.href.split("#")[1]}match=new RegExp("[?&]"+p+"=([^&]*)","i").exec(url);return match?io.uti
2024-01-30 17:52:02 UTC	1252	IN	Data Raw: 75 65 21 3d 3d 75 6e 64 65 66 69 6e 65 64 7d 2c 73 74 72 43 6f 6e 74 61 69 6e 73 3a 66 75 6e 63 74 69 6f 6e 28 73 74 72 2c 76 61 6c 75 65 29 7b 72 65 74 75 72 6e 20 73 74 72 2e 69 6e 64 65 78 4f 66 28 76 61 6c 75 65 29 21 3d 3d 2d 31 7d 2c 61 64 64 4c 69 73 74 65 6e 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 6c 2c 65 76 2c 66 6e 29 7b 69 66 28 65 6c 29 7b 69 66 28 65 6c 2e 61 74 74 61 63 68 45 76 65 6e 74 29 7b 65 6c 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 22 2b 65 76 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6e 2e 63 61 6c 6c 28 65 6c 29 7d 29 7d 65 6c 73 65 7b 65 6c 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 65 76 2c 66 6e 2c 66 61 6c 73 65 29 7d 7d 7d 2c 72 65 6d 6f 76 65 4c 69 73 74 65 6e 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 6c 2c 65 76 Data Ascii: ue!==undefined},strContains:function(str,value){return str.indexOf(value)!==-1},addListener:function(el,ev,fn){if(el){if(el.attachEvent){el.attachEvent("on"+ev,function(){fn.call(el)})}else{el.addEventListener(ev,fn,false)}}},removeListener:function(el,ev
2024-01-30 17:52:02 UTC	1082	IN	Data Raw: 66 28 62 44 6f 6d 61 69 6e 29 7b 63 56 61 6c 75 65 2b 3d 22 3b 20 64 6f 6d 61 69 6e 3d 22 2b 62 44 6f 6d 61 69 6e 7d 7d 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 63 56 61 6c 75 65 3b 72 65 74 75 72 6e 20 76 7d 2c 64 65 6c 65 74 65 43 6f 6f 6b 69 65 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 69 6f 2e 75 74 69 6c 2e 73 65 74 43 6f 6f 6b 69 65 28 6e 2c 22 22 2c 2d 31 29 7d 2c 67 65 74 43 6f 6f 6b 69 65 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 63 6b 73 3d 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 2e 73 70 6c 69 74 28 22 3b 22 29 2c 6c 65 6e 3d 63 6b 73 2e 6c 65 6e 67 74 68 2c 78 2c 61 2c 62 3b 66 6f 72 28 78 3d 30 3b 78 3c 6c 65 6e 3b 78 2b 2b 29 7b 61 3d 63 6b 73 5b 78 5d 2e 73 75 62 73 74 72 28 30 2c 63 6b 73 5b 78 5d 2e 69 6e 64 65 78 4f 66 Data Ascii: f(bDomain){cValue+="; domain="+bDomain}}document.cookie=cValue;return v},deleteCookie:function(n){io.util.setCookie(n,"",-1)},getCookie:function(n){var cks=document.cookie.split(";"),len=cks.length,x,a,b;for(x=0;x<len;x++){a=cks[x].substr(0,cks[x].indexOf
2024-01-30 17:52:02 UTC	1252	IN	Data Raw: 31 30 30 30 0d 0a 61 6c 6c 28 73 6f 75 72 63 65 2c 6e 65 78 74 4b 65 79 29 29 7b 6f 75 74 70 75 74 5b 6e 65 78 74 4b 65 79 5d 3d 73 6f 75 72 63 65 5b 6e 65 78 74 4b 65 79 5d 7d 7d 7d 72 65 74 75 72 6e 20 6f 75 74 70 75 74 7d 2c 6c 6f 67 67 65 72 3a 66 75 6e 63 74 69 6f 6e 28 70 72 65 66 69 78 29 7b 76 61 72 20 6e 6f 6f 70 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 72 65 74 75 72 6e 7b 64 65 62 75 67 3a 6e 6f 6f 70 2c 65 72 72 6f 72 3a 66 75 6e 63 74 69 6f 6e 28 65 76 74 2c 6d 73 67 2c 76 65 72 73 69 6f 6e 2c 61 63 63 6f 75 6e 74 49 64 29 7b 74 72 79 7b 76 61 72 20 69 6d 67 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6d 67 22 29 2c 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 73 2d 30 31 2e 6c 6f 67 67 6c 79 2e 63 6f 6d Data Ascii: 1000all(source,nextKey)){output[nextKey]=source[nextKey]}}}return output},logger:function(prefix){var noop=function(){};return{debug:noop,error:function(evt,msg,version,accountId){try{var img=document.createElement("img"),src="https://logs-01.loggly.com
2024-01-30 17:52:02 UTC	1252	IN	Data Raw: 6c 6c 52 65 61 64 79 28 29 7b 76 61 72 20 63 61 6c 6c 62 61 63 6b 73 3d 72 65 61 64 79 43 61 6c 6c 73 3b 69 66 28 69 73 50 61 67 65 4c 6f 61 64 65 64 29 7b 69 66 28 63 61 6c 6c 62 61 63 6b 73 2e 6c 65 6e 67 74 68 29 7b 72 65 61 64 79 43 61 6c 6c 73 3d 5b 5d 3b 72 75 6e 43 61 6c 6c 62 61 63 6b 73 28 63 61 6c 6c 62 61 63 6b 73 29 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 61 67 65 4c 6f 61 64 65 64 28 29 7b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 29 7b 69 66 28 21 69 73 50 61 67 65 4c 6f 61 64 65 64 29 7b 69 73 50 61 67 65 4c 6f 61 64 65 64 3d 74 72 75 65 3b 69 66 28 73 63 72 6f 6c 6c 49 6e 74 65 72 76 61 6c 49 64 29 7b 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 73 63 72 6f 6c 6c 49 6e 74 65 72 76 61 6c 49 64 29 7d 63 61 6c 6c 52 65 61 64 79 28 29 7d 7d Data Ascii: llReady(){var callbacks=readyCalls;if(isPageLoaded){if(callbacks.length){readyCalls=[];runCallbacks(callbacks)}}}function pageLoaded(){if(document.body){if(!isPageLoaded){isPageLoaded=true;if(scrollIntervalId){clearInterval(scrollIntervalId)}callReady()}}
2024-01-30 17:52:02 UTC	1252	IN	Data Raw: 2c 66 75 6e 63 74 69 6f 6e 28 63 6f 64 65 2c 68 65 78 31 2c 68 65 78 32 29 7b 76 61 72 20 6e 31 3d 70 61 72 73 65 49 6e 74 28 68 65 78 31 2c 31 36 29 2d 31 39 32 3b 69 66 28 6e 31 3c 32 29 7b 72 65 74 75 72 6e 20 63 6f 64 65 7d 76 61 72 20 6e 32 3d 70 61 72 73 65 49 6e 74 28 68 65 78 32 2c 31 36 29 2d 31 32 38 3b 72 65 74 75 72 6e 20 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 28 6e 31 3c 3c 36 29 2b 6e 32 29 7d 29 3b 73 3d 73 2e 72 65 70 6c 61 63 65 28 2f 25 28 5b 30 2d 37 5d 5b 30 2d 39 41 2d 46 5d 29 2f 67 69 2c 66 75 6e 63 74 69 6f 6e 28 63 6f 64 65 2c 68 65 78 29 7b 72 65 74 75 72 6e 20 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 70 61 72 73 65 49 6e 74 28 68 65 78 2c 31 36 29 29 7d 29 7d 72 65 74 75 72 6e 20 73 7d 2c Data Ascii: ,function(code,hex1,hex2){var n1=parseInt(hex1,16)-192;if(n1<2){return code}var n2=parseInt(hex2,16)-128;return String.fromCharCode((n1<<6)+n2)});s=s.replace(/%([0-7][0-9A-F])/gi,function(code,hex){return String.fromCharCode(parseInt(hex,16))})}return s},
2024-01-30 17:52:02 UTC	348	IN	Data Raw: 69 6c 64 28 5f 63 6c 65 61 6e 49 66 72 61 6d 65 29 3b 76 61 72 20 63 6c 65 61 6e 43 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 3d 5f 63 6c 65 61 6e 49 66 72 61 6d 65 2e 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 3b 76 61 72 20 5f 69 73 4e 61 74 69 76 65 52 45 3d 2f 5e 5c 73 2a 66 75 6e 63 74 69 6f 6e 5c 73 2a 28 5c 62 5b 61 2d 7a 24 5f 5d 5b 61 2d 7a 30 2d 39 24 5f 5d 2a 5c 62 29 2a 5c 73 2a 5c 28 28 7c 28 5b 61 2d 7a 24 5f 5d 5b 61 2d 7a 30 2d 39 24 5f 5d 2a 29 28 5c 73 2a 2c 5b 61 2d 7a 24 5f 5d 5b 61 2d 7a 30 2d 39 24 5f 5d 2a 29 2a 29 5c 29 5c 73 2a 7b 5c 73 2a 5c 5b 6e 61 74 69 76 65 20 63 6f 64 65 5c 5d 5c 73 2a 7d 5c 73 2a 24 2f 69 3b 76 61 72 20 5f 72 65 48 6f 73 74 43 74 6f 72 3d 2f 5e 5c 5b 6f 62 6a 65 63 74 20 2e 2b 3f 43 6f 6e 73 74 72 75 63 74 6f 72 5c Data Ascii: ild(_cleanIframe);var cleanContentWindow=_cleanIframe.contentWindow;var _isNativeRE=/^\sfunction\s(\b[a-z$_][a-z0-9$_]\b)\s$(\|([a-z$_][a-z0-9$_])(\s,[a-z$_][a-z0-9$_]))$\s{\s\[native code\]\s}\s*$/i;var _reHostCtor=/^\[object .+?Constructor\
2024-01-30 17:52:02 UTC	1252	IN	Data Raw: 38 30 30 30 0d 0a 57 69 6e 64 6f 77 2e 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3b 76 61 72 20 69 73 4e 61 74 69 76 65 46 75 6e 63 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 66 75 6e 63 29 7b 76 61 72 20 74 79 70 65 3d 74 79 70 65 6f 66 20 66 75 6e 63 3b 72 65 74 75 72 6e 20 74 79 70 65 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 5f 69 73 4e 61 74 69 76 65 52 45 2e 74 65 73 74 28 5f 66 6e 54 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 66 75 6e 63 29 29 3a 28 66 75 6e 63 26 26 74 79 70 65 3d 3d 3d 22 6f 62 6a 65 63 74 22 26 26 5f 72 65 48 6f 73 74 43 74 6f 72 2e 74 65 73 74 28 5f 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 66 75 6e 63 29 29 29 7c 7c 66 61 6c 73 65 7d 3b 69 66 28 21 69 73 4e 61 74 69 76 65 46 75 6e 63 74 69 6f Data Ascii: 8000Window.Function.prototype.toString;var isNativeFunction=function(func){var type=typeof func;return type==="function"?_isNativeRE.test(_fnToString.call(func)):(func&&type==="object"&&_reHostCtor.test(_toString.call(func)))\|\|false};if(!isNativeFunctio
2024-01-30 17:52:02 UTC	1252	IN	Data Raw: 65 66 74 28 57 5b 74 2d 33 5d 5e 57 5b 74 2d 38 5d 5e 57 5b 74 2d 31 34 5d 5e 57 5b 74 2d 31 36 5d 2c 31 29 7d 6c 65 74 20 61 3d 48 5b 30 5d 2c 62 3d 48 5b 31 5d 2c 63 3d 48 5b 32 5d 2c 64 3d 48 5b 33 5d 2c 65 3d 48 5b 34 5d 3b 66 6f 72 28 6c 65 74 20 74 3d 30 3b 74 3c 38 30 3b 2b 2b 74 29 7b 63 6f 6e 73 74 20 73 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 74 2f 32 30 29 3b 63 6f 6e 73 74 20 54 3d 28 72 6f 74 61 74 65 4c 65 66 74 28 61 2c 35 29 2b 66 28 73 2c 62 2c 63 2c 64 29 2b 65 2b 4b 5b 73 5d 2b 57 5b 74 5d 29 3e 3e 3e 30 3b 65 3d 64 3b 64 3d 63 3b 63 3d 72 6f 74 61 74 65 4c 65 66 74 28 62 2c 33 30 29 3e 3e 3e 30 3b 62 3d 61 3b 61 3d 54 7d 48 5b 30 5d 3d 28 48 5b 30 5d 2b 61 29 3e 3e 3e 30 3b 48 5b 31 5d 3d 28 48 5b 31 5d 2b 62 29 3e 3e 3e 30 3b 48 5b 32 5d Data Ascii: eft(W[t-3]^W[t-8]^W[t-14]^W[t-16],1)}let a=H[0],b=H[1],c=H[2],d=H[3],e=H[4];for(let t=0;t<80;++t){const s=Math.floor(t/20);const T=(rotateLeft(a,5)+f(s,b,c,d)+e+K[s]+W[t])>>>0;e=d;d=c;c=rotateLeft(b,30)>>>0;b=a;a=T}H[0]=(H[0]+a)>>>0;H[1]=(H[1]+b)>>>0;H[2]
2024-01-30 17:52:02 UTC	1252	IN	Data Raw: 75 67 28 75 72 6c 2c 74 79 70 65 2c 73 6c 75 67 73 29 7b 69 66 28 21 73 6c 75 67 73 29 7b 72 65 74 75 72 6e 20 75 72 6c 7d 72 65 74 75 72 6e 20 75 72 6c 2e 72 65 70 6c 61 63 65 28 73 6c 75 67 2c 73 6c 75 67 73 5b 74 79 70 65 5d 29 7d 66 75 6e 63 74 69 6f 6e 20 67 65 74 53 6c 75 67 4f 62 6a 65 63 74 28 62 65 61 63 6f 6e 2c 78 68 72 2c 69 6d 61 67 65 2c 69 66 72 61 6d 65 29 7b 72 65 74 75 72 6e 7b 62 65 61 63 6f 6e 3a 62 65 61 63 6f 6e 2c 78 68 72 3a 78 68 72 2c 69 6d 67 3a 69 6d 61 67 65 2c 69 66 72 61 6d 65 3a 69 66 72 61 6d 65 7d 7d 66 75 6e 63 74 69 6f 6e 20 73 74 72 69 70 50 72 6f 74 6f 63 6f 6c 28 75 72 6c 29 7b 72 65 74 75 72 6e 20 75 72 6c 2e 72 65 70 6c 61 63 65 28 2f 68 74 74 70 73 3f 3a 5c 2f 5c 2f 2f 69 2c 22 22 29 7d 66 75 6e 63 74 69 6f 6e 20 Data Ascii: ug(url,type,slugs){if(!slugs){return url}return url.replace(slug,slugs[type])}function getSlugObject(beacon,xhr,image,iframe){return{beacon:beacon,xhr:xhr,img:image,iframe:iframe}}function stripProtocol(url){return url.replace(/https?:\/\//i,"")}function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.17	49902	13.107.213.40	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:02 UTC	600	OUT	GET /16.000/content/js/MeControl_MhktgtiMAnSkSgiYU2_TkQ2.js HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:02 UTC	790	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:02 GMT Content-Type: application/x-javascript Content-Length: 6053 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 06 Oct 2023 05:03:22 GMT ETag: 0x8DBC6299060EA63 x-ms-request-id: 923a99ce-b01e-0084-2c30-53cc2e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240130T175202Z-06m1740h3p1ax7e1pxmxxc6prw000000012g000000001yde x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-01-30 17:52:02 UTC	6053	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 a5 3b 6b 77 d3 ba b2 7f a5 f5 ea 02 fb c6 0d 49 d9 6c c0 a9 e1 b6 a5 1c 0a 85 02 2d 8f bd 4b 4f 96 2c 2b 89 5b c7 0e b6 d3 c7 0e b9 bf fd ce 8c 24 5b 76 1c e0 dc fb 01 2a 8f a4 d1 68 5e 9a 19 29 a3 79 c2 8b 28 4d 36 86 93 5b 9b 39 8b 4c 14 f3 2c d9 60 cf 8b 6c 2e 3c e6 fb bd 1f 3f e0 ff 11 8b 73 41 2d cb 5a 8e ca 39 2f e6 36 73 83 72 96 c4 f1 9c 79 81 31 e6 b5 89 76 23 4a f2 82 25 5c a4 a3 8d bd 2c 63 77 c6 c0 fd 17 c6 48 4b c3 ad ee 70 f4 b7 5d dc cd 70 0a 73 91 2c c7 98 f4 d2 98 a3 07 01 91 79 91 45 c9 d8 24 75 ff d0 18 29 09 bd 77 8f a6 df bb c7 36 6b db 82 c9 27 d9 0b 31 62 f3 b8 a8 ef 8f 90 34 f6 b7 f7 10 11 47 23 7b 93 b0 39 7a 03 d6 00 60 ac 1b b3 bc 38 4a 42 71 7b 32 b2 ad ae e5 ec f6 8c 11 9a 2d dd 22 3d 4e 6f 44 76 Data Ascii: ;kwIl-KO,+[$[v*h^)y(M6[9L,`l.<?sA-Z9/6sry1v#J%\,cwHKp]ps,yE$u)w6k'1b4G#{9z`8JBq{2-"=NoDv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.17	49903	3.215.173.68	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:02 UTC	721	OUT	GET /id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=EA76ADE95776D2EC7F000101%40AdobeOrg&d_nsid=0&ts=1706637121162 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:02 UTC	821	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:02 GMT Content-Type: application/json;charset=utf-8 Content-Length: 6666 Connection: close X-TID: sTc7N0UdR/U= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.microsoft.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-va6-2-v053-09841d1d2.edge-va6.demdex.com 5 ms set-cookie: demdex=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:02 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-01-30 17:52:02 UTC	6666	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 33 34 35 38 39 36 36 38 30 32 34 37 36 34 31 30 33 30 33 34 35 39 35 35 39 30 30 31 31 36 39 39 35 38 31 31 39 39 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 36 47 31 79 6e 59 63 4c 50 75 69 51 78 59 5a 72 73 7a 5f 70 6b 71 66 4c 47 39 79 4d 58 42 70 62 32 7a 58 35 64 76 4a 64 59 51 4a 7a 50 58 49 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 37 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 7b 22 69 64 22 3a 22 34 31 31 22 2c 22 74 74 6c 22 3a 31 30 30 38 30 2c 22 74 61 67 22 3a 22 69 6d 67 22 2c 22 66 69 72 65 55 52 4c 53 79 6e 63 22 3a 31 2c 22 73 79 6e 63 4f 6e 50 61 67 65 22 3a 31 2c 22 75 72 6c 22 3a 5b 22 2f 2f 63 6d 2e 65 76 65 72 Data Ascii: {"d_mid":"34589668024764103034595590011699581199","id_sync_ttl":604800,"d_blob":"6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y","dcs_region":7,"d_ottl":7200,"ibs":[{"id":"411","ttl":10080,"tag":"img","fireURLSync":1,"syncOnPage":1,"url":["//cm.ever

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.17	49904	13.249.39.8	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:02 UTC	644	OUT	GET /pcc/05d32363-d534-4d93-9b65-cde674775e71.js?DeploymentConfigName=Release_20230511&Version=2 HTTP/1.1 Host: cdnssl.clicktale.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:02 UTC	680	IN	HTTP/1.1 200 OK Content-Type: application/javascript;charset=utf-8 Content-Length: 8475 Connection: close Date: Tue, 30 Jan 2024 17:52:03 GMT Last-Modified: Thu, 11 May 2023 10:12:30 GMT ETag: "edece269e6f9d5647cb3d02a5b55c732" x-amz-server-side-encryption: AES256 Content-Encoding: gzip x-amz-version-id: EjvLMkewSuChI5Bn5Jmv3FVq4iKlt1Rv Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 88b63cb2f8aab28c7291262ffc15282e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: -yurxlOGpMbI-YHvnBnG7F5FzttrU_jJZkSvdnzK76yMdPI73NvcXQ== Timing-Allow-Origin: * age: 0 cache-control: max-age=900 Access-Control-Allow-Origin: *
2024-01-30 17:52:02 UTC	8475	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 5c 69 77 db 46 b2 fd 3c 3a 27 ff 01 42 e6 51 80 09 2e 92 e2 cc 0c 61 0c 23 53 92 2d 47 5b 24 79 89 25 c5 a7 01 34 49 44 24 c0 00 a0 16 8b 7c bf fd dd ea c6 4a 82 92 93 79 e3 9c 50 40 a3 97 ea ea 5a 6e 55 37 d0 6a 29 bd 60 f2 10 7a 83 61 ac 6c b5 db 3f 36 b6 da 5b db 4a 6f e4 39 37 17 6c c4 95 c3 d8 6d 1a ca fb 73 e5 94 c5 dc 8f 95 53 ee bb 9e 3f f8 6e ed bb b5 3b cf 77 83 bb 66 56 f7 cd 28 b0 d9 48 b1 94 15 0f 66 33 e5 71 6e 2e b7 3b e7 71 8c 2e a3 8a 96 d9 a3 b4 ed 77 6b 0b bd 36 3d df 8b d1 b2 b2 38 6d b5 f8 30 72 42 6f 12 47 15 cd d2 27 ab c7 4b 6a 34 fb de 28 e6 e1 ea 2e d2 0a e8 49 eb 4f 7d 27 f6 02 5f d1 74 e5 f1 bb b5 bf dd b2 50 09 b9 13 84 c4 ca 8b 61 c8 a3 61 30 72 d1 d7 11 8b 87 cd 90 81 09 63 54 7d a1 6c b6 db Data Ascii: \iwF<:'BQ.a#S-G[$y%4ID$\|JyP@ZnU7j)`zal?6[Jo97lmsS?n;wfV(Hf3qn.;q.wk6=8m0rBoG'Kj4(.IO}'_tPaa0rcT}l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.17	49905	13.249.39.8	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:02 UTC	572	OUT	GET /www/bridge-WR110.js HTTP/1.1 Host: cdnssl.clicktale.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:02 UTC	618	IN	HTTP/1.1 200 OK Content-Type: application/javascript;charset=utf-8 Content-Length: 6107 Connection: close Date: Tue, 30 Jan 2024 12:21:37 GMT Last-Modified: Wed, 29 Jun 2022 11:38:36 GMT ETag: "f5242e0b2a8fc183ac2d4f48cb85dc0e" Cache-Control: max-age=86400 x-amz-version-id: 8rIYEGDsMuMEtspTTLTPFDnakflPuMbP Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 824fe21e467658628899bdd8725649ee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: UJ8b0CsV7Okaq-ySgjCtcncTS5AnQdkVMW506KFByUTsyA_86Fu5VQ== Age: 0 Access-Control-Allow-Origin: *
2024-01-30 17:52:02 UTC	6107	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 2c 76 2c 61 2c 7a 3b 66 75 6e 63 74 69 6f 6e 20 71 28 29 7b 61 3d 66 61 6c 73 65 3b 7a 3d 43 6c 69 63 6b 54 61 6c 65 47 6c 6f 62 61 6c 2e 61 70 69 7c 7c 7b 7d 3b 74 3d 41 28 22 43 6c 69 63 6b 54 61 6c 65 53 65 74 74 69 6e 67 73 2e 49 6e 74 65 67 72 61 74 69 6f 6e 2e 50 72 6f 6a 65 63 74 54 79 70 65 22 2c 30 29 3b 76 3d 7b 63 6c 69 63 6b 74 61 6c 65 4f 6e 6c 79 3a 30 2c 6d 31 3a 31 2c 6d 32 3a 32 2c 6d 32 50 72 69 6d 65 3a 33 7d 3b 6e 28 29 3b 68 28 29 3b 77 28 29 3b 6c 28 29 3b 64 28 29 7d 66 75 6e 63 74 69 6f 6e 20 64 28 29 7b 69 66 28 21 7a 2e 43 6c 69 63 6b 54 61 6c 65 4f 6e 52 65 61 64 79 49 6e 76 6f 6b 65 64 29 7b 7a 2e 43 6c 69 63 6b 54 61 6c 65 4f 6e 52 65 61 64 79 49 6e 76 6f 6b 65 64 3d 74 72 75 Data Ascii: (function(){var t,v,a,z;function q(){a=false;z=ClickTaleGlobal.api\|\|{};t=A("ClickTaleSettings.Integration.ProjectType",0);v={clicktaleOnly:0,m1:1,m2:2,m2Prime:3};n();h();w();l();d()}function d(){if(!z.ClickTaleOnReadyInvoked){z.ClickTaleOnReadyInvoked=tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.17	49910	31.13.65.36	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:02 UTC	660	OUT	GET /tr?id=1770559986549030&ev=PixelInitialized&dpo=LDU&dpoco=0&dpost=0&ts=1706637121398 HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:02 UTC	347	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen Alt-Svc: h3=":443"; ma=86400 Date: Tue, 30 Jan 2024 17:52:02 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.17	49909	31.13.65.36	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:02 UTC	653	OUT	GET /tr?id=undefined&ev=PixelInitialized&dpo=LDU&dpoco=0&dpost=0&ts=1706637121398 HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:02 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Tue, 30 Jan 2024 17:52:02 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.17	49908	31.13.65.36	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:02 UTC	652	OUT	GET /tr?id=1770559986549030&ev=PageView&dpo=LDU&dpoco=0&dpost=0&ts=1706637121398 HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:02 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Tue, 30 Jan 2024 17:52:02 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.17	49907	31.13.65.36	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:02 UTC	645	OUT	GET /tr?id=undefined&ev=PageView&dpo=LDU&dpoco=0&dpost=0&ts=1706637121398 HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:02 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Tue, 30 Jan 2024 17:52:02 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.17	49913	13.107.246.41	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:02 UTC	737	OUT	GET /me/mecache?partner=msdlc&wreply=https%3A%2F%2Fwww.microsoft.com HTTP/1.1 Host: mem.gfx.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:03 UTC	666	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3379 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, no-transform, max-age=7200 Expires: Tue, 30 Jan 2024 19:52:03 GMT X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors https://www.microsoft.com; X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains x-azure-ref: 20240130T175203Z-ewmrvy6vxt4zx6eskwu4xftsu000000001kg00000000ks29 x-fd-int-roxy-purgeid: 38334287 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-01-30 17:52:03 UTC	3379	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 20 2f 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 62 6f 64 79 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 0d Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="utf-8" /> <meta http-equiv="X-UA-Compatible" content="IE=edge" /> <meta name="viewport" content="width=device-width" /> </head><body> <div id="body" role="main">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.17	49917	74.125.136.157	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:02 UTC	825	OUT	GET /pagead/viewthroughconversion/923371515/?guid=ON&script=0&url=www.microsoft.com%2Fen-us%2Fdownload%2Fdetails.aspx&data=ecomm_pagetype%3Dother HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:03 UTC	961	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 30 Jan 2024 17:52:03 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Location: https://www.google.com/pagead/1p-user-list/923371515/?guid=ON&script=0&url=www.microsoft.com%2Fen-us%2Fdownload%2Fdetails.aspx&data=ecomm_pagetype%3Dother&is_vtc=1&cid=CAQSGwAvHhf_Vd2Mkqic_BIKrDlFV8Om8wwf6G-ZhQ&random=3815492425 Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Tue, 30-Jan-2024 18:07:03 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:52:03 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.17	49914	3.224.195.202	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:03 UTC	719	OUT	GET /ats/ats?cmd=RT&AdvertiserID=4249&platform=TUMRI&ActionID=20114&ActionName=Microsoft_Store_RT_Pixel&ut1=&ut2=en&ut3=us&cachebuster=223825862 HTTP/1.1 Host: ats.everesttech.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:03 UTC	391	IN	HTTP/1.1 200 Date: Tue, 30 Jan 2024 17:52:03 GMT Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Set-Cookie: everest_g_v2=g_surferid~Zbk3QwAAhPuiMXuO;path=/;Max-Age=63072000;domain=.everesttech.net;Secure;SameSite=None Pragma: no-cache Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Expires: Tue Jan 30 17:52:03 UTC 2024
2024-01-30 17:52:03 UTC	814	IN	Data Raw: 33 32 37 0d 0a 47 49 46 38 39 61 01 00 01 00 e7 0f 00 00 00 00 80 00 00 00 80 00 80 80 00 00 00 80 80 00 80 00 80 80 80 80 80 c0 c0 c0 ff 00 00 00 ff 00 ff ff 00 00 00 ff ff 00 ff 00 ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 00 00 66 00 00 99 00 00 cc 00 00 ff 00 33 00 00 33 33 00 33 66 00 33 99 00 33 cc 00 33 ff 00 66 00 00 66 33 00 66 66 00 66 99 00 66 cc 00 66 ff 00 99 00 00 99 33 00 99 66 00 99 99 00 99 cc 00 99 ff 00 cc 00 00 cc 33 00 cc 66 00 cc 99 00 cc cc 00 cc ff 00 ff 00 00 ff 33 00 ff 66 00 ff 99 00 ff cc 00 ff ff 33 00 00 33 00 33 33 00 66 Data Ascii: 327GIF89a3f3333f333ff3fffff3f3f3f3333f
2024-01-30 17:52:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.17	49920	54.211.243.61	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:03 UTC	754	OUT	GET /dest5.html?d_nsid=0 HTTP/1.1 Host: mscom.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=35050774984483340004567475019318048768
2024-01-30 17:52:03 UTC	605	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:03 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 6983 Connection: close X-TID: D8GS0YN2QZ8= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Accept-Ranges: bytes last-modified: Mon, 20 Nov 2023 15:28:35 GMT DCS: dcs-prod-va6-1-v053-0b6f4cf35.edge-va6.demdex.com 0 ms
2024-01-30 17:52:03 UTC	6983	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 41 64 6f 62 65 20 41 75 64 69 65 6e 63 65 4d 61 6e 61 67 65 72 3c 2f 74 69 74 6c 65 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>Adobe AudienceManager</title><script type="text/javas

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.17	49921	63.140.39.15	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:03 UTC	748	OUT	GET /id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=EA76ADE95776D2EC7F000101%40AdobeOrg&mid=34589668024764103034595590011699581199&ts=1706637121821 HTTP/1.1 Host: msftenterprise.sc.omtrdc.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:03 UTC	442	IN	HTTP/1.1 200 OK access-control-allow-origin: https://www.microsoft.com access-control-allow-credentials: true date: Tue, 30 Jan 2024 17:52:03 GMT p3p: CP="This is not a P3P policy" server: jag vary: Origin content-type: application/x-javascript;charset=utf-8 content-length: 2 cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-01-30 17:52:03 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.17	49919	35.174.142.23	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:03 UTC	661	OUT	POST /xc/1140789/433018/7593 HTTP/1.1 Host: microsoft.msafflnk.net Connection: keep-alive Content-Length: 162 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: https://www.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:03 UTC	162	OUT	Data Raw: 73 65 61 72 63 68 74 78 74 3d 26 73 72 63 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 25 32 46 26 6c 61 6e 64 75 72 6c 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 25 32 46 65 6e 2d 75 73 25 32 46 64 6f 77 6e 6c 6f 61 64 25 32 46 64 65 74 61 69 6c 73 2e 61 73 70 78 25 33 46 69 64 25 33 44 33 35 26 26 5f 69 72 3d 55 31 32 33 25 37 43 25 37 43 31 37 30 36 36 33 37 31 32 31 37 32 36 Data Ascii: searchtxt=&srcref=https%3A%2F%2Fwww.google.com%2F&landurl=https%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fdownload%2Fdetails.aspx%3Fid%3D35&&_ir=U123%7C%7C1706637121726
2024-01-30 17:52:03 UTC	1385	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:03 GMT Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: AWSALB=NRpfj+xuxLyUQJsR42wtXh+TV1wv28J+DDFJCNlfCwYckXAKavjE2XDQ//gTba3tbOUgMi91prPHRnsNJZT6h03yYIDOkbTe5Q3i9Pvdcb6MsiROApLPqtHfxpnI; Expires=Tue, 06 Feb 2024 17:52:03 GMT; Path=/ Set-Cookie: AWSALBCORS=NRpfj+xuxLyUQJsR42wtXh+TV1wv28J+DDFJCNlfCwYckXAKavjE2XDQ//gTba3tbOUgMi91prPHRnsNJZT6h03yYIDOkbTe5Q3i9Pvdcb6MsiROApLPqtHfxpnI; Expires=Tue, 06 Feb 2024 17:52:03 GMT; Path=/; SameSite=None; Secure Access-Control-Allow-Origin: https://www.microsoft.com Access-Control-Allow-Credentials: true Cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Expires: Tue, 30 Jan 2024 17:51:37 GMT P3P: policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT" Timing-Allow-Origin: * Set-Cookie: brwsr=375d4e93-bf98-11ee-ab40-951d7ea14e93; Domain=.msafflnk.net; Path=/; Secure; Max-Age=62208000; Expires=Mon, 19 Jan 2026 17:51:37 GMT; HttpOnly; SameSite=None Set-Cookie: irld=L0miXzaRycW6BU8b1UETbvwbJx%3AZ34808qRcI3m2yhZwZrzWD; Path=/; Secure; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:51:37 GMT; HttpOnly; SameSite=None Set-Cookie: irtps=1; Domain=.msafflnk.net; Path=/; Secure; Max-Age=86400; Expires=Wed, 31 Jan 2024 17:51:37 GMT; HttpOnly; SameSite=None
2024-01-30 17:52:03 UTC	125	IN	Data Raw: 37 37 0d 0a 7b 22 74 70 73 22 3a 5b 7b 22 75 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6f 6a 72 71 2e 6e 65 74 2f 70 2f 3f 72 65 74 75 72 6e 3d 26 63 69 64 3d 37 35 39 33 26 74 70 73 79 6e 63 3d 6e 6f 26 61 75 74 68 3d 22 7d 5d 2c 22 66 70 63 22 3a 22 33 37 35 64 34 65 39 33 2d 62 66 39 38 2d 31 31 65 65 2d 61 62 34 30 2d 39 35 31 64 37 65 61 31 34 65 39 33 22 7d 0d 0a Data Ascii: 77{"tps":[{"u":"https://www.ojrq.net/p/?return=&cid=7593&tpsync=no&auth="}],"fpc":"375d4e93-bf98-11ee-ab40-951d7ea14e93"}
2024-01-30 17:52:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.17	49923	3.94.15.197	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:03 UTC	457	OUT	POST /quota?ct=0 HTTP/1.1 Host: q-aus1.clicktale.net Connection: keep-alive Content-Length: 165 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:03 UTC	165	OUT	Data Raw: 7b 22 72 65 63 6f 72 64 69 6e 67 54 79 70 65 73 22 3a 5b 35 5d 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 65 6e 2d 75 73 2f 64 6f 77 6e 6c 6f 61 64 2f 64 65 74 61 69 6c 73 2e 61 73 70 78 3f 69 64 3d 33 35 22 2c 22 70 72 6f 6a 65 63 74 49 64 22 3a 32 34 32 32 2c 22 75 75 22 3a 22 39 36 61 66 37 33 38 63 2d 66 64 63 35 2d 61 36 63 35 2d 61 33 62 35 2d 62 66 32 34 65 66 39 63 34 35 61 34 22 2c 22 73 6e 22 3a 31 2c 22 70 6e 22 3a 31 7d Data Ascii: {"recordingTypes":[5],"url":"https://www.microsoft.com/en-us/download/details.aspx?id=35","projectId":2422,"uu":"96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4","sn":1,"pn":1}
2024-01-30 17:52:03 UTC	324	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:03 GMT Content-Type: application/json Content-Length: 29 Connection: close Timing-Allow-Origin: * Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, OPTIONS Access-Control-Allow-Headers: Access-Control-Expose-Headers, Content-Type, Content-Compression
2024-01-30 17:52:03 UTC	29	IN	Data Raw: 7b 22 61 6c 6c 6f 77 65 64 52 65 63 6f 72 64 69 6e 67 54 79 70 65 73 22 3a 5b 35 5d 7d Data Ascii: {"allowedRecordingTypes":[5]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.17	49926	34.206.180.7	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:03 UTC	862	OUT	GET /pageview?ex=&pvt=n&la=en-US&uc=0&url=https%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fdownload%2Fdetails.aspx%3Fid%3D35&dr=https%3A%2F%2Fwww.google.com%2F&dw=1017&dh=2538&ww=1034&wh=870&sw=1280&sh=1024&uu=96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4&sn=1&hd=1706637121&v=13.83.0&pid=2422&pn=1&r=171300 HTTP/1.1 Host: c.clicktale.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:03 UTC	469	IN	HTTP/1.1 204 No Content Date: Tue, 30 Jan 2024 17:52:03 GMT Connection: close Access-Control-Allow-Headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Content-Disposition: inline Expires: Sun, 24 Oct 1982 23:00:00 GMT Pragma: no-cache Timing-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.17	49925	34.206.180.7	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:03 UTC	806	OUT	GET /pageEvent?value=H4sIAAAAAAAAAwsIcVZwD%2FV0UahRMDBNMTYyNjPWTTE1NtE1SbE01rVMMjPVTU5JNTM3MTc3TTU3BAC5OujJLwAAAA%3D%3D&ct=2&isETR=false&isCustomHashId=false&v=13.83.0&pid=2422&pn=1&sn=1&uu=96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4&r=393565 HTTP/1.1 Host: c.clicktale.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:03 UTC	469	IN	HTTP/1.1 204 No Content Date: Tue, 30 Jan 2024 17:52:03 GMT Connection: close Access-Control-Allow-Headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Content-Disposition: inline Expires: Sun, 24 Oct 1982 23:00:00 GMT Pragma: no-cache Timing-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.17	49928	34.206.180.7	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:03 UTC	770	OUT	GET /pageEvent?value=H4sIAAAAAAAAA3POz0vLTLdSCErNSU0sTo03MjAyNjA1NAQA5ZGESRgAAAA%3D&ct=2&isETR=false&isCustomHashId=false&v=13.83.0&pid=2422&pn=1&sn=1&uu=96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4&r=024492 HTTP/1.1 Host: c.clicktale.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:03 UTC	469	IN	HTTP/1.1 204 No Content Date: Tue, 30 Jan 2024 17:52:03 GMT Connection: close Access-Control-Allow-Headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Content-Disposition: inline Expires: Sun, 24 Oct 1982 23:00:00 GMT Pragma: no-cache Timing-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.17	49929	34.206.180.7	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:03 UTC	765	OUT	GET /dvar?v=13.83.0&pid=2422&pn=1&sn=1&uu=96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4&dv=H4sIAAAAAAAAA6tWCghxjncvzUxRslIyME0xNjI2M9ZNMTU20TVJsTTWtUwyM9VNTkk1MzcxNzdNNTdUqgUAotlAIzMAAAA%3D&ct=2&r=246796 HTTP/1.1 Host: c.clicktale.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:03 UTC	469	IN	HTTP/1.1 204 No Content Date: Tue, 30 Jan 2024 17:52:03 GMT Connection: close Access-Control-Allow-Headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Content-Disposition: inline Expires: Sun, 24 Oct 1982 23:00:00 GMT Pragma: no-cache Timing-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.17	49931	173.194.219.105	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:03 UTC	1124	OUT	GET /pagead/1p-user-list/923371515/?guid=ON&script=0&url=www.microsoft.com%2Fen-us%2Fdownload%2Fdetails.aspx&data=ecomm_pagetype%3Dother&is_vtc=1&cid=CAQSGwAvHhf_Vd2Mkqic_BIKrDlFV8Om8wwf6G-ZhQ&random=3815492425 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-01-30-17; NID=511=FFnG6Cruye5Kyg5RqYGJ2WnltgKVzilQohEElWvHlsKwKeqpmikRbwhs-SpYWi79yUNWJRtOrFwRCPLJzSUQvg3BccW7HepEoxBmNAqYIoFq5MgG2ccXtEgsL3nCf4Pw4xkQsxyVf1aUP9zmu7ZUkGD1cQm1ExYbk_aI4Z_B-Gpzd8AAerdrpqvC5prqx5be7R4-GSWEYI1Fkv4
2024-01-30 17:52:03 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Tue, 30 Jan 2024 17:52:03 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:52:03 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.17	49930	34.206.180.7	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:03 UTC	788	OUT	GET /pageEvent?value=H4sIAAAAAAAAA8vPy8lPTFGoUXDOz0vLTC8tSlWozC8tUgguLUpLTE4FSpgoFJekFhQDAPRW154pAAAA&ct=2&isETR=false&isCustomHashId=false&v=13.83.0&pid=2422&pn=1&sn=1&uu=96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4&r=113321 HTTP/1.1 Host: c.clicktale.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:03 UTC	469	IN	HTTP/1.1 204 No Content Date: Tue, 30 Jan 2024 17:52:03 GMT Connection: close Access-Control-Allow-Headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Content-Disposition: inline Expires: Sun, 24 Oct 1982 23:00:00 GMT Pragma: no-cache Timing-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.17	49932	3.208.151.21	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:03 UTC	693	OUT	POST /exist?v=13.83.0&pid=2422&pn=1&sn=1&uu=96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4 HTTP/1.1 Host: srm.bf.contentsquare.net Connection: keep-alive Content-Length: 1328 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:03 UTC	1328	OUT	Data Raw: 7b 22 70 72 6f 6a 65 63 74 49 64 22 3a 22 32 34 32 32 22 2c 22 66 69 6c 74 65 72 22 3a 32 2c 22 68 61 73 68 65 73 22 3a 5b 22 65 65 32 62 38 34 31 35 32 39 65 35 64 30 36 61 65 61 65 37 66 36 35 62 34 31 33 62 34 30 62 62 66 65 66 35 31 36 31 63 39 66 61 64 39 61 38 61 31 37 35 35 64 61 63 30 33 38 30 36 32 39 31 62 22 2c 22 64 36 33 31 66 30 66 34 37 39 39 64 33 33 64 65 33 64 61 35 63 61 30 37 32 63 65 32 61 31 64 35 62 61 33 31 39 63 63 61 35 33 35 33 61 66 64 35 37 33 63 37 32 39 32 38 61 65 66 31 63 65 63 65 22 2c 22 33 35 65 66 34 37 34 30 31 32 35 63 31 37 66 37 33 66 30 31 33 36 37 31 32 39 66 38 32 62 38 32 62 37 32 34 65 33 35 63 33 34 36 30 32 31 35 37 36 37 61 30 63 34 39 64 64 64 65 65 39 30 31 30 22 2c 22 65 34 30 65 64 31 39 32 61 37 66 37 Data Ascii: {"projectId":"2422","filter":2,"hashes":["ee2b841529e5d06aeae7f65b413b40bbfef5161c9fad9a8a1755dac03806291b","d631f0f4799d33de3da5ca072ce2a1d5ba319cca5353afd573c72928aef1cece","35ef4740125c17f73f01367129f82b82b724e35c3460215767a0c49dddee9010","e40ed192a7f7
2024-01-30 17:52:03 UTC	158	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:03 GMT Content-Type: application/json Content-Length: 2 Connection: close Access-Control-Allow-Origin: *
2024-01-30 17:52:03 UTC	2	IN	Data Raw: 5b 5d Data Ascii: []

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.17	49934	3.215.173.68	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:03 UTC	713	OUT	GET /ibs:dpid=411&dpuuid=Zbk3QwAAAGzR0xva HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553
2024-01-30 17:52:03 UTC	889	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:03 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: mbZ+OesoTck= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-2-v053-0fb7471d1.edge-va6.demdex.com 2 ms set-cookie: dpm=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:03 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:03 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-01-30 17:52:03 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.17	49936	63.140.39.248	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:03 UTC	2341	OUT	POST /rest/v1/delivery?client=microsoftmscompoc&sessionId=1a6c9ca5742d4e74a9aab3fd907ed375&version=2.4.0 HTTP/1.1 Host: target.microsoft.com Connection: keep-alive Content-Length: 1132 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://www.microsoft.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: MUID=bf64e47598274166b375abec1b76dcac; fptctx2=H3ihr9e92IdW6yd1ZgQ9SxNMSL5fwIGS0iyEDx6kB4%252bdSb45qNgKwTJfQYQaCchWv80obhIrY%252f4vcyS%252fMgt%252bXC%252br7M0GYe3i0VcbETzQE44ztBSgOCWDjZ2qL%252f%252fwievVUUNJdMM4kowGIRTh845d545EUZPrIZrwdXWFsf2Z2S1Nv55%252bkMJASOG7qS2DLCKYo785JU3dJ9GY30MnouY0bByxUQ38%252bdH91a4iAtgi3jSMk%252btaXVKgFQn1LIq2Hu2zywiZWcG1yQjPTafZ1e39%252bSYZZLxdcKLSfrEmrNf08tgMyv9s%252fyXuatA8jBb5TQnxs2XuGdbL04E0SECVJ6vQNg%253d%253d; MSCC=NR; _cs_c=0; ak_bmsc=B700447037615F8A9DFA8E0E1470F872~000000000000000000000000000000~YAAQLcHOF7p7EEmNAQAA39h/WxZgYwzcRpoOPTk7QjSCL1xIAfn04c3E+xPXXBPNSWUXrwtac3DL0keENj+PCYQC9ZYRqIg9m1zKZRSvTcCa+yfJmuxJCqRNHEHVCFW/jWd7YkuCoakrkdenFIajb/1JLKrWTCb5e84iKgEa+MatPFIK2JwUquzf0t+RbXH7rKbv6ulOSoaMbrLVi+fyKf8SpogDip9QlkvOP+ABz3wQWYZejuFkC2YmbgjQG9xnWuwjbTOtzBFIyPVMX78MSs2RhJ2Q2oOrdVe6T9Rqx8Wywa6qu6Pg2dhmXC5lCLAhVr9P3p6uFkhIzGUsKeWWek0GM22EprbFW3FQlLe9efGDw6Znt+BqU/3XBUhR; at_check=true; mbox=session#1a6c9ca5742d4e74a9aab3fd907ed375#1706638982; _uetsid=45796de0bf9811ee975cbbde3b7e2e38; _uetvid=4579c1d0bf9811eeb905c3aa5c483381; IR_gbd=microsoft.com; IR_7593=1706637121726%7C1140789%7C1706637121726%7C%7C; AMCVS_EA76ADE95776D2EC7F000101%40AdobeOrg=1; _cs_id=96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4.1706637121.1.1706637121.1706637121.1613561419.1740801121854.1; _cs_s=1.T.0.1706638921856; _cs_cvars=%7B%7D; AMCV_EA76ADE95776D2EC7F000101%40AdobeOrg=1585540135%7CMCIDTS%7C19753%7CMCMID%7C34589668024764103034595590011699581199%7CMCAAMLH-1707241921%7C7%7CMCAAMB-1707241921%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1706644322s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C4.4.0
2024-01-30 17:52:03 UTC	1132	OUT	Data Raw: 7b 22 72 65 71 75 65 73 74 49 64 22 3a 22 36 65 30 32 62 65 31 64 36 31 64 30 34 30 32 37 39 61 39 62 64 61 63 30 32 66 65 34 33 64 32 39 22 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 75 73 65 72 41 67 65 6e 74 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 31 31 37 2e 30 2e 30 2e 30 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 22 2c 22 74 69 6d 65 4f 66 66 73 65 74 49 6e 4d 69 6e 75 74 65 73 22 3a 36 30 2c 22 63 68 61 6e 6e 65 6c 22 3a 22 77 65 62 22 2c 22 73 63 72 65 65 6e 22 3a 7b 22 77 69 64 74 68 22 3a 31 32 38 30 2c 22 68 65 69 67 68 Data Ascii: {"requestId":"6e02be1d61d040279a9bdac02fe43d29","context":{"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","timeOffsetInMinutes":60,"channel":"web","screen":{"width":1280,"heigh
2024-01-30 17:52:04 UTC	843	IN	HTTP/1.1 200 OK date: Tue, 30 Jan 2024 17:52:03 GMT content-type: application/json;charset=UTF-8 vary: origin,access-control-request-method,access-control-request-headers,accept-encoding access-control-allow-origin: https://www.microsoft.com access-control-allow-credentials: true x-request-id: e81d5421-49c4-46bc-991b-33fab7f3bad1 timing-allow-origin: * accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close transfer-encoding: chunked
2024-01-30 17:52:04 UTC	13173	IN	Data Raw: 33 33 36 64 0d 0a 7b 22 73 74 61 74 75 73 22 3a 32 30 30 2c 22 72 65 71 75 65 73 74 49 64 22 3a 22 36 65 30 32 62 65 31 64 36 31 64 30 34 30 32 37 39 61 39 62 64 61 63 30 32 66 65 34 33 64 32 39 22 2c 22 63 6c 69 65 6e 74 22 3a 22 6d 69 63 72 6f 73 6f 66 74 6d 73 63 6f 6d 70 6f 63 22 2c 22 69 64 22 3a 7b 22 74 6e 74 49 64 22 3a 22 31 61 36 63 39 63 61 35 37 34 32 64 34 65 37 34 61 39 61 61 62 33 66 64 39 30 37 65 64 33 37 35 2e 33 34 5f 30 22 2c 22 6d 61 72 6b 65 74 69 6e 67 43 6c 6f 75 64 56 69 73 69 74 6f 72 49 64 22 3a 22 33 34 35 38 39 36 36 38 30 32 34 37 36 34 31 30 33 30 33 34 35 39 35 35 39 30 30 31 31 36 39 39 35 38 31 31 39 39 22 7d 2c 22 65 64 67 65 48 6f 73 74 22 3a 22 6d 62 6f 78 65 64 67 65 33 34 2e 74 74 2e 6f 6d 74 72 64 63 2e 6e 65 74 22 Data Ascii: 336d{"status":200,"requestId":"6e02be1d61d040279a9bdac02fe43d29","client":"microsoftmscompoc","id":{"tntId":"1a6c9ca5742d4e74a9aab3fd907ed375.34_0","marketingCloudVisitorId":"34589668024764103034595590011699581199"},"edgeHost":"mboxedge34.tt.omtrdc.net"
2024-01-30 17:52:04 UTC	259	IN	Data Raw: 66 64 0d 0a 65 78 70 2d 70 72 6f 64 75 63 74 2d 5c 22 20 2b 20 63 20 3a 20 5c 22 5c 22 29 3b 20 76 61 72 20 75 20 3d 20 7b 7d 3b 20 61 20 3d 20 74 2e 65 78 74 65 6e 64 28 21 30 2c 20 61 2c 20 75 29 2c 20 77 69 6e 64 6f 77 2e 73 74 61 74 69 63 45 78 70 65 72 69 6d 65 6e 74 43 6f 6e 66 69 67 28 7b 20 75 74 69 6c 69 74 79 3a 20 7b 20 6c 6f 63 61 6c 69 7a 61 74 69 6f 6e 3a 20 7b 20 67 65 74 4c 6f 63 53 74 72 69 6e 67 3a 20 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 20 76 61 72 20 74 20 3d 20 6f 2e 75 72 6c 2e 6c 6f 63 61 6c 65 28 29 2c 20 6e 20 3d 20 74 2e 6c 61 6e 67 20 2b 20 5c 22 2d 5c 22 20 2b 20 74 2e 72 65 67 69 6f 6e 2c 20 72 20 3d 20 61 2c 20 69 20 3d 20 72 20 26 26 20 72 2e 63 6f 6e 66 69 67 20 3f 20 72 2e 63 6f 6e 66 69 67 20 3a 20 6e 75 6c 6c 2c 20 Data Ascii: fdexp-product-\" + c : \"\"); var u = {}; a = t.extend(!0, a, u), window.staticExperimentConfig({ utility: { localization: { getLocString: function (e) { var t = o.url.locale(), n = t.lang + \"-\" + t.region, r = a, i = r && r.config ? r.config : null,
2024-01-30 17:52:04 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 3d 20 6e 75 6c 6c 2c 20 6c 20 3d 20 6e 75 6c 6c 2c 20 75 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 74 29 20 7b 20 72 65 74 75 72 6e 20 65 20 26 26 20 65 2e 6c 65 6e 67 74 68 20 3f 20 65 2e 72 65 70 6c 61 63 65 28 5c 22 7b 30 7d 5c 22 2c 20 74 20 26 26 20 74 2e 6c 6f 63 61 6c 65 20 3f 20 74 2e 6c 6f 63 61 6c 65 20 3a 20 6e 29 20 3a 20 5c 22 5c 22 20 7d 3b 20 69 66 20 28 63 20 3d 20 75 28 29 2c 20 21 28 6c 20 3d 20 6f 2e 6f 62 6a 65 63 74 2e 66 69 6e 64 28 72 2c 20 63 29 29 20 26 26 20 69 20 26 26 20 69 2e 66 61 6c 6c 62 61 63 6b 20 26 26 20 28 63 20 3d 20 75 28 7b 20 6c 6f 63 61 6c 65 3a 20 69 2e 66 61 6c 6c 62 61 63 6b 2e 6c 6f 63 61 6c 65 20 3f 20 69 2e 66 61 6c 6c 62 61 63 6b 2e 6c 6f 63 61 6c 65 20 3a 20 5c 22 65 6e 2d 75 73 5c 22 2c 20 Data Ascii: 1000= null, l = null, u = function (t) { return e && e.length ? e.replace(\"{0}\", t && t.locale ? t.locale : n) : \"\" }; if (c = u(), !(l = o.object.find(r, c)) && i && i.fallback && (c = u({ locale: i.fallback.locale ? i.fallback.locale : \"en-us\",
2024-01-30 17:52:04 UTC	16384	IN	Data Raw: 34 37 66 39 0d 0a 65 64 53 6b 75 49 64 2c 20 49 6d 61 67 65 73 3a 20 72 2e 49 6d 61 67 65 73 2c 20 50 72 6f 64 75 63 74 44 65 73 63 72 69 70 74 69 6f 6e 3a 20 72 2e 50 72 6f 64 75 63 74 44 65 73 63 72 69 70 74 69 6f 6e 2c 20 48 61 64 41 64 64 4f 6e 73 3a 20 65 2e 50 72 6f 70 65 72 74 69 65 73 20 3f 20 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 48 61 73 41 64 64 4f 6e 73 20 3a 20 6e 75 6c 6c 20 7d 2c 20 65 2e 44 69 73 70 6c 61 79 53 6b 75 41 76 61 69 6c 61 62 69 6c 69 74 69 65 73 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 20 28 74 29 20 7b 20 76 61 72 20 72 20 3d 20 74 2e 41 76 61 69 6c 61 62 69 6c 69 74 69 65 73 20 26 26 20 74 2e 41 76 61 69 6c 61 62 69 6c 69 74 69 65 73 5b 30 5d 20 3f 20 74 2e 41 76 61 69 6c 61 62 69 6c 69 74 69 65 73 5b 30 5d 20 3a Data Ascii: 47f9edSkuId, Images: r.Images, ProductDescription: r.ProductDescription, HadAddOns: e.Properties ? e.Properties.HasAddOns : null }, e.DisplaySkuAvailabilities.forEach(function (t) { var r = t.Availabilities && t.Availabilities[0] ? t.Availabilities[0] :
2024-01-30 17:52:04 UTC	2054	IN	Data Raw: 2e 70 75 73 68 28 74 29 2c 72 2e 6a 6f 69 6e 28 5c 22 2c 5c 22 29 2c 75 28 72 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 27 5b 69 64 2a 3d 5c 22 72 6f 6f 74 43 6f 6e 74 61 69 6e 65 72 5f 5c 22 5d 20 2e 72 65 76 69 65 77 20 2e 63 6f 6e 74 61 69 6e 65 72 20 62 75 74 74 6f 6e 27 29 3b 6c 2e 6f 62 73 65 72 76 65 28 74 2c 7b 61 74 74 72 69 62 75 74 65 73 3a 21 30 2c 61 74 74 72 69 62 75 74 65 46 69 6c 74 65 72 3a 5b 5c 22 64 69 73 61 62 6c 65 64 5c 22 5d 2c 61 74 74 72 69 62 75 74 65 4f 6c 64 56 61 6c 75 65 3a 21 30 7d 29 7d 29 29 2e 63 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 5c 22 66 28 67 70 64 29 3a 20 5c 22 Data Ascii: .push(t),r.join(\",\"),u(r).then((function(){var t=document.querySelector('[id*=\"rootContainer_\"] .review .container button');l.observe(t,{attributes:!0,attributeFilter:[\"disabled\"],attributeOldValue:!0})})).catch((function(t){console.log(\"f(gpd): \"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.17	49938	35.244.154.8	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:03 UTC	637	OUT	GET /365868.gif?partner_uid=35050774984483340004567475019318048768 HTTP/1.1 Host: idsync.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:03 UTC	736	IN	HTTP/1.1 307 Temporary Redirect Cache-Control: no-cache, no-store Location: https://idsync.rlcdn.com/1000.gif?memo=CKyqFhIxCi0IARCYEhomMzUwNTA3NzQ5ODQ0ODMzNDAwMDQ1Njc0NzUwMTkzMTgwNDg3NjgQABoNCMPu5K0GEgUI6AcQAEIASgA P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=eKwtq0lZ/flxovLVeYToWVTIh2jBHaOMvP3BGDUDkRw=; Path=/; Domain=rlcdn.com; Expires=Wed, 29 Jan 2025 17:52:03 GMT; Secure; SameSite=None Set-Cookie: pxrc=CAA=; Path=/; Domain=rlcdn.com; Expires=Sat, 30 Mar 2024 17:52:03 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Tue, 30 Jan 2024 17:52:03 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.17	49935	13.107.213.35	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:03 UTC	541	OUT	GET /tag/uet/4000034?insights=1 HTTP/1.1 Host: www.clarity.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:03 UTC	379	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:03 GMT Content-Type: application/x-javascript Content-Length: 702 Connection: close Cache-Control: no-cache, no-store Expires: -1 Request-Context: appId=cid-v1:e97341f6-8fff-46a6-9229-fbbfe0892c78 x-azure-ref: 20240130T175203Z-knrd6rfsch6m3459awnzfpvaz800000000mg00000000cx9d X-Cache: CONFIG_NOCACHE Accept-Ranges: bytes
2024-01-30 17:52:03 UTC	702	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 63 2c 6c 2c 61 2c 72 2c 69 2c 74 2c 79 29 7b 61 5b 63 5d 3d 61 5b 63 5d 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 28 61 5b 63 5d 2e 71 3d 61 5b 63 5d 2e 71 7c 7c 5b 5d 29 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 7d 3b 61 5b 63 5d 28 22 6d 65 74 61 64 61 74 61 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 61 5b 63 5d 28 22 73 65 74 22 2c 22 5f 73 22 2c 22 43 6c 61 72 69 74 79 49 6e 73 69 67 68 74 73 22 29 7d 29 2c 21 31 29 3b 61 5b 63 5d 28 22 6d 65 74 61 64 61 74 61 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 61 5b 63 5d 28 22 73 65 74 22 2c 22 5f 75 22 2c 22 34 30 30 30 30 33 34 22 29 7d 29 2c 21 31 29 3b 69 66 28 61 5b 63 5d 2e 76 7c 7c 61 5b 63 5d 2e 74 29 72 65 74 75 72 6e 20 61 5b 63 5d 28 22 65 76 65 6e 74 22 2c 63 2c 22 Data Ascii: !function(c,l,a,r,i,t,y){a[c]=a[c]\|\|function(){(a[c].q=a[c].q\|\|[]).push(arguments)};a[c]("metadata",(function(){a[c]("set","_s","ClarityInsights")}),!1);a[c]("metadata",(function(){a[c]("set","_u","4000034")}),!1);if(a[c].v\|\|a[c].t)return a[c]("event",c,"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.17	49933	68.67.160.137	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:03 UTC	644	OUT	GET /getuid?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D358%26dpuuid%3D%24UID HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:04 UTC	1493	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Tue, 30 Jan 2024 17:52:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID AN-X-Request-Uuid: 503bcaa2-103b-475c-ac0d-5f058887d814 Set-Cookie: XANDR_PANID=0U84jn1ew9ikPVt7_w3fV-ISfsCe9Ihc9la-kJur8ncyUhWxqD3Sx06SfQjg93aWzvvzpuruaMR21JdAcdeLWKJ8KsCpVkZhV1B8KCKoSgQ.; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 29-Apr-2024 17:52:03 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Tue, 17-Jan-2034 17:52:03 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=535537844608889607; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 29-Apr-2024 17:52:03 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 81.181.57.74; 81.181.57.74; 639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.17	49942	34.95.127.121	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:03 UTC	608	OUT	GET /p/?return=&cid=7593&tpsync=no&auth= HTTP/1.1 Host: www.ojrq.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:04 UTC	612	IN	HTTP/1.1 200 OK Cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Expires: Tue, 30 Jan 2024 17:52:04 GMT P3P: policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT" Timing-Allow-Origin: * Set-Cookie: brwsr=46e3271a-bf98-11ee-8f3e-7937e1ff086a; Domain=.ojrq.net; Path=/; Secure; Max-Age=62208000; Expires=Mon, 19 Jan 2026 17:52:04 GMT; HttpOnly; SameSite=None Content-Type: image/gif Content-Length: 50 Date: Tue, 30 Jan 2024 17:52:04 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:52:04 UTC	50	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 ff 00 ff ff ff 00 00 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 02 00 2c 00 00 00 00 01 00 01 00 40 02 02 54 01 00 3b 00 Data Ascii: GIF89a!,@T;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.17	49947	54.162.65.117	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:04 UTC	541	OUT	POST /v2/recording?rt=5&rst=1706637121875&let=1706637122648&v=13.83.0&pid=2422&pn=1&sn=1&uu=96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4&ri=1&ct=2 HTTP/1.1 Host: k-aus1.clicktale.net Connection: keep-alive Content-Length: 66860 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Origin: https://www.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:04 UTC	16384	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a ec bd 8b 76 db 48 92 36 f8 2a f8 6b ce f4 76 f7 18 22 ee 17 fb d4 a9 95 25 bb ca 33 be fd 25 b9 aa 77 a7 e6 e8 80 40 92 44 09 04 50 00 a8 4b 4d cf 2b fd 0f b1 4f b6 99 00 2f 20 04 22 2f 0c 82 a0 e5 ea b6 2d 51 50 02 c8 8c f8 22 32 32 e2 8b ff fc ef ef 8a c7 14 7d f7 52 b3 5f 7c 17 78 05 fe 4a b5 15 cb d2 6d 55 53 1d 5b 79 f1 9d 97 4d f3 ef 5e fe e7 7f 7f 87 ee 50 5c 7c f4 e6 f8 92 ef 3e 5f 5f 48 3f 7e 79 77 29 fd 53 52 cc 40 d7 74 4b 97 03 53 37 64 23 70 75 d9 1d 5b a6 ec 07 c8 b2 0d db 36 91 ad 7e f7 3f ff f5 3f 2f ba ef 64 ec b8 d3 45 12 4f c2 e9 4b e9 67 14 21 2f 47 37 9a a2 e9 8a a9 ae 86 5c ff 8e 9f bf 0b f0 88 2f be 9b 24 d9 dc 2b be 7b 89 1f 7d 8c 7f e1 cb cf ef f0 28 b3 a2 48 f3 97 a3 d1 fd fd fd d9 3c f4 b3 24 4f 26 Data Ascii: vH6*kv"%3%w@DPKM+O/ "/-QP"22}R_\|xJmUS[yM^P\\|>__H?~yw)SR@tKS7d#pu[6~??/dEOKg!/G7\/$+{}(H<$O&
2024-01-30 17:52:04 UTC	16384	OUT	Data Raw: 96 24 c5 fa 58 ee e6 f2 fd c5 65 a5 c0 c7 85 53 87 25 eb 63 1b fe d2 75 f4 8f 33 e1 ab 6e e7 c2 39 c6 ad 7d e1 73 95 20 e9 07 b1 1c 3c c6 73 14 84 9e ac 36 0e d5 c3 7c 54 de 6c 03 ae 7e 92 a5 a3 b7 c8 2b 16 19 92 df 04 53 24 bf 7b 23 7f 49 a7 99 17 a0 97 bf 7c 36 65 47 51 1e 0c 93 3f 64 34 c1 70 3e 93 d3 2c 4c 48 8b dd fa 83 86 53 fe 6c f2 f2 75 6a 83 fc 15 03 ba 5c 9d 7b aa 86 a2 a4 0f 7f 93 3c 0c 04 7f 9d 7b 0f ab 8f 4d d7 c5 1f 0f 1f 81 1d 16 d7 e8 79 49 9d 21 5b 3a 96 ba 6a c7 3e 50 a9 53 1c a3 4d ea f4 53 91 3a 96 64 f5 e7 25 75 ba 6c 62 a9 d3 5d d6 48 d6 11 a4 ce b1 5a a1 0e 3b b3 a7 21 74 fc fb 8b af 5d e8 34 d9 31 dd 07 d3 1c b0 d0 99 46 9b d0 e1 c7 3e 0d 99 63 49 49 78 5e 32 a7 62 a0 73 1f f4 21 9b d7 36 89 c3 0f 7d 1a 12 c7 12 85 6e 04 0c bc 34 Data Ascii: $XeS%cu3n9}s <s6\|Tl~+S${#I\|6eGQ?d4p>,LHSluj\{<{MyI![:j>PSMS:d%ulb]HZ;!t]41F>cIIx^2bs!6}n4
2024-01-30 17:52:04 UTC	16384	OUT	Data Raw: ee 60 a5 9c e0 ed 16 01 e9 80 0f a2 90 1c 34 28 71 90 71 06 22 39 61 72 eb 45 59 36 5e 9f ae 2a e6 8f 86 1d fc ba 93 d6 9a e2 18 d9 93 94 91 09 83 86 81 2b 3c 13 3e 02 9b 35 84 ec ba eb 35 cd be 7a 72 1b 8e 60 28 20 ff ea 09 0d ec 11 dc e0 6e 5f 12 92 16 10 ee 83 04 ef 1e 64 b8 91 96 89 3d 3b 72 6e 59 29 fa e5 26 f2 e2 69 90 c4 a4 10 c2 df 94 d3 f3 e2 d4 98 98 53 29 29 0f 6a 64 c4 97 72 80 1d 86 21 a8 87 25 ca dd 60 a8 8d 42 61 8c 6c 12 4e 93 9b f8 36 9c 4c 70 4f ca b1 a3 84 a1 a2 1f f1 55 1a d7 bd 49 42 96 c5 d7 bc 34 28 ac 65 3c c2 33 04 7a 32 05 0a d8 b1 47 4a 9c 67 5f 08 ed bf 70 fc 82 97 b1 b1 d9 6f fa bf 76 fe f8 92 0d 28 26 c5 bb 51 64 3f 74 3e 5e f3 ec e5 81 b9 d6 ff 15 07 39 07 ce 46 b6 53 18 34 56 cc 1f 08 5b 37 97 a7 fb 27 4d cc c3 7d 1c 14 49 Data Ascii: `4(qq"9arEY6^*+<>55zr`( n_d=;rnY)&iS))jdr!%`BalN6LpOUIB4(e<3z2GJg_pov(&Qd?t>^9FS4V[7'M}I
2024-01-30 17:52:04 UTC	16384	OUT	Data Raw: 86 f0 ff 64 66 09 25 ab e5 b5 16 49 e4 56 24 ec 0f 26 b3 fd a6 ea ba ca 38 d2 ad a8 59 10 92 cb d3 79 96 56 04 44 2d ed b2 b0 e4 59 fa 92 e4 d9 a9 b8 c2 05 fa ea c9 ff 26 7b af 9f 93 e2 5e 35 28 19 58 8c e1 32 65 26 4c 18 2b 96 d0 ad 50 f8 f8 26 1a da 63 ff 77 a2 01 6a a0 c7 74 bb 15 3e 65 a2 54 03 49 1e f8 e3 5b 32 13 7e b4 55 53 32 86 3a 76 71 db f5 e3 9c b7 cc 0b d5 67 60 c9 bd 9f 80 1e 20 10 a3 1c a2 74 eb ea 0b b7 a5 40 28 6c d4 c8 4d 06 b0 2c 43 12 e0 ea 35 7e 75 81 99 c2 84 3f f3 1d d9 15 d0 54 b7 46 2f 73 b6 20 1c 86 41 00 d3 51 4e c1 02 31 74 b9 b6 f9 e4 66 20 a8 6b b1 3f 14 9d 30 08 23 31 b0 61 26 4b 44 e4 3c 98 00 bd 48 9c fa ee c0 35 da f3 7c f4 f1 9a d3 30 02 f5 ec 52 24 cf 04 e1 5f fe 88 84 da 1e 27 15 2e 40 f8 f3 a5 2c 83 ba 32 23 42 45 99 Data Ascii: df%IV$&8YyVD-Y&{^5(X2e&L+P&cwjt>eTI[2~US2:vqg` t@(lM,C5~u?TF/s AQN1tf k?0#1a&KD<H5\|0R$_'.@,2#BE
2024-01-30 17:52:04 UTC	1324	OUT	Data Raw: da 11 cc 55 84 ea 16 60 ee 46 0e e0 c9 26 36 33 42 dd f4 41 c7 10 46 4d db b2 3d e2 1b 6e 10 04 61 e8 12 4a 00 8c 81 9d 32 48 18 50 97 79 00 22 62 9e ae 33 67 62 5a 93 c8 f0 00 48 00 4d db 3e 9d 10 2f f2 5c 42 02 c7 c4 0f d9 2d 3f b0 dd 89 65 58 b6 63 f9 00 06 e7 43 68 13 9a 09 a2 c0 30 3d dd 74 cd 28 9a 84 84 b8 b0 e0 62 c4 37 69 04 b3 26 34 6e 3a 9e 1b b8 ae 6e 4c fc c8 9f b8 fa c4 9b 98 a1 13 50 5b 07 30 a8 0a 81 c2 96 e5 f9 ae 1f 4d a0 0d 07 26 82 c0 d7 ad 09 60 6d f9 b6 17 11 a0 a4 17 b0 09 9b 44 13 cb 01 9a 03 b6 be 6f 5b 13 42 fc d0 35 7d 13 c0 a0 24 3a 61 e0 79 26 d0 2e 74 42 3f 70 43 9d 04 86 67 d8 96 e1 3a ba ae 87 64 12 39 56 08 65 00 0d c7 04 fa 4f 4c 9b 38 86 61 eb 80 ba 05 0c 06 30 0e 92 38 82 19 34 62 c6 c4 23 9e e5 b9 ae 83 f5 80 53 76 44 Data Ascii: U`F&63BAFM=naJ2HPy"b3gbZHM>/\B-?eXcCh0=t(b7i&4n:nLP[0M&`mDo[B5}$:ay&.tB?pCg:d9VeOL8a084b#SvD
2024-01-30 17:52:04 UTC	314	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:04 GMT Content-Length: 0 Connection: close Access-Control-Allow-Headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Origin: * Timing-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.17	49949	173.194.219.157	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:04 UTC	837	OUT	GET /pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MzUwNTA3NzQ5ODQ0ODMzNDAwMDQ1Njc0NzUwMTkzMTgwNDg3Njg= HTTP/1.1 Host: cm.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-01-30 17:52:04 UTC	996	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESENggFu3tzOCGc387ChgMM6w&google_cver=1?gdpr=0&gdpr_consent= Date: Tue, 30 Jan 2024 17:52:04 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 Server: HTTP server (unknown) Content-Length: 314 X-XSS-Protection: 0 Set-Cookie: IDE=AHWqTUmjUykVjVbva7WYqm-tzFHCJeOSmPnq-o0aH-0LuwZxXO2DvAErgDo1GJB_uNc; expires=Thu, 29-Jan-2026 17:52:04 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Set-Cookie: test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:52:04 UTC	256	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 64 70 6d 2e 64 65 6d 64 65 78 2e 6e 65 74 2f 69 62 73 3a 64 70 69 64 3d 37 37 31 26 61 6d 70 3b 64 70 75 75 69 64 3d 43 41 45 53 45 4e 67 67 46 75 33 74 7a 4f 43 47 63 33 38 37 43 68 67 4d 4d 36 77 26 61 6d 70 3b 67 6f 6f 67 6c 65 5f 63 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESENggFu3tzOCGc387ChgMM6w&google_c
2024-01-30 17:52:04 UTC	58	IN	Data Raw: 65 72 3d 31 3f 67 64 70 72 3d 30 26 61 6d 70 3b 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3e 68 65 72 65 3c 2f 41 3e 2e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: er=1?gdpr=0&gdpr_consent=">here</A>.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.17	49952	35.244.154.8	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:04 UTC	760	OUT	GET /1000.gif?memo=CKyqFhIxCi0IARCYEhomMzUwNTA3NzQ5ODQ0ODMzNDAwMDQ1Njc0NzUwMTkzMTgwNDg3NjgQABoNCMPu5K0GEgUI6AcQAEIASgA HTTP/1.1 Host: idsync.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: rlas3=eKwtq0lZ/flxovLVeYToWVTIh2jBHaOMvP3BGDUDkRw=; pxrc=CAA=
2024-01-30 17:52:04 UTC	745	IN	HTTP/1.1 307 Temporary Redirect Cache-Control: no-cache, no-store Location: https://dpm.demdex.net/ibs:dpid=477&dpuuid=a32adb534ed7b015ab5f979962884ce67525e2a0283d43d778da44e182749c01b0da87c991749652 P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=XrMWg1tkMVZxovLVeYToWVTIh2jBHaOMvP3BGDUDkRw=; Path=/; Domain=rlcdn.com; Expires=Wed, 29 Jan 2025 17:52:04 GMT; Secure; SameSite=None Set-Cookie: pxrc=CMTu5K0GEgUI6AcQABIGCPHrARAA; Path=/; Domain=rlcdn.com; Expires=Sat, 30 Mar 2024 17:52:04 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Tue, 30 Jan 2024 17:52:04 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.17	49951	13.107.213.35	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:04 UTC	534	OUT	GET /s/0.7.20/clarity.js HTTP/1.1 Host: www.clarity.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:04 UTC	619	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:04 GMT Content-Type: application/javascript;charset=utf-8 Content-Length: 61023 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Wed, 24 Jan 2024 14:33:55 GMT ETag: "0x8DC1CE97EB406F9" x-ms-request-id: fb8ab196-e01e-0013-20e9-500ad7000000 x-ms-version: 2018-03-28 Access-Control-Allow-Origin: * Cache-Control: public, max-age=86400 x-azure-ref: 20240130T175204Z-smhrpgcv2d1n71w9agnr5te8an00000001h0000000006e3q x-fd-int-roxy-purgeid: 51562430 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-01-30 17:52:04 UTC	15765	IN	Data Raw: 2f 2a 20 63 6c 61 72 69 74 79 2d 6a 73 20 76 30 2e 37 2e 32 30 3a 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 6d 69 63 72 6f 73 6f 66 74 2f 63 6c 61 72 69 74 79 20 28 4c 69 63 65 6e 73 65 3a 20 4d 49 54 29 20 2a 2f 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 6e 75 6c 6c 2c 67 65 74 20 71 75 65 75 65 28 29 7b 72 65 74 75 72 6e 20 57 61 7d 2c 67 65 74 20 73 74 61 72 74 28 29 7b 72 65 74 75 72 6e 20 71 61 7d 2c 67 65 74 20 73 74 6f 70 28 29 7b 72 65 74 75 72 6e 20 58 61 7d 2c 67 65 74 20 74 72 61 63 6b 28 29 7b 72 65 74 75 72 6e 20 4c 61 7d 7d 29 2c 65 3d 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 7b 5f 5f 70 72 6f Data Ascii: /* clarity-js v0.7.20: https://github.com/microsoft/clarity (License: MIT) */!function(){"use strict";var t=Object.freeze({__proto__:null,get queue(){return Wa},get start(){return qa},get stop(){return Xa},get track(){return La}}),e=Object.freeze({__pro
2024-01-30 17:52:04 UTC	16384	IN	Data Raw: 6e 64 65 78 4f 66 28 63 29 3e 3d 30 3f 69 3a 6c 3f 34 3a 32 3b 62 72 65 61 6b 3b 63 61 73 65 22 64 61 74 61 2d 63 6c 61 72 69 74 79 2d 6d 61 73 6b 22 69 6e 20 6f 3a 72 2e 70 72 69 76 61 63 79 3d 33 3b 62 72 65 61 6b 3b 63 61 73 65 22 64 61 74 61 2d 63 6c 61 72 69 74 79 2d 75 6e 6d 61 73 6b 22 69 6e 20 6f 3a 72 2e 70 72 69 76 61 63 79 3d 30 3b 62 72 65 61 6b 3b 63 61 73 65 20 71 74 2e 68 61 73 28 74 29 3a 72 2e 70 72 69 76 61 63 79 3d 71 74 2e 67 65 74 28 74 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 57 74 2e 68 61 73 28 74 29 3a 72 2e 70 72 69 76 61 63 79 3d 32 3b 62 72 65 61 6b 3b 63 61 73 65 22 2a 54 22 3d 3d 3d 75 3a 76 61 72 20 64 3d 6e 26 26 6e 2e 64 61 74 61 3f 6e 2e 64 61 74 61 2e 74 61 67 3a 22 22 2c 66 3d 6e 26 26 6e 2e 73 65 6c 65 63 74 6f 72 3f 6e Data Ascii: ndexOf(c)>=0?i:l?4:2;break;case"data-clarity-mask"in o:r.privacy=3;break;case"data-clarity-unmask"in o:r.privacy=0;break;case qt.has(t):r.privacy=qt.get(t);break;case Wt.has(t):r.privacy=2;break;case"*T"===u:var d=n&&n.data?n.data.tag:"",f=n&&n.selector?n
2024-01-30 17:52:04 UTC	16384	IN	Data Raw: 72 22 2c 22 64 61 74 61 2d 64 72 75 70 61 6c 2d 66 6f 72 6d 2d 73 75 62 6d 69 74 2d 6c 61 73 74 22 5d 2c 61 61 3d 2f 5b 5c 72 5c 6e 5d 2b 2f 67 3b 66 75 6e 63 74 69 6f 6e 20 72 61 28 74 2c 65 29 7b 76 61 72 20 6e 2c 61 3d 6e 75 6c 6c 3b 69 66 28 32 3d 3d 3d 65 26 26 21 31 3d 3d 3d 65 65 28 74 29 29 72 65 74 75 72 6e 20 61 3b 30 21 3d 3d 65 26 26 74 2e 6e 6f 64 65 54 79 70 65 3d 3d 3d 4e 6f 64 65 2e 54 45 58 54 5f 4e 4f 44 45 26 26 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 26 26 22 53 54 59 4c 45 22 3d 3d 3d 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 74 61 67 4e 61 6d 65 26 26 28 74 3d 74 2e 70 61 72 65 6e 74 4e 6f 64 65 29 3b 76 61 72 20 72 3d 21 31 3d 3d 3d 65 65 28 74 29 3f 22 61 64 64 22 3a 22 75 70 64 61 74 65 22 2c 69 3d 74 2e 70 61 72 65 6e Data Ascii: r","data-drupal-form-submit-last"],aa=/[\r\n]+/g;function ra(t,e){var n,a=null;if(2===e&&!1===ee(t))return a;0!==e&&t.nodeType===Node.TEXT_NODE&&t.parentElement&&"STYLE"===t.parentElement.tagName&&(t=t.parentNode);var r=!1===ee(t)?"add":"update",i=t.paren
2024-01-30 17:52:04 UTC	12490	IN	Data Raw: 3f 37 3a 65 2c 65 3d 73 28 29 3e 37 32 65 35 3f 32 3a 65 2c 28 65 3d 74 3e 31 30 34 38 35 37 36 30 3f 32 3a 65 29 21 3d 3d 74 72 2e 63 68 65 63 6b 26 26 77 72 28 65 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 77 72 28 74 29 7b 74 72 2e 63 68 65 63 6b 3d 74 2c 59 72 28 29 2c 6a 69 28 29 7d 66 75 6e 63 74 69 6f 6e 20 6b 72 28 29 7b 30 21 3d 3d 74 72 2e 63 68 65 63 6b 26 26 6d 72 28 33 35 29 7d 66 75 6e 63 74 69 6f 6e 20 45 72 28 29 7b 74 72 3d 6e 75 6c 6c 7d 76 61 72 20 4f 72 3d 6e 75 6c 6c 2c 53 72 3d 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 78 72 28 29 7b 4f 72 3d 7b 7d 2c 53 72 3d 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 4e 72 28 29 7b 4f 72 3d 7b 7d 2c 53 72 3d 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 54 72 28 74 2c 65 29 7b 65 26 26 28 65 3d 22 22 2e 63 6f 6e 63 61 74 Data Ascii: ?7:e,e=s()>72e5?2:e,(e=t>10485760?2:e)!==tr.check&&wr(e)}}function wr(t){tr.check=t,Yr(),ji()}function kr(){0!==tr.check&&mr(35)}function Er(){tr=null}var Or=null,Sr=null;function xr(){Or={},Sr={}}function Nr(){Or={},Sr={}}function Tr(t,e){e&&(e="".concat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.17	49953	68.67.160.137	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:04 UTC	860	OUT	GET /bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XANDR_PANID=0U84jn1ew9ikPVt7_w3fV-ISfsCe9Ihc9la-kJur8ncyUhWxqD3Sx06SfQjg93aWzvvzpuruaMR21JdAcdeLWKJ8KsCpVkZhV1B8KCKoSgQ.; receive-cookie-deprecation=1; uuid2=535537844608889607
2024-01-30 17:52:04 UTC	1425	IN	HTTP/1.1 302 Found Server: nginx/1.23.4 Date: Tue, 30 Jan 2024 17:52:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://dpm.demdex.net/ibs:dpid=358&dpuuid=535537844608889607 AN-X-Request-Uuid: f2ea4341-7396-4edf-958f-a586ee8b3259 Set-Cookie: XANDR_PANID=0U84jn1ew9ikPVt7_w3fV-ISfsCe9Ihc9la-kJur8ncyUhWxqD3Sx06SfQjg93aWzvvzpuruaMR21JdAcdeLWKJ8KsCpVkZhV1B8KCKoSgQ.; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 29-Apr-2024 17:52:04 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Tue, 17-Jan-2034 17:52:04 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=535537844608889607; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 29-Apr-2024 17:52:04 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 81.181.57.74; 81.181.57.74; 639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.17	49954	34.206.180.7	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:04 UTC	1051	OUT	GET /dvar?v=13.83.0&pid=2422&pn=1&sn=1&uu=96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4&dv=H4sIAAAAAAAAA1WQ0UvDMBDG%2F5WjL9swZe1cRX07y6YWlNKu%2BDDGSNtDAmkiSYoM9X83qYPhS758Iff77u4rwocj7o7pTXaXQgy4RCDFWynUO%2FCuGw13BH0QoRWQdWL4u442fJk9St1y6SvfqPVnaXQ%2FA%2Bx1S4CKy5MTnQVDH9o4sKNwFN1HnE9xLo3YOX61zta3vnyPDYMcGRQlg6Y%2B%2BKfmaQvf8OxosCAU5NyDKhqE6slAzSVd3OY1bmoWJCC21STeBWiBcVF6UJYsswTmlR5VD6uF72bK3l16Sa%2BzJAmrkJ%2F8ZGM%2FaliKl33ttKHzkHAF%2F%2BwcNy%2BLg8chxhMhj35%2BAYjXMCZdAQAA&ct=2&r=474970 HTTP/1.1 Host: c.clicktale.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:04 UTC	469	IN	HTTP/1.1 204 No Content Date: Tue, 30 Jan 2024 17:52:04 GMT Connection: close Access-Control-Allow-Headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Content-Disposition: inline Expires: Sun, 24 Oct 1982 23:00:00 GMT Pragma: no-cache Timing-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.17	49955	34.206.180.7	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:04 UTC	762	OUT	POST /v2/events?uu=96af738c-fdc5-a6c5-a3b5-bf24ef9c45a4&sn=1&hd=1706637121&v=13.83.0&pid=2422&pn=1&str=10588&di=14192&dc=15492&fl=15500&sr=34&mdh=2538&ct=0 HTTP/1.1 Host: c.clicktale.net Connection: keep-alive Content-Length: 2015 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:04 UTC	2015	OUT	Data Raw: 5b 7b 22 74 79 70 65 22 3a 30 2c 22 74 73 22 3a 35 2c 22 78 22 3a 31 30 33 34 2c 22 79 22 3a 38 37 30 7d 2c 7b 22 74 79 70 65 22 3a 31 39 2c 22 6e 61 6d 65 22 3a 22 46 43 50 22 2c 22 76 61 6c 22 3a 31 32 32 37 30 2e 35 2c 22 74 73 22 3a 32 32 7d 2c 7b 22 74 79 70 65 22 3a 31 39 2c 22 6e 61 6d 65 22 3a 22 4c 43 50 22 2c 22 76 61 6c 22 3a 31 32 34 35 34 2e 36 30 30 30 30 30 30 30 30 30 30 36 2c 22 74 73 22 3a 32 32 7d 2c 7b 22 74 79 70 65 22 3a 31 39 2c 22 6e 61 6d 65 22 3a 22 54 54 46 42 22 2c 22 76 61 6c 22 3a 31 30 39 37 38 2e 31 30 30 30 30 30 30 30 30 30 30 36 2c 22 74 73 22 3a 32 32 7d 2c 7b 22 74 79 70 65 22 3a 31 39 2c 22 6e 61 6d 65 22 3a 22 43 4c 53 22 2c 22 76 61 6c 22 3a 30 2e 30 33 36 31 39 31 38 36 32 34 38 35 38 34 33 36 31 2c 22 74 73 22 3a Data Ascii: [{"type":0,"ts":5,"x":1034,"y":870},{"type":19,"name":"FCP","val":12270.5,"ts":22},{"type":19,"name":"LCP","val":12454.600000000006,"ts":22},{"type":19,"name":"TTFB","val":10978.100000000006,"ts":22},{"type":19,"name":"CLS","val":0.03619186248584361,"ts":
2024-01-30 17:52:04 UTC	469	IN	HTTP/1.1 204 No Content Date: Tue, 30 Jan 2024 17:52:04 GMT Connection: close Access-Control-Allow-Headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Content-Disposition: inline Expires: Sun, 24 Oct 1982 23:00:00 GMT Pragma: no-cache Timing-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.17	49957	52.201.196.73	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:04 UTC	822	OUT	GET /ibs:dpid=771&dpuuid=CAESENggFu3tzOCGc387ChgMM6w&google_cver=1?gdpr=0&gdpr_consent= HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887; dpm=35050774984483340004567475019318048768
2024-01-30 17:52:05 UTC	889	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:04 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: 79lHd9bjSXg= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-1-v053-0b8af7933.edge-va6.demdex.com 3 ms set-cookie: dpm=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:04 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:04 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-01-30 17:52:05 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.17	49958	52.201.196.73	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:04 UTC	840	OUT	GET /ibs:dpid=477&dpuuid=a32adb534ed7b015ab5f979962884ce67525e2a0283d43d778da44e182749c01b0da87c991749652 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887; dpm=35050774984483340004567475019318048768
2024-01-30 17:52:05 UTC	889	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:04 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: 4Hkz3LXVSUY= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-1-v053-0975f56c5.edge-va6.demdex.com 9 ms set-cookie: dpm=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:04 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:04 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-01-30 17:52:05 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.17	49959	52.201.196.73	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:04 UTC	778	OUT	GET /ibs:dpid=358&dpuuid=535537844608889607 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887; dpm=35050774984483340004567475019318048768
2024-01-30 17:52:05 UTC	889	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:05 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: pitqt3QITKo= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-1-v053-0bc9452d5.edge-va6.demdex.com 2 ms set-cookie: dpm=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:05 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:05 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-01-30 17:52:05 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.17	49961	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:05 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NvNedGrehGN2W1y&MD=3Z8G6gZk HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-01-30 17:52:05 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 85953260-4de5-43a4-96c9-bec333dbdad8 MS-RequestId: 5f80e35c-fcde-468d-a75a-5125106604dc MS-CV: HqOCpD+4NkWJ0cQv.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 30 Jan 2024 17:52:05 GMT Connection: close Content-Length: 25457
2024-01-30 17:52:05 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-01-30 17:52:05 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.17	49967	52.201.196.73	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:06 UTC	816	OUT	GET /ibs:dpid=782&dpuuid=Zbk3QwAAAGzR0xva HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884
2024-01-30 17:52:06 UTC	895	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:06 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: PkTOg1PwREw= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcscanary-prod-va6-1-v067-07f4b616a.edge-va6.demdex.com 3 ms set-cookie: dpm=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:06 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:06 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-01-30 17:52:06 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.17	49971	104.244.42.131	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:07 UTC	648	OUT	GET /i/adsct?p_user_id=35050774984483340004567475019318048768&p_id=38594 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:07 UTC	572	IN	HTTP/1.1 200 OK date: Tue, 30 Jan 2024 17:52:06 GMT perf: 7469935968 server: tsa_b set-cookie: personalization_id="v1_pCr4nbko6BYswO9e/CxYzw=="; Max-Age=63072000; Expires=Thu, 29 Jan 2026 17:52:07 GMT; Path=/; Domain=.twitter.com; Secure; SameSite=None content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: ebf70ca387c2efec strict-transport-security: max-age=631138519 x-response-time: 77 x-connection-hash: bce290472fc8ca310314c3dec5a4d00c0f9718693ec64890892b9efefb1901f0 connection: close
2024-01-30 17:52:07 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.17	49973	52.223.40.198	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:08 UTC	661	OUT	GET /track/cmf/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&domain=www.microsoft.com&ttd_tpi=1 HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:08 UTC	137	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:08 GMT Content-Type: image/gif Content-Length: 70 Connection: close server: Kestrel
2024-01-30 17:52:08 UTC	70	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 81 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 01 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 08 04 00 01 04 04 00 3b Data Ascii: GIF89a!NETSCAPE2.0!,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.17	49975	192.184.69.201	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:09 UTC	634	OUT	GET /pixel/p-vj4AYjBqd6VJ2.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP/1.1 Host: cms.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:09 UTC	492	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:09 GMT Content-Type: image/gif Content-Length: 35 Connection: close Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV" Pragma: no-cache Set-Cookie: mc=65b93749-7682a-a8fd8-41480; expires=Sat, 01-Mar-2025 17:52:09 GMT; path=/; domain=.quantserve.com; SameSite=None; Secure Strict-Transport-Security: max-age=86400
2024-01-30 17:52:09 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 80 ff ff ff 00 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.17	49979	52.201.196.73	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:10 UTC	916	OUT	GET /ibs:dpid=1957&dpuuid=235DAA179B1F6089140CBE019A496167 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890
2024-01-30 17:52:10 UTC	889	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:10 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: N1t/d7ADRnA= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-2-v053-0e37111ad.edge-va6.demdex.com 2 ms set-cookie: dpm=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:10 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:10 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-01-30 17:52:10 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.17	49981	52.201.196.73	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:11 UTC	940	OUT	GET /ibs:dpid=3047&dpuuid=5873EF962A9843&gdpr=0&gdpr_consent= HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890\|3047-1-1706637129886
2024-01-30 17:52:11 UTC	889	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:11 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: Zuw3bJjnTnc= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-1-v053-0d754d4b8.edge-va6.demdex.com 2 ms set-cookie: dpm=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:11 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:11 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-01-30 17:52:11 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.17	49982	104.18.25.173	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:12 UTC	713	OUT	GET /i.match?p=b13&u=35050774984483340004567475019318048768&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$ HTTP/1.1 Host: a.tribalfusion.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:12 UTC	889	IN	HTTP/1.1 302 Found Date: Tue, 30 Jan 2024 17:52:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close P3P: CP="NOI DEVo TAIa OUR BUS" X-Function: 206 X-Reuse-Index: 487 Cache-Control: no-cache Cache-Control: private Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache Set-Cookie: ANON_ID=atnoeUriItxP3PTTfUSuwbKqJ63rewTSSb34AXlw; path=/; domain=.tribalfusion.com; expires=Mon, 29-Apr-2024 17:52:12 GMT; SameSite=None; Secure; Set-Cookie: ANON_ID_old=atnoeUriItxP3PTTfUSuwbKqJ63rewTSSb34AXlw; path=/; domain=.tribalfusion.com; expires=Mon, 29-Apr-2024 17:52:12 GMT; Location: https://s.tribalfusion.com/z/i.match?p=b13&u=35050774984483340004567475019318048768&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$ CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 84db913d1ee0b0b7-ATL alt-svc: h3=":443"; ma=86400
2024-01-30 17:52:12 UTC	42	IN	Data Raw: 32 34 0d 0a 3c 68 31 3e 45 72 72 6f 72 20 33 30 32 20 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 68 31 3e 0d 0a Data Ascii: 24<h1>Error 302 Moved Temporarily</h1>
2024-01-30 17:52:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.17	49984	104.18.25.173	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:12 UTC	773	OUT	GET /z/i.match?p=b13&u=35050774984483340004567475019318048768&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$ HTTP/1.1 Host: s.tribalfusion.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ANON_ID=atnoeUriItxP3PTTfUSuwbKqJ63rewTSSb34AXlw
2024-01-30 17:52:13 UTC	849	IN	HTTP/1.1 302 Found Date: Tue, 30 Jan 2024 17:52:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close P3P: CP="NOI DEVo TAIa OUR BUS" X-Function: 209 X-Reuse-Index: 3246 Cache-Control: no-cache Cache-Control: private Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache Set-Cookie: ANON_ID=aSnsuBN3IdaSIdwFTkVRHtTJpvcZcrQDgnyfTsc5xUsQVQhwwSNiNu3KIpCWZc4DpdJ5Uh7kiW7prb0cZbx; path=/; domain=.tribalfusion.com; expires=Mon, 29-Apr-2024 17:52:13 GMT; SameSite=None; Secure; Set-Cookie: ANON_ID_old=aSnsuBN3IdaSIdwFTkVRHtTJpvcZcrQDgnyfTsc5xUsQVQhwwSNiNu3KIpCWZc4DpdJ5Uh7kiW7prb0cZbx; path=/; domain=.tribalfusion.com; expires=Mon, 29-Apr-2024 17:52:13 GMT; Location: https://dpm.demdex.net/ibs:dpid=22054 CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 84db91418bae44cf-ATL alt-svc: h3=":443"; ma=86400
2024-01-30 17:52:13 UTC	42	IN	Data Raw: 32 34 0d 0a 3c 68 31 3e 45 72 72 6f 72 20 33 30 32 20 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 68 31 3e 0d 0a Data Ascii: 24<h1>Error 302 Moved Temporarily</h1>
2024-01-30 17:52:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.17	49986	34.200.65.202	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:13 UTC	674	OUT	GET /cms?partner_id=ADOBE&_hosted_id=35050774984483340004567475019318048768&gdpr=0&gdpr_consent= HTTP/1.1 Host: cms.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:13 UTC	570	IN	HTTP/1.1 302 Redirect Date: Tue, 30 Jan 2024 17:52:13 GMT Connection: close Server: ATS/9.1.10.94 Cache-Control: no-store Location: https://ups.analytics.yahoo.com/ups/58782/cms?partner_id=ADOBE&_hosted_id=35050774984483340004567475019318048768&gdpr=0&gdpr_consent= Content-Type: text/html Content-Language: en Set-Cookie: A3=d=AQABBE03uWUCEFWu7doihFyFzYzJN-r2wxsFEgEBAQGIumXDZfGAziMA_eMAAA&S=AQAAAuVSLiP59Sh0eVinCS4hPZc; Expires=Wed, 29 Jan 2025 23:52:13 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly Content-Length: 415
2024-01-30 17:52:13 UTC	415	IN	Data Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 44 6f 63 75 6d 65 6e 74 20 48 61 73 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 77 68 69 74 65 22 20 46 47 43 4f 4c 4f 52 3d 22 62 6c 61 63 6b 22 3e 0a 3c 48 31 3e 44 6f 63 75 6d 65 6e 74 20 48 61 73 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 3c 48 52 3e 0a 0a 3c 46 4f 4e 54 20 46 41 43 45 3d 22 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 22 3e 3c 42 3e 0a 44 65 73 63 72 69 70 74 69 6f 6e 3a 20 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 68 61 73 20 6d 6f 76 65 64 20 74 6f 20 61 20 6e 65 77 20 6c 6f 63 61 74 69 6f 6e 2e 20 20 54 68 65 20 6e 65 77 20 6c 6f 63 61 74 69 6f 6e 20 69 73 20 22 68 Data Ascii: <HTML><HEAD><TITLE>Document Has Moved</TITLE></HEAD><BODY BGCOLOR="white" FGCOLOR="black"><H1>Document Has Moved</H1><HR><FONT FACE="Helvetica,Arial"><B>Description: The document you requested has moved to a new location. The new location is "h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.17	49987	52.201.196.73	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:13 UTC	942	OUT	GET /ibs:dpid=22054 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890\|3047-1-1706637129886\|22054-1-1706637130883\|30646-1-1706637131888
2024-01-30 17:52:13 UTC	903	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:13 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: PoHUok8hQU0= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Error: 300 X-Content-Type-Options: nosniff DCS: dcs-prod-va6-2-v053-08397a447.edge-va6.demdex.com 0 ms set-cookie: dpm=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:13 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:13 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-01-30 17:52:13 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.17	49988	34.200.65.202	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:13 UTC	791	OUT	GET /ups/58782/cms?partner_id=ADOBE&_hosted_id=35050774984483340004567475019318048768&gdpr=0&gdpr_consent= HTTP/1.1 Host: ups.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBE03uWUCEFWu7doihFyFzYzJN-r2wxsFEgEBAQGIumXDZfGAziMA_eMAAA&S=AQAAAuVSLiP59Sh0eVinCS4hPZc
2024-01-30 17:52:13 UTC	719	IN	HTTP/1.1 302 Found Date: Tue, 30 Jan 2024 17:52:13 GMT Content-Length: 0 Strict-Transport-Security: max-age=31536000 Set-Cookie: IDSYNC=19cu~2gh5;Version=1;Domain=.analytics.yahoo.com;Path=/;Max-Age=31536000;Expires=Wed, 29-Jan-2025 17:52:13 GMT;Secure;SameSite=None P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Location: https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-GUgwg.xE2pFMcbpyXNvyw.wczz.DSnmIwWo-~A Age: 0 Connection: close Server: ATS/9.1.10.94 Set-Cookie: A3=d=AQABBE03uWUCEFWu7doihFyFzYzJN-r2wxsFEgEBAQGIumXDZfGAziMA_eMAAA&S=AQAAAuVSLiP59Sh0eVinCS4hPZc; Expires=Wed, 29 Jan 2025 23:52:13 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.17	49990	52.201.196.73	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:14 UTC	1012	OUT	GET /ibs:dpid=30646?dpuuid=y-GUgwg.xE2pFMcbpyXNvyw.wczz.DSnmIwWo-~A HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890\|3047-1-1706637129886\|22054-1-1706637130883\|30646-1-1706637131888\|53196-1-1706637132888
2024-01-30 17:52:14 UTC	889	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:14 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: 80zeZBncQ0w= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-2-v053-00fd5bbb2.edge-va6.demdex.com 6 ms set-cookie: dpm=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:14 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:14 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-01-30 17:52:14 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.17	49996	52.201.196.73	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:16 UTC	1048	OUT	GET /ibs:dpid=57282&dpuuid=0C29F8072DAC5CAE99535F32A7D13BAE HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890\|3047-1-1706637129886\|22054-1-1706637130883\|30646-1-1706637131888\|53196-1-1706637132888\|38117-1-1706637133877\|57282-1-1706637134881
2024-01-30 17:52:16 UTC	889	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:16 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: 5TrgQ2C2TXs= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-1-v053-0e7e1546c.edge-va6.demdex.com 7 ms set-cookie: dpm=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:16 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:16 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-01-30 17:52:16 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.17	49997	192.132.33.68	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:17 UTC	632	OUT	GET /dmp/adobe/user?dd_uuid=35050774984483340004567475019318048768 HTTP/1.1 Host: bttrack.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:17 UTC	258	IN	HTTP/1.1 200 OK Cache-Control: private,no-cache Pragma: no-cache Content-Type: image/gif Expires: -1 X-ServerName: Track004-iad Date: Tue, 30 Jan 2024 17:51:33 GMT Connection: close Content-Length: 35 Strict-Transport-Security: max-age=31536000;
2024-01-30 17:52:17 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.17	49998	52.223.22.214	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:18 UTC	697	OUT	GET /getuid?redir=%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D72352%26dpuuid%3D$UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: dmpsync.3lift.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:18 UTC	572	IN	HTTP/1.1 302 Found Date: Tue, 30 Jan 2024 17:52:18 GMT Content-Length: 0 Connection: close Location: /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D72352%26dpuuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D Cache-Control: no-cache, no-store, must-revalidate P3P: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" Set-Cookie: tluid=3226875877078116803796; Path=/; Domain=.3lift.com; Max-Age=7776000; Expires=Mon, 29 Apr 2024 17:52:18 GMT; Secure; SameSite=None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.17	50002	34.224.206.102	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:19 UTC	587	OUT	GET /dv/sync?tid=6 HTTP/1.1 Host: ag.innovid.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:19 UTC	388	IN	HTTP/1.1 302 Found Date: Tue, 30 Jan 2024 17:52:19 GMT Content-Length: 0 Connection: close Location: https://dpm.demdex.net/ibs:dpid=80742&dpuuid=99c5e057-9d5a-425b-9d30-6752d1836cd6 Set-Cookie: uuid=99c5e057-9d5a-425b-9d30-6752d1836cd6-20240130 12:52:19; Max-Age=7776000; Expires=Mon, 29 Apr 2024 17:52:19 GMT; SameSite=None; Path=/; Domain=.innovid.com; Secure Request-Time: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.17	50001	52.223.22.214	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:19 UTC	748	OUT	GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D72352%26dpuuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1 Host: dmpsync.3lift.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tluid=3226875877078116803796
2024-01-30 17:52:19 UTC	526	IN	HTTP/1.1 302 Found Date: Tue, 30 Jan 2024 17:52:19 GMT Content-Length: 0 Connection: close Location: https://dpm.demdex.net/ibs:dpid=72352&dpuuid=3226875877078116803796&gdpr=0&gdpr_consent= Cache-Control: no-cache, no-store, must-revalidate P3P: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" Set-Cookie: tluid=3226875877078116803796; Path=/; Domain=.3lift.com; Max-Age=7776000; Expires=Mon, 29 Apr 2024 17:52:19 GMT; Secure; SameSite=None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.17	50003	52.201.196.73	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:19 UTC	1118	OUT	GET /ibs:dpid=80742&dpuuid=99c5e057-9d5a-425b-9d30-6752d1836cd6 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890\|3047-1-1706637129886\|22054-1-1706637130883\|30646-1-1706637131888\|53196-1-1706637132888\|38117-1-1706637133877\|57282-1-1706637134881\|49276-1-1706637135885\|72352-1-1706637136874\|80742-1-1706637137880
2024-01-30 17:52:19 UTC	889	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:19 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: bIWF6WcrQSM= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-2-v053-0fb7471d1.edge-va6.demdex.com 2 ms set-cookie: dpm=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:19 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:19 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-01-30 17:52:19 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.17	50004	52.201.196.73	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:20 UTC	1147	OUT	GET /ibs:dpid=72352&dpuuid=3226875877078116803796&gdpr=0&gdpr_consent= HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890\|3047-1-1706637129886\|22054-1-1706637130883\|30646-1-1706637131888\|53196-1-1706637132888\|38117-1-1706637133877\|57282-1-1706637134881\|49276-1-1706637135885\|72352-1-1706637136874\|80742-1-1706637137880\|81309-1-1706637138883
2024-01-30 17:52:20 UTC	889	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:20 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: G/6Z9H4NQUc= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-2-v053-080f9a2ef.edge-va6.demdex.com 2 ms set-cookie: dpm=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:20 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:20 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-01-30 17:52:20 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.17	50005	18.214.166.242	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:20 UTC	591	OUT	GET /CookieSyncAdobe HTTP/1.1 Host: rtb.adentifi.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:20 UTC	128	IN	HTTP/1.1 204 No Content Date: Tue, 30 Jan 2024 17:52:20 GMT Content-Type: text/plain Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.17	50006	50.19.176.119	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:21 UTC	737	OUT	GET /map/c=9828/tp=ADBE/gdpr=0/gdpr_consent=/tpid=35050774984483340004567475019318048768?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id} HTTP/1.1 Host: sync.crwdcntrl.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:21 UTC	536	IN	HTTP/1.1 302 Found Date: Tue, 30 Jan 2024 17:52:21 GMT Content-Length: 0 Connection: close P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV Cache-Control: no-cache Pragma: no-cache Expires: 0 X-Server: 10.40.61.11 Set-Cookie: _cc_cc=ctst;Path=/;Domain=crwdcntrl.net;SameSite=None;Secure Location: https://sync.crwdcntrl.net/map/ct=y/c=9828/tp=ADBE/gdpr=0/gdpr_consent=/tpid=35050774984483340004567475019318048768?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id} Server: Jetty(9.4.38.v20210224)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
151	192.168.2.17	50007	50.19.176.119	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:21 UTC	763	OUT	GET /map/ct=y/c=9828/tp=ADBE/gdpr=0/gdpr_consent=/tpid=35050774984483340004567475019318048768?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id} HTTP/1.1 Host: sync.crwdcntrl.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _cc_cc=ctst
2024-01-30 17:52:21 UTC	727	IN	HTTP/1.1 302 Found Date: Tue, 30 Jan 2024 17:52:21 GMT Content-Length: 0 Connection: close P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV Cache-Control: no-cache Pragma: no-cache Expires: 0 X-Server: 10.40.3.30 Set-Cookie: _cc_dc=0;Path=/;Domain=crwdcntrl.net;Expires=Sat, 26-Oct-2024 17:10:00 GMT;SameSite=None;Secure Set-Cookie: _cc_id=d2e823aefb96712d90244489d20af824;Path=/;Domain=crwdcntrl.net;Expires=Sat, 26-Oct-2024 17:10:00 GMT;SameSite=None;Secure Set-Cookie: _cc_cc="";Version=1;Path=/;Domain=crwdcntrl.net;Expires=Thu, 01-Jan-1970 02:01:00 GMT;Max-Age=0;SameSite=None;Secure Location: https://dpm.demdex.net/ibs:dpid=121998&dpuuid=d2e823aefb96712d90244489d20af824 Server: Jetty(9.4.38.v20210224)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
152	192.168.2.17	50008	52.201.196.73	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:22 UTC	1183	OUT	GET /ibs:dpid=121998&dpuuid=d2e823aefb96712d90244489d20af824 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890\|3047-1-1706637129886\|22054-1-1706637130883\|30646-1-1706637131888\|53196-1-1706637132888\|38117-1-1706637133877\|57282-1-1706637134881\|49276-1-1706637135885\|72352-1-1706637136874\|80742-1-1706637137880\|81309-1-1706637138883\|121998-1-1706637139875\|144228-1-1706637140884
2024-01-30 17:52:22 UTC	889	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:22 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: /EFgvS4rQ74= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-2-v053-0d7021062.edge-va6.demdex.com 2 ms set-cookie: dpm=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:22 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:22 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-01-30 17:52:22 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
153	192.168.2.17	50010	52.201.196.73	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:22 UTC	1164	OUT	GET /ibs:dpid=782&dpuuid=Zbk3QwAAAGzR0xva HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890\|3047-1-1706637129886\|22054-1-1706637130883\|30646-1-1706637131888\|53196-1-1706637132888\|38117-1-1706637133877\|57282-1-1706637134881\|49276-1-1706637135885\|72352-1-1706637136874\|80742-1-1706637137880\|81309-1-1706637138883\|121998-1-1706637139875\|144228-1-1706637140884
2024-01-30 17:52:22 UTC	889	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:22 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: Kws5PD0ASRY= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-2-v053-08ac3cf26.edge-va6.demdex.com 1 ms set-cookie: dpm=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:22 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:22 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-01-30 17:52:22 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.17	50014	173.194.219.157	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:24 UTC	751	OUT	GET /pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WmJrM1F3QUFBR3pSMHh2YQ== HTTP/1.1 Host: cm.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUmjUykVjVbva7WYqm-tzFHCJeOSmPnq-o0aH-0LuwZxXO2DvAErgDo1GJB_uNc
2024-01-30 17:52:24 UTC	374	IN	HTTP/1.1 200 OK Content-Type: image/png Date: Tue, 30 Jan 2024 17:52:24 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Cross-Origin-Resource-Policy: cross-origin Server: HTTP server (unknown) Content-Length: 170 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:52:24 UTC	170	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 07 74 49 4d 45 07 d7 05 1d 0d 0d 2d 51 d5 37 6e 00 00 00 1d 74 45 58 74 43 6f 6d 6d 65 6e 74 00 43 72 65 61 74 65 64 20 77 69 74 68 20 54 68 65 20 47 49 4d 50 ef 64 25 6e 00 00 00 0d 49 44 41 54 08 d7 63 a8 69 79 e5 00 00 05 95 02 2b 03 a2 de f7 00 00 00 00 49 45 4e 44 ae 42 60 82 0a Data Ascii: PNGIHDRbKGDpHYstIME-Q7ntEXtCommentCreated with The GIMPd%nIDATciy+IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
155	192.168.2.17	50019	104.18.36.155	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:26 UTC	634	OUT	GET /rum?cm_dsp_id=88&external_user_id=Zbk3QwAAAGzR0xva HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:26 UTC	1166	IN	HTTP/1.1 302 Found Date: Tue, 30 Jan 2024 17:52:26 GMT Content-Length: 0 Connection: close Location: /rum?cm_dsp_id=88&external_user_id=Zbk3QwAAAGzR0xva&C=1 CF-Ray: 84db91973e45b08b-ATL CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=Zbk3WqdpVPwfFuWW3lkEqAAA; Path=/; Domain=casalemedia.com; Expires=Wed, 29 Jan 2025 17:52:26 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPS=084; Path=/; Domain=casalemedia.com; Expires=Mon, 29 Apr 2024 17:52:26 GMT; Max-Age=7776000; Secure; SameSite=None Set-Cookie: CMPRO=084; Path=/; Domain=casalemedia.com; Expires=Mon, 29 Apr 2024 17:52:26 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5EAM%2FWl70fFQBxlYsRse%2BCBUKGRZ7YA9RGnMl8B3c4qxJhc%2BxACaxQUcFKy2Z%2BIy8sJ1pkMGkKhA5tqb8oDVD6ofX%2BHTNoodUsICZ7rCgrmd9jh5b4KL2WC9yspPYeG%2Fylz1ohOr53FLTA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
156	192.168.2.17	50021	104.18.36.155	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:27 UTC	698	OUT	GET /rum?cm_dsp_id=88&external_user_id=Zbk3QwAAAGzR0xva&C=1 HTTP/1.1 Host: dsum-sec.casalemedia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CMID=Zbk3WqdpVPwfFuWW3lkEqAAA; CMPS=084; CMPRO=084
2024-01-30 17:52:27 UTC	985	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:27 GMT Content-Type: image/gif Content-Length: 43 Connection: close CF-Ray: 84db919abc714552-ATL CF-Cache-Status: DYNAMIC Cache-Control: no-cache Expires: 0 Set-Cookie: CMID=Zbk3WqdpVPwfFuWW3lkEqAAA; Path=/; Domain=casalemedia.com; Expires=Wed, 29 Jan 2025 17:52:27 GMT; Max-Age=31536000; Secure; SameSite=None P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Pragma: no-cache Set-Cookie: CMPRO=084; Path=/; Domain=casalemedia.com; Expires=Mon, 29 Apr 2024 17:52:27 GMT; Max-Age=7776000; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S68e5ULAhNbsmPPNM69TmQuUwdSK%2FK82A63GfeFRo%2BctgDSwX3BVLO9NwSDPX83QSUrU9F0Ejb9sIqTTkQ99pTzWPYsPnADL9839EHI2L%2BJWIGD%2BIZrSHlck9qta49XRlPERSCiCmc34cg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-01-30 17:52:27 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
157	192.168.2.17	50022	68.67.160.137	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:27 UTC	797	OUT	GET /setuid?entity=158&code=Zbk3QwAAAGzR0xva HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XANDR_PANID=0U84jn1ew9ikPVt7_w3fV-ISfsCe9Ihc9la-kJur8ncyUhWxqD3Sx06SfQjg93aWzvvzpuruaMR21JdAcdeLWKJ8KsCpVkZhV1B8KCKoSgQ.; receive-cookie-deprecation=1; uuid2=535537844608889607
2024-01-30 17:52:27 UTC	1517	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Tue, 30 Jan 2024 17:52:27 GMT Content-Type: image/gif Content-Length: 43 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness AN-X-Request-Uuid: 164adf02-2bc5-4751-8175-62caca2ff3ca Set-Cookie: XANDR_PANID=0U84jn1ew9ikPVt7_w3fV-ISfsCe9Ihc9la-kJur8ncyUhWxqD3Sx06SfQjg93aWzvvzpuruaMR21JdAcdeLWKJ8KsCpVkZhV1B8KCKoSgQ.; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 29-Apr-2024 17:52:27 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: anj=dTM7k!M4.FErk#WF']wIg2GVTreJ6K!]tbPl1MwL(!R7qUY#QN`[/bhYWJX5@OOP<Ajed!KBLjv<QG=%9sk?bIRwi:w9Ld1srOXGFiqPY/y@Yw#tt_]*xHx`; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 29-Apr-2024 17:52:27 GMT; Domain=.adnxs.com; Secure; HttpOnly Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Tue, 17-Jan-2034 17:52:27 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=535537844608889607; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 29-Apr-2024 17:52:27 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 81.181.57.74; 81.181.57.74; 639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2024-01-30 17:52:27 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 40 02 02 4c 01 00 3b Data Ascii: GIF89a!,@L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
158	192.168.2.17	50026	35.244.159.8	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:28 UTC	616	OUT	GET /w/1.0/sd?id=537148856&val=Zbk3QwAAAGzR0xva HTTP/1.1 Host: us-u.openx.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:28 UTC	366	IN	HTTP/1.1 200 OK Vary: Accept Server: OXGW/0.0.0 Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Expires: Mon, 26 Jul 1997 05:00:00 GMT Date: Tue, 30 Jan 2024 17:52:28 GMT Content-Type: image/gif Content-Length: 43 Cache-Control: private, max-age=0, no-cache Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-30 17:52:28 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 00 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
159	192.168.2.17	50029	162.248.18.37	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:29 UTC	679	OUT	GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Zbk3QwAAAGzR0xva HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:29 UTC	327	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 30 Jan 2024 17:52:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2024-01-30 17:52:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
160	192.168.2.17	50034	31.13.66.35	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:31 UTC	636	OUT	GET /fr/b.php?p=1531105787105294&e=Zbk3QwAAAGzR0xva&t=2592000&o=0 HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:31 UTC	1965	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/gif report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}],"group":"network-errors"} Date: Tue, 30 Jan 2024 09:52:31 PST document-policy: force-load-at-top permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=() permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=(self) cross-origin-resource-policy: cross-origin nel: {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01} cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report" cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report" Pragma: public Cache-Control: public, max-age=0 Expires: Tue, 30 Jan 2024 09:52:31 PST X-Content-Type-Options: nosniff reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown" origin-agent-cluster: ?0
2024-01-30 17:52:31 UTC	235	IN	Data Raw: 53 74 72 69 63 74 2d 54 72 61 6e 73 70 6f 72 74 2d 53 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 31 35 35 35 32 30 30 30 3b 20 70 72 65 6c 6f 61 64 0d 0a 58 2d 46 42 2d 44 65 62 75 67 3a 20 2f 56 56 7a 58 48 73 63 54 53 6a 4e 33 37 6e 77 37 55 67 77 55 75 33 63 78 59 77 4b 34 41 5a 79 61 75 6d 71 6a 4f 72 62 6c 69 62 6c 2b 45 41 42 32 4d 4f 7a 71 52 44 58 4b 43 6c 39 6f 48 53 36 6b 59 79 76 5a 2f 46 4e 36 6f 6c 47 61 41 37 44 35 76 35 31 6e 51 3d 3d 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 41 6c 74 2d 53 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a Data Ascii: Strict-Transport-Security: max-age=15552000; preloadX-FB-Debug: /VVzXHscTSjN37nw7UgwUu3cxYwK4AZyaumqjOrblibl+EAB2MOzqRDXKCl9oHS6kYyvZ/FN6olGaA7D5v51nQ==Transfer-Encoding: chunkedAlt-Svc: h3=":443"; ma=86400Connection: close
2024-01-30 17:52:31 UTC	54	IN	Data Raw: 32 62 0d 0a 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bGIF89a!,D;0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
161	192.168.2.17	50036	151.101.193.44	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:32 UTC	609	OUT	GET /sg/adobe/1/cm?gdpr=0&gdpr_consent= HTTP/1.1 Host: trc.taboola.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:32 UTC	598	IN	HTTP/1.1 200 OK Connection: close Server: nginx Cache-Control: no-cache, no-store Pragma: no-cache P3P: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-to-NLB-rtt: 170779 Accept-Ranges: bytes Date: Tue, 30 Jan 2024 17:52:32 GMT Via: 1.1 varnish X-SERVICE-VERSION: v2 X-Served-By: cache-pdk-kfty2130058-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1706637152.246383,VS0,VE172 X-vcl-time-ms: 172 transfer-encoding: chunked
2024-01-30 17:52:32 UTC	4	IN	Data Raw: 32 62 0d 0a Data Ascii: 2b
2024-01-30 17:52:32 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 40 02 02 4c 01 00 3b Data Ascii: GIF89a!,@L;
2024-01-30 17:52:32 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-01-30 17:52:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
162	192.168.2.17	50038	52.87.115.253	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:33 UTC	597	OUT	GET /sync?nid=adobe HTTP/1.1 Host: sync.srv.stackadapt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-30 17:52:33 UTC	1315	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Date: Tue, 30 Jan 2024 17:52:33 GMT Location: https://dpm.demdex.net/ibs:dpid=390122&dpuuid=4QGHe0AkU19ZmYu7n2WfX1G1OUo Set-Cookie: sa-user-id=s%3A0-e101877b-4024-535f-5999-8bbb9f659f5f.bEOpYUo4O0%2BuPpggetfO1ZC%2BD27Mos%2Fr1TBQ1R2hZ3g; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id=s%3A0-e101877b-4024-535f-5999-8bbb9f659f5f.bEOpYUo4O0%2BuPpggetfO1ZC%2BD27Mos%2Fr1TBQ1R2hZ3g; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v2=s%3A4QGHe0AkU19ZmYu7n2WfX1G1OUo.G4p8%2FPTVKGbmeP1CT0i0r5Kj3clVh7xkjuBOuOgFvUE; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v2=s%3A4QGHe0AkU19ZmYu7n2WfX1G1OUo.G4p8%2FPTVKGbmeP1CT0i0r5Kj3clVh7xkjuBOuOgFvUE; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v3=s%3AAQAKIJR9DUu03c6xr6ZXPfGMAhRF93MatNvpr-or40dRNE_sEHwYBCDh7uStBjABOgT87-jmQgQoBq52.hxMmZIO%2BIr3UIKCZ1eFM%2FGnjqZgT4MPpHBhoVC61PfY; Max-Age=31536000; Secure; SameSite=None Set-Cookie: sa-user-id-v3=s%3AAQAKIJR9DUu03c6xr6ZXPfGMAhRF93MatNvpr-or40dRNE_sEHwYBCDh7uStBjABOgT87-jmQgQoBq52.hxMmZIO%2BIr3UIKCZ1eFM%2FGnjqZgT4MPpHBhoVC61PfY; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None Content-Length: 100 Connection: Close
2024-01-30 17:52:33 UTC	100	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 70 6d 2e 64 65 6d 64 65 78 2e 6e 65 74 2f 69 62 73 3a 64 70 69 64 3d 33 39 30 31 32 32 26 61 6d 70 3b 64 70 75 75 69 64 3d 34 51 47 48 65 30 41 6b 55 31 39 5a 6d 59 75 37 6e 32 57 66 58 31 47 31 4f 55 6f 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://dpm.demdex.net/ibs:dpid=390122&dpuuid=4QGHe0AkU19ZmYu7n2WfX1G1OUo">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
163	192.168.2.17	50041	52.201.196.73	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-30 17:52:33 UTC	1431	OUT	GET /ibs:dpid=390122&dpuuid=4QGHe0AkU19ZmYu7n2WfX1G1OUo HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=35050774984483340004567475019318048768; dpm=35050774984483340004567475019318048768; dextp=358-1-1706637122441\|477-1-1706637122553\|771-1-1706637122887\|782-1-1706637123887\|992-1-1706637124884\|1123-1-1706637125884\|903-1-1706637126875\|1175-1-1706637127881\|1957-1-1706637128890\|3047-1-1706637129886\|22054-1-1706637130883\|30646-1-1706637131888\|53196-1-1706637132888\|38117-1-1706637133877\|57282-1-1706637134881\|49276-1-1706637135885\|72352-1-1706637136874\|80742-1-1706637137880\|81309-1-1706637138883\|121998-1-1706637139875\|144228-1-1706637140884\|144229-1-1706637141887\|144230-1-1706637142878\|144231-1-1706637143886\|144232-1-1706637144888\|144233-1-1706637145886\|144234-1-1706637146889\|144235-1-1706637147875\|144236-1-1706637148881\|144237-1-1706637149884\|147592-1-1706637150876\|390122-1-1706637151882
2024-01-30 17:52:33 UTC	890	IN	HTTP/1.1 200 OK Date: Tue, 30 Jan 2024 17:52:33 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: /ZvxHhWKSIY= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-va6-1-v053-0b771a927.edge-va6.demdex.com 11 ms set-cookie: dpm=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:33 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=35050774984483340004567475019318048768; Max-Age=15552000; Expires=Sun, 28 Jul 2024 17:52:33 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-01-30 17:52:33 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Target ID:	7
Start time:	18:51:15
Start date:	30/01/2024
Path:	C:\Users\user\Desktop\Palworld.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Palworld.exe
Imagebase:	0x7ff74f740000
File size:	182'784 bytes
MD5 hash:	A9181A14270AD54407A16516C05817BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	18:51:31
Start date:	30/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe"
Imagebase:	0x7ff6fa1e0000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	18:51:32
Start date:	30/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=2116,i,8841958676898613242,11507238833919217486,262144 /prefetch:8
Imagebase:	0x7ff6fa1e0000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	18:52:03
Start date:	30/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6212 --field-trial-handle=2116,i,8841958676898613242,11507238833919217486,262144 /prefetch:8
Imagebase:	0x7ff6fa1e0000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	18:52:08
Start date:	30/01/2024
Path:	C:\Users\user\Downloads\dxwebsetup.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Downloads\dxwebsetup.exe"
Imagebase:	0x1000000
File size:	295'320 bytes
MD5 hash:	2CBD6AD183914A0C554F0739069E77D7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	18:52:09
Start date:	30/01/2024
Path:	C:\Users\user\Downloads\dxwebsetup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Downloads\dxwebsetup.exe"
Imagebase:	0x1000000
File size:	295'320 bytes
MD5 hash:	2CBD6AD183914A0C554F0739069E77D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	18:52:09
Start date:	30/01/2024
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Imagebase:	0x170000
File size:	527'360 bytes
MD5 hash:	AC3A5F7BE8CD13A863B50AB5FE00B71C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	18:53:17
Start date:	30/01/2024
Path:	C:\Users\user\Desktop\Palworld.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Palworld.exe"
Imagebase:	0x7ff74f740000
File size:	182'784 bytes
MD5 hash:	A9181A14270AD54407A16516C05817BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	22.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	24.1%
Total number of Nodes:	83
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0100198B Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 169
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(80000002,0100A0C4,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 010019E4
wsprintfA.USER32 ref: 01001A09
RegQueryValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000000,00000000,?), ref: 01001A1D
GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 01001A56
LoadLibraryA.KERNELBASE(00000000), ref: 01001A74
FreeLibrary.KERNELBASE(?), ref: 01001A9F
GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 01001AB1
lstrlen.KERNEL32(0100AC44), ref: 01001AD7
lstrlen.KERNEL32(00000000), ref: 01001AE2
LocalAlloc.KERNEL32(00000040,00000050), ref: 01001AEB
GetModuleFileNameA.KERNEL32(00000000,00000104), ref: 01001B19
wsprintfA.USER32 ref: 01001B59
lstrlen.KERNEL32(00000000), ref: 01001B63
RegSetValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000001,00000000,00000001), ref: 01001B70
RegCloseKey.KERNELBASE(?), ref: 01001B79
LocalFree.KERNEL32(00000000), ref: 01001B80

Strings

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 01001B39, 01001B57
%s /D:%s, xrefs: 01001B46
DelNodeRunDLL32, xrefs: 01001A85
wextract_cleanup0, xrefs: 010019F6, 01001A08, 01001A19, 01001A3D, 01001B6C
advpack.dll, xrefs: 01001A5C

Memory Dump Source

Source File: 00000011.00000002.2542730863.0000000001001000.00000020.00000001.01000000.00000006.sdmp, Offset: 01001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1001000_dxwebsetup.jbxd

Similarity

API ID: lstrlen$DirectoryFreeLibraryLocalSystemValuewsprintf$AllocCloseCreateFileLoadModuleNameQuery
String ID: %s /D:%s$DelNodeRunDLL32$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 3721875013-3876174064
Opcode ID: 5d94104a00e9d0ccd01717d02609a08f8015148e237d1d63623d6869345cfc5d
Instruction ID: bcd9c67c776e79ec80fa89b258506c9e143caafd4bb2848af9ab02cf1fab0281
Opcode Fuzzy Hash: 5d94104a00e9d0ccd01717d02609a08f8015148e237d1d63623d6869345cfc5d
Instruction Fuzzy Hash: 31514071A40218BBEB229BA5DD49EDE7BBCEB08700F004495F685E6085D7B9DA41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01001E52 Relevance: 4.5, APIs: 3, Instructions: 32
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 01001E6E
RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,00000000,?), ref: 01001E85
RegCloseKey.KERNELBASE(?), ref: 01001E95

Memory Dump Source

Source File: 00000011.00000002.2542730863.0000000001001000.00000020.00000001.01000000.00000006.sdmp, Offset: 01001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1001000_dxwebsetup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 7a797c0b9dcb7767ccf906ce318d436ef8d89cccfb9cdaf3cd7182f96baaf62c
Instruction ID: 28be454f978d5970a4e16e1394c3bca2c1ef4d0bed3d580e281dbf39f647a0de
Opcode Fuzzy Hash: 7a797c0b9dcb7767ccf906ce318d436ef8d89cccfb9cdaf3cd7182f96baaf62c
Instruction Fuzzy Hash: E1F0D475A01128FBEB229F92DD08DEFBFACEF057A0F008055F98996150D771DA10EBA0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0100168B Relevance: 16.6, APIs: 11, Instructions: 107
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 010015F6: LoadLibraryA.KERNEL32(advapi32.dll), ref: 0100161A
Part of subcall function 010015F6: AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0100165E
Part of subcall function 010015F6: FreeSid.ADVAPI32(?), ref: 01001672
Part of subcall function 010015F6: FreeLibrary.KERNEL32(?), ref: 0100167C

GetCurrentProcess.KERNEL32(00000008,?), ref: 010016CF
OpenProcessToken.ADVAPI32(00000000), ref: 010016D6
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 010016F6
GetLastError.KERNEL32 ref: 01001700
LocalAlloc.KERNEL32(00000000,?), ref: 01001714
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 0100172D
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0100174A
EqualSid.ADVAPI32(00000004,?), ref: 01001760
FreeSid.ADVAPI32(?), ref: 01001782
LocalFree.KERNEL32(00000000), ref: 01001789
CloseHandle.KERNEL32(?), ref: 01001793

Memory Dump Source

Source File: 00000011.00000002.2542730863.0000000001001000.00000020.00000001.01000000.00000006.sdmp, Offset: 01001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1001000_dxwebsetup.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AllocCloseCurrentEqualErrorHandleLastLoadOpen
String ID:
API String ID: 793078628-0
Opcode ID: bb5fe4861fc728833115231643eac192e69f4f778fcc582930cb2832bc57f699
Instruction ID: fa5215c0b5e6886bf03ae5b40989aa8fe66889e67d1830d7472693dfac7b44e0
Opcode Fuzzy Hash: bb5fe4861fc728833115231643eac192e69f4f778fcc582930cb2832bc57f699
Instruction Fuzzy Hash: A7315E71A00249EFEB23DBA49988EEE7BB9FF04340F5004A5F6C5E2085D775D644CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01001C7F Relevance: 16.6, APIs: 11, Instructions: 86
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(?,?), ref: 01001CAD
lstrcat.KERNEL32(?,0100128C), ref: 01001CC1
FindFirstFileA.KERNEL32(?,?), ref: 01001CD1
lstrcpy.KERNEL32(?,?), ref: 01001CEB
lstrcmp.KERNEL32(?,01001288), ref: 01001D02
lstrcmp.KERNEL32(?,01001284), ref: 01001D18
lstrcat.KERNEL32(?,?), ref: 01001D30
lstrcat.KERNEL32(?,?), ref: 01001D59
FindNextFileA.KERNEL32(?,00000010), ref: 01001D84
FindClose.KERNEL32(?), ref: 01001D95
RemoveDirectoryA.KERNEL32(?), ref: 01001D9C

Memory Dump Source

Source File: 00000011.00000002.2542730863.0000000001001000.00000020.00000001.01000000.00000006.sdmp, Offset: 01001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1001000_dxwebsetup.jbxd

Similarity

API ID: Findlstrcat$Filelstrcmplstrcpy$CloseDirectoryFirstNextRemove
String ID:
API String ID: 2848787617-0
Opcode ID: 4ab2d1adc861ee376fe6417c4b70ad234cb15c40ff7beeece14c99d657c3a8df
Instruction ID: a00f6dc85045b5a751000bc1c93d4bef5bd8a44fc60f5db9cfdca4d6f7f72306
Opcode Fuzzy Hash: 4ab2d1adc861ee376fe6417c4b70ad234cb15c40ff7beeece14c99d657c3a8df
Instruction Fuzzy Hash: 0F3119B690415DABEF62EBB5DD88FCA7BBCAF14340F440592B6C5D2084DBB4D6848F60

Uniqueness

Uniqueness Score: -1.00%

Function 010018B5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 010018C2
OpenProcessToken.ADVAPI32(00000000), ref: 010018C9
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 010018EB
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 0100190A

Strings

@l, xrefs: 01001922
SeShutdownPrivilege, xrefs: 010018E5

Memory Dump Source

Source File: 00000011.00000002.2542730863.0000000001001000.00000020.00000001.01000000.00000006.sdmp, Offset: 01001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1001000_dxwebsetup.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege$@l
API String ID: 2349140579-2743654327
Opcode ID: 5c5867862be160855593b21028be569d484c2d5728f526fa0e32b4ad4f6b976e
Instruction ID: 05607d40d37e3d7cfa1acf5e7c24027e9414555ed0db78eb33ce689f5d9f9449
Opcode Fuzzy Hash: 5c5867862be160855593b21028be569d484c2d5728f526fa0e32b4ad4f6b976e
Instruction Fuzzy Hash: 21014C71642225BAF7329BA28C0DFEF7EACEF06794F000410BA89E40C5D6B5D70496F5

Uniqueness

Uniqueness Score: -1.00%

Function 01001B8B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000000,?,?), ref: 01001BE3
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 01001C12
wsprintfA.USER32 ref: 01001C46
lstrlen.KERNEL32(?), ref: 01001C56

Strings

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 01001C40
wextract_cleanup0, xrefs: 01001B97, 01001BD3, 01001BD8, 01001C68

Memory Dump Source

Source File: 00000011.00000002.2542730863.0000000001001000.00000020.00000001.01000000.00000006.sdmp, Offset: 01001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1001000_dxwebsetup.jbxd

Similarity

API ID: DirectoryQuerySystemValuelstrlenwsprintf
String ID: rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 770829711-2593670723
Opcode ID: e75a87f575a87b88306cb88d64188b753a6e3c5b2626c8ce63df789149fba349
Instruction ID: 2fb7fcdbff80cae6b570ff950ba8ccadd0e573114065fe0f363dccfd66d38777
Opcode Fuzzy Hash: e75a87f575a87b88306cb88d64188b753a6e3c5b2626c8ce63df789149fba349
Instruction Fuzzy Hash: 25215375A4021CBBEB22DBA5DD49FDABB7CEB08740F0000A5F689E6081D7B5DB448F60

Uniqueness

Uniqueness Score: -1.00%

Function 010015F6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(advapi32.dll), ref: 0100161A
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0100165E
FreeSid.ADVAPI32(?), ref: 01001672
FreeLibrary.KERNEL32(?), ref: 0100167C

Strings

CheckTokenMembership, xrefs: 01001628
advapi32.dll, xrefs: 010015FF

Memory Dump Source

Source File: 00000011.00000002.2542730863.0000000001001000.00000020.00000001.01000000.00000006.sdmp, Offset: 01001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1001000_dxwebsetup.jbxd

Similarity

API ID: FreeLibrary$AllocateInitializeLoad
String ID: CheckTokenMembership$advapi32.dll
API String ID: 2374981305-1888249752
Opcode ID: 05aef74ab9c6aad8ac387d91b692b6fb9c51c55194fb5577f0a734ca75a63f4d
Instruction ID: 7c54915b23e232019903c0576df7497f5bb26148f144bc74401e3466b5a6cae1
Opcode Fuzzy Hash: 05aef74ab9c6aad8ac387d91b692b6fb9c51c55194fb5577f0a734ca75a63f4d
Instruction Fuzzy Hash: 87117071944289FBDB12DFA99C48ADEBFB8EF18344F540099F181A3181C6758A04CB65

Uniqueness

Uniqueness Score: -1.00%

Function 01001DDF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 01001DF7
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 01001E1D
_llseek.KERNEL32(00000000,00000000,00000002), ref: 01001E3D
_lclose.KERNEL32(00000000), ref: 01001E46

Strings

wininit.ini, xrefs: 01001E02

Memory Dump Source

Source File: 00000011.00000002.2542730863.0000000001001000.00000020.00000001.01000000.00000006.sdmp, Offset: 01001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1001000_dxwebsetup.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek
String ID: wininit.ini
API String ID: 3481966002-4206010578
Opcode ID: 33bb5396c23d974d2fbc9a26ebd13b6f924a008bcaa109b51e7b3c9eaee11000
Instruction ID: b7b4abcde96b08424be1b8ef761040528c423947c2d44bd333b95f446d3817fe
Opcode Fuzzy Hash: 33bb5396c23d974d2fbc9a26ebd13b6f924a008bcaa109b51e7b3c9eaee11000
Instruction Fuzzy Hash: BCF0AFB6600194A7E732E7799D8CEEB3ABCAB85710F000095B7D9E30C0D6B8C9458B70

Uniqueness

Uniqueness Score: -1.00%

Function 010017B1 Relevance: 7.5, APIs: 5, Instructions: 40
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EndDialog.USER32(?,0000083E), ref: 010017E3
GetDesktopWindow.USER32 ref: 010017EB
LoadStringA.USER32(?,00000000,00000200), ref: 01001816
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 0100182B
MessageBeep.USER32(000000FF), ref: 01001833

Memory Dump Source

Source File: 00000011.00000002.2542730863.0000000001001000.00000020.00000001.01000000.00000006.sdmp, Offset: 01001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1001000_dxwebsetup.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 52c35957c5d6308ac9e5b8dfae4ee701d5fa30329f22752cf5df4afad45c4fb5
Instruction ID: dbb55cd7090eff77bfa65d7c4eba401a97cfafb7d2c079e3b47d5aa362050595
Opcode Fuzzy Hash: 52c35957c5d6308ac9e5b8dfae4ee701d5fa30329f22752cf5df4afad45c4fb5
Instruction Fuzzy Hash: D601283140024AABFB265FA4DC4CAEA3AB8BB04745F044564BAA9950E5CBB9CB51CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dxwsetup.exePID: 5416, Parent PID: 3160COMMON

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	46

Executed Functions

Function 6C690362 Relevance: 72.2, APIs: 10, Strings: 31, Instructions: 446
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6C6903E7
GetLastError.KERNEL32(00000000,?,?,?,00000000,?,00000104,?,?,?,?,?,0000003B,?,?,?), ref: 6C690674
GetLastError.KERNEL32(00000000,?,00000000,?,00000104,?,?,?,?,?,0000003B,?,?,?), ref: 6C690837
GetLastError.KERNEL32(00000000,?,0000003B,?,?,?), ref: 6C690850
GetLastError.KERNEL32(00000000,?,?,?,?,?,00000000,?,00000104,?,?,?,?,?,0000003B,?), ref: 6C69087D
GetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6908CC
GetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,?,00000104,?), ref: 6C69091E
GetLastError.KERNEL32(00000000), ref: 6C690933
GetLastError.KERNEL32 ref: 6C69094E

Strings

Wow64RevertWow64FsRedirection, xrefs: 6C69067B, 6C69083E, 6C690884, 6C6908D3, 6C690925
_MDX2_, xrefs: 6C690570
CheckSectionsForDownloadPlugIn(): [%s] is being downloaded., xrefs: 6C690778, 6C6907EC
GAC\, xrefs: 6C6905BC
DirectXUpdateDownloadPlugIn, xrefs: 6C6903A0
CheckSectionsForDownloadPlugIn(): .NET Framework is not available, %s is skipped., xrefs: 6C690569
CheckSectionsForDownloadPlugIn(): [%s], xrefs: 6C690532
CheckSectionsForDownloadPlugIn(): .NET Framework 2.0 is not available, %s is skipped., xrefs: 6C69058B
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C690396, 6C690866, 6C6908AA, 6C6908AF, 6C6908DE, 6C6908F4, 6C6908F9
;, xrefs: 6C690410
CheckDependency(): no dependency., xrefs: 6C6904D8
CheckSectionsForDownloadPlugIn(): [%s] is not being downloaded., xrefs: 6C6907A8, 6C6907CB
-----, xrefs: 6C690521
CheckSectionsForDownloadPlugIn(): DXGetFileVersion() failed, file: %s., xrefs: 6C69064C
SetupGetLineText(), xrefs: 6C69093A
_MDX1_, xrefs: 6C69054E
CheckSectionsForDownloadPlugIn(): %s is older than update file, xrefs: 6C69076D
, , xrefs: 6C69044E, 6C6904C3
CheckSectionsForDownloadPlugIn(): SetupFindFirstLine() returns 0, reason = %d., xrefs: 6C690955
CheckSectionsForDownloadPlugIn(): ParseCifLine() failed, line: %s is skipped., xrefs: 6C690514
_MDX_, xrefs: 6C69053C
CheckSectionsForDownloadPlugIn, xrefs: 6C690680, 6C690843, 6C69085C, 6C690889, 6C69089F, 6C6908A4, 6C6908D8, 6C6908E9, 6C6908EE, 6C69092A, 6C69093F
Target file: '%s'Target Version %d.%d.%d.%dUpdate Version %d.%d.%d.%d, xrefs: 6C690741
CDownloadManager::SetSection("%s") failed., xrefs: 6C690896, 6C6908E2
Wow64DisableWow64FsRedirection, xrefs: 6C690857
%s%s, xrefs: 6C6905E9
CheckSectionsForDownloadPlugIn(): %s have been installed., xrefs: 6C69079D, 6C6907C0
CheckSectionsForDownloadPlugIn(): %s have not been installed., xrefs: 6C6907E1
CheckSectionsForDownloadPlugIn(): StringToVersionInfo() failed, version: %s., xrefs: 6C6906C3
Dependencies:, xrefs: 6C690425
_x64, xrefs: 6C690592

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorLast$_memset
String ID: %s%s$, $-----$;$CDownloadManager::SetSection("%s") failed.$CheckDependency(): no dependency.$CheckSectionsForDownloadPlugIn$CheckSectionsForDownloadPlugIn(): %s have been installed.$CheckSectionsForDownloadPlugIn(): %s have not been installed.$CheckSectionsForDownloadPlugIn(): %s is older than update file$CheckSectionsForDownloadPlugIn(): .NET Framework 2.0 is not available, %s is skipped.$CheckSectionsForDownloadPlugIn(): .NET Framework is not available, %s is skipped.$CheckSectionsForDownloadPlugIn(): DXGetFileVersion() failed, file: %s.$CheckSectionsForDownloadPlugIn(): ParseCifLine() failed, line: %s is skipped.$CheckSectionsForDownloadPlugIn(): SetupFindFirstLine() returns 0, reason = %d.$CheckSectionsForDownloadPlugIn(): StringToVersionInfo() failed, version: %s.$CheckSectionsForDownloadPlugIn(): [%s]$CheckSectionsForDownloadPlugIn(): [%s] is being downloaded.$CheckSectionsForDownloadPlugIn(): [%s] is not being downloaded.$Dependencies:$DirectXUpdateDownloadPlugIn$GAC\$SetupGetLineText()$Target file: '%s'Target Version %d.%d.%d.%dUpdate Version %d.%d.%d.%d$Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$_MDX1_$_MDX2_$_MDX_$_x64$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 536390146-1979185646
Opcode ID: 2f9ec7cc19c64fe24247a7b89a523e557930c7a5692afa08871822d4c721eca4
Instruction ID: 0cd7398f97b4e66fe8eaeb7464319267d5a8b9f618097bf522f902838c150012
Opcode Fuzzy Hash: 2f9ec7cc19c64fe24247a7b89a523e557930c7a5692afa08871822d4c721eca4
Instruction Fuzzy Hash: AFE1067190625AAADF209A658C94FFF737CEF89748F100595F809A2941EB70DA84CF7C

Uniqueness

Uniqueness Score: -1.00%

Function 6C69680F Relevance: 37.1, APIs: 2, Strings: 19, Instructions: 383
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strnlen.LIBCMT ref: 6C6968F1

Part of subcall function 6C689EA5: CompareStringA.KERNEL32(00000409,00000001,?,000000FF,6C690ED5,000000FF,?,6C690ED5,?,Version,?,00000000,?), ref: 6C689EBB

GetPrivateProfileStringA.KERNEL32(DXUpdate.URL,?,6C68311C,?,00000104,6C6812F4), ref: 6C696BC5

Part of subcall function 6C691F44: _memset.LIBCMT ref: 6C691F7A

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

GetSectionFromCif(): DirectX Version: %d.%02d.%02d.%04d.%d, xrefs: 6C6968CA
GetSectionFromCif, xrefs: 6C69688D, 6C69699A, 6C696BF4, 6C696C08, 6C696C23, 6C696C44
DXUpdate.URL, xrefs: 6C696BC0
MDX, xrefs: 6C69695E
Strings, xrefs: 6C696933
DirectX, xrefs: 6C696912
GetSectionFromCif(): Invalid URL, skipped., xrefs: 6C696BDA
StringToVersionInfo() failed, version = %s., xrefs: 6C696BED, 6C696C01
GetSectionFromCif(): Section [%d.%02d.%02d.%04d.%02d-%d.%02d.%02d.%04d.%02d_%s] is downloading., xrefs: 6C696AF2
Unable to get base URL, Cif: %s, Version: %s., xrefs: 6C696C18
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C696897, 6C6969A4, 6C696C2D, 6C696C4E
GetSectionFromCif(): MDX: %d.%02d.%02d.%04d, Update:%d.%02d.%02d.%04d, xrefs: 6C6969F6
GetPrivateProfileString(), xrefs: 6C696C1E
DXUpdate_, xrefs: 6C696949
GetMDXVersion() failed, skipping MDX section., xrefs: 6C696993
GetSectionNamesFromInf() failed., xrefs: 6C696886
Unable to load section list, Cif: %s., xrefs: 6C696C3D
Version, xrefs: 6C6968F8
GetSectionFromCif(): Section [%d.%02d.%02d.%04d.%d-%d.%02d.%02d.%04d.%d_%s_%s] is downloading., xrefs: 6C696B7D

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: String__wstrtime$ComparePrivateProfile_memset_strnlen_strrchr
String ID: DXUpdate.URL$DXUpdate_$DirectX$GetMDXVersion() failed, skipping MDX section.$GetPrivateProfileString()$GetSectionFromCif$GetSectionFromCif(): DirectX Version: %d.%02d.%02d.%04d.%d$GetSectionFromCif(): Invalid URL, skipped.$GetSectionFromCif(): MDX: %d.%02d.%02d.%04d, Update:%d.%02d.%02d.%04d$GetSectionFromCif(): Section [%d.%02d.%02d.%04d.%02d-%d.%02d.%02d.%04d.%02d_%s] is downloading.$GetSectionFromCif(): Section [%d.%02d.%02d.%04d.%d-%d.%02d.%02d.%04d.%d_%s_%s] is downloading.$GetSectionNamesFromInf() failed.$MDX$StringToVersionInfo() failed, version = %s.$Strings$Unable to get base URL, Cif: %s, Version: %s.$Unable to load section list, Cif: %s.$Version$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 2037971165-2157400507
Opcode ID: 4228c9f4ee50bb1804c75a9eb574534094830acf2fe5f86c181497258276ea96
Instruction ID: b52f2f55403c81d571682532e0880dc84008ae117595f3580c46f852fee56fc8
Opcode Fuzzy Hash: 4228c9f4ee50bb1804c75a9eb574534094830acf2fe5f86c181497258276ea96
Instruction Fuzzy Hash: 7BC18C7190120ABADB409BA5CD80DFEBBBCEF06308F100519F851F6A41E731D955ABBC

Uniqueness

Uniqueness Score: -1.00%

Function 6C68B4D6 Relevance: 33.5, APIs: 6, Strings: 13, Instructions: 279
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(mscoree.dll,00000000,00000000), ref: 6C68B505
GetProcAddress.KERNEL32(00000000,CLRCreateInstance), ref: 6C68B526
GetProcAddress.KERNEL32(?,GetCORVersion), ref: 6C68B732
FreeLibrary.KERNELBASE(?), ref: 6C68B84A
GetLastError.KERNEL32 ref: 6C68B859
GetLastError.KERNEL32(Unable to load mscoree.dll.), ref: 6C68B876

Strings

mscoree.dll is not available., xrefs: 6C68B897
mscoree.dll, xrefs: 6C68B4F2
CLR version number = %d.%d.%d, xrefs: 6C68B68C
e:\bt\382730\setup\deliverables\dxupdate\inline.h, xrefs: 6C68B823, 6C68B888
CLR version number = %d.%d.%d, xrefs: 6C68B7F9
CLRCreateInstance, xrefs: 6C68B520
Unable to get CLR build number., xrefs: 6C68B812
GetCORVersion, xrefs: 6C68B727
LoadLibrary(), xrefs: 6C68B879
GetCORVersion not found in mscoree.dll, function deprecated for .NET Framework 4.0., xrefs: 6C68B839
Unable to load mscoree.dll., xrefs: 6C68B871
GetDotNETFrameworkVersion, xrefs: 6C68B819, 6C68B87E
GetCORVersion() failed, function deprecated for .NET Framework 4.0., xrefs: 6C68B832

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: AddressErrorLastLibraryProc$FreeLoad
String ID: CLR version number = %d.%d.%d$CLR version number = %d.%d.%d$CLRCreateInstance$GetCORVersion$GetCORVersion not found in mscoree.dll, function deprecated for .NET Framework 4.0.$GetCORVersion() failed, function deprecated for .NET Framework 4.0.$GetDotNETFrameworkVersion$LoadLibrary()$Unable to get CLR build number.$Unable to load mscoree.dll.$e:\bt\382730\setup\deliverables\dxupdate\inline.h$mscoree.dll$mscoree.dll is not available.
API String ID: 1490555712-2310045088
Opcode ID: 676687fed11deb1acadf9b7c61b0a1fa9f4fe45d4b779f3eab460adbe2e5810d
Instruction ID: f9c645b0ef23a946fd48a8c89c721b7da1454074be5fbf59dcff31936e6cc0fc
Opcode Fuzzy Hash: 676687fed11deb1acadf9b7c61b0a1fa9f4fe45d4b779f3eab460adbe2e5810d
Instruction Fuzzy Hash: 35A140F19022159BDB649F65CCD4E9AB7B8AF85308F1444AEE20AE7641D734D984CF3C

Uniqueness

Uniqueness Score: -1.00%

Function 6C6898CF Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,00000258), ref: 6C689905
OutputDebugStringA.KERNEL32(DXSETUP_DPF(): Unable to open log file.,?,00000258), ref: 6C689914
CreateDirectoryA.KERNELBASE(?,00000000), ref: 6C689954
GetLastError.KERNEL32 ref: 6C68995E
__wstrtime.LIBCMT ref: 6C6899B7
__wstrtime.LIBCMT ref: 6C6899C0

Strings

%s %s: %s: %s, xrefs: 6C6899D9
%s%s%s, xrefs: 6C689983
Logs\DirectX.log, xrefs: 6C689972
DXSETUP_DPF(): Unable to open log file., xrefs: 6C6899A9
%s%s, xrefs: 6C68992B
DXSETUP_DPF(): failed to create log directory., xrefs: 6C68996B
DXSETUP_DPF(): path name too long., xrefs: 6C689944
\Logs, xrefs: 6C68991F
dxupdate, xrefs: 6C6899CF, 6C6899F4
%s %s: %s: (null), xrefs: 6C6899FE
DXSETUP_DPF(): GetWindowsDirectory() failed., xrefs: 6C68990F
C:\Windows\Logs\DirectX.log, xrefs: 6C6898E4, 6C6898ED, 6C689989, 6C68999B

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: Directory__wstrtime$CreateDebugErrorLastOutputStringWindows
String ID: %s %s: %s: %s$%s %s: %s: (null)$%s%s$%s%s%s$C:\Windows\Logs\DirectX.log$DXSETUP_DPF(): GetWindowsDirectory() failed.$DXSETUP_DPF(): Unable to open log file.$DXSETUP_DPF(): failed to create log directory.$DXSETUP_DPF(): path name too long.$Logs\DirectX.log$\Logs$dxupdate
API String ID: 1979891910-1420145299
Opcode ID: e1c8bd92607a7f2656698482c425629771ea38852bc6f2b1e1ea2153abd5142c
Instruction ID: e279af55dfa738a1c1bb28fa7fd6d7f70420416c6b394e54481e875394bd6e36
Opcode Fuzzy Hash: e1c8bd92607a7f2656698482c425629771ea38852bc6f2b1e1ea2153abd5142c
Instruction Fuzzy Hash: 4E31B6B2D0B119BBDB10D6A18C84EDF73BCAB0A35CF440955FA64E2D01E734D6494A7D

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A1DD6 Relevance: 24.5, APIs: 16, Instructions: 497
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a26f1085df1a8d5070fa2371d8790c62bd326c7c2254fb766cddf5c7ab41959
Instruction ID: 4a2d3b01ff01c8feb419235f56e176f3eea5e16d21da32283e877461930dabed
Opcode Fuzzy Hash: 5a26f1085df1a8d5070fa2371d8790c62bd326c7c2254fb766cddf5c7ab41959
Instruction Fuzzy Hash: C3126C719446298FDB21CFA6CC88BAA77B4EF06316F4001E5E95DE7680D7318E82CF59

Uniqueness

Uniqueness Score: -1.00%

Function 6C69A2F6 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 85
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,?,6C697068,?,00000000,?,?,?,?,?), ref: 6C69A339
CoInitialize.OLE32(00000000), ref: 6C69A382
CoCreateInstance.OLE32(6C687E28,00000000,00000005,6C687E38,00000018,?,6C697068,?,00000000,?,?,?,?,?,?,?), ref: 6C69A3A7

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

e:\bt\382730\setup\deliverables\dxupdate\dwnldmgr.cpp, xrefs: 6C69A3C2, 6C69A3EE
CDownloadManager(), xrefs: 6C69A300
CDownloadManager::CDownloadManager(): CoInitliaze() returns 0x%x., xrefs: 6C69A38D
RegisterInstallEngineCallback(), xrefs: 6C69A3DF
CoCreateInstance(), xrefs: 6C69A3B3
CDownloadManager::CDownloadManager, xrefs: 6C69A3B8, 6C69A3E4

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: Create__wstrtime$EventInitializeInstance_strrchr
String ID: CDownloadManager()$CDownloadManager::CDownloadManager$CDownloadManager::CDownloadManager(): CoInitliaze() returns 0x%x.$CoCreateInstance()$RegisterInstallEngineCallback()$e:\bt\382730\setup\deliverables\dxupdate\dwnldmgr.cpp
API String ID: 3266464906-1942859877
Opcode ID: af9c89a17da2b32b2bf0493bcb11535175265497c41760df6c6a653e36b21998
Instruction ID: 2051f056516335ac0f2b36d3b372ce1a3f122eada4b94523348a2520ed5fe25c
Opcode Fuzzy Hash: af9c89a17da2b32b2bf0493bcb11535175265497c41760df6c6a653e36b21998
Instruction Fuzzy Hash: FF31FAB1502B40AFD3208F6A8C88E97FBF8EF9A715F10491EE559D6621D6B064448F39

Uniqueness

Uniqueness Score: -1.00%

Function 6C69A48C Relevance: 13.6, APIs: 9, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?), ref: 6C69A4C0
__heap_term.LIBCMT ref: 6C69A531
GetCommandLineA.KERNEL32 ref: 6C69A538
___crtGetEnvironmentStringsA.LIBCMT ref: 6C69A543

Part of subcall function 6C69CE99: GetEnvironmentStringsW.KERNEL32(?,?,?,6C69A548), ref: 6C69CEB7
Part of subcall function 6C69CE99: GetEnvironmentStringsW.KERNEL32(?,?,?,6C69A548), ref: 6C69CEF2

Part of subcall function 6C69C855: GetStartupInfoA.KERNEL32(?), ref: 6C69C86A
Part of subcall function 6C69C855: GetFileType.KERNEL32(00000024), ref: 6C69C978
Part of subcall function 6C69C855: ___crtInitCritSecAndSpinCount.LIBCMT ref: 6C69C9AC

__mtterm.LIBCMT ref: 6C69A556

Part of subcall function 6C69C20A: TlsFree.KERNELBASE(00000038,6C69A5C1), ref: 6C69C235
Part of subcall function 6C69C20A: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,6C69A5C1), ref: 6C69F8AD
Part of subcall function 6C69C20A: DeleteCriticalSection.KERNEL32(00000038,?,?,6C69A5C1), ref: 6C69F8D7

__mtterm.LIBCMT ref: 6C69A5BC
__heap_term.LIBCMT ref: 6C69A5C1
___set_flsgetvalue.LIBCMT ref: 6C69A5CD

Part of subcall function 6C69C1DB: TlsGetValue.KERNEL32(6C69C316), ref: 6C69C1E1
Part of subcall function 6C69C1DB: TlsSetValue.KERNEL32(00000000), ref: 6C69C1FE

Part of subcall function 6C69C80F: __calloc_impl.LIBCMT ref: 6C69C824

Part of subcall function 6C69B293: ___sbh_find_block.LIBCMT ref: 6C69B2BC
Part of subcall function 6C69B293: HeapFree.KERNEL32(00000000,00000000,6C6A66B0,0000000C,6C69F9AC,00000000,6C6A6880,0000000C,6C69F9EB,00000000,-0000000F,?,6C69C76D,00000004,6C6A67B8,0000000C), ref: 6C69B2FB
Part of subcall function 6C69B293: GetLastError.KERNEL32(?,6C69C76D,00000004,6C6A67B8,0000000C,6C6A1B11,00000000,00000000,00000000,00000000,00000000,?,6C69C33C,00000001,00000214), ref: 6C69B30C

__freeptd.LIBCMT ref: 6C69A61F

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: EnvironmentStrings$CriticalDeleteFreeSectionValue___crt__heap_term__mtterm$CommandCountCritErrorFileHeapInfoInitLastLineSpinStartupTypeVersion___sbh_find_block___set_flsgetvalue__calloc_impl__freeptd
String ID:
API String ID: 4055056290-0
Opcode ID: 4c56c3c1fc5fbbe4a4f859730ee9d8a246112c268387372591df3d0a4a06278f
Instruction ID: ec7406a0896c279e99ccec0cb2be7c429f87cabf68ffd5cf39af3538eef7daa2
Opcode Fuzzy Hash: 4c56c3c1fc5fbbe4a4f859730ee9d8a246112c268387372591df3d0a4a06278f
Instruction Fuzzy Hash: FB41B431E05103AADB10EBBA98446DD37F4EF4735CF20412AD81AD2A42EF71984A8B6D

Uniqueness

Uniqueness Score: -1.00%

Function 6C68C99A Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 75COMMON

Download Yara Rule

APIs

_realloc.LIBCMT ref: 6C68C9E4
GetPrivateProfileSectionNamesA.KERNEL32(00000000,-00000258,?), ref: 6C68C9F6

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

realloc(), xrefs: 6C68CA0B
GetSectionNamesFromInf, xrefs: 6C68C9BC, 6C68CA10
GetSectionNamesFromInf(): Unable to get section names from %s., xrefs: 6C68CA3F
Unable to find %s., xrefs: 6C68C9B5
e:\bt\382730\setup\deliverables\dxupdate\inline.h, xrefs: 6C68C9C3, 6C68CA17

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$NamesPrivateProfileSection_realloc_strrchr
String ID: GetSectionNamesFromInf$GetSectionNamesFromInf(): Unable to get section names from %s.$Unable to find %s.$e:\bt\382730\setup\deliverables\dxupdate\inline.h$realloc()
API String ID: 14898424-2734547356
Opcode ID: e3d64af6025d800d1c62453f22ed61166454b230df0690ffcf0fb2a240aa0830
Instruction ID: 448298a1457ee5516e5b2e15274983121da3c1cc660e1a1030179b2e77133401
Opcode Fuzzy Hash: e3d64af6025d800d1c62453f22ed61166454b230df0690ffcf0fb2a240aa0830
Instruction Fuzzy Hash: B311EB72107204BEEB206EA59CC1C967B9CDF453BCB204B39F955A2A40DA758844467C

Uniqueness

Uniqueness Score: -1.00%

Function 6C68A3EB Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 64fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(?,?,?,00000104,?,?,?), ref: 6C68A48E
FindClose.KERNEL32(00000000), ref: 6C68A49A

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

StringCchCopy(), xrefs: 6C68A462
Unable to create path string, %s%s., xrefs: 6C68A420
IsFileAvailable, xrefs: 6C68A427, 6C68A467
e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h, xrefs: 6C68A431, 6C68A471

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: Find__wstrtime$CloseFileFirst_strrchr
String ID: IsFileAvailable$StringCchCopy()$Unable to create path string, %s%s.$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
API String ID: 317478765-495664935
Opcode ID: 0ef6568bcc88b86f3aac560644443f9f7d265ea3371b65a7edcd92262e814539
Instruction ID: 91a7984112b477e791dbe780054507e25f160c3197c529eb0d9779fac3c76a89
Opcode Fuzzy Hash: 0ef6568bcc88b86f3aac560644443f9f7d265ea3371b65a7edcd92262e814539
Instruction Fuzzy Hash: 5811E9B6E431047ADB10AA659C49EEF77BCCF9A718F400511BD25F25C2EB34D944467C

Uniqueness

Uniqueness Score: -1.00%

Function 6C69715C Relevance: 68.7, APIs: 7, Strings: 32, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6C6971D2
_memset.LIBCMT ref: 6C697315
_memset.LIBCMT ref: 6C697329
_memset.LIBCMT ref: 6C6973DB

Strings

CDownloadManager::GetDownloadSize() failed., xrefs: 6C697715
GetSectionFromCif() failed., xrefs: 6C697392
DXUpdate_DXDllReg_x86, xrefs: 6C697668, 6C69767C, 6C6976A3
Unable to open %s., xrefs: 6C697581
Unable to find %s., xrefs: 6C6972D0
GetDXVersion() failed., xrefs: 6C697630
DirectXUpdateDownloadPlugIn, xrefs: 6C697229, 6C697249, 6C6972AF, 6C6972D7, 6C697399, 6C6973FA, 6C6974BA, 6C697516, 6C69754D, 6C697592, 6C697637, 6C697688, 6C69771C, 6C697754
DirectXUpdateDownloadPlugIn(): CDownloadManager::InitInstallEngine() failed., xrefs: 6C697524
Unable to create path string, %s\%s., xrefs: 6C697222, 6C6972A8
CDownloadManager::Download() failed., xrefs: 6C69774D
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C697233, 6C697253, 6C6972E1, 6C6973A3, 6C6974C4, 6C69751B, 6C697553, 6C697598, 6C69763D, 6C69768E, 6C697722, 6C69775A
DirectXUpdateDownloadPlugIn(): Cif %s, xrefs: 6C6972FC
DirectXUpdateDownloadPlugIn(): end download, xrefs: 6C697787
DirectXUpdateDownloadPlugIn(): unable to initialize CDownloadManager., xrefs: 6C69743F
Unable to initialize CKernel32., xrefs: 6C6974B3
-----, xrefs: 6C697699
Invalid parameter., xrefs: 6C697242
Srv2K3, xrefs: 6C697608
Unable to initialize CSetupAPI., xrefs: 6C697546
DirectXUpdateDownloadPlugIn(): start download, xrefs: 6C697730
SetupOpenInfFile(), xrefs: 6C69758D
dxupdate.cif, xrefs: 6C6971FA, 6C6971FF, 6C69721B, 6C697285, 6C6972A1, 6C6972CF
http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C, xrefs: 6C697504
Win2K, xrefs: 6C6975E0
CDownloadManager::SetSection("%s") failed., xrefs: 6C697681
Srv2K3@64, xrefs: 6C697331
WinXP, xrefs: 6C6975F4
DirectXUpdateDownloadPlugIn(): no download section in %s., xrefs: 6C6973B9
GetCachePath() failed., xrefs: 6C6973F3
DirectXUpdateDownloadPlugIn(): [%s] is being downloaded., xrefs: 6C6976AA
@64, xrefs: 6C69746B
WinXP@64, xrefs: 6C69734C

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: _memset
String ID: -----$@64$CDownloadManager::Download() failed.$CDownloadManager::GetDownloadSize() failed.$CDownloadManager::SetSection("%s") failed.$DXUpdate_DXDllReg_x86$DirectXUpdateDownloadPlugIn$DirectXUpdateDownloadPlugIn(): CDownloadManager::InitInstallEngine() failed.$DirectXUpdateDownloadPlugIn(): Cif %s$DirectXUpdateDownloadPlugIn(): [%s] is being downloaded.$DirectXUpdateDownloadPlugIn(): end download$DirectXUpdateDownloadPlugIn(): no download section in %s.$DirectXUpdateDownloadPlugIn(): start download$DirectXUpdateDownloadPlugIn(): unable to initialize CDownloadManager.$GetCachePath() failed.$GetDXVersion() failed.$GetSectionFromCif() failed.$Invalid parameter.$SetupOpenInfFile()$Srv2K3$Srv2K3@64$Unable to create path string, %s\%s.$Unable to find %s.$Unable to initialize CKernel32.$Unable to initialize CSetupAPI.$Unable to open %s.$Win2K$WinXP$WinXP@64$dxupdate.cif$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp$http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C
API String ID: 2102423945-1754519923
Opcode ID: 485d8ebe45508beed432fb94282f5416126a713a64beb1f83dbe79339673e191
Instruction ID: ac122a99fb05f5d7e6917544a82ef1715e35a1f7d44f2ee7589a469a2c7e7261
Opcode Fuzzy Hash: 485d8ebe45508beed432fb94282f5416126a713a64beb1f83dbe79339673e191
Instruction Fuzzy Hash: C4E183B1D0711AAAEB209B658C80EDE77BCAF5530CF1405D6F519B2A41EB309E848F3D

Uniqueness

Uniqueness Score: -1.00%

Function 6C68C2B0 Relevance: 61.4, APIs: 16, Strings: 19, Instructions: 168
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(mscoree.dll,?,00000000,00000000,?,6C68D408,?,00000104,00000000,?,6C695CF7,?,00000104,00000000,?,6C696A2C), ref: 6C68C2CF
GetLastError.KERNEL32(Unable to load mscoree.dll.,?,6C68D408,?,00000104,00000000,?,6C695CF7,?,00000104,00000000,?,6C696A2C,?,?,?), ref: 6C68C2E1

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

GetProcAddress.KERNEL32(00000000,LoadLibraryShim), ref: 6C68C316
GetLastError.KERNEL32(Module: mscoree.dll, Function: LoadLibraryShim,?,6C68D408,?,00000104,00000000,?,6C695CF7,?,00000104,00000000,?,6C696A2C,?,?,?), ref: 6C68C326
FreeLibrary.KERNEL32(?,?,6C696A2C,?,?,?,?,00000008,?,00000007,?,DirectX,?,Version,?,Version), ref: 6C68C433
GetLastError.KERNEL32(?,6C696A2C,?,?,?,?,00000008,?,00000007,?,DirectX,?,Version,?,Version,?), ref: 6C68C442
FreeLibrary.KERNEL32(00000000,?,6C696A2C,?,?,?,?,00000008,?,00000007,?,DirectX,?,Version,?,Version), ref: 6C68C480
GetLastError.KERNEL32(?,6C696A2C,?,?,?,?,00000008,?,00000007,?,DirectX,?,Version,?,Version,?), ref: 6C68C48A

Strings

Module: fusion.dll, Function: CreateAssemblyEnum, xrefs: 6C68C39E
GetCachePath, xrefs: 6C68C3E8
mscoree.dll, xrefs: 6C68C2BC
fusion.dll, xrefs: 6C68C346
GetProcAddress(), xrefs: 6C68C32D, 6C68C37A, 6C68C3AA, 6C68C3D7, 6C68C404
Module: fusion.dll, Function: CreateAssemblyCache, xrefs: 6C68C3CB
CreateAssemblyEnum, xrefs: 6C68C38E
CFusion::CFusion, xrefs: 6C68C2ED, 6C68C332, 6C68C37F, 6C68C3AF, 6C68C3DC, 6C68C409, 6C68C41D, 6C68C450, 6C68C498
Module: fusion.dll, Function: GetCachePath, xrefs: 6C68C3F8
LoadLibraryShim, xrefs: 6C68C310
FreeLibrary(), xrefs: 6C68C439, 6C68C44F, 6C68C497
LoadLibrary(), xrefs: 6C68C2E8
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68C2F7, 6C68C318, 6C68C427, 6C68C45A, 6C68C4A2
CreateAssemblyNameObject, xrefs: 6C68C35F
CreateAssemblyCache, xrefs: 6C68C3BB
Unable to load mscoree.dll., xrefs: 6C68C2DC
LoadLibraryShim(), xrefs: 6C68C418
Module: fusion.dll, Function: CreateAssemblyNameObject, xrefs: 6C68C36E
Module: mscoree.dll, Function: LoadLibraryShim, xrefs: 6C68C321

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorLast$Library$Free__wstrtime$AddressLoadProc_strrchr
String ID: CFusion::CFusion$CreateAssemblyCache$CreateAssemblyEnum$CreateAssemblyNameObject$FreeLibrary()$GetCachePath$GetProcAddress()$LoadLibrary()$LoadLibraryShim$LoadLibraryShim()$Module: fusion.dll, Function: CreateAssemblyCache$Module: fusion.dll, Function: CreateAssemblyEnum$Module: fusion.dll, Function: CreateAssemblyNameObject$Module: fusion.dll, Function: GetCachePath$Module: mscoree.dll, Function: LoadLibraryShim$Unable to load mscoree.dll.$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp$fusion.dll$mscoree.dll
API String ID: 919326679-2703188920
Opcode ID: b4b41eb15f0cab1d75a4f158e11fb95f11c4991d09e50b1d5d9dc08865eb99f0
Instruction ID: dddb9df3f9e5557a1d5318ad5026a1ccc7524901d0e3142a2bccc73f2a917064
Opcode Fuzzy Hash: b4b41eb15f0cab1d75a4f158e11fb95f11c4991d09e50b1d5d9dc08865eb99f0
Instruction Fuzzy Hash: D151C670647301BBE7106FA6CC55E267AF8AF56B46F104E3DF6A2E2D40EA60D5404E3C

Uniqueness

Uniqueness Score: -1.00%

Function 6C68BAF8 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 74
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C68BB17
CreateMutexA.KERNELBASE(00000000,00000000,DXUPDATE DLL Mutex), ref: 6C68BB24
GetLastError.KERNEL32(00000000), ref: 6C68BB31
GetLastError.KERNEL32 ref: 6C68BB5B
CloseHandle.KERNEL32(00000000), ref: 6C68BB70
GetLastError.KERNEL32(00000000), ref: 6C68BB7B
CloseHandle.KERNEL32 ref: 6C68BBA2
GetLastError.KERNEL32(00000000), ref: 6C68BBAD

Strings

e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68BB44, 6C68BBC0
CloseHandle(), xrefs: 6C68BB7E, 6C68BBB4
DXUPDATE DLL Mutex, xrefs: 6C68BB1D
DllMain, xrefs: 6C68BB3D, 6C68BB83, 6C68BBB9
CreateMutex(), xrefs: 6C68BB38
DXUpdate is running already., xrefs: 6C68BB64

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorLast$CloseHandle$CallsCreateDisableLibraryMutexThread
String ID: CloseHandle()$CreateMutex()$DXUPDATE DLL Mutex$DXUpdate is running already.$DllMain$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 137530272-569196964
Opcode ID: ddc74396a41ccf274c6ae372a9b131d3269c897c3b87d696094d06dcdfbde12d
Instruction ID: 7b07fc2d0f3a6380917319a02efb3246382c37da70cc204f55741c42d37093a5
Opcode Fuzzy Hash: ddc74396a41ccf274c6ae372a9b131d3269c897c3b87d696094d06dcdfbde12d
Instruction Fuzzy Hash: F011C472717144BBD7206AB6CCCCE5B3BFCEB96B5AF040921F605E6900EA24D9019A7C

Uniqueness

Uniqueness Score: -1.00%

Function 6C699C99 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 133
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?,6C69A1B0,00000000,00000000,?,6C69A439,?,?,?,?), ref: 6C699CEC
GetLastError.KERNEL32(00000000,?,6C69A1B0,00000000,00000000,?,6C69A439,?,?,?,?,6C6812F4,00000000,?,6C6970A6,?), ref: 6C699CF7
WaitForSingleObject.KERNEL32(?,000000FF,?,6C69A1B0,00000000,00000000,?,6C69A439,?,?,?,?,6C6812F4,00000000,?,6C6970A6), ref: 6C699DB7
GetLastError.KERNEL32(00000000,?,6C69A1B0,00000000,00000000,?,6C69A439,?,?,?,?,6C6812F4,00000000,?,6C6970A6,?), ref: 6C699DC4

Strings

e:\bt\382730\setup\deliverables\dxupdate\dwnldmgr.cpp, xrefs: 6C699CB7, 6C699CDB, 6C699D09, 6C699D52, 6C699DA0
QueryInterface(), xrefs: 6C699D47
Unable to query timing function., xrefs: 6C699D41
Event handle handle is not initialized., xrefs: 6C699CCE
CDownloadManager::Download(), xrefs: 6C699CA3
CDownloadManager::Download, xrefs: 6C699CB2, 6C699CD5, 6C699D03, 6C699D4C, 6C699D9A, 6C699DD0
WaitForsingleObject(), xrefs: 6C699DCB
ResetEvent(), xrefs: 6C699CFE
DownloadComponents(), xrefs: 6C699D95

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorLast$EventObjectResetSingleWait
String ID: CDownloadManager::Download$CDownloadManager::Download()$DownloadComponents()$Event handle handle is not initialized.$QueryInterface()$ResetEvent()$Unable to query timing function.$WaitForsingleObject()$e:\bt\382730\setup\deliverables\dxupdate\dwnldmgr.cpp
API String ID: 2267819996-2907961203
Opcode ID: 3e710c80766cffe4ac99fe39eb86dc1f50029e62e532c3b2a04a42b56ef87112
Instruction ID: 4e35b7ae71a13e67b796d6c6a08a0c10cc260518ee525d3e8cab879a64f88bef
Opcode Fuzzy Hash: 3e710c80766cffe4ac99fe39eb86dc1f50029e62e532c3b2a04a42b56ef87112
Instruction Fuzzy Hash: 8C41A370605601BFE7249B65CC89E6773BCEF4A71EF140A09F556D7691D670EC008BB8

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A2E97 Relevance: 18.0, APIs: 9, Strings: 1, Instructions: 520fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

__get_daylight.LIBCMT ref: 6C6A2ED9
__get_wpgmptr.LIBCMT ref: 6C6A2EF4
CreateFileA.KERNEL32(00000000,00000080,00000000,0000000C,00000001,00000080,00000000,00000109,00000000,00000000), ref: 6C6A30CB
GetLastError.KERNEL32 ref: 6C6A30F3
__dosmaperr.LIBCMT ref: 6C6A30FA
GetFileType.KERNELBASE(00000000), ref: 6C6A310D
CloseHandle.KERNEL32(00000000), ref: 6C6A3133
CloseHandle.KERNEL32(00000000), ref: 6C6A315F
__locking.LIBCMT ref: 6C6A3453

Strings

@, xrefs: 6C6A32B9

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: CloseFileHandle$CreateErrorLastType__dosmaperr__get_daylight__get_wpgmptr__locking
String ID: @
API String ID: 690964824-2766056989
Opcode ID: ebd28fae7db0954c10c84dfaed459ec1169a393e4157a9c7ef6e8eb69fb41d43
Instruction ID: 11285efd58ee7814bd827b355a44a4711334ab25906a21d4d4b592f5716e8933
Opcode Fuzzy Hash: ebd28fae7db0954c10c84dfaed459ec1169a393e4157a9c7ef6e8eb69fb41d43
Instruction Fuzzy Hash: 0E0230719086499FEB118FEACC857ADBBB0EF0231CF240679E56097A90D735CD86CB49

Uniqueness

Uniqueness Score: -1.00%

Function 6C690243 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6C68C2B0: LoadLibraryA.KERNELBASE(mscoree.dll,?,00000000,00000000,?,6C68D408,?,00000104,00000000,?,6C695CF7,?,00000104,00000000,?,6C696A2C), ref: 6C68C2CF
Part of subcall function 6C68C2B0: GetLastError.KERNEL32(Unable to load mscoree.dll.,?,6C68D408,?,00000104,00000000,?,6C695CF7,?,00000104,00000000,?,6C696A2C,?,?,?), ref: 6C68C2E1

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000104,sil,00000104,00000000,00000000), ref: 6C69031A
GetLastError.KERNEL32(00000000), ref: 6C690325

Strings

GetCachePath(), xrefs: 6C6902E0
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C69029C, 6C6902EF
GetCachePath, xrefs: 6C690292, 6C6902E5, 6C690331
WideCharToMultiByte(), xrefs: 6C69032C
Unable to initialize CFusion., xrefs: 6C69028B
sil, xrefs: 6C69025A, 6C69030A

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorLast__wstrtime$ByteCharLibraryLoadMultiWide_strrchr
String ID: GetCachePath$GetCachePath()$Unable to initialize CFusion.$WideCharToMultiByte()$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp$sil
API String ID: 2559884782-1946086078
Opcode ID: fc21ef0c9d6c8f68be27a41bfcd6f67280a34561467d5f7b933e006744e7a901
Instruction ID: 808b7a64a50e56560ff166066f5092ea53d2874257d66de7ec5b90d948a3b05a
Opcode Fuzzy Hash: fc21ef0c9d6c8f68be27a41bfcd6f67280a34561467d5f7b933e006744e7a901
Instruction Fuzzy Hash: 9321D8B1942159BBDB109BA48CC8EFA777CDB1A318F1005A5E909A7541DA708E888F7C

Uniqueness

Uniqueness Score: -1.00%

Function 6C694094 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMDXCheck::IsInUse, xrefs: 6C6940C4
IsInUse(): Unable to find DLL name, skipped %s., xrefs: 6C69411C
IsInUse(): Unable to get file list from %s:[%s]., xrefs: 6C694131
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C6940CE
.dll, xrefs: 6C6940F9
MDXDLLs, xrefs: 6C6940AB, 6C6940B0, 6C69412F
LoadListFromInfSection() failed., xrefs: 6C6940BB

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$_strrchr
String ID: .dll$CMDXCheck::IsInUse$IsInUse(): Unable to find DLL name, skipped %s.$IsInUse(): Unable to get file list from %s:[%s].$LoadListFromInfSection() failed.$MDXDLLs$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 4138713405-4040500528
Opcode ID: 19a151ba8a058c6a89a22e4396823b1582ebe270a800dfa34db0ef710233a9ea
Instruction ID: c72a3375d785244eac2643ef261089ab5f363ed67d855b2ecf237a4ecc78fb8c
Opcode Fuzzy Hash: 19a151ba8a058c6a89a22e4396823b1582ebe270a800dfa34db0ef710233a9ea
Instruction Fuzzy Hash: 5B110832906102B6DB205B695C41FFB7AB88F5372CF240655F521F7AC1DBF09A0495BD

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A505A Relevance: 14.0, APIs: 9, Instructions: 502COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3795a3d9d7d29676f60e83dcc890a88b3ba6d4f7b1540ee5a4a0534e649e04
Instruction ID: 35920b8c66aea85840fbe7a2260003c50f71be63b1aa18dbf254dfeeb9b2143f
Opcode Fuzzy Hash: dd3795a3d9d7d29676f60e83dcc890a88b3ba6d4f7b1540ee5a4a0534e649e04
Instruction Fuzzy Hash: CC12D130A09B8ADFDB11CFE8C8807ADBBB1FF43308F144599D5619BA91D3709946CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 6C69EA7C Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fassign.LIBCMT ref: 6C69EC4D
__wsopen_s.LIBCMT ref: 6C69ECE9

Strings

UTF-16LE, xrefs: 6C69EC79
ccs=, xrefs: 6C69EC48
UTF-8, xrefs: 6C69EC5C
, xrefs: 6C69EBAE
UNICODE, xrefs: 6C69EC96

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __fassign__wsopen_s
String ID: $UNICODE$UTF-16LE$UTF-8$ccs=
API String ID: 2488987356-1656882147
Opcode ID: 22b358106f6c37305753414b491ed2705265aff1f318154c1d5017bfd181e9ab
Instruction ID: 86a2f764fde751f8138b74afbe91934c060b20a67d4c4bc8b2e39e654f01f329
Opcode Fuzzy Hash: 22b358106f6c37305753414b491ed2705265aff1f318154c1d5017bfd181e9ab
Instruction Fuzzy Hash: A671E4B180920BEADB048F59C5403D97FB0BB1631CF24C46AE8B596A91E379D242CFCD

Uniqueness

Uniqueness Score: -1.00%

Function 6C69AA91 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

__fileno.LIBCMT ref: 6C69AAE4
__fileno.LIBCMT ref: 6C69AAF0
__fileno.LIBCMT ref: 6C69AAFC
__fileno.LIBCMT ref: 6C69AB0C
__fileno.LIBCMT ref: 6C69AB29
__fileno.LIBCMT ref: 6C69AB35
__fileno.LIBCMT ref: 6C69AB41
__fileno.LIBCMT ref: 6C69AB51

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __fileno
String ID:
API String ID: 1873356214-0
Opcode ID: f2aa95c3035acfb2f6251862f2658103680258eaac0baa6092f55d057be4c13c
Instruction ID: 1e1ffb1f710970be649179b930808214e42bb36e8eddcb8c0c55697848324586
Opcode Fuzzy Hash: f2aa95c3035acfb2f6251862f2658103680258eaac0baa6092f55d057be4c13c
Instruction Fuzzy Hash: F1310B32D055179AD7009F748C85ADD77E6AF0333CF248625E424DBED2DB38DA8A869C

Uniqueness

Uniqueness Score: -1.00%

Function 6C699870 Relevance: 10.5, APIs: 3, Strings: 4, Instructions: 46sleepCOMMON

Download Yara Rule

APIs

CoUninitialize.OLE32 ref: 6C6998D4
CloseHandle.KERNEL32(?), ref: 6C6998E5
Sleep.KERNELBASE(000003E8), ref: 6C6998F0

Strings

e:\bt\382730\setup\deliverables\dxupdate\dwnldmgr.cpp, xrefs: 6C6998B6
~CDownloadManager(), xrefs: 6C699875
CDownloadManager::~CDownloadManager, xrefs: 6C6998AC
UnregisterInstallEngineCallback(), xrefs: 6C6998A7

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: CloseHandleSleepUninitialize
String ID: CDownloadManager::~CDownloadManager$UnregisterInstallEngineCallback()$e:\bt\382730\setup\deliverables\dxupdate\dwnldmgr.cpp$~CDownloadManager()
API String ID: 314316678-1669205376
Opcode ID: 74a1996ba453d87b4b7a95e1ec9dfedf9da760750380af865285ee532638fac9
Instruction ID: 3569d4852aa533d8b5391de58716933df01c95d4865309f541f9af6a731e0294
Opcode Fuzzy Hash: 74a1996ba453d87b4b7a95e1ec9dfedf9da760750380af865285ee532638fac9
Instruction Fuzzy Hash: B8014C71602301AFD7209FA5C899B1677B8AF49319F100D1DE45ADBA91DB30D845CB78

Uniqueness

Uniqueness Score: -1.00%

Function 6C69A20F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 6C69A253
SendMessageA.USER32(00000000), ref: 6C69A25A
SetDlgItemTextA.USER32(000003EA,000003EA,--:--:--), ref: 6C69A2DB

Part of subcall function 6C68A2E4: _vswprintf_s.LIBCMT ref: 6C68A317

Strings

%02d:%02d:%02d, xrefs: 6C69A2A9
--:--:--, xrefs: 6C69A2CB

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: Item$MessageSendText_vswprintf_s
String ID: %02d:%02d:%02d$--:--:--
API String ID: 4103211107-521328129
Opcode ID: 09b68c48c1907adb5308c90ddcf22258bc5a3f7abebb347d04a43369b7572e26
Instruction ID: 4bb2f1d3c5519c3f94e2e0b95f636dff2c50debe9e6101ece37d76ed89b120eb
Opcode Fuzzy Hash: 09b68c48c1907adb5308c90ddcf22258bc5a3f7abebb347d04a43369b7572e26
Instruction Fuzzy Hash: 38214631A04604ABDB10CA35CC44DEB73F9EB96304F24866AF666E2180C770E981CB58

Uniqueness

Uniqueness Score: -1.00%

Function 6C69A193 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

#17.COMCTL32(00000000,00000000,?,6C69A439,?,?,?,?,6C6812F4,00000000,?,6C6970A6,?,?,?,?), ref: 6C69A1E1
DialogBoxParamA.USER32(?,000003E8,?,6C69A12F,00000000), ref: 6C69A1FE

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

e:\bt\382730\setup\deliverables\dxupdate\dwnldmgr.cpp, xrefs: 6C69A1C5
Download() falied., xrefs: 6C69A1B4
CDownloadManager::Download, xrefs: 6C69A1BB

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$DialogParam_strrchr
String ID: CDownloadManager::Download$Download() falied.$e:\bt\382730\setup\deliverables\dxupdate\dwnldmgr.cpp
API String ID: 3573595137-1322761809
Opcode ID: bb39147aa6138d37e703ff5e072ecd8a9672d48aad37bfdb16f141d71246a248
Instruction ID: 853dcca4e261461b9cc5986a92ddd93103cb950b007106b484ee5672502ee8bd
Opcode Fuzzy Hash: bb39147aa6138d37e703ff5e072ecd8a9672d48aad37bfdb16f141d71246a248
Instruction Fuzzy Hash: 21F0E932E45252FBC7211A638C08DC77AF8EBC776AF144427FA6991801E6319011DABD

Uniqueness

Uniqueness Score: -1.00%

Function 6C68C4C7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(00000000,6C695D4A,?,6C696A2C,?,?,?,?,00000008,?,00000007,?,DirectX,?,Version,?), ref: 6C68C4CE
GetLastError.KERNEL32(?,6C696A2C,?,?,?,?,00000008,?,00000007,?,DirectX,?,Version,?,Version,?), ref: 6C68C4D8

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

FreeLibrary(), xrefs: 6C68C4E5
CFusion::~CFusion, xrefs: 6C68C4EA
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68C4F4

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$ErrorFreeLastLibrary_strrchr
String ID: CFusion::~CFusion$FreeLibrary()$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 2808663981-2807337669
Opcode ID: 99867c8eb08d333f44de938d82c82e29c49ffcf99565255e1fbb9fdd5d085a06
Instruction ID: efe0389542f8e445dea62b2bbf43bfee3cd78abb4492ee577f99eee15ba8c570
Opcode Fuzzy Hash: 99867c8eb08d333f44de938d82c82e29c49ffcf99565255e1fbb9fdd5d085a06
Instruction Fuzzy Hash: 88D09E74713201B7FF103A624C89B1739A86B12F8DF544564F521E68C1EA52C610897F

Uniqueness

Uniqueness Score: -1.00%

Function 6C69D391 Relevance: 6.1, APIs: 4, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

__fileno.LIBCMT ref: 6C69D39B
__locking.LIBCMT ref: 6C69D44A
__lseeki64.LIBCMT ref: 6C69D494
__locking.LIBCMT ref: 6C69D4B8

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __locking$__fileno__lseeki64
String ID:
API String ID: 3501863086-0
Opcode ID: 2b3b6f328c4e909ede286c0e7d0c7b6305229aa12a7f53f3e69ba287d5f264b8
Instruction ID: 717e9c461091cc18fed117b015e7f36f6d12c408354a70b2a8fb18053b71bdb6
Opcode Fuzzy Hash: 2b3b6f328c4e909ede286c0e7d0c7b6305229aa12a7f53f3e69ba287d5f264b8
Instruction Fuzzy Hash: 1F41E671104A069FC7208FA9C881A9677E4EF46778B10C73DE8B98BED1D734F9418B58

Uniqueness

Uniqueness Score: -1.00%

Function 6C699E01 Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 6C699E18
SendMessageA.USER32(00000000,00000401,00000000,?), ref: 6C699E36
SendMessageA.USER32(00000000,00000402,00000000,00000000), ref: 6C699E42
SendMessageA.USER32(00000000,00000404,00000001,00000000), ref: 6C699E4E

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: MessageSend$Item
String ID:
API String ID: 3888421826-0
Opcode ID: 054ddf923f6691c968a8fa4fdf679bdb5f86d6980d9fba100b133d2d20d7d707
Instruction ID: b33e61ba683f4d250d65c20ee33d0f20f7b20feb9e9cec0211dd5a5e65a3bb98
Opcode Fuzzy Hash: 054ddf923f6691c968a8fa4fdf679bdb5f86d6980d9fba100b133d2d20d7d707
Instruction Fuzzy Hash: E0E0657138031436F62015164C4AF7B3A6CD7C2F61F104026F714FA1C1C5F5A80286B8

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A1C2E Relevance: 4.6, APIs: 3, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000002,00000000,00000000,00BFBBEF,6C6A3458,6C6A3458,?,6C6A1EBB,00BFBBEF,00000000,00000000,00000002,00000000,00000000), ref: 6C6A1C70
GetLastError.KERNEL32(?,6C6A1EBB,00BFBBEF,00000000,00000000,00000002,00000000,00000000,00000002), ref: 6C6A1C7D
__dosmaperr.LIBCMT ref: 6C6A1C88

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: ed9341c3e5eca36e2c2c2c3342d48b78a98e755185e01dafb8a3d4f928e9267a
Instruction ID: 6851975a942677d37d898d2bdd29c1b67ad320f6bd8bb34e55e5c512cd79d310
Opcode Fuzzy Hash: ed9341c3e5eca36e2c2c2c3342d48b78a98e755185e01dafb8a3d4f928e9267a
Instruction Fuzzy Hash: E7016576A14109FFCF008FDAD84488D7BB9AB46364B240256F421E7680D670DE018768

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A5BD1 Relevance: 4.5, APIs: 3, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000109,00000000,6C6A3433,00004000,00000109,?,6C6A3433,00000109,00000000,00000000), ref: 6C6A5C00
GetLastError.KERNEL32(?,6C6A3433,00000109,00000000,00000000), ref: 6C6A5C0D
__dosmaperr.LIBCMT ref: 6C6A5C1C

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: 377208f4bb06929058487cf3d7ee37dddf527896345ef99c5781c87495dacfc6
Instruction ID: 006b8d4b2b1b1d80240bc20be05843fae5e84566e04e440dce3da06df7e5b4d9
Opcode Fuzzy Hash: 377208f4bb06929058487cf3d7ee37dddf527896345ef99c5781c87495dacfc6
Instruction Fuzzy Hash: 8A01F432228914BBCB008AFEDC4898A3B68AB87335F150716F931CBAD0DB30DC4147AD

Uniqueness

Uniqueness Score: -1.00%

Function 6C69E95B Relevance: 3.1, APIs: 2, Instructions: 111COMMON

Download Yara Rule

APIs

__fileno.LIBCMT ref: 6C69EA03
__locking.LIBCMT ref: 6C69EA0A

Part of subcall function 6C69E53D: __fileno.LIBCMT ref: 6C69E56B
Part of subcall function 6C69E53D: __locking.LIBCMT ref: 6C69E572

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __fileno__locking
String ID:
API String ID: 2385650056-0
Opcode ID: b38bcfd551dd446acf600f144ef1975b7976bc6a923d98c4559ce00ddf488865
Instruction ID: d0909558ec96e74d26b5bfd2283f24740182f87377ff19f865bd5e0e997d3ce6
Opcode Fuzzy Hash: b38bcfd551dd446acf600f144ef1975b7976bc6a923d98c4559ce00ddf488865
Instruction Fuzzy Hash: 2731ED31601B06EFDB14CF69C48069EBBF5FF52364F20852DE855D7A50D770EA408B88

Uniqueness

Uniqueness Score: -1.00%

Function 6C69AD75 Relevance: 3.1, APIs: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__getstream.LIBCMT ref: 6C69ADD9
@_EH4_CallFilterFunc@8.LIBCMT ref: 6C69AE0F

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: CallFilterFunc@8__getstream
String ID:
API String ID: 2779671989-0
Opcode ID: 994829d5ee8d2f77cfccb459ecf59b91b03e2187eb050b8deed369444f2b226d
Instruction ID: 40ecec6b90f43be57bd27ac4858fa7d374ed94cc6962a8eee349816da881ab02
Opcode Fuzzy Hash: 994829d5ee8d2f77cfccb459ecf59b91b03e2187eb050b8deed369444f2b226d
Instruction Fuzzy Hash: D111B6B1D09107EEDB10AFF48C805DE77E4AF07318B154979D01097A62D735894D97AE

Uniqueness

Uniqueness Score: -1.00%

Function 6C69E53D Relevance: 3.0, APIs: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__fileno.LIBCMT ref: 6C69E56B
__locking.LIBCMT ref: 6C69E572

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __fileno__locking
String ID:
API String ID: 2385650056-0
Opcode ID: f34ee2353d581f99db61ec7ed969a26067ae195e629ff946469a8732c1a5b05c
Instruction ID: de0d8ac3fddca4711b186c390968d0682068514d3841fcce214a4eb5eb6564a8
Opcode Fuzzy Hash: f34ee2353d581f99db61ec7ed969a26067ae195e629ff946469a8732c1a5b05c
Instruction Fuzzy Hash: 3501DBB2204B015FD7104E6DC881B93B7E9EF85378F108A1DE4A987A80E765EC4547D4

Uniqueness

Uniqueness Score: -1.00%

Function 6C69A12F Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000004), ref: 6C69A15D
EndDialog.USER32(?,00000000), ref: 6C69A17F

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: DialogWindow
String ID:
API String ID: 2634769047-0
Opcode ID: ff319ad5c2f397d8417e0bffef8fa1042619c2558d152adefc67c7960dfa0a11
Instruction ID: 5d5e03ee0dc6ba0626dbef617e3c8478fb5a443b28cfe5a8ae4ccd423d71e333
Opcode Fuzzy Hash: ff319ad5c2f397d8417e0bffef8fa1042619c2558d152adefc67c7960dfa0a11
Instruction Fuzzy Hash: 4EF0BE31601105AFC7008B5BD888AAB3BF9FF87769F114025E55882642C3B1A402CFE8

Uniqueness

Uniqueness Score: -1.00%

Function 6C69D037 Relevance: 3.0, APIs: 2, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,6C69A523,00000001), ref: 6C69D04C
HeapDestroy.KERNEL32(?,6C69A523,00000001), ref: 6C69D083

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: a0980cb1dcdb0c5e687417156a80f9a9f3cc51ed5dee3cb14a3152e6a4a44bac
Instruction ID: d052018c28160e1f7130d7c83ed23eae68f15b5b283d772b74eeda176599111d
Opcode Fuzzy Hash: a0980cb1dcdb0c5e687417156a80f9a9f3cc51ed5dee3cb14a3152e6a4a44bac
Instruction Fuzzy Hash: 98F0A031748306EAEF019FB3A884B5A3AB8E74739DF108436E44CC4440EB70A045CE2C

Uniqueness

Uniqueness Score: -1.00%

Function 6C69AA10 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__fclose_nolock.LIBCMT ref: 6C69AA6A

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __fclose_nolock
String ID:
API String ID: 4232755567-0
Opcode ID: a7577423fa4a6141869521991a9a1b2a7416697c3ef931795291fcf9a66fa2e7
Instruction ID: b226d5c8974f00b852c63b1ce8cda9303e331062a1eec612f54321f52ce94693
Opcode Fuzzy Hash: a7577423fa4a6141869521991a9a1b2a7416697c3ef931795291fcf9a66fa2e7
Instruction Fuzzy Hash: 94F0C271C042029AD711ABAD8A006DEBBE06F43338F159645D0389AAD1CB3C86069F5E

Uniqueness

Uniqueness Score: -1.00%

Function 6C69C80F Relevance: 1.5, APIs: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_impl.LIBCMT ref: 6C69C824

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __calloc_impl
String ID:
API String ID: 2175177749-0
Opcode ID: 6bc0eed9ca1301c1c806570c5c14b31f498a1e2defb2505aa1be8d54acaea466
Instruction ID: 01f60906f4f4499e16674097cbb6d03952c2ee99ce15f26ad6e30affcaf4a9cf
Opcode Fuzzy Hash: 6bc0eed9ca1301c1c806570c5c14b31f498a1e2defb2505aa1be8d54acaea466
Instruction Fuzzy Hash: 03E022B2600106B7CF006A89CD01ADE3BBCDF82368F200061EC06E7200D730CE0483EC

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6C68EA87 Relevance: 61.6, APIs: 7, Strings: 28, Instructions: 339COMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 6C68EAE2
GetLastError.KERNEL32(00000000), ref: 6C68EAEF

Strings

Unable to create catalog name, %sD., xrefs: 6C68ED8A
Unable to get catalog name, Inf: %s., xrefs: 6C68EB76
Unable to create catalog name, %sengD., xrefs: 6C68EC7C
DirectXUpdateInstall, xrefs: 6C68EAAC
\dinput8d.dll, xrefs: 6C68EC33
InstallCatalogFile, xrefs: 6C68EAFD, 6C68EB38, 6C68EB82, 6C68EC09, 6C68EC85, 6C68ECBE, 6C68ED04, 6C68ED4B, 6C68ED93, 6C68EDF7, 6C68EE83, 6C68EED8
Warning: InstallCatalogFile: DeleteOldCatalogFile() returns 0, continue..., xrefs: 6C68EE55
engD, xrefs: 6C68EC5B
InstCatWin() failed. Certificate, catalog file and module need to be checked., xrefs: 6C68EED1
Unable to create path string, %s\%s., xrefs: 6C68EB31
Unable to create path string, %s%s., xrefs: 6C68EC00, 6C68ED42
BDA4*.CAT, xrefs: 6C68EE46, 6C68EE4B
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68EAD4, 6C68ED0E, 6C68EE8D, 6C68EEE2
GetPrivateProfileString(), xrefs: 6C68EB7D
eng, xrefs: 6C68EC94
DX4*.CAT, xrefs: 6C68EE3F
GetsystemDirectory(), xrefs: 6C68EAF6
Version, xrefs: 6C68EB60
\ddraw.dll, xrefs: 6C68EBDE, 6C68EBF4
Unable to create catalog name, %seng., xrefs: 6C68ECB5
InstallCatalogFile(): installing %s ..., xrefs: 6C68EE20
\msyuv.dll, xrefs: 6C68ED20, 6C68ED36
Unable to create path string, %s\., xrefs: 6C68EE7C
Catalog name too long, %s., xrefs: 6C68EDEE
Unable to create catalog name, %s%s., xrefs: 6C68ECFB
%d.%02d.%02d.%04d.%d, xrefs: 6C68EBA7
DX%s.CAT, xrefs: 6C68EBC2, 6C68EBC7, 6C68EDC5, 6C68EE34
CatalogFile, xrefs: 6C68EB5B

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: DirectoryErrorLastSystem
String ID: %d.%02d.%02d.%04d.%d$BDA4*.CAT$Catalog name too long, %s.$CatalogFile$DX%s.CAT$DX4*.CAT$DirectXUpdateInstall$GetPrivateProfileString()$GetsystemDirectory()$InstCatWin() failed. Certificate, catalog file and module need to be checked.$InstallCatalogFile$InstallCatalogFile(): installing %s ...$Unable to create catalog name, %s%s.$Unable to create catalog name, %sD.$Unable to create catalog name, %seng.$Unable to create catalog name, %sengD.$Unable to create path string, %s%s.$Unable to create path string, %s\%s.$Unable to create path string, %s\.$Unable to get catalog name, Inf: %s.$Version$Warning: InstallCatalogFile: DeleteOldCatalogFile() returns 0, continue...$\ddraw.dll$\dinput8d.dll$\msyuv.dll$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp$eng$engD
API String ID: 3081803543-1549923111
Opcode ID: 9e8e659b43fe9a7fb2085472677aa93da4dbb2b1d2268f2fb0d08c7a4cb43cae
Instruction ID: 6a8d9585d203422685495759ed5f58c1e751ad19147d5978037738b5ff02ff03
Opcode Fuzzy Hash: 9e8e659b43fe9a7fb2085472677aa93da4dbb2b1d2268f2fb0d08c7a4cb43cae
Instruction Fuzzy Hash: 4EB1A5B5D07228B6DB30DAA18C44EEB7ABCDF16754F000591FA48E2940E771DA848EFC

Uniqueness

Uniqueness Score: -1.00%

Function 6C692D36 Relevance: 59.9, APIs: 6, Strings: 28, Instructions: 383registryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C692209: _memset.LIBCMT ref: 6C69224D
Part of subcall function 6C692209: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 6C692262
Part of subcall function 6C692209: GetLastError.KERNEL32(00000000,?,\mdxredist.msi,00000000), ref: 6C69226D

Part of subcall function 6C691F44: _memset.LIBCMT ref: 6C691F7A

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\.NETFramework\AssemblyFolders,00000000,00020007,?,?,{B4C88CF0-B617-4658-8F84-C4E847FBC9F7},?,ProductCode,?,?), ref: 6C692F38
RegOpenKeyExA.ADVAPI32(?,ManagedDX,00000000,00000001,?), ref: 6C692F5C
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,?,?), ref: 6C692F89
RegCloseKey.ADVAPI32(?), ref: 6C692F9B
RegDeleteKeyA.ADVAPI32(?,ManagedDX), ref: 6C693019
RegCloseKey.ADVAPI32(?), ref: 6C693094

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Part of subcall function 6C68BBDC: _strrchr.LIBCMT ref: 6C68BBF5

Strings

RegQueryValueEx(), xrefs: 6C69305A
Unable to initialize CDXMsi., xrefs: 6C69323C
DirectXUpdateInstall, xrefs: 6C692D50
InstallMDX(): unable to find %s., xrefs: 6C693045
InstallMDX(): uninstalling MDX 9.0..., xrefs: 6C6930EB
{7F34A21F-2DEB-4598-BB19-611D6BD24271}, xrefs: 6C692E83, 6C693102
InstallMDX(): removing MDX 9.0 reference files..., xrefs: 6C692FEE
Unable to create path string, %s%s., xrefs: 6C693212
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C692D4C, 6C692FB8, 6C693081, 6C6930C9, 6C6931B4, 6C693223, 6C69324D, 6C693280
ProductCode, xrefs: 6C692EDE
GetMDXVersion() failed., xrefs: 6C69325C
RegOpenKeyEx(), xrefs: 6C693072, 6C6930BA
InstallMDX(): MDX: %d.%02d.%02d.%04d, Update:%d.%02d.%02d.%04d, xrefs: 6C692DF0
InstallMDX(): installing MDX 9.1..., xrefs: 6C693128
VersionString, xrefs: 6C692E78, 6C692E7D, 6C692EAC
MsiInstallProduct(), xrefs: 6C69314B, 6C6931A5
REINSTALL=ALL REINSTALLMODE=aumv, xrefs: 6C69311F, 6C693186
GetMDXProductVersion() failed., xrefs: 6C69326F
InstallMDX, xrefs: 6C692FAE, 6C69305F, 6C693077, 6C6930A6, 6C6930BF, 6C693150, 6C693163, 6C6931AA, 6C693219, 6C693243, 6C693263, 6C693276
MsiConfigureProductEx(), xrefs: 6C69315E
RegCloseKey(), xrefs: 6C692FA9, 6C6930A1
ManagedDX, xrefs: 6C692F51, 6C69300D, 6C693012, 6C693029
\mdxredist.msi, xrefs: 6C692D52, 6C692D59, 6C692E34, 6C69320B
{B4C88CF0-B617-4658-8F84-C4E847FBC9F7}, xrefs: 6C692EAD, 6C692EFE
InstallMDX(): updating MDX 9.1..., xrefs: 6C693115
InstallMDX(): Unable to remove [%s\%s], result = %d., xrefs: 6C69302F
Software\Microsoft\.NETFramework\AssemblyFolders, xrefs: 6C692F2E, 6C69302A
InstallMDX(): updating MDX..., xrefs: 6C69316F

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: CloseOpen__wstrtime_memset_strrchr$DeleteDirectoryErrorLastQuerySystemValue
String ID: DirectXUpdateInstall$GetMDXProductVersion() failed.$GetMDXVersion() failed.$InstallMDX$InstallMDX(): MDX: %d.%02d.%02d.%04d, Update:%d.%02d.%02d.%04d$InstallMDX(): Unable to remove [%s\%s], result = %d.$InstallMDX(): installing MDX 9.1...$InstallMDX(): removing MDX 9.0 reference files...$InstallMDX(): unable to find %s.$InstallMDX(): uninstalling MDX 9.0...$InstallMDX(): updating MDX 9.1...$InstallMDX(): updating MDX...$ManagedDX$MsiConfigureProductEx()$MsiInstallProduct()$ProductCode$REINSTALL=ALL REINSTALLMODE=aumv$RegCloseKey()$RegOpenKeyEx()$RegQueryValueEx()$Software\Microsoft\.NETFramework\AssemblyFolders$Unable to create path string, %s%s.$Unable to initialize CDXMsi.$VersionString$\mdxredist.msi$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp${7F34A21F-2DEB-4598-BB19-611D6BD24271}${B4C88CF0-B617-4658-8F84-C4E847FBC9F7}
API String ID: 2153593905-857003154
Opcode ID: 1423c8b8b894f36ce3b313418a420685ca03e46c340191cc92241b0e22c4c5f5
Instruction ID: 2c4c00f217daac73b09a2c801ba159e10c2ddf9c696a4d38c683c806c723cdfb
Opcode Fuzzy Hash: 1423c8b8b894f36ce3b313418a420685ca03e46c340191cc92241b0e22c4c5f5
Instruction Fuzzy Hash: CFD1D6B19022197BEB219B648C84FEE76BC9B09708F5005A9F519F7980DB709F84CE3D

Uniqueness

Uniqueness Score: -1.00%

Function 6C690CB3 Relevance: 58.2, APIs: 6, Strings: 27, Instructions: 413COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000,?,?,\dsetup.dll), ref: 6C690D66
GetLastError.KERNEL32(00000000), ref: 6C690D71

Strings

DirectXUpdateGetSetupInformation(): DirectX Version: %d.%02d.%02d.%04d.%d, xrefs: 6C690E98
\dsetup.dll, xrefs: 6C690D2E
NumberOfFiles, xrefs: 6C6911A0
Unable to load section list from %s., xrefs: 6C69121D
Strings, xrefs: 6C690F62
Size, xrefs: 6C6911B3
GetDXVersion() failed., xrefs: 6C690E14
, xrefs: 6C6911D1
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C690DF2, 6C691230, 6C691275
SourceDisksNames, xrefs: 6C690EDD
DXUpdate, xrefs: 6C690F3C
GetModuleFileName(), xrefs: 6C690D78
DirectX_Update, xrefs: 6C690F16
GetSectionNamesFromInf() failed., xrefs: 6C690E62
Version, xrefs: 6C690EC6
SourceDisksFiles, xrefs: 6C690EF0
Invalid parameter., xrefs: 6C691264
CopyCount, xrefs: 6C6911C6
DestinationDirs, xrefs: 6C690F03
StringToVersionInfo() failed, version = %s., xrefs: 6C691105, 6C691123
Unable to create path string, %s\dsetup.dll., xrefs: 6C690DE1
DirectXUpdateGetSetupInformation, xrefs: 6C690D7D, 6C690DE8, 6C690E1B, 6C690E6B, 6C69110E, 6C69112C, 6C691226, 6C69126B
MDXDLLs, xrefs: 6C690F4F, 6C6911D8, 6C6911F1
DirectXUpdateGetSetupInformation(): Section [%d.%02d.%02d.%04d.%d-%d.%02d.%02d.%04d.%d_%s_%s] is being installed., xrefs: 6C6910C9
DirectXUpdateGetSetupInformation(): Section [%d.%02d.%02d.%04d.%d-%d.%02d.%02d.%04d.%d_%s] is being installed., xrefs: 6C691185
DirectX_Update_PlugIn, xrefs: 6C690F29
DirectXUpdateGetSetupInformation(): DXGetFileVersion() failed, file: %s., xrefs: 6C690DAA

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: $CopyCount$DXUpdate$DestinationDirs$DirectXUpdateGetSetupInformation$DirectXUpdateGetSetupInformation(): DXGetFileVersion() failed, file: %s.$DirectXUpdateGetSetupInformation(): DirectX Version: %d.%02d.%02d.%04d.%d$DirectXUpdateGetSetupInformation(): Section [%d.%02d.%02d.%04d.%d-%d.%02d.%02d.%04d.%d_%s] is being installed.$DirectXUpdateGetSetupInformation(): Section [%d.%02d.%02d.%04d.%d-%d.%02d.%02d.%04d.%d_%s_%s] is being installed.$DirectX_Update$DirectX_Update_PlugIn$GetDXVersion() failed.$GetModuleFileName()$GetSectionNamesFromInf() failed.$Invalid parameter.$MDXDLLs$NumberOfFiles$Size$SourceDisksFiles$SourceDisksNames$StringToVersionInfo() failed, version = %s.$Strings$Unable to create path string, %s\dsetup.dll.$Unable to load section list from %s.$Version$\dsetup.dll$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 2776309574-2123207260
Opcode ID: 32ec348f3723619eb0b1a2385b584474382435985c7aed0832ebb5385580d28f
Instruction ID: 290da6449b41bc6943378dbfa29a19bf696a26ad6ff5b0a0f3c705463288978a
Opcode Fuzzy Hash: 32ec348f3723619eb0b1a2385b584474382435985c7aed0832ebb5385580d28f
Instruction Fuzzy Hash: 90E1B531906229BAEF218A158C40FEE77BCAF0A308F100195F949F6990DB31DA95DF7D

Uniqueness

Uniqueness Score: -1.00%

Function 6C68FB07 Relevance: 42.2, APIs: 12, Strings: 12, Instructions: 232filestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C68FB3E
_memset.LIBCMT ref: 6C68FBA9
GetWindowsDirectoryA.KERNEL32(?,00000104,?,6C6812F4,dxupdate.inf,?,00000000,?), ref: 6C68FBBD
_memset.LIBCMT ref: 6C68FBFC
FindFirstFileA.KERNEL32(?,?,?,?,\*.*,?,00000000,?,?,\Microsoft.NET\DirectX for Managed Code), ref: 6C68FCA8
lstrcmpA.KERNEL32(?,6C684608), ref: 6C68FCD3
lstrcmpA.KERNEL32(?,6C684604), ref: 6C68FCED
GetFileAttributesA.KERNEL32(?,?,?,6C6812F4,?), ref: 6C68FD29
GetLastError.KERNEL32 ref: 6C68FD34

Part of subcall function 6C689BC1: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 6C689D51
Part of subcall function 6C689BC1: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C689D76

FindNextFileA.KERNEL32(?,?), ref: 6C68FDAB
GetLastError.KERNEL32(00000000), ref: 6C68FBC8

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

FindClose.KERNEL32(?), ref: 6C68FE1A

Strings

\*.*, xrefs: 6C68FC54
Unable to create path string, %s\%s., xrefs: 6C68FB74, 6C68FDC9
Unable to create path string, %s\., xrefs: 6C68FDF4
Unable to create path string, %s%s., xrefs: 6C68FC29
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68FB85, 6C68FBDE, 6C68FC88, 6C68FCC2, 6C68FD51, 6C68FDD6, 6C68FE01
MDXDLLs, xrefs: 6C68FD8A
GetWindowsDirectory(), xrefs: 6C68FBCF
GetFileAttributes(), xrefs: 6C68FD46
IsMDXDevInUse, xrefs: 6C68FB7B, 6C68FBD4, 6C68FC30, 6C68FC7E, 6C68FCBD, 6C68FD4B, 6C68FDD0, 6C68FDFB
\Microsoft.NET\DirectX for Managed Code, xrefs: 6C68FC04, 6C68FC09, 6C68FC21
dxupdate.inf, xrefs: 6C68FB46, 6C68FB4B, 6C68FB6D
Unable to create path string, %s\*.*., xrefs: 6C68FC77

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: FileFind_memset$ErrorLast__wstrtimelstrcmp$AttributesCloseDirectoryFirstFormatFreeLocalMessageNextWindows_strrchr
String ID: GetFileAttributes()$GetWindowsDirectory()$IsMDXDevInUse$MDXDLLs$Unable to create path string, %s%s.$Unable to create path string, %s\%s.$Unable to create path string, %s\*.*.$Unable to create path string, %s\.$\*.*$\Microsoft.NET\DirectX for Managed Code$dxupdate.inf$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 3616435459-4245276639
Opcode ID: f5af6d063d505a224dd4f707e383bab0f6700b6395355c9c3bc9576f18525454
Instruction ID: 194e2d1a723478e00ad3da29a392b19917e822b24626052d5e126ddf35009045
Opcode Fuzzy Hash: f5af6d063d505a224dd4f707e383bab0f6700b6395355c9c3bc9576f18525454
Instruction Fuzzy Hash: B47177B190311CBADB10DA658C84EEB77BCDB56358F0005A1F624E2941EB719F948F7E

Uniqueness

Uniqueness Score: -1.00%

Function 6C68E7AF Relevance: 42.2, APIs: 9, Strings: 15, Instructions: 209fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C68E812
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 6C68E831
GetLastError.KERNEL32(00000000), ref: 6C68E83C
StringFromGUID2.OLE32(F750E6C3,?,00000104), ref: 6C68E875
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,00000104,00000000,00000000), ref: 6C68E8A4
GetLastError.KERNEL32(00000000), ref: 6C68E8AF
FindFirstFileA.KERNEL32(?,?,?,?,?,Qhl), ref: 6C68E9C9
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,00000001), ref: 6C68EA3A
FindClose.KERNEL32(00000000,?,?,00000000,?,00000000,00000001), ref: 6C68EA65

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

DeleteOldCatalogFile(): removing %s..., xrefs: 6C68E9E1
WideCharToMultiByte(), xrefs: 6C68E8B6
InstCatWin() failed., xrefs: 6C68EA46
\CATROOT\%s\, xrefs: 6C68E923
StringCchPrintf(), xrefs: 6C68E949
DeleteOldCatalogFile, xrefs: 6C68E848, 6C68E886, 6C68E8BB, 6C68E900, 6C68E94E, 6C68E99F, 6C68EA4D
Unable to create path string, \CATROOT\%s\., xrefs: 6C68E943
Unable to create path string, %s\sfp\tempcats\%s., xrefs: 6C68E8F9
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68E852, 6C68E90A, 6C68E958, 6C68E9A9, 6C68EA57
StringFromGUID2(), xrefs: 6C68E881
\sfp\tempcats\, xrefs: 6C68E8D1
DX%s.CAT, xrefs: 6C68E7C4
Qhl, xrefs: 6C68E7C7, 6C68E8D0, 6C68E8F1, 6C68E96A, 6C68E989
Unable to create path string, %s%s%s., xrefs: 6C68E998
GetsystemDirectory(), xrefs: 6C68E843

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: Find$ErrorFileLast__wstrtime$ByteCharCloseDirectoryFirstFromMultiNextStringSystemWide_memset_strrchr
String ID: DX%s.CAT$DeleteOldCatalogFile$DeleteOldCatalogFile(): removing %s...$GetsystemDirectory()$InstCatWin() failed.$Qhl$StringCchPrintf()$StringFromGUID2()$Unable to create path string, %s%s%s.$Unable to create path string, %s\sfp\tempcats\%s.$Unable to create path string, \CATROOT\%s\.$WideCharToMultiByte()$\CATROOT\%s\$\sfp\tempcats\$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 3317173840-613241423
Opcode ID: fc68713c15c59ebdc5009b7ac2d6b2d173839537016d7908ee40985ffe024ccc
Instruction ID: ab973f0a6e016d4f3e1349faca69fa0a12f09e123990c32376c0744ee99b8325
Opcode Fuzzy Hash: fc68713c15c59ebdc5009b7ac2d6b2d173839537016d7908ee40985ffe024ccc
Instruction Fuzzy Hash: FA61D8F6906118BADB1097618C84EEB73BCAB46748F0005A5FA09E2941EB75DF844FBD

Uniqueness

Uniqueness Score: -1.00%

Function 6C689BC1 Relevance: 42.2, APIs: 6, Strings: 18, Instructions: 200windowCOMMON

Download Yara Rule

APIs

__wstrtime.LIBCMT ref: 6C689BF2
__wstrtime.LIBCMT ref: 6C689BFB

Part of subcall function 6C689A8B: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 6C689AC1
Part of subcall function 6C689A8B: OutputDebugStringA.KERNEL32(DXSETUP_DPF(): Unable to open log file.,00000000,00000000), ref: 6C689AD0

Part of subcall function 6C689A8B: CreateDirectoryA.KERNEL32(?,00000000), ref: 6C689B10
Part of subcall function 6C689A8B: GetLastError.KERNEL32 ref: 6C689B1A

_strrchr.LIBCMT ref: 6C689C41
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 6C689D51
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C689D76
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C689D7E

Strings

Failed API:%s, xrefs: 6C689C91
[%s %s], xrefs: 6C689C14
- , xrefs: 6C689D5B
(0x%x), xrefs: 6C689D11
%s(): %s failed, error = 0x%x., xrefs: 6C689CBA
Mar 30 2011, xrefs: 6C689C62
%s(): %s, xrefs: 6C689E28
dxupdate, xrefs: 6C689C67
%s(): %s failed, error = %d., xrefs: 6C689CC1
(%d), xrefs: 6C689D18, 6C689D20
DXSError(): FormatMessage() failed, system cannot find message text for error., xrefs: 6C689D8B
--------------------, xrefs: 6C689C02
DXSError(): FormatMessage() failed, error = %d., xrefs: 6C689D98
module: %s(%s), file: %s, line: %d, function: %s, xrefs: 6C689C6C
%s(): %s failed., xrefs: 6C689CDF
File in process:, xrefs: 6C689DC2
, xrefs: 6C689DFA
Error:, xrefs: 6C689D03

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: DirectoryErrorLast__wstrtime$CreateDebugFormatFreeLocalMessageOutputStringWindows_strrchr
String ID: $ Error:$ Failed API:%s$ File in process:$ - $ module: %s(%s), file: %s, line: %d, function: %s$%s(): %s$%s(): %s failed, error = %d.$%s(): %s failed, error = 0x%x.$%s(): %s failed.$(%d)$(0x%x)$--------------------$DXSError(): FormatMessage() failed, error = %d.$DXSError(): FormatMessage() failed, system cannot find message text for error.$Mar 30 2011$[%s %s]$dxupdate
API String ID: 3982051927-3131141717
Opcode ID: 8bac674dffc947e07beb8bde966175779ac567af4835d2e21af86ee6eb7b0a4d
Instruction ID: 39676c45ef7b1e98bb90405e79cdc9a7008785569a18c4ccecbdfe43fcaffa19
Opcode Fuzzy Hash: 8bac674dffc947e07beb8bde966175779ac567af4835d2e21af86ee6eb7b0a4d
Instruction Fuzzy Hash: 1C61DAB1906219ABDF11AFA4CC85EDE37BC9F4534CF000595F629A6A01DB35CE488B7C

Uniqueness

Uniqueness Score: -1.00%

Function 6C68F070 Relevance: 37.0, APIs: 10, Strings: 11, Instructions: 300COMMON

Download Yara Rule

APIs

_strnlen.LIBCMT ref: 6C68F104
CharLowerA.USER32(?,?,00000104,?,?,?,?,?,7655B4B0,?), ref: 6C68F129
_strnlen.LIBCMT ref: 6C68F202

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

;, xrefs: 6C68F27C
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68F0CC, 6C68F3DE, 6C68F400
Unable to load list from %s:[%s]., xrefs: 6C68F3EF
copycount, xrefs: 6C68F16B, 6C68F2C5
malloc(), xrefs: 6C68F3CF
numberoffiles, xrefs: 6C68F135, 6C68F28F
targetbuildnumber, xrefs: 6C68F186, 6C68F2E0
size, xrefs: 6C68F150, 6C68F2AA
GetInfAndSection, xrefs: 6C68F0C2, 6C68F3D4, 6C68F3F6
LoadListFromInfSection() failed., xrefs: 6C68F0BB
dependencies, xrefs: 6C68F19D, 6C68F2FB

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime_strnlen$CharLower_strrchr
String ID: ;$GetInfAndSection$LoadListFromInfSection() failed.$Unable to load list from %s:[%s].$copycount$dependencies$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp$malloc()$numberoffiles$size$targetbuildnumber
API String ID: 3123729947-1907312236
Opcode ID: b8183e6dc5062246e5d94818c6a90c889e8c9ac1d62af898d2541cc71b9739f5
Instruction ID: dc1006471a619f63b19fc418380e7baa37aade9e444693d088068ccb894214d4
Opcode Fuzzy Hash: b8183e6dc5062246e5d94818c6a90c889e8c9ac1d62af898d2541cc71b9739f5
Instruction Fuzzy Hash: 30A10A3290A21D6BDB248A65DC51FDA77BCEF06328F100595E704E2941EF719AC48EBD

Uniqueness

Uniqueness Score: -1.00%

Function 6C69097D Relevance: 37.0, APIs: 7, Strings: 14, Instructions: 222COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C6909D0
_memset.LIBCMT ref: 6C6909E4
GetPrivateProfileStringA.KERNEL32(?,Dependencies,6C68311C,?,00000104,?), ref: 6C690A16
_strrchr.LIBCMT ref: 6C690B07
GetPrivateProfileStringA.KERNEL32(?,TargetBuildNumber,6C68311C,?,00000104,?), ref: 6C690B7D
GetVersionExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C690C1F
GetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C690C74

Strings

, , xrefs: 6C690A31, 6C690ACA
CheckDependency(): supported build number is not checked for this Plug-In., xrefs: 6C690BEE
CheckDependency(): %s does not exist, this Plug-In is not installed., xrefs: 6C690A85
GetVersionEx(), xrefs: 6C690C7B
CheckDependency, xrefs: 6C690AAC, 6C690C80
CheckDependency(): supported build number: %d - %d., xrefs: 6C690BD9
CheckDependency(): supported build number: %d - ., xrefs: 6C690C02
CheckDependency(): build %d is supported., xrefs: 6C690C65
Unable to create path string, %s\%s., xrefs: 6C690AA5
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C690AB6, 6C690C8A
CheckDependency(): no dependency., xrefs: 6C690AE8
Dependencies, xrefs: 6C690A05
CheckDependency(): build %d is not supported, this Plug-In is not installed., xrefs: 6C690C43
TargetBuildNumber, xrefs: 6C690B6C

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: PrivateProfileString_memset$ErrorLastVersion_strrchr
String ID: , $CheckDependency$CheckDependency(): %s does not exist, this Plug-In is not installed.$CheckDependency(): build %d is not supported, this Plug-In is not installed.$CheckDependency(): build %d is supported.$CheckDependency(): no dependency.$CheckDependency(): supported build number is not checked for this Plug-In.$CheckDependency(): supported build number: %d - %d.$CheckDependency(): supported build number: %d - .$Dependencies$GetVersionEx()$TargetBuildNumber$Unable to create path string, %s\%s.$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 4223943085-915270717
Opcode ID: 102a81d93a3bf749c8edd5d39dcae5fd21b52bd2778d728a9e6f0ae6e1edfb1b
Instruction ID: 852e24ecfd70653bdd29471999c39915451c7adb02bfd2528efbe921023bdd36
Opcode Fuzzy Hash: 102a81d93a3bf749c8edd5d39dcae5fd21b52bd2778d728a9e6f0ae6e1edfb1b
Instruction Fuzzy Hash: 59718671D0625AEFDF209B549C88EDEBBBCAF46308F1004D5E558A2941DF709AC48F6D

Uniqueness

Uniqueness Score: -1.00%

Function 6C68D86D Relevance: 35.2, APIs: 7, Strings: 13, Instructions: 218fileCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(6C6A9DB0,00000104,,Gil,00000000,CMDXInstall::Install,e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp,00000000), ref: 6C68D8AD
GetLastError.KERNEL32(00000000), ref: 6C68D8B8

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

_strrchr.LIBCMT ref: 6C68D91D
FindFirstFileA.KERNEL32(,Gil,?,,Gil,,Gil,00000000,CMDXInstall::Install,e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp,00000000), ref: 6C68DAF5
FindClose.KERNEL32(00000000), ref: 6C68DB07
FindFirstFileA.KERNEL32(?,?), ref: 6C68DB13
FindClose.KERNEL32(00000000), ref: 6C68DB1F

Strings

,Gil, xrefs: 6C68D884, 6C68D88A, 6C68D905, 6C68D942, 6C68D980, 6C68D98F, 6C68D99E, 6C68D9C7, 6C68D9D2, 6C68DA57, 6C68DAF3, 6C68DB2F, 6C68DB67
Unable to get Version on target file %s, xrefs: 6C68D9D4
CheckVersions, xrefs: 6C68D8C4, 6C68D964
GetWindowsDirectory(), xrefs: 6C68D8BF
Skipped file %s, xrefs: 6C68D944
Target file: '%s' Target file is Version %d.%d.%d.%dSource file is Version %d.%d.%d.%d, xrefs: 6C68DA59
%s have been installed already., xrefs: 6C68DB69
\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}, xrefs: 6C68D8EF, 6C68D955
Currently %s is newer than the one being installed., xrefs: 6C68DB31
Unable to create path string, %s%s., xrefs: 6C68D95B
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68D883, 6C68D8CE, 6C68D96E
CMDXInstall::Install, xrefs: 6C68D887
Unable to get Version on source file %s, xrefs: 6C68D9F1

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: Find$CloseFileFirst__wstrtime_strrchr$DirectoryErrorLastWindows
String ID: %s have been installed already.$,Gil$CMDXInstall::Install$CheckVersions$Currently %s is newer than the one being installed.$GetWindowsDirectory()$Skipped file %s$Target file: '%s' Target file is Version %d.%d.%d.%dSource file is Version %d.%d.%d.%d$Unable to create path string, %s%s.$Unable to get Version on source file %s$Unable to get Version on target file %s$\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 2366300620-3639779622
Opcode ID: 550def4340b737e27ae156fe1a60487b552342479ba46b5a0705795a284a68aa
Instruction ID: 77cf5ba3fe80b4a8d8f55e5bb45167c62bc893c7e2990b82bc2da3da369a6230
Opcode Fuzzy Hash: 550def4340b737e27ae156fe1a60487b552342479ba46b5a0705795a284a68aa
Instruction Fuzzy Hash: 0071A87090711AABDF209A55CC84FAA73B99B06308F5005A7E985F7991DB35A981CF3C

Uniqueness

Uniqueness Score: -1.00%

Function 6C68E634 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 110libraryloaderCOMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?,?,00000104,?,?,00000000), ref: 6C68E69E
GetLastError.KERNEL32(00000000), ref: 6C68E6A9
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 6C68E6EA
GetLastError.KERNEL32(00000000), ref: 6C68E6F5
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 6C68E713
GetLastError.KERNEL32(00000000), ref: 6C68E740
GetLastError.KERNEL32 ref: 6C68E76C

Strings

GetDiskFreeSpace(), xrefs: 6C68E6B0
kernel32.dll, xrefs: 6C68E6E2
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68E6BF
DXGetDiskFreeSpace(): Unable to find GetDiskFreeSpaceEx(), (%d). Use GetDiskFreeSpace(), xrefs: 6C68E773
GetDiskFreeSpaceExA, xrefs: 6C68E70D
DXGetDiskFreeSpace, xrefs: 6C68E6B5, 6C68E701, 6C68E74C
GetDiskFreeSpaceEx(), xrefs: 6C68E6FC, 6C68E747

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorLast$AddressDiskFreeHandleModuleProcSpace
String ID: DXGetDiskFreeSpace$DXGetDiskFreeSpace(): Unable to find GetDiskFreeSpaceEx(), (%d). Use GetDiskFreeSpace()$GetDiskFreeSpace()$GetDiskFreeSpaceEx()$GetDiskFreeSpaceExA$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp$kernel32.dll
API String ID: 3160920872-3630560494
Opcode ID: 27b619d8ed7c012bd574b93dc2fd3a3b9e6a06e4d1909d74389a9e84d411e925
Instruction ID: 21b50365e067f093c9d26de11b968355638a77d2c1e4bf2971c55e607865005a
Opcode Fuzzy Hash: 27b619d8ed7c012bd574b93dc2fd3a3b9e6a06e4d1909d74389a9e84d411e925
Instruction Fuzzy Hash: 71418576A06218ABDB14DFA0CC89DDB77B8BB15304F1045AAF655E7940DA30DB848F78

Uniqueness

Uniqueness Score: -1.00%

Function 6C68C01B Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 94COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C68C07A
GetPrivateProfileStringA.KERNEL32(DirectX_Attributes,PNP_DEVICE_ID,6C68311C,?,00000104,00FEDF58), ref: 6C68C0A5

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

UpdatePnPDrv, xrefs: 6C68C049, 6C68C0C6, 6C68C0EE, 6C68C12B
CSetupAPI is not initialized., xrefs: 6C68C042
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68C053, 6C68C0D0, 6C68C135
PNP_DEVICE_ID, xrefs: 6C68C09A
DirectX_Attributes, xrefs: 6C68C09F, 6C68C0A4, 6C68C0B4
GetPrivateProfileString(), xrefs: 6C68C0C1
UpdatePnPDrv(): INF:%s ID:%s., xrefs: 6C68C105
Unable to get hardware ID., xrefs: 6C68C0E7
UpdateUnpluggedPnpDrv() failed., xrefs: 6C68C124
Inf: %s, Section: %s, Entry: PNP_DEVICE_ID, xrefs: 6C68C0BB

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$PrivateProfileString_memset_strrchr
String ID: CSetupAPI is not initialized.$DirectX_Attributes$GetPrivateProfileString()$Inf: %s, Section: %s, Entry: PNP_DEVICE_ID$PNP_DEVICE_ID$Unable to get hardware ID.$UpdatePnPDrv$UpdatePnPDrv(): INF:%s ID:%s.$UpdateUnpluggedPnpDrv() failed.$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 3478578772-3059308929
Opcode ID: 6cbba73d2f213de66bb60e3b14da23a44635d6625c1fe2bd768cd5759696c385
Instruction ID: 81fea22be3e13b89bdd0636ffb9d637c9bb219d4a623cd726e27f9c96c7b32e8
Opcode Fuzzy Hash: 6cbba73d2f213de66bb60e3b14da23a44635d6625c1fe2bd768cd5759696c385
Instruction Fuzzy Hash: 5B212BF1A061187BE720EA649CC1EEF73ACC71674CF440561F685B7A40EAA19E844EBD

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A62CB Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 135memorylibraryloaderCOMMON

Download Yara Rule

APIs

__get_wpgmptr.LIBCMT ref: 6C6A62E9
VirtualQuery.KERNEL32(?,?,0000001C), ref: 6C6A6314
GetSystemInfo.KERNEL32(?), ref: 6C6A632C
GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6C6A6355
GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 6C6A6365
VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C6A63EC
VirtualProtect.KERNEL32(?,?,?,?), ref: 6C6A63FF

Part of subcall function 6C69E1C7: OutputDebugStringA.KERNEL32(Invalid parameter passed to C runtime function.), ref: 6C69E25B

Strings

kernel32.dll, xrefs: 6C6A634D
SetThreadStackGuarantee, xrefs: 6C6A635F

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: Virtual$AddressAllocDebugHandleInfoModuleOutputProcProtectQueryStringSystem__get_wpgmptr
String ID: SetThreadStackGuarantee$kernel32.dll
API String ID: 2401657611-423161677
Opcode ID: 4a1f8243a9e431493623e95d059e329e55e0a6e48849d406153224a0330628c2
Instruction ID: faaf1bc9472bbf0589782b820aaa9deb90be65a20de5bc5024535cccc3df6864
Opcode Fuzzy Hash: 4a1f8243a9e431493623e95d059e329e55e0a6e48849d406153224a0330628c2
Instruction Fuzzy Hash: 6B418172E01118AFDF01CFE9CC849EEBBB9EF45708F104565E611E6640E734DA56CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 6C68D792 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 69COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(MDX,Version,6C68311C,?,00000104,?), ref: 6C68D7D2

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

StringToVersionInfo() failed, version = %s., xrefs: 6C68D835
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68D7F1, 6C68D846
MDX, xrefs: 6C68D7C8
GetPrivateProfileString(), xrefs: 6C68D7E2
Unable to get MDX version from CIF., xrefs: 6C68D7DC
Version, xrefs: 6C68D7C1
GetMDXCifVersion, xrefs: 6C68D7E7, 6C68D83C

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$PrivateProfileString_strrchr
String ID: GetMDXCifVersion$GetPrivateProfileString()$MDX$StringToVersionInfo() failed, version = %s.$Unable to get MDX version from CIF.$Version$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 2523604036-1635775825
Opcode ID: aa54a5f3864afa19058a61e5ce2dba5c44e48cd0857e9944d7598ff21780a345
Instruction ID: 4b74cc2eaef748ad175dd0d86f7e4d3754f9359b7ccc308948c7202731f0ada8
Opcode Fuzzy Hash: aa54a5f3864afa19058a61e5ce2dba5c44e48cd0857e9944d7598ff21780a345
Instruction Fuzzy Hash: 9C11E9F1906249BEEB509A64CC41EDA7BBC9B06308F8048B6F595E7901D670DD848F7C

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A5A16 Relevance: 9.2, APIs: 6, Instructions: 156memoryfileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C6A1C2E: SetFilePointer.KERNELBASE(00000000,00000000,00000002,00000000,00000000,00BFBBEF,6C6A3458,6C6A3458,?,6C6A1EBB,00BFBBEF,00000000,00000000,00000002,00000000,00000000), ref: 6C6A1C70
Part of subcall function 6C6A1C2E: GetLastError.KERNEL32(?,6C6A1EBB,00BFBBEF,00000000,00000000,00000002,00000000,00000000,00000002), ref: 6C6A1C7D
Part of subcall function 6C6A1C2E: __dosmaperr.LIBCMT ref: 6C6A1C88

GetProcessHeap.KERNEL32(00000008,00001000,?,?,?,?,?,00000000,00000109,00000000,?,?,6C6A321D,00000109,00000000), ref: 6C6A5A7F
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00000000,00000109,00000000,?,?,6C6A321D,00000109,00000000), ref: 6C6A5A86
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,00000109,00000000,?,?,6C6A321D), ref: 6C6A5B02
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000109,00000000,?,?,6C6A321D,00000109), ref: 6C6A5B09
SetEndOfFile.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,00000109,00000000,?,?,6C6A321D), ref: 6C6A5B64
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00000109,00000000,?,?,6C6A321D,00000109), ref: 6C6A5B91

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: Heap$ErrorFileLastProcess$AllocFreePointer__dosmaperr
String ID:
API String ID: 3789379547-0
Opcode ID: e7e0a9e9b8ac3ca1644c9554d6e78336b973cfcde803470669aac5a7e0b78db2
Instruction ID: 85197e45fbf46cb6483a3dd14027f0d099b348a33e20c6c4d5ab2965e2dbef08
Opcode Fuzzy Hash: e7e0a9e9b8ac3ca1644c9554d6e78336b973cfcde803470669aac5a7e0b78db2
Instruction Fuzzy Hash: 95410432A00919AFDF109FF8CC8469D3B75FB02328F114765FA34A6A90D7358D468BAD

Uniqueness

Uniqueness Score: -1.00%

Function 6C69AE6A Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6C69F065
UnhandledExceptionFilter.KERNEL32(6C68861C), ref: 6C69F070
GetCurrentProcess.KERNEL32(C0000409), ref: 6C69F07B
TerminateProcess.KERNEL32(00000000), ref: 6C69F082

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 56b7e9616353d53b6d48efd170ec920cca173adced4a0c67f518c5720231e8e5
Instruction ID: 9d320773c15d2c59d053723c5eef2ea86b5391b896df615b91ce8ee83bda1e60
Opcode Fuzzy Hash: 56b7e9616353d53b6d48efd170ec920cca173adced4a0c67f518c5720231e8e5
Instruction Fuzzy Hash: E1219AB8A11245AFCB91CF9BE1C865C7BB4FB0B308F40411BE94883712E374A9858F5D

Uniqueness

Uniqueness Score: -1.00%

Function 6C69ACA5 Relevance: 1.6, APIs: 1, Instructions: 78timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,00000000,00000000,?,?), ref: 6C69ACD3

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: e03240f956dcea46954022e6ed6101d43aa811e436fa2d5d5380f0e831082610
Instruction ID: 76252249d5428aaa2291429bee5b0411a393f8ff0b7b7c21ccd40408c40e406c
Opcode Fuzzy Hash: e03240f956dcea46954022e6ed6101d43aa811e436fa2d5d5380f0e831082610
Instruction Fuzzy Hash: C4117B227093819BC7205BAD68D42DA7BE19F27328F18846EF0D54B683C171D80DC766

Uniqueness

Uniqueness Score: -1.00%

Function 6C69D200 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

csm, xrefs: 6C69D2E2

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID:
String ID: csm
API String ID: 0-1018135373
Opcode ID: 238b7f37a045fc5290b0620ba506b388abc8192c3b88f15186138d60e697918d
Instruction ID: e32d0c1e6899ea81ef33e01e1d86769fc7130400cf0cd93fd4e639e63d602731
Opcode Fuzzy Hash: 238b7f37a045fc5290b0620ba506b388abc8192c3b88f15186138d60e697918d
Instruction Fuzzy Hash: B1519630A042068FDB14CFA9C490AADB7F1FF86318F14C56DD9269B7A1DB30E945CB49

Uniqueness

Uniqueness Score: -1.00%

Function 6C6932B3 Relevance: 56.4, APIs: 3, Strings: 29, Instructions: 391COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C6932E9
GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 6C69333B
GetLastError.KERNEL32(00000000,?,e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp,00000000), ref: 6C693346

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

Unable to get product version from %s, xrefs: 6C6936C1
\msi.dll, xrefs: 6C693375
Unable to initialize CDXMsi., xrefs: 6C6937B5
DirectXUpdateInstall, xrefs: 6C69332D
Unable to find %s., xrefs: 6C693307
StringToVersioninfo() failed, version = %s., xrefs: 6C6936E2
InstallMSI(): newer version of %s have been installed already., xrefs: 6C693591
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C6932C9, 6C693318, 6C69335C, 6C6935D5, 6C6935DA, 6C69368C, 6C6936FD, 6C693717, 6C69375C, 6C693784, 6C6937C6
MsiGetProductInfo(), xrefs: 6C69370C
ProductCode, xrefs: 6C6933D0
InstallMSI(): MsiGetProductName() returned %d., xrefs: 6C69341B
InstallMSI(): %s is updated., xrefs: 6C693664
GetsystemDirectory(), xrefs: 6C69334D
InstallMSI(): unable to find msi.dll., xrefs: 6C6937EA
MsiGetProductProperty(), xrefs: 6C6936C7, 6C693775
InstallMSI(): %s have been installed already., xrefs: 6C69359B
InstallMSI(): %s is installed., xrefs: 6C693739
VersionString, xrefs: 6C693448
Unable to get product code from %s., xrefs: 6C69376F
MsiInstallProduct(), xrefs: 6C693609, 6C693637, 6C69367D, 6C693751
REINSTALL=ALL REINSTALLMODE=aumv, xrefs: 6C6935ED, 6C693648
ProductVersion, xrefs: 6C6934B7
MsiConfigureProductEx(), xrefs: 6C6935C5
InstallMSI(): updating MDX..., xrefs: 6C6935E0
ProductName, xrefs: 6C6933FE
StringToVersionInfo() failed, version = %s., xrefs: 6C6936A5
InstallMSI, xrefs: 6C69330E, 6C693352, 6C6935CA, 6C6935CF, 6C69360E, 6C69363C, 6C693682, 6C6936AC, 6C6936CC, 6C6936E9, 6C6936F8, 6C693711, 6C693756, 6C69377A, 6C6937BC
InstallMSI(): installing MDX..., xrefs: 6C693619
InstallMSI(): Product: %s, Installed:<%d.%02d.%02d.%04d>, Update:<%d.%02d.%02d.%04d>, xrefs: 6C693557

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$DirectoryErrorLastSystem_memset_strrchr
String ID: DirectXUpdateInstall$GetsystemDirectory()$InstallMSI$InstallMSI(): %s have been installed already.$InstallMSI(): %s is installed.$InstallMSI(): %s is updated.$InstallMSI(): MsiGetProductName() returned %d.$InstallMSI(): Product: %s, Installed:<%d.%02d.%02d.%04d>, Update:<%d.%02d.%02d.%04d>$InstallMSI(): installing MDX...$InstallMSI(): newer version of %s have been installed already.$InstallMSI(): unable to find msi.dll.$InstallMSI(): updating MDX...$MsiConfigureProductEx()$MsiGetProductInfo()$MsiGetProductProperty()$MsiInstallProduct()$ProductCode$ProductName$ProductVersion$REINSTALL=ALL REINSTALLMODE=aumv$StringToVersionInfo() failed, version = %s.$StringToVersioninfo() failed, version = %s.$Unable to find %s.$Unable to get product code from %s.$Unable to get product version from %s$Unable to initialize CDXMsi.$VersionString$\msi.dll$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 419038105-3012496545
Opcode ID: bb25af43acd5f9cb7d1582637565515f11f1608a5d2a36d7f9c7e972cc157fc1
Instruction ID: 8ccd698b204f92d63bb19be0aaf19c77dd626aa2dd6d4259c978c33b5805b4bd
Opcode Fuzzy Hash: bb25af43acd5f9cb7d1582637565515f11f1608a5d2a36d7f9c7e972cc157fc1
Instruction Fuzzy Hash: EEC117B1902219BBFB209A508C84FEF76BD9B45318F1005A6F50AF7981DB319E948E7D

Uniqueness

Uniqueness Score: -1.00%

Function 6C69581F Relevance: 52.8, APIs: 8, Strings: 22, Instructions: 326stringCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,6C6A9880,DirectXUpdateInstall,e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp,00000000), ref: 6C69588E
GetLastError.KERNEL32(00000000), ref: 6C695899

Part of subcall function 6C68B06F: CharNextA.USER32(?,00000104,?,6C693CF3,6C6A9880,6C6A9880,00000104,?,?,00000000,?,?,dxupdate.cab), ref: 6C68B082

_memset.LIBCMT ref: 6C695946
lstrcmpA.KERNEL32(?,DefaultInstall), ref: 6C69595F
_strrchr.LIBCMT ref: 6C6959F2
_strrchr.LIBCMT ref: 6C695A11
_strnlen.LIBCMT ref: 6C695A28

Part of subcall function 6C68D09A: GetWindowsDirectoryA.KERNEL32(?,00000104,e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp), ref: 6C68D0BF
Part of subcall function 6C68D09A: GetLastError.KERNEL32(00000000), ref: 6C68D0CA

Part of subcall function 6C69253A: GetLastError.KERNEL32 ref: 6C69269F

GetLastError.KERNEL32(Unable to iterate through %s. The file may be damaged.,00000000), ref: 6C695C36

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

Unable to initialize MDXInstall., xrefs: 6C695B40
GetInfAndSection() failed., xrefs: 6C695B90
DirectXUpdateInstall, xrefs: 6C695839
Inf and section are not valid., xrefs: 6C695C18
, , xrefs: 6C695997, 6C6959B6, 6C695A4E
SetupIterateCabinet(), xrefs: 6C695C3D
Unable to initialize CSetupAPI., xrefs: 6C695C80
Unable to iterate through %s. The file may be damaged., xrefs: 6C695C31
MDXInstall::Install() failed., xrefs: 6C695B5E
Unable to create path string, %s\%s., xrefs: 6C695C00
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C695838, 6C6958AF, 6C69596A, 6C695A95, 6C695B6B, 6C695C0D, 6C695C25, 6C695C4C, 6C695C91
MDXDLLs, xrefs: 6C695B0E
ExecuteInf() failed., xrefs: 6C695BDA
ExecuteCab(): Installing:%s - [%s], xrefs: 6C695BA2
Unable to find '\'., xrefs: 6C695A88
, xrefs: 6C695ADA
DefaultInstall, xrefs: 6C69594E
inf, xrefs: 6C695A34
GetCurrentDirectory(), xrefs: 6C6958A0
ExecuteCab, xrefs: 6C6958A5, 6C695965, 6C695A80, 6C695A8F, 6C695B47, 6C695B65, 6C695B97, 6C695BE1, 6C695C07, 6C695C1F, 6C695C42, 6C695C87
Unable to find '.'., xrefs: 6C695A79
ExecuteCab(): Installing:%s, xrefs: 6C695AF1

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorLast$_strrchr$Directory__wstrtime$CharCurrentNextWindows_memset_strnlenlstrcmp
String ID: $, $DefaultInstall$DirectXUpdateInstall$ExecuteCab$ExecuteCab(): Installing:%s$ExecuteCab(): Installing:%s - [%s]$ExecuteInf() failed.$GetCurrentDirectory()$GetInfAndSection() failed.$Inf and section are not valid.$MDXDLLs$MDXInstall::Install() failed.$SetupIterateCabinet()$Unable to create path string, %s\%s.$Unable to find '.'.$Unable to find '\'.$Unable to initialize CSetupAPI.$Unable to initialize MDXInstall.$Unable to iterate through %s. The file may be damaged.$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp$inf
API String ID: 3877836308-1548703517
Opcode ID: c9e86ed5898a016cbc671348a09a485ad8bd3428263202c8ffaaa2620dcdd105
Instruction ID: 351c45f68f389d767d4bb34b2ad479bda1f58066b5037bdfecda9ca6235140e8
Opcode Fuzzy Hash: c9e86ed5898a016cbc671348a09a485ad8bd3428263202c8ffaaa2620dcdd105
Instruction Fuzzy Hash: 68B196F1D0221AAADB209F648C84FDA77BCAB0530DF5045A9F608B2941DB719E84CF7D

Uniqueness

Uniqueness Score: -1.00%

Function 6C68AC14 Relevance: 52.7, APIs: 11, Strings: 19, Instructions: 231fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C68AC50
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 6C68AC64
DeleteFileA.KERNEL32(?,?,00000000,?,?,\sfp\tempcats\,?), ref: 6C68AD14
GetLastError.KERNEL32(Unable to remove %s.,?), ref: 6C68AD2E
GetLastError.KERNEL32(00000000), ref: 6C68AC6F

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

CreateDirectoryA.KERNEL32(?,00000000,?,?,\sfp,?,?,6C6A9880), ref: 6C68ADC9
GetLastError.KERNEL32 ref: 6C68ADDE
CreateDirectoryA.KERNEL32(?,00000000,?,?,\sfp\tempcats), ref: 6C68AE3B
GetLastError.KERNEL32 ref: 6C68AE45

Strings

\sfp, xrefs: 6C68AD7B
InstCatWin9X, xrefs: 6C68AC7B, 6C68ACE3, 6C68AD3A, 6C68AD6C, 6C68ADA5, 6C68ADEB, 6C68AE24, 6C68AE52, 6C68AE97, 6C68AEC5, 6C68AF08
DeleteFile(), xrefs: 6C68AD35
Unable to copy %s to %s., xrefs: 6C68AEFB
InstCatWin9X(): installing catalog file..., xrefs: 6C68AD46
Unable to create path string, %s\sfp\tempcats., xrefs: 6C68AE1D
Unable to create path string, %s\sfp., xrefs: 6C68AD9E
CreateDirectory(), xrefs: 6C68ADE6, 6C68AE4D
Unable to find %s., xrefs: 6C68AEBE
e:\bt\382730\setup\deliverables\dxupdate\instcat.cpp, xrefs: 6C68AC85, 6C68ACED, 6C68ADAF
Unable to remove %s., xrefs: 6C68AD29
Unable to create path string, %s%s., xrefs: 6C68AD65
\sfp\tempcats, xrefs: 6C68ADFA
Unable to create path string, %s\sfp\tempcats\%s., xrefs: 6C68ACDC, 6C68AE90
CopyFile(), xrefs: 6C68AF03
InstCatWin9X(): deleting catalog file..., xrefs: 6C68ACA2
\sfp\tempcats\, xrefs: 6C68ACB9, 6C68AE6D
GetSystemDirectory(), xrefs: 6C68AC76
DX%s.CAT, xrefs: 6C68AC2C

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorLast$Directory$Create__wstrtime$DeleteFileSystem_memset_strrchr
String ID: CopyFile()$CreateDirectory()$DX%s.CAT$DeleteFile()$GetSystemDirectory()$InstCatWin9X$InstCatWin9X(): deleting catalog file...$InstCatWin9X(): installing catalog file...$Unable to copy %s to %s.$Unable to create path string, %s%s.$Unable to create path string, %s\sfp.$Unable to create path string, %s\sfp\tempcats.$Unable to create path string, %s\sfp\tempcats\%s.$Unable to find %s.$Unable to remove %s.$\sfp$\sfp\tempcats$\sfp\tempcats\$e:\bt\382730\setup\deliverables\dxupdate\instcat.cpp
API String ID: 1023852320-3800338692
Opcode ID: 22a688ca4afff3b0c5611b4454cf67df6297fa02f5deee04612c27f432fc24f6
Instruction ID: 095a18822806386c226980367c988a93515027345d7af6560420518dddcf515d
Opcode Fuzzy Hash: 22a688ca4afff3b0c5611b4454cf67df6297fa02f5deee04612c27f432fc24f6
Instruction Fuzzy Hash: 6F7185B590711DBBDB1196918C84EEB73BCAB05748F040996B925F2841FA70DE844F38

Uniqueness

Uniqueness Score: -1.00%

Function 6C68FF6F Relevance: 49.2, APIs: 11, Strings: 17, Instructions: 206COMMON

Download Yara Rule

APIs

Part of subcall function 6C68A2E4: _vswprintf_s.LIBCMT ref: 6C68A317

_strrchr.LIBCMT ref: 6C68FFD4
GetTempFileNameA.KERNEL32(?,DXI,00000000,?,?,00000104,?,?,00000000,?,?), ref: 6C68FFF9
GetLastError.KERNEL32(00000000,?,00000000,?,?), ref: 6C690004

Strings

DXI, xrefs: 6C68FFED
Unable to copy %s to %s., xrefs: 6C6901DE
fopen(), xrefs: 6C690084
Unable to create temp file %s., xrefs: 6C69007E
Use string section : [Strings.%s], xrefs: 6C6900EC
fopen, xrefs: 6C69003D
Unable to open %s., xrefs: 6C690037
GetTempFileName(), xrefs: 6C69000B
EnableINTLStringSection, xrefs: 6C690010, 6C690042, 6C690089, 6C6901EF, 6C690214
[Strings], xrefs: 6C6900D2, 6C6900F6, 6C69012A
CopyFile(), xrefs: 6C6901EA
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C69004C, 6C690093, 6C6901F9, 6C69021E
EnableINTLStringSection(): Language is not found in inf defaulting to english., xrefs: 6C690120
[Strings.eng], xrefs: 6C690112
EnableINTLStringSection(): unable to find localized string section, original CIF file is used., xrefs: 6C6901B6
Unable to find back slash, failed to create path., xrefs: 6C69020D
[Strings.%s], xrefs: 6C68FF8E

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorFileLastNameTemp_strrchr_vswprintf_s
String ID: CopyFile()$DXI$EnableINTLStringSection$EnableINTLStringSection(): Language is not found in inf defaulting to english.$EnableINTLStringSection(): unable to find localized string section, original CIF file is used.$GetTempFileName()$Unable to copy %s to %s.$Unable to create temp file %s.$Unable to find back slash, failed to create path.$Unable to open %s.$Use string section : [Strings.%s]$[Strings.%s]$[Strings.eng]$[Strings]$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp$fopen$fopen()
API String ID: 590862462-893682192
Opcode ID: cc5c02d063d17a17bcf226a7181bd7fe5b93dc71bca8a58b94c7adaef449e88e
Instruction ID: 37cb00bce7039919f69c02b8ac39cfba5cdf6eb83d62adc6a70afafe6d2d3940
Opcode Fuzzy Hash: cc5c02d063d17a17bcf226a7181bd7fe5b93dc71bca8a58b94c7adaef449e88e
Instruction Fuzzy Hash: BA611EB1D46159BADB109AA19C85FEB77BCDF4E308F4004A5F604B2941EB71DA448E7C

Uniqueness

Uniqueness Score: -1.00%

Function 6C69525A Relevance: 47.7, APIs: 5, Strings: 22, Instructions: 423COMMON

Download Yara Rule

APIs

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

_strnlen.LIBCMT ref: 6C6953A8

Part of subcall function 6C689EA5: CompareStringA.KERNEL32(00000409,00000001,?,000000FF,6C690ED5,000000FF,?,6C690ED5,?,Version,?,00000000,?), ref: 6C689EBB

_strnlen.LIBCMT ref: 6C695416
_strrchr.LIBCMT ref: 6C695461
_strnlen.LIBCMT ref: 6C6955CA
GetLastError.KERNEL32 ref: 6C695501

Part of subcall function 6C689BC1: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 6C689D51
Part of subcall function 6C689BC1: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C689D76

Strings

filelist.dat, xrefs: 6C695272, 6C695277, 6C69529B
Unable to remove %s, need to remove this file., xrefs: 6C69563A
Unable to find cab list, %s., xrefs: 6C6957E8
.exe, xrefs: 6C69546C
SetupIterateCabinet(), xrefs: 6C695516
General, xrefs: 6C6953AF
Unable to initialize CSetupAPI., xrefs: 6C695781
Unable to iterate through %s. The file may be damaged., xrefs: 6C695510
LoadListFromInfSection() failed., xrefs: 6C6956CE
%s is not downloaded., xrefs: 6C69567D
URL, xrefs: 6C695430, 6C6955E4
IterateDownloadedCabs(): Iterating through %s, xrefs: 6C6954C8
Unable to create path string, %s\%s., xrefs: 6C69529D, 6C695719
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C6952AE, 6C695306, 6C695525, 6C69564B, 6C69568E, 6C6956DF, 6C69572A, 6C695792, 6C6957CC, 6C6957F9
IterateDownloadedCabs, xrefs: 6C6952A4, 6C6952FC, 6C69551B, 6C695641, 6C695684, 6C6956D5, 6C695720, 6C695788, 6C6957C2, 6C6957EF
IterateDownloadedCabs(): removing [%s] ..., xrefs: 6C6955A5
IterateDownloadedCabs(): start section : [%s], xrefs: 6C6953D2
Unable to load cab list, %s., xrefs: 6C6957BB
IterateDownloadedCabs(): %s is not cab, skipped., xrefs: 6C69547C
GetSectionNamesFromInf() failed., xrefs: 6C6952F5
IterateDownloadedCabs(): %s is removed., xrefs: 6C69565A
IterateDownloadedCabs(): Unable to get cab list in section., xrefs: 6C695774

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: _strnlen$__wstrtime_strrchr$CompareErrorFormatFreeLastLocalMessageString
String ID: %s is not downloaded.$.exe$General$GetSectionNamesFromInf() failed.$IterateDownloadedCabs$IterateDownloadedCabs(): %s is not cab, skipped.$IterateDownloadedCabs(): %s is removed.$IterateDownloadedCabs(): Iterating through %s$IterateDownloadedCabs(): Unable to get cab list in section.$IterateDownloadedCabs(): removing [%s] ...$IterateDownloadedCabs(): start section : [%s]$LoadListFromInfSection() failed.$SetupIterateCabinet()$URL$Unable to create path string, %s\%s.$Unable to find cab list, %s.$Unable to initialize CSetupAPI.$Unable to iterate through %s. The file may be damaged.$Unable to load cab list, %s.$Unable to remove %s, need to remove this file.$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp$filelist.dat
API String ID: 3230511836-1238058061
Opcode ID: c24830d0d2ea969e9e3c03457396b54c6eed57edf9f166bcaa12582bc509f01c
Instruction ID: 5da594bd12c9edeccdb15bc955b981f3fa2c4737c9a953aaee65f6deac3c3584
Opcode Fuzzy Hash: c24830d0d2ea969e9e3c03457396b54c6eed57edf9f166bcaa12582bc509f01c
Instruction Fuzzy Hash: 5BD12C7194621A7ADB209B649C84EDE77B89B1531DF200695F118E6E80EB709EC48E7C

Uniqueness

Uniqueness Score: -1.00%

Function 6C693811 Relevance: 44.0, APIs: 6, Strings: 19, Instructions: 254COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C693853
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 6C69386E
GetLastError.KERNEL32(00000000), ref: 6C693879

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

CheckLFN(): SetupFindFirstLine() returns 0, reason = %d., xrefs: 6C693B11
CheckLFN, xrefs: 6C693885, 6C6938CB, 6C69390F, 6C693967, 6C693A0A, 6C693AF1, 6C693B46
SetupGetLineText(), xrefs: 6C693AEC
CheckLFN(): checking [%s]..., xrefs: 6C693A2D
CheckLFN(): %s is not locked., xrefs: 6C693AC0
CheckLFN(): %s is locked!, xrefs: 6C693AAA
Unable to open %s., xrefs: 6C6939F9
StringCchPrintf(), xrefs: 6C693962
Unable to initialize CSetupAPI., xrefs: 6C693B3F
SetupOpenInfFile(), xrefs: 6C693A05
%s-%s_LFN, xrefs: 6C69393D
CheckLFN(): section [%s] is not found in %s., xrefs: 6C693996
Unable to create path string, %s\%s., xrefs: 6C693908
Unable to create path string, %s\., xrefs: 6C6938C4
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C69388F, 6C6938D5, 6C693919, 6C693A14, 6C693AFB, 6C693B50
GetSystemDirectory(), xrefs: 6C693880
Unable to create section name, %s-%s_LFN., xrefs: 6C69395C
;, xrefs: 6C693A79
dxupdate.inf, xrefs: 6C6938E7, 6C693902, 6C69398A

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$DirectoryErrorLastSystem_memset_strrchr
String ID: %s-%s_LFN$;$CheckLFN$CheckLFN(): %s is locked!$CheckLFN(): %s is not locked.$CheckLFN(): SetupFindFirstLine() returns 0, reason = %d.$CheckLFN(): checking [%s]...$CheckLFN(): section [%s] is not found in %s.$GetSystemDirectory()$SetupGetLineText()$SetupOpenInfFile()$StringCchPrintf()$Unable to create path string, %s\%s.$Unable to create path string, %s\.$Unable to create section name, %s-%s_LFN.$Unable to initialize CSetupAPI.$Unable to open %s.$dxupdate.inf$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 419038105-1513605989
Opcode ID: c4af053c14c7a86386b40692e9e7b75deaec5b8773475937dbac92f0a7b787ab
Instruction ID: deb0abf4c002d6abdb4c5a095b0bfeac3fc813553543b723c333218993ace70d
Opcode Fuzzy Hash: c4af053c14c7a86386b40692e9e7b75deaec5b8773475937dbac92f0a7b787ab
Instruction Fuzzy Hash: F7819DB19061197BEB209AA48C84EEF77BC9B1631CF0405B5F61AE3941EB709EC44E7D

Uniqueness

Uniqueness Score: -1.00%

Function 6C68DC9E Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 210filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

CopyFileA.KERNEL32(?,?,00000000), ref: 6C68DDA6
GetLastError.KERNEL32(Unable to copy %s to %s.,?,?), ref: 6C68DDC3
CharLowerA.USER32(?,?,00000004,?,?,00000000,?,?,dx9bdaxp.cat,?,?,dx9bda.cat,?,?,6C6812F4,e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp), ref: 6C68DE18
lstrcmpA.KERNEL32(?,eng), ref: 6C68DE2A

Strings

dxdiag.chm, xrefs: 6C68DE60
Unable to copy %s to %s., xrefs: 6C68DDBE
Renamed %s to %s, xrefs: 6C68DDDE
dxw9x%s.cat, xrefs: 6C68DF1C
Unable to find %s to rename, skipped., xrefs: 6C68DDF4
jystk%s.inf, xrefs: 6C68DEC9
dx9w9x.cat, xrefs: 6C68DF4F
dx9bdaxp.cat, xrefs: 6C68DD50, 6C68DD55, 6C68DD67
dijoy.hlp, xrefs: 6C68DE9C
Unable to create path string, %s\., xrefs: 6C68DCCE
Unable to create path string, %s%s., xrefs: 6C68DD2E, 6C68DD6F
CopyFile(), xrefs: 6C68DDCA
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68DCB3, 6C68DCDF, 6C68DD41
joystick.inf, xrefs: 6C68DEFC
dxdia%s.chm, xrefs: 6C68DE3F
eng, xrefs: 6C68DE1E
dijoy%s.hlp, xrefs: 6C68DE80
RenameFiles, xrefs: 6C68DCD5, 6C68DD37, 6C68DD78, 6C68DDCF
dx9bda.cat, xrefs: 6C68DD09, 6C68DD0E, 6C68DD2C

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$CharCopyErrorFileLastLower_strrchrlstrcmp
String ID: CopyFile()$RenameFiles$Renamed %s to %s$Unable to copy %s to %s.$Unable to create path string, %s%s.$Unable to create path string, %s\.$Unable to find %s to rename, skipped.$dijoy%s.hlp$dijoy.hlp$dx9bda.cat$dx9bdaxp.cat$dx9w9x.cat$dxdia%s.chm$dxdiag.chm$dxw9x%s.cat$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp$eng$joystick.inf$jystk%s.inf
API String ID: 2354368704-3421414887
Opcode ID: 301a0f37e8bb20bd1e587df52f134dc43e95109266026c8679aeeb5854ac100e
Instruction ID: fd42c34029e57686dfe0908692ca86338d201038cf2a2f90e0a2b01fe5f1b831
Opcode Fuzzy Hash: 301a0f37e8bb20bd1e587df52f134dc43e95109266026c8679aeeb5854ac100e
Instruction Fuzzy Hash: 4D6131B690721977DB20D6A1CC45FEA73BCAB15704F4408A2BA54E3941EB70DB888F7D

Uniqueness

Uniqueness Score: -1.00%

Function 6C68A9D6 Relevance: 40.4, APIs: 10, Strings: 13, Instructions: 168fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C68AA3A
GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 6C68AA63
GetLastError.KERNEL32(00000000), ref: 6C68AA6E
StringFromGUID2.OLE32(F750E6C3,?,00000104), ref: 6C68AAA5
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,00000104,00000000,00000000), ref: 6C68AAD4
GetLastError.KERNEL32(00000000), ref: 6C68AADF
SetFileAttributesA.KERNEL32(?,00000080,?,00000000), ref: 6C68AB94
GetLastError.KERNEL32(00000000), ref: 6C68AB9F
DeleteFileA.KERNEL32(?), ref: 6C68ABBD
GetLastError.KERNEL32(Unable to remove %s.,?), ref: 6C68ABD3

Strings

InstCatWin2K(): OBSOLETE: catalog file for Win2K must be installed with the inf file., xrefs: 6C68ABF1
DeleteFile(), xrefs: 6C68ABD6
%s\CATROOT\%s\%s, xrefs: 6C68AB06
InstCatWin2K(): deleting catalog file..., xrefs: 6C68AA4B
WideCharToMultiByte(), xrefs: 6C68AAE6
InstCatWin2K, xrefs: 6C68AA7A, 6C68AAB6, 6C68AAEB, 6C68AB35, 6C68AB71, 6C68ABA7, 6C68ABDB
SetFileAttributes(), xrefs: 6C68ABA2
e:\bt\382730\setup\deliverables\dxupdate\instcat.cpp, xrefs: 6C68AA84, 6C68AB3F, 6C68AB76, 6C68ABAD, 6C68ABE1
Unable to remove %s., xrefs: 6C68ABCE
Unable to create path string, %s\CATROOT\%s\%s., xrefs: 6C68AB2E
StringFromGUID2(), xrefs: 6C68AAB1
GetSystemDirectory(), xrefs: 6C68AA75
Qhl, xrefs: 6C68A9F0

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorLast$File$AttributesByteCharDeleteDirectoryFromMultiStringSystemWide_memset
String ID: %s\CATROOT\%s\%s$DeleteFile()$GetSystemDirectory()$InstCatWin2K$InstCatWin2K(): OBSOLETE: catalog file for Win2K must be installed with the inf file.$InstCatWin2K(): deleting catalog file...$Qhl$SetFileAttributes()$StringFromGUID2()$Unable to create path string, %s\CATROOT\%s\%s.$Unable to remove %s.$WideCharToMultiByte()$e:\bt\382730\setup\deliverables\dxupdate\instcat.cpp
API String ID: 1279157429-3189502458
Opcode ID: 5e847f534863cffdc909ad7c519399e68110d91218cd42e995e69b99bcd60570
Instruction ID: 84d77f1d970aa789682aca8fc94989f256ff35561735df506ba2cb3053e1e633
Opcode Fuzzy Hash: 5e847f534863cffdc909ad7c519399e68110d91218cd42e995e69b99bcd60570
Instruction Fuzzy Hash: BF51C476A02208BBDB20DBA1CC84FEB377C9B47B48F040595F915E2941EA74CA848F7D

Uniqueness

Uniqueness Score: -1.00%

Function 6C68BD14 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 250COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C68BE8B
GetLastError.KERNEL32(00000000), ref: 6C68BFC9

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

CSetupAPI is not initialized., xrefs: 6C68BD37
UpdateUnpluggedPnPDrv(): SetupDiSetDeviceRegistryProperty() succeeded., xrefs: 6C68BF17
UpdateUnpluggedPnPDrv(): ID:%s., xrefs: 6C68BD5F
UpdateUnpluggedPnPDrv(): SetupDiEnumDeviceInfo() completed., xrefs: 6C68BFA4
SetupDiSetDeviceRegistryProperty(), xrefs: 6C68BF33
Unable to allocate memory block., xrefs: 6C68BF8C
SetupDiGetDeviceRegistryProperty(), xrefs: 6C68BEB0, 6C68BF48, 6C68BF6E
SetupDiDestroyDeviceInfoList(), xrefs: 6C68BFD0
UpdateUnpluggedPnPDrv, xrefs: 6C68BD3E, 6C68BDA8, 6C68BEA3, 6C68BEB5, 6C68BF38, 6C68BF4D, 6C68BF73, 6C68BF93, 6C68BFD5, 6C68BFEB
, xrefs: 6C68BEF5
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68BD48, 6C68BDAD, 6C68BF53, 6C68BF79, 6C68BF99, 6C68BFDB, 6C68BFF5
UpdateUnpluggedPnPDrv(): %s is found., xrefs: 6C68BEC3
SetupDiGetClassDevs(), xrefs: 6C68BFE6
SetupDiEnumDeviceInfo(), xrefs: 6C68BE9E

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorLast__wstrtime$_strrchr
String ID: $CSetupAPI is not initialized.$SetupDiDestroyDeviceInfoList()$SetupDiEnumDeviceInfo()$SetupDiGetClassDevs()$SetupDiGetDeviceRegistryProperty()$SetupDiSetDeviceRegistryProperty()$Unable to allocate memory block.$UpdateUnpluggedPnPDrv$UpdateUnpluggedPnPDrv(): %s is found.$UpdateUnpluggedPnPDrv(): ID:%s.$UpdateUnpluggedPnPDrv(): SetupDiEnumDeviceInfo() completed.$UpdateUnpluggedPnPDrv(): SetupDiSetDeviceRegistryProperty() succeeded.$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 3134455230-3781566494
Opcode ID: 989d44e20ab6a45e9d8c5602e9e1d4383b1968787225ba517d39b5cef7839dc8
Instruction ID: 55817e319b610a93d3b0dd129d711ef657930461fa1023669bac4a75f598128a
Opcode Fuzzy Hash: 989d44e20ab6a45e9d8c5602e9e1d4383b1968787225ba517d39b5cef7839dc8
Instruction Fuzzy Hash: 87815C71A46208BFEB009FA5DC89EEE7BBCEB4A748F140025F601B6551D7319A04CB3D

Uniqueness

Uniqueness Score: -1.00%

Function 6C692209 Relevance: 37.0, APIs: 3, Strings: 18, Instructions: 229COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C69224D
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 6C692262
GetLastError.KERNEL32(00000000,?,\mdxredist.msi,00000000), ref: 6C69226D

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Part of subcall function 6C689BC1: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 6C689D51
Part of subcall function 6C689BC1: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C689D76

Strings

\msi.dll, xrefs: 6C69229F
Unable to get product code from %s., xrefs: 6C6923BE
Unable to initialize CDXMsi., xrefs: 6C692501
Unable to get product version from %s., xrefs: 6C69247E
GetProductProperty(), xrefs: 6C692484
ProductVersion, xrefs: 6C6923EA
GetMDXProductVersion(): MDX 9.0 [%s], xrefs: 6C692417
GetMDXProductVersion(): MDX 9.1 [%s], xrefs: 6C692439
{7F34A21F-2DEB-4598-BB19-611D6BD24271}, xrefs: 6C692343
Unable to create path string, %s%s., xrefs: 6C6924A5
\mdxredist.msi, xrefs: 6C692222, 6C6922E6, 6C6922EB, 6C69249E
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C692283, 6C69233A, 6C692390, 6C6923D3, 6C692493, 6C6924B8, 6C692512
{B4C88CF0-B617-4658-8F84-C4E847FBC9F7}, xrefs: 6C692361
Unknown MDX package [%s]., xrefs: 6C69237D
ProductCode, xrefs: 6C692321
GetsystemDirectory(), xrefs: 6C692274
MsiGetProductProperty(), xrefs: 6C6923C4
GetMDXProductVersion, xrefs: 6C692279, 6C692386, 6C6923C9, 6C692489, 6C6924AE, 6C692508

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$DirectoryErrorFormatFreeLastLocalMessageSystem_memset_strrchr
String ID: GetMDXProductVersion$GetMDXProductVersion(): MDX 9.0 [%s]$GetMDXProductVersion(): MDX 9.1 [%s]$GetProductProperty()$GetsystemDirectory()$MsiGetProductProperty()$ProductCode$ProductVersion$Unable to create path string, %s%s.$Unable to get product code from %s.$Unable to get product version from %s.$Unable to initialize CDXMsi.$Unknown MDX package [%s].$\mdxredist.msi$\msi.dll$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp${7F34A21F-2DEB-4598-BB19-611D6BD24271}${B4C88CF0-B617-4658-8F84-C4E847FBC9F7}
API String ID: 1089790045-1702744034
Opcode ID: 5ee78eb7e1466da7b784903e0a5ab7bc844eda398dc1c3203d7669d62eabb870
Instruction ID: 72d347eb332ad481b3e00d47a236663e85504f6f1182e88623c63d821acd0b61
Opcode Fuzzy Hash: 5ee78eb7e1466da7b784903e0a5ab7bc844eda398dc1c3203d7669d62eabb870
Instruction Fuzzy Hash: EF7195B1D02219ABEB219B64CC84FEE77FCAF09708F104495F519E6941DB708B858E7D

Uniqueness

Uniqueness Score: -1.00%

Function 6C68C15A Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 108processsynchronizationCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C68C16F
CreateProcessA.KERNEL32(00000000,6C6846C8,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?), ref: 6C68C193
WaitForSingleObject.KERNEL32(?,000000FF,?,00000104,?), ref: 6C68C1A6
GetLastError.KERNEL32(00000000,?,00000104,?), ref: 6C68C1B2
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 6C68C1DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 6C68C1E3
GetExitCodeProcess.KERNEL32(?,?), ref: 6C68C1F5
GetLastError.KERNEL32(00000000,?,00000104,?), ref: 6C68C200
CloseHandle.KERNEL32(?,?,00000104,?), ref: 6C68C221
GetLastError.KERNEL32(00000000,?,00000104,?), ref: 6C68C228
CloseHandle.KERNEL32(?,?,00000104,?), ref: 6C68C243
GetLastError.KERNEL32(00000000,?,00000104,?), ref: 6C68C24A
GetLastError.KERNEL32(00000000,?,00000104,?), ref: 6C68C268

Strings

RunProcess, xrefs: 6C68C1BE, 6C68C20C, 6C68C234, 6C68C256, 6C68C274
GetExitCodeProcess(), xrefs: 6C68C207
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68C1C8, 6C68C27E
CloseHandle(), xrefs: 6C68C22F, 6C68C251
WaitForSingleObject(), xrefs: 6C68C1B9
CreateProcess(), xrefs: 6C68C26F

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorLast$CloseHandle$Process$CodeCreateExitObjectSingleWait_memset
String ID: CloseHandle()$CreateProcess()$GetExitCodeProcess()$RunProcess$WaitForSingleObject()$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 1220342516-444330189
Opcode ID: 8433589e6bbf41496aeb20adf9548b3592cbf9aa4907d8945575d62d5dca91cc
Instruction ID: c59e27a9a0e921e486fdf85da1b21b5897c732cbaa8d67265d176e9e34fbab0b
Opcode Fuzzy Hash: 8433589e6bbf41496aeb20adf9548b3592cbf9aa4907d8945575d62d5dca91cc
Instruction Fuzzy Hash: 68319571A47154BBDB016BE68C48DAF3B78EF43B55F000621FA62F1980D73186059BBD

Uniqueness

Uniqueness Score: -1.00%

Function 6C691F44 Relevance: 31.7, APIs: 3, Strings: 15, Instructions: 203COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C691F7A
GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 6C691FC4
GetLastError.KERNEL32(00000000,?,?,00000104), ref: 6C691FCF

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

GetMDXVersion(): unable to find Windows Installer component., xrefs: 6C6921E2
VersionString, xrefs: 6C69205B, 6C692060, 6C6920CE
Invalid parameter - version information is NULL., xrefs: 6C691F8C
\msi.dll, xrefs: 6C691FFA
Unable to initialize CDXMsi., xrefs: 6C6921AE
GetMDXVersion(): MDX 9.0 [%s] is detected., xrefs: 6C69208A
GetMDXVersion(): MDX 9.1 [%s] is detected., xrefs: 6C6920F8
{7F34A21F-2DEB-4598-BB19-611D6BD24271}, xrefs: 6C692061
GetMDXVersion, xrefs: 6C691F93, 6C691FDB, 6C6920A9, 6C69210E, 6C6921B5
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C691F9D, 6C691FE1, 6C692118, 6C6921BF
{B4C88CF0-B617-4658-8F84-C4E847FBC9F7}, xrefs: 6C6920CF
MsiGetProductInfo(), xrefs: 6C6920A4, 6C692109
GetMDXVersion(): MDX 9.0 is not detected., xrefs: 6C6920B5
GetMDXVersion(): MDX 9.1 is not detected., xrefs: 6C692127
GetsystemDirectory(), xrefs: 6C691FD6

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$DirectoryErrorLastSystem_memset_strrchr
String ID: GetMDXVersion$GetMDXVersion(): MDX 9.0 [%s] is detected.$GetMDXVersion(): MDX 9.0 is not detected.$GetMDXVersion(): MDX 9.1 [%s] is detected.$GetMDXVersion(): MDX 9.1 is not detected.$GetMDXVersion(): unable to find Windows Installer component.$GetsystemDirectory()$Invalid parameter - version information is NULL.$MsiGetProductInfo()$Unable to initialize CDXMsi.$VersionString$\msi.dll$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp${7F34A21F-2DEB-4598-BB19-611D6BD24271}${B4C88CF0-B617-4658-8F84-C4E847FBC9F7}
API String ID: 419038105-2521548459
Opcode ID: 62eeb5f26aa0828c374312a5b2eaefd9d87644646d4babbb55987219cf5b38e3
Instruction ID: 7f8c5441903f78248ebb2721534bdd7f9a1a7cdb769c686109386a64346c7659
Opcode Fuzzy Hash: 62eeb5f26aa0828c374312a5b2eaefd9d87644646d4babbb55987219cf5b38e3
Instruction Fuzzy Hash: 4E61EB7190221AABDB319B658C48FEF77BC9B49708F50049AF616A2D40EB704B858F7D

Uniqueness

Uniqueness Score: -1.00%

Function 6C68F43D Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 98libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(6C692ADF,00000000,00000008,6C692ADF,00000000,00000000,6C6981D2,00000000,?,?,?,6C692ADF,0000003B), ref: 6C68F462
GetProcAddress.KERNEL32(00000000,DllRegisterServer), ref: 6C68F47A
GetLastError.KERNEL32(Module: %s, Function %s,6C692ADF,DllRegisterServer,?,?,?,6C692ADF,0000003B), ref: 6C68F4D1
FreeLibrary.KERNEL32(6C692ADF,?,?,?,?,?,?,6C692ADF,0000003B), ref: 6C68F4EF
GetLastError.KERNEL32(00000000,?,?,?,?,?,?,6C692ADF,0000003B), ref: 6C68F4FA

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

GetLastError.KERNEL32(Unable to load %s.,6C692ADF,?,?,?,6C692ADF,0000003B), ref: 6C68F51D

Strings

RegisterDLL(): %s is registered successfully., xrefs: 6C68F4B3
FreeLibrary(), xrefs: 6C68F501
RegisterDLL, xrefs: 6C68F480, 6C68F4A2, 6C68F4DD, 6C68F506, 6C68F529, 6C68F53D
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68F485, 6C68F4A8, 6C68F4E3, 6C68F50C, 6C68F547
Module: %s, Function %s, xrefs: 6C68F4CC
Unable to find find %s., xrefs: 6C68F536
GetProcAddress(), xrefs: 6C68F4D8
LoadLibraryEx(), xrefs: 6C68F524
DllRegisterServer, xrefs: 6C68F473, 6C68F478, 6C68F4C8
DllRegisterServer(), xrefs: 6C68F49D
Unable to load %s., xrefs: 6C68F518
Unable to register %s., xrefs: 6C68F497

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorLast$Library__wstrtime$AddressFreeLoadProc_strrchr
String ID: DllRegisterServer$DllRegisterServer()$FreeLibrary()$GetProcAddress()$LoadLibraryEx()$Module: %s, Function %s$RegisterDLL$RegisterDLL(): %s is registered successfully.$Unable to find find %s.$Unable to load %s.$Unable to register %s.$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 1678312016-3976787067
Opcode ID: ba9b9805f543d6c7de1c8f3bf66f33d77cd02270edb928fd1ad03bc9b1257eb5
Instruction ID: 4b7e4801db27913a63bc9c261cb44245ba44a39a5313e560a138a2a3b07268e3
Opcode Fuzzy Hash: ba9b9805f543d6c7de1c8f3bf66f33d77cd02270edb928fd1ad03bc9b1257eb5
Instruction Fuzzy Hash: BD21D871607104BBE7106A969C89DBF3E7CDF57B9DF004415FA54E2D41EBB08A4086BE

Uniqueness

Uniqueness Score: -1.00%

Function 6C68A0F6 Relevance: 31.6, APIs: 8, Strings: 10, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(sfc.dll,DirectXUpdateInstall,00000000,00000000,?,?,6C68AFC7,e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp), ref: 6C68A11A
GetProcAddress.KERNEL32(00000000,00000008), ref: 6C68A136
GetProcAddress.KERNEL32(00000009), ref: 6C68A145
GetProcAddress.KERNEL32(SRSetRestorePoint), ref: 6C68A157

Strings

sfc.dll, xrefs: 6C68A114, 6C68A119, 6C68A181, 6C68A1D3
FreeLibrary(), xrefs: 6C68A1B9
LoadLibrary(), xrefs: 6C68A1E0
DirectXUpdateInstall, xrefs: 6C68A113
GetProcAddress(), xrefs: 6C68A18A
LoadSfcDLL, xrefs: 6C68A18F, 6C68A194, 6C68A1BE, 6C68A1E5
SRSetRestorePoint, xrefs: 6C68A147
Module: %s, xrefs: 6C68A182
Unable to load %s., xrefs: 6C68A1D4
e:\bt\382730\setup\deliverables\dxupdate\instcat.cpp, xrefs: 6C68A197, 6C68A19C, 6C68A1C1, 6C68A1EC

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: DirectXUpdateInstall$FreeLibrary()$GetProcAddress()$LoadLibrary()$LoadSfcDLL$Module: %s$SRSetRestorePoint$Unable to load %s.$e:\bt\382730\setup\deliverables\dxupdate\instcat.cpp$sfc.dll
API String ID: 2238633743-2231956943
Opcode ID: 7076e2f03c5c8592639e34fa79796bdfc860f32be74943ad6f6865e07e4d7123
Instruction ID: c2ed48398225fd6f580c3ca6ecc91041df0fc708fbf495d84a99d214aed60371
Opcode Fuzzy Hash: 7076e2f03c5c8592639e34fa79796bdfc860f32be74943ad6f6865e07e4d7123
Instruction Fuzzy Hash: 98217175B03200BBEF105FE69CC9EAA3AB8EB4675DF20442DE962A6941D7719500CA7C

Uniqueness

Uniqueness Score: -1.00%

Function 6C693C32 Relevance: 30.3, APIs: 3, Strings: 17, Instructions: 259COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(Unable to iterate through %s. The file may be damaged.,?), ref: 6C693DB4
GetLastError.KERNEL32(Unable to iterate through %s. The file may be damaged.,?), ref: 6C693E79
GetLastError.KERNEL32(Unable to iterate through %s. The file may be damaged.,?), ref: 6C693F23

Strings

%s_REDIST_%04d%02d, xrefs: 6C693DF7
DirectXUpdateApplyUpdate(): searching %s-*.cab., xrefs: 6C693D7D, 6C693E42
DirectXUpdateApplyUpdate(): Extracting %s..., xrefs: 6C693EE2
Win9X_REDIST_%04d%02d, xrefs: 6C693D39, 6C693D46
StringCchPrintf(), xrefs: 6C693D68
SetupIterateCabinet(), xrefs: 6C693DBB, 6C693E80, 6C693F2A
Unable to initialize CSetupAPI., xrefs: 6C693F63
Unable to iterate through %s. The file may be damaged., xrefs: 6C693DAF, 6C693E74, 6C693F1E
Unable to create path string, %s%s., xrefs: 6C693C93, 6C693EBF
DirectXUpdateApplyUpdate, xrefs: 6C693C9A, 6C693D6D, 6C693DC0, 6C693E25, 6C693E85, 6C693EC6, 6C693F2F, 6C693F6A
Unable to create cab name, Win??_REDIST_%04d%02d., xrefs: 6C693D62
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C693CA4, 6C693DCA, 6C693E2F, 6C693ED0, 6C693F74
dxupdate.cab, xrefs: 6C693C7A, 6C693C7F, 6C693C91
DirectXUpdateApplyUpdate(): Update is not found in %s., xrefs: 6C693F5C
Unable to create cab name, %s_REDIST_%04d%02d., xrefs: 6C693E1C
WinNT_REDIST_%04d%02d, xrefs: 6C693D32
DirectXUpdateApplyUpdate(): There is not update cab - %s., xrefs: 6C693FA3

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorLast
String ID: %s_REDIST_%04d%02d$DirectXUpdateApplyUpdate$DirectXUpdateApplyUpdate(): Extracting %s...$DirectXUpdateApplyUpdate(): There is not update cab - %s.$DirectXUpdateApplyUpdate(): Update is not found in %s.$DirectXUpdateApplyUpdate(): searching %s-*.cab.$SetupIterateCabinet()$StringCchPrintf()$Unable to create cab name, %s_REDIST_%04d%02d.$Unable to create cab name, Win??_REDIST_%04d%02d.$Unable to create path string, %s%s.$Unable to initialize CSetupAPI.$Unable to iterate through %s. The file may be damaged.$Win9X_REDIST_%04d%02d$WinNT_REDIST_%04d%02d$dxupdate.cab$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 1452528299-1828712378
Opcode ID: b863a97e1e8f22b88e7d4b82dc65aae2a4e2966b4bb905a33f166f3a5eb24514
Instruction ID: 32b78842667bc2bd6d634b5d2e41e7599c3760e390fb26ed41901d1a58c71902
Opcode Fuzzy Hash: b863a97e1e8f22b88e7d4b82dc65aae2a4e2966b4bb905a33f166f3a5eb24514
Instruction Fuzzy Hash: 93811AB1506215BAEB109BA58C41FEB76BC9F06308F000565FA49E7D82EB71D9848F7C

Uniqueness

Uniqueness Score: -1.00%

Function 6C68EF07 Relevance: 29.9, APIs: 3, Strings: 14, Instructions: 106COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C68EF36
GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 6C68EF4B
GetLastError.KERNEL32(00000000,?,00000000,?), ref: 6C68EF56

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

REDIST, xrefs: 6C68F019
\dinput8d.dll, xrefs: 6C68EFCE
CheckDirectXLanguage(): Installed DX - single language (English) runtime, xrefs: 6C68F032
SDKDEBUG, xrefs: 6C68EFF6
CheckDirectXLanguage, xrefs: 6C68EF62, 6C68EFAF
CheckDirectXLanguage(): Installed DX - multi lingual (redist) runtime, xrefs: 6C68F00F
ENG, xrefs: 6C68F03C
Unable to create path string, %s%s., xrefs: 6C68EFA6
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68EF6C, 6C68EFB9
CheckDirectXLanguage(): Installed DX - SDK debug runtime, xrefs: 6C68EFEC
CheckDirectXLanguage(): Installed DX - single language runtime, xrefs: 6C68F04C
GetsystemDirectory(), xrefs: 6C68EF5D
\ddraw.dll, xrefs: 6C68EF81, 6C68EF86, 6C68EFA4
CheckDirectXLanguage(): Installed DX - SDK retail runtime, xrefs: 6C68EFFF

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$DirectoryErrorLastSystem_memset_strrchr
String ID: CheckDirectXLanguage$CheckDirectXLanguage(): Installed DX - SDK debug runtime$CheckDirectXLanguage(): Installed DX - SDK retail runtime$CheckDirectXLanguage(): Installed DX - multi lingual (redist) runtime$CheckDirectXLanguage(): Installed DX - single language (English) runtime$CheckDirectXLanguage(): Installed DX - single language runtime$ENG$GetsystemDirectory()$REDIST$SDKDEBUG$Unable to create path string, %s%s.$\ddraw.dll$\dinput8d.dll$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 419038105-3909562069
Opcode ID: b80cc8867183d89a35e058facc25b89860b1903ee4516ae6d653058f7e2c2b4d
Instruction ID: 12783217ab64fae182dbb25f411e7f0b2de3b14823340bae94b0a2ca2e7258bd
Opcode Fuzzy Hash: b80cc8867183d89a35e058facc25b89860b1903ee4516ae6d653058f7e2c2b4d
Instruction Fuzzy Hash: 49310A7190F114BBD720ABA14C51FFB77AC9F1634CF100451E645E2D81EBB0D6449A7E

Uniqueness

Uniqueness Score: -1.00%

Function 6C691C04 Relevance: 28.2, APIs: 4, Strings: 12, Instructions: 159registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000002,?,00000000,00000000,00000000,00000002,00000000,?,00000000,?,Software\Microsoft\.NETFramework\AssemblyFolders,\DX_,?,CMDXInstall::Install,e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp,00000000), ref: 6C691D21
_strnlen.LIBCMT ref: 6C691D42

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,?,00000001), ref: 6C691D5B
RegCloseKey.ADVAPI32(?), ref: 6C691D95

Strings

CMDXInstall::SetupRegistry, xrefs: 6C691CBD, 6C691CEE, 6C691D61, 6C691D76, 6C691DA6, 6C691DBE, 6C691DE5
Unable to create path string, %s%s., xrefs: 6C691CB2
Unable to create path string, %s_., xrefs: 6C691CE3
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C691C1D, 6C691CC7, 6C691CF8, 6C691D66, 6C691D7C, 6C691DAC, 6C691DC8, 6C691DEF
RegSetValueEx(), xrefs: 6C691D71
StringCchCat(), xrefs: 6C691CB8, 6C691CE9
Unable to create key name %s\DX_%s., xrefs: 6C691DDE
Software\Microsoft\.NETFramework\AssemblyFolders, xrefs: 6C691C3A, 6C691C3F, 6C691DDD
\DX_, xrefs: 6C691C2F
RegCreateKeyEx(), xrefs: 6C691DB9
CMDXInstall::Install, xrefs: 6C691C21
RegCloseKey(), xrefs: 6C691DA1

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$CloseCreateValue_strnlen_strrchr
String ID: CMDXInstall::Install$CMDXInstall::SetupRegistry$RegCloseKey()$RegCreateKeyEx()$RegSetValueEx()$Software\Microsoft\.NETFramework\AssemblyFolders$StringCchCat()$Unable to create key name %s\DX_%s.$Unable to create path string, %s%s.$Unable to create path string, %s_.$\DX_$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 439715491-2221351213
Opcode ID: aec0f062aa61a11fdae3e0708bcf264f930d84f85530b119daec34ba67ff8b55
Instruction ID: 19a15bf3140cc1edde765ea719e57aa00ad2b429ff8bdeb1697be2eed4dcb9d7
Opcode Fuzzy Hash: aec0f062aa61a11fdae3e0708bcf264f930d84f85530b119daec34ba67ff8b55
Instruction Fuzzy Hash: 1841F4B1D42109BBFB205A548C81EEB7BBCDB1A30AF140595F655F2980EB708EC49E7D

Uniqueness

Uniqueness Score: -1.00%

Function 6C69280A Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 133COMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 6C6928E8
GetLastError.KERNEL32(00000000), ref: 6C692963

Part of subcall function 6C68FE3C: lstrcmpA.KERNEL32(?,DefaultInstall,RegisterDLL64,e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp,00000000), ref: 6C68FE63

GetLastError.KERNEL32(00000000,6C6981D2,00000000), ref: 6C692890

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Part of subcall function 6C68B0A6: FreeLibrary.KERNEL32(00000000,00000000,6C6921D7,?,?,?,?,\msi.dll,00000000,?,?,00000104), ref: 6C68B0B2
Part of subcall function 6C68B0A6: GetLastError.KERNEL32(?,?,?,?,\msi.dll,00000000,?,?,00000104), ref: 6C68B0BC

GetLastError.KERNEL32(00000000,?,?,6C692AD8,00000000,00000000,6C6981D2,00000000), ref: 6C6929AC

Strings

RegisterDLL64(): %s is not registered properly., xrefs: 6C692945
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C692856, 6C6928A6, 6C6928CF, 6C692975, 6C692993, 6C6929BE
RegisterDLL64(): %s is registered successfully., xrefs: 6C69292D
\regsvr32.exe /s, xrefs: 6C6928F2
RegSvr32.exe, xrefs: 6C692919
Wow64RevertWow64FsRedirection(), xrefs: 6C6929B3
GetSystemDirectory(), xrefs: 6C69296A
StringCchCat(), xrefs: 6C692955
Unable to find find %s., xrefs: 6C692986
Wow64DisableWow64FsRedirection(), xrefs: 6C692897
Unable to initialize CKernel32., xrefs: 6C692845
RegisterDLL64, xrefs: 6C69284C, 6C69289C, 6C6928CA, 6C69295A, 6C69296F, 6C69298D, 6C6929B8

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorLast$__wstrtime$DirectoryFreeLibrarySystem_strrchrlstrcmp
String ID: GetSystemDirectory()$RegSvr32.exe$RegisterDLL64$RegisterDLL64(): %s is not registered properly.$RegisterDLL64(): %s is registered successfully.$StringCchCat()$Unable to find find %s.$Unable to initialize CKernel32.$Wow64DisableWow64FsRedirection()$Wow64RevertWow64FsRedirection()$\regsvr32.exe /s$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 1827676591-3868886123
Opcode ID: ef84557159fff51f8bae9c683f5cfa7d94c57172e2417540cc4ef842be3dce26
Instruction ID: 6bf8b6353c5b76adf87413b6003c97bd1b03d2d53c098256027f8f05a3140346
Opcode Fuzzy Hash: ef84557159fff51f8bae9c683f5cfa7d94c57172e2417540cc4ef842be3dce26
Instruction Fuzzy Hash: 1741B771A03215BBEB10AAA58C89EEF37BC9B56718F400495F545B1940EF709E848E7D

Uniqueness

Uniqueness Score: -1.00%

Function 6C68D09A Relevance: 28.1, APIs: 6, Strings: 10, Instructions: 99COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp), ref: 6C68D0BF
GetLastError.KERNEL32(00000000), ref: 6C68D0CA

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

GetFileAttributesA.KERNEL32(?,?,00000000,?,?,\inf\,6C698200), ref: 6C68D120
SetFileAttributesA.KERNEL32(?,00000080), ref: 6C68D14E
GetLastError.KERNEL32(00000000), ref: 6C68D159

Strings

Unable to create path string, %s\inf\%s., xrefs: 6C68D1AF
CheckReadOnlyFlag(): file attribute is successfully changed to NORMAL., xrefs: 6C68D171
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68D0AF
\inf\, xrefs: 6C68D0E6
GetWindowsDirectory(), xrefs: 6C68D0D1
GetFileAttributes(), xrefs: 6C68D189
e:\bt\382730\setup\deliverables\dxupdate\inline.h, xrefs: 6C68D198, 6C68D1C2
SetFileAttributes(), xrefs: 6C68D160
CheckReadOnlyFlag(): %s is ReadOnly., xrefs: 6C68D136
CheckReadOnlyFlag, xrefs: 6C68D0D6, 6C68D165, 6C68D18E, 6C68D1B8

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: AttributesErrorFileLast__wstrtime$DirectoryWindows_strrchr
String ID: CheckReadOnlyFlag$CheckReadOnlyFlag(): %s is ReadOnly.$CheckReadOnlyFlag(): file attribute is successfully changed to NORMAL.$GetFileAttributes()$GetWindowsDirectory()$SetFileAttributes()$Unable to create path string, %s\inf\%s.$\inf\$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp$e:\bt\382730\setup\deliverables\dxupdate\inline.h
API String ID: 3300351523-1733329513
Opcode ID: b498e26c0ccf09e06c3d7a4ff09275cea83357802b880ced98ad9346e02e6868
Instruction ID: c376ff33a51049a55a1901d2b282f033f87a992ecf511a099660bfb182628ccb
Opcode Fuzzy Hash: b498e26c0ccf09e06c3d7a4ff09275cea83357802b880ced98ad9346e02e6868
Instruction Fuzzy Hash: BE31D7B2A07214B7DB109AA58C49EEB777C9F07358F500462F595E3980DB70D6848A7D

Uniqueness

Uniqueness Score: -1.00%

Function 6C69253A Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 200COMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,?,00000000), ref: 6C6925BC
GetLastError.KERNEL32(00000000), ref: 6C6925C7

Part of subcall function 6C68B06F: CharNextA.USER32(?,00000104,?,6C693CF3,6C6A9880,6C6A9880,00000104,?,?,00000000,?,?,dxupdate.cab), ref: 6C68B082

GetLastError.KERNEL32 ref: 6C69269F
GetLastError.KERNEL32(Unable to open %s.,?), ref: 6C692741

Strings

Unable to install %s:[%s] due to certificate problem. Please check valid certificate is installed and Cryptographic Services are enabled., xrefs: 6C692717
Unable to install %s:[%s]. The file may be damaged., xrefs: 6C6926E5
Unable to install %s:[%s]. The file is not signed properly., xrefs: 6C6926BE
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C6925DD, 6C69272C, 6C692757, 6C6927D3
ExecuteInf, xrefs: 6C6925D3, 6C6926C9, 6C6926F0, 6C692709, 6C692722, 6C69274D, 6C6927C9
SetupInstallFromInfSection(), xrefs: 6C6926C4, 6C6926EB, 6C692704, 6C69271D
Unable to open %s., xrefs: 6C69273C
Unable to initialize CSetupAPI., xrefs: 6C6927C2
SetupOpenInfFile(), xrefs: 6C692748
Unable to install %s:[%s]. Please verify the Cryptographic Services are enabled., xrefs: 6C6926FE
GetCurrentDirectory(), xrefs: 6C6925CE

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorLast$CharCurrentDirectoryNext
String ID: ExecuteInf$GetCurrentDirectory()$SetupInstallFromInfSection()$SetupOpenInfFile()$Unable to initialize CSetupAPI.$Unable to install %s:[%s] due to certificate problem. Please check valid certificate is installed and Cryptographic Services are enabled.$Unable to install %s:[%s]. Please verify the Cryptographic Services are enabled.$Unable to install %s:[%s]. The file is not signed properly.$Unable to install %s:[%s]. The file may be damaged.$Unable to open %s.$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 132608271-2763982466
Opcode ID: 09223d80cb77f7d7c64c11b0eddc0a7004340a2f4ec881beb220235c9903f930
Instruction ID: 1c2cff42e2408cfd5eb4c334315904b483a9911ba9f5b52c89f2822d0f368615
Opcode Fuzzy Hash: 09223d80cb77f7d7c64c11b0eddc0a7004340a2f4ec881beb220235c9903f930
Instruction Fuzzy Hash: E66107B0902219BBEB249B608C4DFEB37B8EB05709F500959F555F5980EB704EC48EBD

Uniqueness

Uniqueness Score: -1.00%

Function 6C68D5C5 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 131registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\DirectX,00000000,00000001,?,?,00000000,?), ref: 6C68D62A
RegQueryValueExA.ADVAPI32(?,Version,00000000,00000000,?,?), ref: 6C68D676
RegCloseKey.ADVAPI32(?), ref: 6C68D74E

Strings

GetDXVersion, xrefs: 6C68D63F, 6C68D687, 6C68D6C6, 6C68D75F
Current DirectX may be a older version which does not have the version value in the registry., xrefs: 6C68D67C
StringToVersionInfo() failed, version = %s., xrefs: 6C68D6BF
GetDXVersion(): Unable to get RC string from registry, now RC is 0., xrefs: 6C68D70A
RegQueryValueEx(), xrefs: 6C68D682
Current DirectX may be a older version which does not have directx key in the registry., xrefs: 6C68D634
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68D691, 6C68D6D0, 6C68D769
RegOpenKeyEx(), xrefs: 6C68D63A
RegCloseKey(), xrefs: 6C68D75A
Version, xrefs: 6C68D661
Software\Microsoft\DirectX, xrefs: 6C68D618

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Current DirectX may be a older version which does not have directx key in the registry.$Current DirectX may be a older version which does not have the version value in the registry.$GetDXVersion$GetDXVersion(): Unable to get RC string from registry, now RC is 0.$RegCloseKey()$RegOpenKeyEx()$RegQueryValueEx()$Software\Microsoft\DirectX$StringToVersionInfo() failed, version = %s.$Version$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 3677997916-2346953853
Opcode ID: de456c2a4b79be0b3bf25deada0144396ae7ade3c1dda48236bbfb12d8863eac
Instruction ID: 27d4f87fac8af8fffa58832abfc6d04a8ed78cc02978f4fad54069e2fb759483
Opcode Fuzzy Hash: de456c2a4b79be0b3bf25deada0144396ae7ade3c1dda48236bbfb12d8863eac
Instruction Fuzzy Hash: 37416FF194211EBBEF209E54CCC4EEA76B8EB15349F5008B6E518A7901D7719EC48E7C

Uniqueness

Uniqueness Score: -1.00%

Function 6C695D7C Relevance: 25.9, APIs: 1, Strings: 16, Instructions: 353COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000), ref: 6C696047

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

IsMDXInUse, xrefs: 6C695E0D, 6C695EF9, 6C696006, 6C696053, 6C696132, 6C6961AF, 6C696217, 6C696239, 6C69628A
VersionString, xrefs: 6C695EC5, 6C6960D1
IsMDXInUse(): %s [%s] is detected., xrefs: 6C695F80, 6C695F9D
Unable to get product code from %s., xrefs: 6C69622E
SetupGetLineText(), xrefs: 6C69604E
Unable to initialize CDXMsi., xrefs: 6C696283
MDX, xrefs: 6C695EA2
Unable to initialize CSetupAPI., xrefs: 6C69612B
Unable to initialize CMDXCheck., xrefs: 6C695FFF, 6C6961A8
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C695E12, 6C695EFF, 6C69600C, 6C696059, 6C69613C, 6C6961B5, 6C69621D, 6C69623F, 6C696294
ProductCode, xrefs: 6C6960A1
MsiGetProductInfo(), xrefs: 6C695EF4, 6C696212
IsMDXInUse(): %s, xrefs: 6C695F68
;, xrefs: 6C695E99
MsiGetProductProperty(), xrefs: 6C696234
InstalledProductName, xrefs: 6C695F3B

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$ErrorLast_strrchr
String ID: ;$InstalledProductName$IsMDXInUse$IsMDXInUse(): %s$IsMDXInUse(): %s [%s] is detected.$MDX$MsiGetProductInfo()$MsiGetProductProperty()$ProductCode$SetupGetLineText()$Unable to get product code from %s.$Unable to initialize CDXMsi.$Unable to initialize CMDXCheck.$Unable to initialize CSetupAPI.$VersionString$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 205445871-52278232
Opcode ID: 498426fd985a7dae3a611f8073dc8f174ab514d69d3198038e812487493b50c2
Instruction ID: 34efcb349ba98d4a99488057ae28c68ac46d4a988d6467e358b3b93eaada403d
Opcode Fuzzy Hash: 498426fd985a7dae3a611f8073dc8f174ab514d69d3198038e812487493b50c2
Instruction Fuzzy Hash: 00D18471D0222D9BCB629B14CC84AED77BCAF0A719F5001D5E519E2A81DB708FC58FAD

Uniqueness

Uniqueness Score: -1.00%

Function 6C68F563 Relevance: 24.7, APIs: 2, Strings: 12, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

_strnlen.LIBCMT ref: 6C68F622

Part of subcall function 6C68A3EB: FindFirstFileA.KERNELBASE(?,?,?,00000104,?,?,?), ref: 6C68A48E
Part of subcall function 6C68A3EB: FindClose.KERNEL32(00000000), ref: 6C68A49A

_strnlen.LIBCMT ref: 6C68F6CB

Part of subcall function 6C68B237: CreateFileA.KERNEL32(0000003B,40000000,00000003,00000000,00000003,00000080,00000000,?,6C693A9F,0000003B,0000003B,00000000,?,?,?,6C6812F4), ref: 6C68B251
Part of subcall function 6C68B237: GetLastError.KERNEL32(?,6C693A9F,0000003B,0000003B,00000000,?,?,?,6C6812F4,dxupdate.inf,?,?,6C6812F4), ref: 6C68B25C

Strings

IsTargetFileInUse(): %s is not locked., xrefs: 6C68F690, 6C68F723
Unable to create path string, %s%s., xrefs: 6C68F741
.xml, xrefs: 6C68F6D7
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68F57C, 6C68F5BB, 6C68F5F4, 6C68F754
.dll, xrefs: 6C68F6B6
IsTargetFileInUse(): Unable to get file list in section., xrefs: 6C68F76C
MDXDLLs, xrefs: 6C68F69C
IsTargetFileInUse(): %s is locked!, xrefs: 6C68F67A, 6C68F70D
IsTargetFileInUse, xrefs: 6C68F5B1, 6C68F5EA, 6C68F74A
Unable to find %s., xrefs: 6C68F5AA
LoadListFromInfSection() failed., xrefs: 6C68F5E3
_IsMDXDevInUse, xrefs: 6C68F580

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: FileFind__wstrtime_strnlen$CloseCreateErrorFirstLast_strrchr
String ID: .dll$.xml$IsTargetFileInUse$IsTargetFileInUse(): %s is locked!$IsTargetFileInUse(): %s is not locked.$IsTargetFileInUse(): Unable to get file list in section.$LoadListFromInfSection() failed.$MDXDLLs$Unable to create path string, %s%s.$Unable to find %s.$_IsMDXDevInUse$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 2474516121-2892458256
Opcode ID: 8657920304b977f8d171ea9da5a78b233837a3b30f6d714e67c2eac3a5e20dcb
Instruction ID: 04f6c49714b298df14352add59032c574759eee161e99c3235f005c899b44198
Opcode Fuzzy Hash: 8657920304b977f8d171ea9da5a78b233837a3b30f6d714e67c2eac3a5e20dcb
Instruction Fuzzy Hash: A2510A719072186AEB209BA59C81FDE77ACDF0635CF100595E615B2980DFB09AC48F7E

Uniqueness

Uniqueness Score: -1.00%

Function 6C694FF4 Relevance: 24.7, APIs: 3, Strings: 11, Instructions: 161COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C695069
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104,?,00000001,00000000), ref: 6C695093
GetLastError.KERNEL32(00000000,?,00000001,00000000), ref: 6C69509E

Strings

iUil, xrefs: 6C695009
%s is not trusted due to certificate problem. Please check valid certificate is installed and Cryptographic Services are enabled., xrefs: 6C6951DE
MultiByteToWideChar(), xrefs: 6C6950A5
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C6950B4, 6C6951F3, 6C695223
%s is not trusted. The file may be damaged. Please check valid certificate is installed and Cryptographic Services are enabled., xrefs: 6C6951C1
DXCheckTrust(): %s is trusted., xrefs: 6C695176
0, xrefs: 6C6950ED
%s is not trusted. The file is not signed properly., xrefs: 6C695196
WinVerifyTrust(), xrefs: 6C69519C, 6C6951C7, 6C6951E4
Unable to initialize CWinTrust., xrefs: 6C695212
DXCheckTrust, xrefs: 6C6950AA, 6C6951A1, 6C6951CC, 6C6951E9, 6C695219

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide_memset
String ID: %s is not trusted due to certificate problem. Please check valid certificate is installed and Cryptographic Services are enabled.$%s is not trusted. The file is not signed properly.$%s is not trusted. The file may be damaged. Please check valid certificate is installed and Cryptographic Services are enabled.$0$DXCheckTrust$DXCheckTrust(): %s is trusted.$MultiByteToWideChar()$Unable to initialize CWinTrust.$WinVerifyTrust()$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp$iUil
API String ID: 1545292163-794801010
Opcode ID: cea47a7602945bfe1120173e0217a85db8e0b82bd98f417ed50e2b959d855ea1
Instruction ID: 7f47e359cf054721eeb08c6098c70463b11411ca96cbba03b147aebdd559cb43
Opcode Fuzzy Hash: cea47a7602945bfe1120173e0217a85db8e0b82bd98f417ed50e2b959d855ea1
Instruction Fuzzy Hash: 5251FA71D46219BEEB205F54CCC8FEE77B4AB05309F100699E118E6A80DB708AC58F6D

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A4E65 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 153libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000314,6C6AA508,00000000,?,?,?,?,6C6A148B,6C6AA508,Microsoft Visual C++ Runtime Library,00012010), ref: 6C6A4E94
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 6C6A4EB3
GetProcAddress.KERNEL32(00000000,00000000), ref: 6C6A4ECC
GetProcAddress.KERNEL32(00000000,00000000), ref: 6C6A4EE1
__get_wpgmptr.LIBCMT ref: 6C6A4EF2
GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 6C6A4F16
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 6C6A4F2E
__get_amblksiz.LIBCMT ref: 6C6A4F86

Strings

USER32.DLL, xrefs: 6C6A4E8F
MessageBoxA, xrefs: 6C6A4EAD
GetUserObjectInformationA, xrefs: 6C6A4F10
GetActiveWindow, xrefs: 6C6A4EBF
GetProcessWindowStation, xrefs: 6C6A4F28
GetLastActivePopup, xrefs: 6C6A4ED4

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: AddressProc$LibraryLoad__get_amblksiz__get_wpgmptr
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2538533512-232180764
Opcode ID: 9ef2f6818829f670ea592d9f6324e1f7cae68818904c054f98b0f35ad23503f9
Instruction ID: f997fe280c67ee4067627280b89ee242bc880f707deff66f20e29ccb4d1382e7
Opcode Fuzzy Hash: 9ef2f6818829f670ea592d9f6324e1f7cae68818904c054f98b0f35ad23503f9
Instruction Fuzzy Hash: 5041E571905205BBDF01AFF69C849AE7BB8AB4A708F10182AE411D3601DF75D946CE6C

Uniqueness

Uniqueness Score: -1.00%

Function 6C68F938 Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 130COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C68F977
GetLastError.KERNEL32(00000000), ref: 6C68FAB1

Part of subcall function 6C689BC1: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 6C689D51
Part of subcall function 6C689BC1: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C689D76

GetWindowsDirectoryA.KERNEL32(?,00000104,?,6C6845C8,?,6C6812F4,?,?,6C6812F4,dxupdate.inf,e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp,00000000,IsMDXInUse), ref: 6C68FA0C

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

IsMDXInUse, xrefs: 6C68F950
Unable to create path string, %s\%s., xrefs: 6C68F9A8
Unable to create directory name, \v%s\., xrefs: 6C68FADF
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68F952, 6C68F9B9, 6C68FA9E, 6C68FAC7, 6C68FAF0
MDXDLLs, xrefs: 6C68FA4C
GetWindowsDirectory(), xrefs: 6C68FAB8
IsMDXDevInUse(): ProductVersion = %s., xrefs: 6C68F9D4
\Microsoft.NET\Managed DirectX, xrefs: 6C68FA21, 6C68FA26, 6C68FA85
IsMDXDevInUse, xrefs: 6C68F9AF, 6C68FA94, 6C68FABD, 6C68FAE6
Unable to create path string, %s%s%s., xrefs: 6C68FA8D
dxupdate.inf, xrefs: 6C68F97F, 6C68F984, 6C68F9A1

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$DirectoryErrorFormatFreeLastLocalMessageWindows_memset_strrchr
String ID: GetWindowsDirectory()$IsMDXDevInUse$IsMDXDevInUse(): ProductVersion = %s.$IsMDXInUse$MDXDLLs$Unable to create directory name, \v%s\.$Unable to create path string, %s%s%s.$Unable to create path string, %s\%s.$\Microsoft.NET\Managed DirectX$dxupdate.inf$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 600149719-3529715575
Opcode ID: 57cd27371bb62f45c83c55cd1a2215817958d16596edfc7bfd0649be003ccee2
Instruction ID: 3eb319dc8ef8413b2c03c4ea5a3ab74f9bcd7e91b6ddd500186094c199dc2156
Opcode Fuzzy Hash: 57cd27371bb62f45c83c55cd1a2215817958d16596edfc7bfd0649be003ccee2
Instruction Fuzzy Hash: 014188B190211CBADB10DA548C84EEA77BCDB56358F0045A5F614F2980EA709FC48F7E

Uniqueness

Uniqueness Score: -1.00%

Function 6C69C568 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 112libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,6C69A52D), ref: 6C69C570
__mtterm.LIBCMT ref: 6C69C57C

Part of subcall function 6C69C20A: TlsFree.KERNELBASE(00000038,6C69A5C1), ref: 6C69C235
Part of subcall function 6C69C20A: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,6C69A5C1), ref: 6C69F8AD
Part of subcall function 6C69C20A: DeleteCriticalSection.KERNEL32(00000038,?,?,6C69A5C1), ref: 6C69F8D7

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 6C69C592
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 6C69C59F
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 6C69C5AC
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 6C69C5B9
TlsAlloc.KERNEL32(?,6C69A52D), ref: 6C69C609
TlsSetValue.KERNEL32(00000000,?,6C69A52D), ref: 6C69C620
__mtterm.LIBCMT ref: 6C69C677

Strings

FlsSetValue, xrefs: 6C69C5A1
KERNEL32.DLL, xrefs: 6C69C56B
FlsAlloc, xrefs: 6C69C58C
FlsFree, xrefs: 6C69C5AE
FlsGetValue, xrefs: 6C69C594

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection__mtterm$AllocFreeHandleModuleValue
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 1270926730-3819984048
Opcode ID: d08e186748db8d7b45783b16884176447fdae5030fe7b1d9561b34101115199e
Instruction ID: ed0a0d76259e6000e3bd6b6900eb2a2835a2167a3076d49968118709319d93a6
Opcode Fuzzy Hash: d08e186748db8d7b45783b16884176447fdae5030fe7b1d9561b34101115199e
Instruction Fuzzy Hash: 11316871A05242BADF117BF7AC8479D3AB4AB4F36CF204557E421D2A90EB329040DF5D

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A4307 Relevance: 24.4, APIs: 16, Instructions: 391COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,6C688CA8,00000001,00000000,00000000,6C6A6A68,0000002C,6C6A47F4,00004000,00000000,00004000,?,?,?,?), ref: 6C6A4331
GetLastError.KERNEL32(?,6C69EC67,6C6812E7,UTF-8,00000000,6C6812E8,00000000,6C6A93E8), ref: 6C6A4343
MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,6C6A6A68,0000002C,6C6A47F4,00004000,00000000,00004000,?,?,?,?), ref: 6C6A43D2
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000), ref: 6C6A4486

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastString
String ID:
API String ID: 2717499641-0
Opcode ID: 3841a936bbb4222ee1cda8e14da7d338753e9b2c970a4422a468204c5cc41585
Instruction ID: e83118cbc208e2337f8cb5980112e7bf7397304af1b6a2f0297f43fe3ceaa8ef
Opcode Fuzzy Hash: 3841a936bbb4222ee1cda8e14da7d338753e9b2c970a4422a468204c5cc41585
Instruction Fuzzy Hash: 11D18D71905219EFDF018FE5DC84AEE7BB5EF0A318F206129F514A6A50DBB1CC52CB68

Uniqueness

Uniqueness Score: -1.00%

Function 6C696516 Relevance: 24.2, APIs: 3, Strings: 13, Instructions: 216COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(Unable to open %s.,?), ref: 6C6965BA

Strings

DirectXUpdateInstallPlugIn, xrefs: 6C69653B
SetupGetLineText(), xrefs: 6C6966DD
MDX, xrefs: 6C69662D
Unable to open %s., xrefs: 6C6965B5
Unable to initialize CSetupAPI., xrefs: 6C6967C6
, xrefs: 6C69654B
SetupOpenInfFile(), xrefs: 6C6965C1
TestForPlugIn(): %s is locked!, xrefs: 6C6966BA
TestForPlugIn(): %s is not locked., xrefs: 6C696693
SetupFindfirstLine(), xrefs: 6C696774
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C69653C, 6C6965D0, 6C6966EC, 6C696783, 6C6967D7
TestForPlugIn, xrefs: 6C6965C6, 6C6966E2, 6C696779, 6C6967CD
;, xrefs: 6C696624

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorLast
String ID: $;$DirectXUpdateInstallPlugIn$MDX$SetupFindfirstLine()$SetupGetLineText()$SetupOpenInfFile()$TestForPlugIn$TestForPlugIn(): %s is locked!$TestForPlugIn(): %s is not locked.$Unable to initialize CSetupAPI.$Unable to open %s.$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 1452528299-4140705820
Opcode ID: 86acd5fb3d198386c085346ea32f173be4fe5cff7fee04ddb8eb40a151e41f4a
Instruction ID: 068b0486ad13a5eb1faba0f64acf99094a61d7bb5c802e7ab00c0450787366b4
Opcode Fuzzy Hash: 86acd5fb3d198386c085346ea32f173be4fe5cff7fee04ddb8eb40a151e41f4a
Instruction Fuzzy Hash: C0714C31A0131AABCB655B658C44FEE77B8AF06718F104599F519E6980DB70CAC08FFC

Uniqueness

Uniqueness Score: -1.00%

Function 6C689A8B Relevance: 22.8, APIs: 4, Strings: 9, Instructions: 80COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 6C689AC1
OutputDebugStringA.KERNEL32(DXSETUP_DPF(): Unable to open log file.,00000000,00000000), ref: 6C689AD0
CreateDirectoryA.KERNEL32(?,00000000), ref: 6C689B10
GetLastError.KERNEL32 ref: 6C689B1A

Strings

--------------------, xrefs: 6C689B70
%s%s%s, xrefs: 6C689B3F
DXSETUP_DPF(): Unable to open log file., xrefs: 6C689B65
%s%s, xrefs: 6C689AE7
DXSETUP_DPF(): failed to create log directory., xrefs: 6C689B27
DXSETUP_DPF(): path name too long., xrefs: 6C689B00
\Logs, xrefs: 6C689ADB
DXSETUP_DPF(): GetWindowsDirectory() failed., xrefs: 6C689ACB
Logs\DXError.log, xrefs: 6C689B2E

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: Directory$CreateDebugErrorLastOutputStringWindows
String ID: %s%s$%s%s%s$--------------------$DXSETUP_DPF(): GetWindowsDirectory() failed.$DXSETUP_DPF(): Unable to open log file.$DXSETUP_DPF(): failed to create log directory.$DXSETUP_DPF(): path name too long.$Logs\DXError.log$\Logs
API String ID: 3967814497-1050326959
Opcode ID: ae0ebc00366ae80888278e2b28891786714a7a63377cb4351138e0554a1dfde4
Instruction ID: 9fed73ceccc6e707658fcdebc3aaddf8e2f863fbdb1039ec5f8a8f87c677ad4b
Opcode Fuzzy Hash: ae0ebc00366ae80888278e2b28891786714a7a63377cb4351138e0554a1dfde4
Instruction Fuzzy Hash: 9321AE75A0B214B7C71096A68C88FCB37BC9B4271CF540965FA66E2D01E724DA448A7D

Uniqueness

Uniqueness Score: -1.00%

Function 6C68B31E Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 68libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,\ddraw.dll,?,6C68F00B,?,\dinput8d.dll,00000000,?,00000000,\ddraw.dll,?,?,00000000,?), ref: 6C68B328
FindResourceExA.KERNEL32(00000000,00000010,00000001,00000409), ref: 6C68B347
FindResourceExA.KERNEL32(00000000,00000010,00000001,00000411), ref: 6C68B356
FindResourceExA.KERNEL32(00000000,00000010,00000001,00000407), ref: 6C68B365
FreeLibrary.KERNEL32(00000000,?,6C68F00B,?,\dinput8d.dll,00000000,?,00000000,\ddraw.dll,?,?,00000000,?), ref: 6C68B36E
GetLastError.KERNEL32(6C68F00B,?,\dinput8d.dll,00000000,?,00000000,\ddraw.dll,?,?,00000000,?), ref: 6C68B379
GetLastError.KERNEL32(Unable to load %s.,?,?,6C68F00B,?,\dinput8d.dll,00000000,?,00000000,\ddraw.dll,?,?,00000000,?), ref: 6C68B3AC

Strings

FreeLibrary(), xrefs: 6C68B386
LoadLibrary(), xrefs: 6C68B3B3
IsMultilingual, xrefs: 6C68B38B, 6C68B3B8
e:\bt\382730\setup\deliverables\dxupdate\inline.h, xrefs: 6C68B395, 6C68B3C2
Unable to load %s., xrefs: 6C68B3A7
\ddraw.dll, xrefs: 6C68B323

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: FindResource$ErrorLastLibrary$FreeLoad
String ID: FreeLibrary()$IsMultilingual$LoadLibrary()$Unable to load %s.$\ddraw.dll$e:\bt\382730\setup\deliverables\dxupdate\inline.h
API String ID: 2275697535-429043600
Opcode ID: 4a4a617adbdd40459bd4e885a4ea21368951f0d0b6487537f9e26271663f8fe5
Instruction ID: edbe16858de07ee78458e9bce672defd7582c2cb092e3f491477fcb13d6b6ed2
Opcode Fuzzy Hash: 4a4a617adbdd40459bd4e885a4ea21368951f0d0b6487537f9e26271663f8fe5
Instruction Fuzzy Hash: D511D671747209BBFB001AA54CC6FB739ACDF86FC8F100425FB20B5880EAA1C902687D

Uniqueness

Uniqueness Score: -1.00%

Function 6C68F7A7 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 118registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\.NETFramework\AssemblyFolders,00000000,00020007,?,?,00000000,00000000), ref: 6C68F7F1
RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00000001,?), ref: 6C68F80C
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,?,?), ref: 6C68F841
RegCloseKey.ADVAPI32(?), ref: 6C68F853

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

RegCloseKey.ADVAPI32(?), ref: 6C68F8D7

Strings

RegQueryValueEx(), xrefs: 6C68F8A1
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68F813, 6C68F86A, 6C68F8C0, 6C68F8EE, 6C68F907
RegOpenKeyEx(), xrefs: 6C68F8B5, 6C68F8F8
MDXDLLs, xrefs: 6C68F888
Software\Microsoft\.NETFramework\AssemblyFolders, xrefs: 6C68F7E7
RegCloseKey(), xrefs: 6C68F85F, 6C68F8E3
_IsMDXDevInUse, xrefs: 6C68F80E, 6C68F864, 6C68F8A6, 6C68F8BA, 6C68F8E8, 6C68F8FD

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: CloseOpen__wstrtime$QueryValue_strrchr
String ID: MDXDLLs$RegCloseKey()$RegOpenKeyEx()$RegQueryValueEx()$Software\Microsoft\.NETFramework\AssemblyFolders$_IsMDXDevInUse$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 856003746-2312745670
Opcode ID: 058509dd8c9ca53c05ff2f0ad4f05fc13c01fd8ccdeb3c17586911dafde7e1ef
Instruction ID: 0d74eced008d9f26607cf96e0d8baf0c6e5c83baef766b973dacfed276f1a3a9
Opcode Fuzzy Hash: 058509dd8c9ca53c05ff2f0ad4f05fc13c01fd8ccdeb3c17586911dafde7e1ef
Instruction Fuzzy Hash: DE416DB1D0211CBFEB219A518C82EEB777CEB56748F4005A6F604E2541D6B08E848FBA

Uniqueness

Uniqueness Score: -1.00%

Function 6C689F7A Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeA.VERSION(6C68A06B,?,?,00000000,00000000,?,?,6C68A06B,?), ref: 6C689F8B

Part of subcall function 6C689ED4: _strrchr.LIBCMT ref: 6C689EDF

GetLastError.KERNEL32(6C68A06B,6C68A06B,?,?,00000000,00000000,?,?,6C68A06B,?), ref: 6C689FA2
_memset.LIBCMT ref: 6C689FFA
GetFileVersionInfoA.VERSION(6C68A06B,00000000,00000000,00000000,?,6C68A06B,?), ref: 6C68A008
GetLastError.KERNEL32(00000000,6C68A06B,00000000,00000000,00000000,?,6C68A06B,?), ref: 6C68A012

Strings

GetFileVersionInfoBlock, xrefs: 6C689FDE, 6C68A01E
GetFileVersionInfoBlock(): Unable to get FileVersionInfoSize, file: %s, reason: %d., xrefs: 6C689FAA
GetFileVersionInfo(), xrefs: 6C68A019
e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h, xrefs: 6C689FE8, 6C68A028
GetFileVersionInfoBlock(): %s does not have version information., xrefs: 6C689FBA
Unable to allocate memory., xrefs: 6C689FD7

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorFileInfoLastVersion$Size_memset_strrchr
String ID: GetFileVersionInfo()$GetFileVersionInfoBlock$GetFileVersionInfoBlock(): %s does not have version information.$GetFileVersionInfoBlock(): Unable to get FileVersionInfoSize, file: %s, reason: %d.$Unable to allocate memory.$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
API String ID: 388213077-1642510695
Opcode ID: 7e95ec25793930c6ed7091e42ca07546538f3e87739fe357acb003820dad50c9
Instruction ID: 97cde1d08c9cae0f55e759ad762dbfa9489bce1a52e05d110882fd2300d0ae43
Opcode Fuzzy Hash: 7e95ec25793930c6ed7091e42ca07546538f3e87739fe357acb003820dad50c9
Instruction Fuzzy Hash: 3F1108A2A0B0257A93143AAA5C84CEF396CCF537DC7080425F902E1E42FA11CE4589BE

Uniqueness

Uniqueness Score: -1.00%

Function 6C6929D8 Relevance: 18.1, APIs: 3, Strings: 9, Instructions: 146COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(Unable to open %s.,00000000), ref: 6C692A53

Part of subcall function 6C68F43D: LoadLibraryExA.KERNEL32(6C692ADF,00000000,00000008,6C692ADF,00000000,00000000,6C6981D2,00000000,?,?,?,6C692ADF,0000003B), ref: 6C68F462
Part of subcall function 6C68F43D: GetProcAddress.KERNEL32(00000000,DllRegisterServer), ref: 6C68F47A
Part of subcall function 6C68F43D: FreeLibrary.KERNEL32(6C692ADF,?,?,?,?,?,?,6C692ADF,0000003B), ref: 6C68F4EF
Part of subcall function 6C68F43D: GetLastError.KERNEL32(00000000,?,?,?,?,?,?,6C692ADF,0000003B), ref: 6C68F4FA

GetLastError.KERNEL32(00000000), ref: 6C692B24

Part of subcall function 6C689BC1: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 6C689D51
Part of subcall function 6C689BC1: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C689D76

Part of subcall function 6C689BC1: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C689D7E

GetLastError.KERNEL32(00000000), ref: 6C692AE4

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

SetupFindfirstLine(), xrefs: 6C692B2B
SetupGetLineText(), xrefs: 6C692AEB
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C6929F4, 6C692A69, 6C692AFA, 6C692B3A, 6C692B7E
DirectXUpdateInstall, xrefs: 6C6929F8
RegisterDllFromSection, xrefs: 6C692A5F, 6C692AF0, 6C692B30, 6C692B74
Unable to open %s., xrefs: 6C692A4E
Unable to initialize CSetupAPI., xrefs: 6C692B6D
SetupOpenInfFile(), xrefs: 6C692A5A
;, xrefs: 6C692ABD

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorLast$FreeLibrary__wstrtime$AddressFormatLoadLocalMessageProc_strrchr
String ID: ;$DirectXUpdateInstall$RegisterDllFromSection$SetupFindfirstLine()$SetupGetLineText()$SetupOpenInfFile()$Unable to initialize CSetupAPI.$Unable to open %s.$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 63134139-2384529571
Opcode ID: 7f16b4f4952e10babb9226bb79237847f6c8fb07f206e2d7b33be157938e529e
Instruction ID: fafe068fd0b62231390ab40bf34aba17349f5b031e8eb2c1975fd80be2ee57e0
Opcode Fuzzy Hash: 7f16b4f4952e10babb9226bb79237847f6c8fb07f206e2d7b33be157938e529e
Instruction Fuzzy Hash: C1414972A01206BBDB219AB58C8CEEF77F8AB4BB18F100845F555E2941D7B04A808A7D

Uniqueness

Uniqueness Score: -1.00%

Function 6C68FE3C Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32(?,DefaultInstall,RegisterDLL64,e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp,00000000), ref: 6C68FE63

Part of subcall function 6C68C15A: _memset.LIBCMT ref: 6C68C16F
Part of subcall function 6C68C15A: CreateProcessA.KERNEL32(00000000,6C6846C8,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?), ref: 6C68C193
Part of subcall function 6C68C15A: WaitForSingleObject.KERNEL32(?,000000FF,?,00000104,?), ref: 6C68C1A6
Part of subcall function 6C68C15A: GetLastError.KERNEL32(00000000,?,00000104,?), ref: 6C68C1B2
Part of subcall function 6C68C15A: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 6C68C1DE
Part of subcall function 6C68C15A: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 6C68C1E3

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Part of subcall function 6C689EA5: CompareStringA.KERNEL32(00000409,00000001,?,000000FF,6C690ED5,000000FF,?,6C690ED5,?,Version,?,00000000,?), ref: 6C689EBB

Strings

InstallEXE(): %s returned %d., xrefs: 6C68FF15
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68FE55, 6C68FEB4, 6C68FEFC
RunProcess() failed., xrefs: 6C68FEA3
Unable to create command string, %s %s., xrefs: 6C68FEEB
InstallEXE, xrefs: 6C68FEAA, 6C68FEF2
RegSvr32.exe, xrefs: 6C68FF39
InstallEXE(): Command:%s %s, xrefs: 6C68FEC5
infinst.exe, xrefs: 6C68FF22
InstallEXE(): Command:%s, xrefs: 6C68FE6E
DefaultInstall, xrefs: 6C68FE5D
RegisterDLL64, xrefs: 6C68FE59

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: CloseHandle__wstrtime$CompareCreateErrorLastObjectProcessSingleStringWait_memset_strrchrlstrcmp
String ID: DefaultInstall$InstallEXE$InstallEXE(): %s returned %d.$InstallEXE(): Command:%s$InstallEXE(): Command:%s %s$RegSvr32.exe$RegisterDLL64$RunProcess() failed.$Unable to create command string, %s %s.$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp$infinst.exe
API String ID: 2433414053-2811192177
Opcode ID: 4a0fecdb34d02faefd92baef00dde7bda1101222f8fc74ed0dde7431c0c3a5ba
Instruction ID: 16db4ce9039f10f284a302899a2bb5280594a2378f0397cb3f5a60dee6c6feb4
Opcode Fuzzy Hash: 4a0fecdb34d02faefd92baef00dde7bda1101222f8fc74ed0dde7431c0c3a5ba
Instruction Fuzzy Hash: AA21F6725071147AD720AAB59C44EFB37BC9F5731CF000A51F918E2940EBB0D9888EBE

Uniqueness

Uniqueness Score: -1.00%

Function 6C68DB78 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 98fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,00000000), ref: 6C68DC1E
GetLastError.KERNEL32(Unable to copy %s to %s.,?,?), ref: 6C68DC3B

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

Unable to find %s to rename, original version is used., xrefs: 6C68DC79
CopyFile(), xrefs: 6C68DC42
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68DBC0, 6C68DC51
Unable to copy %s to %s., xrefs: 6C68DC36
DirectXUpdateInstall, xrefs: 6C68DB95
Renamed %s to %s, xrefs: 6C68DC63
DXRenameFile, xrefs: 6C68DBB6, 6C68DBF0, 6C68DC47
Unable to create path string %s%s, failed to rename %s to %s., xrefs: 6C68DBAF, 6C68DBE9

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$CopyErrorFileLast_strrchr
String ID: CopyFile()$DXRenameFile$DirectXUpdateInstall$Renamed %s to %s$Unable to copy %s to %s.$Unable to create path string %s%s, failed to rename %s to %s.$Unable to find %s to rename, original version is used.$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 4156371552-2855794351
Opcode ID: 565700de217460285f5a7eef16dc209c195b16176cd3bc919730828ddccd5181
Instruction ID: 67ae6d71f7569017150bafed7f3604b53c6ebf6d75c0328fdcc26b2c81a256d5
Opcode Fuzzy Hash: 565700de217460285f5a7eef16dc209c195b16176cd3bc919730828ddccd5181
Instruction Fuzzy Hash: 4B21D8B69071097BD710DAA58C84EEB77BCDB46708F000566FA15E3940EB70DA848B7C

Uniqueness

Uniqueness Score: -1.00%

Function 6C68A8BC Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 97COMMON

Download Yara Rule

Strings

Unable to create path string, %s%s., xrefs: 6C68A923, 6C68A947
CopyFile(), xrefs: 6C68A998
Unable to copy %s to %s., xrefs: 6C68A98C
DX%s.CAT, xrefs: 6C68A8D1
InstCatWinMe(): installing catalog file..., xrefs: 6C68A904
InstCatWinMe(): deleting catalog file..., xrefs: 6C68A8F0
InstCatWinMe, xrefs: 6C68A92A, 6C68A94E, 6C68A99D
e:\bt\382730\setup\deliverables\dxupdate\instcat.cpp, xrefs: 6C68A9A4

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID:
String ID: CopyFile()$DX%s.CAT$InstCatWinMe$InstCatWinMe(): deleting catalog file...$InstCatWinMe(): installing catalog file...$Unable to copy %s to %s.$Unable to create path string, %s%s.$e:\bt\382730\setup\deliverables\dxupdate\instcat.cpp
API String ID: 0-1446033246
Opcode ID: fbcefecfc0d96e7fa7e6d6e12ca26c15884b402ed965f328e5a4caf8bf6de349
Instruction ID: 1d397339fff68698cad43a45b26a9a7537bb86c3e059e6d434b8223492e81999
Opcode Fuzzy Hash: fbcefecfc0d96e7fa7e6d6e12ca26c15884b402ed965f328e5a4caf8bf6de349
Instruction Fuzzy Hash: 572180B2507218BADF109AA19C85FFB376CDF4631CF110556BD21E2982DB74DE448ABC

Uniqueness

Uniqueness Score: -1.00%

Function 6C68C631 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000004,?), ref: 6C68C64B
GetLastError.KERNEL32 ref: 6C68C656
_strnlen.LIBCMT ref: 6C68C6B7
SHFileOperationA.SHELL32(?,?,00000104,00000004,?,00000000), ref: 6C68C708
DeleteFileA.KERNEL32(00000004,?,00000000), ref: 6C68C717

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

GetLastError.KERNEL32(Unable to remove %s.,00000004), ref: 6C68C729

Strings

Unable to remove %s., xrefs: 6C68C724
DXRemoveFile, xrefs: 6C68C66E, 6C68C731
e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h, xrefs: 6C68C678, 6C68C73B
GetFileAttributes(), xrefs: 6C68C669

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: File$ErrorLast__wstrtime$AttributesDeleteOperation_strnlen_strrchr
String ID: DXRemoveFile$GetFileAttributes()$Unable to remove %s.$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
API String ID: 3110083123-1900097680
Opcode ID: 864d42d3133fb2eb51de813e41de860b081485cd6b4caec3dacd2d71c20fe12c
Instruction ID: 8460beb8aa821397b092a69de29f47d0f6995bd3cef75d4e1ea612420d927be1
Opcode Fuzzy Hash: 864d42d3133fb2eb51de813e41de860b081485cd6b4caec3dacd2d71c20fe12c
Instruction Fuzzy Hash: B1212B71D02118BBCB10ABA98C85FDEB7B8DB0B354F5006A5E655E3540D7308E848FBC

Uniqueness

Uniqueness Score: -1.00%

Function 6C68B0F6 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 64libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 6C68B10F
FreeLibrary.KERNEL32(00000000,?,00000000,?,?,dxupdate.cab), ref: 6C68B154
GetLastError.KERNEL32 ref: 6C68B15E

Part of subcall function 6C689BC1: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 6C689D51
Part of subcall function 6C689BC1: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C689D76

GetLastError.KERNEL32(Module: %s, Function: %s,00000004,?,6C6A9880,?,6C6912C5,SetupDefaultQueueCallbackA,setupapi.dll,00000104,6C693D09,6C6A9880,6C6A9880,00000104,?,?,00000000), ref: 6C68B12D

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

FreeLibrary(), xrefs: 6C68B16B
CDllLoader::GetProcAddress, xrefs: 6C68B139, 6C68B13E, 6C68B170, 6C68B18C
GetProcAddress(), xrefs: 6C68B134
Invalid member - m_hModule is NULL., xrefs: 6C68B185
e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h, xrefs: 6C68B144, 6C68B149, 6C68B176, 6C68B196
Module: %s, Function: %s, xrefs: 6C68B128

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorFreeLast__wstrtime$AddressFormatLibraryLocalMessageProc_strrchr
String ID: CDllLoader::GetProcAddress$FreeLibrary()$GetProcAddress()$Invalid member - m_hModule is NULL.$Module: %s, Function: %s$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
API String ID: 2317682547-2938890287
Opcode ID: b3699d6568cc1d6cc5fe7616a2a60b00afbf80da5396728b0b622637d886bdb6
Instruction ID: 2270f1b320c9f4c0261bd04ec578a2f014ea21e4fe34f861cd22f18e4eb9ccf4
Opcode Fuzzy Hash: b3699d6568cc1d6cc5fe7616a2a60b00afbf80da5396728b0b622637d886bdb6
Instruction Fuzzy Hash: BF11E5B1A03104FFE7115E96CC89E6B37BCEBC6B88F100419F595E6940E261DB008A7C

Uniqueness

Uniqueness Score: -1.00%

Function 6C68B3DC Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 50libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00000104,?,6C68F02E,?,?,\dinput8d.dll,00000000,?,00000000,\ddraw.dll,?,?,00000000,?), ref: 6C68B3E6
FindResourceExA.KERNEL32(00000000,00000010,00000001,00000409), ref: 6C68B3FE
FreeLibrary.KERNEL32(00000000,?,6C68F02E,?,?,\dinput8d.dll,00000000,?,00000000,\ddraw.dll,?,?,00000000,?), ref: 6C68B40B
GetLastError.KERNEL32(?,6C68F02E,?,?,\dinput8d.dll,00000000,?,00000000,\ddraw.dll,?,?,00000000,?), ref: 6C68B415

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

GetLastError.KERNEL32(Unable to load %s.,?,?,6C68F02E,?,?,\dinput8d.dll,00000000,?,00000000,\ddraw.dll,?,?,00000000,?), ref: 6C68B448

Strings

IsEnglish, xrefs: 6C68B427, 6C68B454
FreeLibrary(), xrefs: 6C68B422
LoadLibrary(), xrefs: 6C68B44F
e:\bt\382730\setup\deliverables\dxupdate\inline.h, xrefs: 6C68B431, 6C68B45E
Unable to load %s., xrefs: 6C68B443

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorLastLibrary__wstrtime$FindFreeLoadResource_strrchr
String ID: FreeLibrary()$IsEnglish$LoadLibrary()$Unable to load %s.$e:\bt\382730\setup\deliverables\dxupdate\inline.h
API String ID: 664765759-1316196923
Opcode ID: 11c031a07254b8e99675180ca886ff1969ee33440b80444bf7c9975067686979
Instruction ID: bc28b7d3c4046cd7e7578ce97efcd52df004a01e611a75c7ce883e139566c983
Opcode Fuzzy Hash: 11c031a07254b8e99675180ca886ff1969ee33440b80444bf7c9975067686979
Instruction Fuzzy Hash: FE012D32743500B7EB1016A68C4FF9739A8DF83FC5F014514F621F5984DA71C5015ABD

Uniqueness

Uniqueness Score: -1.00%

Function 6C68A04B Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 62COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C68A05B

Part of subcall function 6C689F7A: GetFileVersionInfoSizeA.VERSION(6C68A06B,?,?,00000000,00000000,?,?,6C68A06B,?), ref: 6C689F8B
Part of subcall function 6C689F7A: GetLastError.KERNEL32(6C68A06B,6C68A06B,?,?,00000000,00000000,?,?,6C68A06B,?), ref: 6C689FA2

VerQueryValueW.VERSION(00000000,6C681724,?,?,?), ref: 6C68A083
GetLastError.KERNEL32(00000000,00000000,6C681724,?,?,?), ref: 6C68A08D

Strings

Data size mismatch., xrefs: 6C68A0AB
VerQueryValue(), xrefs: 6C68A094
DXGetFileVersion, xrefs: 6C68A099, 6C68A0B4
e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h, xrefs: 6C68A0BE
4, xrefs: 6C68A0A5

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ErrorLast$FileInfoQuerySizeValueVersion_memset
String ID: 4$DXGetFileVersion$Data size mismatch.$VerQueryValue()$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
API String ID: 2833552196-926253235
Opcode ID: f27e851c0924ec6f8ff5fdf45d3972c6d6a205eff3c1468a60a469053b5e4786
Instruction ID: 65535405f3fe8178c85623d54085f085d8c53508c9807573313f135e0cbe7eb2
Opcode Fuzzy Hash: f27e851c0924ec6f8ff5fdf45d3972c6d6a205eff3c1468a60a469053b5e4786
Instruction Fuzzy Hash: 03012871642208BEEB111A948C81FEF366CEB427DCF204524FE11A89C2E771DF05953D

Uniqueness

Uniqueness Score: -1.00%

Function 6C689ED4 Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 59COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6C689EDF

Part of subcall function 6C689EA5: CompareStringA.KERNEL32(00000409,00000001,?,000000FF,6C690ED5,000000FF,?,6C690ED5,?,Version,?,00000000,?), ref: 6C689EBB

Strings

png, xrefs: 6C689F1E
txt, xrefs: 6C689F0F
dls, xrefs: 6C689F5A
fon, xrefs: 6C689F2D
inf, xrefs: 6C689EF1
chm, xrefs: 6C689F4B
ini, xrefs: 6C689F00
hlp, xrefs: 6C689F3C

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: CompareString_strrchr
String ID: chm$dls$fon$hlp$inf$ini$png$txt
API String ID: 987711976-1006119773
Opcode ID: 20a501b0cece079286751c72ab5fc4807ee0c90a4875602beefbb07d0b4cc2d5
Instruction ID: 05bceace756e6af72da9d3ca97b73f39c8bc31606173756cadaf12f5119f17df
Opcode Fuzzy Hash: 20a501b0cece079286751c72ab5fc4807ee0c90a4875602beefbb07d0b4cc2d5
Instruction Fuzzy Hash: C701CD6514B71634B78625368D04EDF2BDE9F1329CB101424BE25F0DD4EF05D646C8BE

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A5E22 Relevance: 15.2, APIs: 10, Instructions: 198COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,6C688CA8,00000001,?,?,00000004,00000000), ref: 6C6A5E63
GetStringTypeW.KERNEL32(?,?,000000FF,?,?,00000004,00000000), ref: 6C6A5E9B

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: StringType
String ID:
API String ID: 4177115715-0
Opcode ID: c34ae23f5eaa4acccecc604c41161e979f31548c7ad2cb8ef4c49a0da6d0824b
Instruction ID: 465694c9ce268652397b2880710e4f7f0f580b4ac3f2e77ef008ae77c6e42ab8
Opcode Fuzzy Hash: c34ae23f5eaa4acccecc604c41161e979f31548c7ad2cb8ef4c49a0da6d0824b
Instruction Fuzzy Hash: F3618B71904A09AFDF11CFEACC8089EBBB5FF4A358B204516E96496A50D730DC93CF69

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A1346 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 150fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

__set_error_mode.LIBCMT ref: 6C6A1377
__set_error_mode.LIBCMT ref: 6C6A1388
GetModuleFileNameA.KERNEL32(00000000,6C6AA521,00000104,00000000,00000000,00000000,?,6C69C33C,00000001,00000214), ref: 6C6A13E8
GetStdHandle.KERNEL32(000000F4,772F5E70,00000000,00000000,00000003,00000003,?,6C6A14FC,000000FC,6C69B8D2,?,6C69F955,00000018,6C6A6880,0000000C,6C69F9EB), ref: 6C6A1492
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,6C6A14FC,000000FC,6C69B8D2,?,6C69F955,00000018,6C6A6880,0000000C,6C69F9EB,00000000), ref: 6C6A14C0

Strings

Runtime Error!Program: , xrefs: 6C6A13AB
<program name unknown>, xrefs: 6C6A13F2
Microsoft Visual C++ Runtime Library, xrefs: 6C6A1480

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: File__set_error_mode$HandleModuleNameWrite
String ID: <program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3248813247-385325454
Opcode ID: 8544e60b49050678692f47be05808075c3cdc3e7ce8f1320ece7fe474a1c2240
Instruction ID: 8189904eb58a1547c3682d3630a27922fe34d8554d3456f587c604c62db4ec83
Opcode Fuzzy Hash: 8544e60b49050678692f47be05808075c3cdc3e7ce8f1320ece7fe474a1c2240
Instruction Fuzzy Hash: F23118B2A02201FBEB105AE94C84EAF726CDF5775CF154025F916A2E41E661DE0B81BD

Uniqueness

Uniqueness Score: -1.00%

Function 6C68D1E5 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,00000000,?,?,6C6812F4,00000000,CMDXInstall::Install,e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp,00000000), ref: 6C68D266
GetLastError.KERNEL32 ref: 6C68D270

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Part of subcall function 6C689BC1: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 6C689D51
Part of subcall function 6C689BC1: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C689D76

Strings

DXCreateDirectoryTree, xrefs: 6C68D2C1, 6C68D2ED
Unable to create path string, %s\%s., xrefs: 6C68D2E4
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68D202
CreateDirectory(), xrefs: 6C68D2BC
CMDXInstall::Install, xrefs: 6C68D203
e:\bt\382730\setup\deliverables\dxupdate\inline.h, xrefs: 6C68D2CB, 6C68D2F7

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$CreateDirectoryErrorFormatFreeLastLocalMessage_strrchr
String ID: CMDXInstall::Install$CreateDirectory()$DXCreateDirectoryTree$Unable to create path string, %s\%s.$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp$e:\bt\382730\setup\deliverables\dxupdate\inline.h
API String ID: 967560131-6166127
Opcode ID: edf47aa460a70f18255b26482a4fbbad4b2381b1df3e5a97bbcd3b326ab0e07b
Instruction ID: 859d4955c9cbf8540f6a4b86ecf392a36aa62ac340d25a59d96784ddf74c823b
Opcode Fuzzy Hash: edf47aa460a70f18255b26482a4fbbad4b2381b1df3e5a97bbcd3b326ab0e07b
Instruction Fuzzy Hash: 8221BCB290611DBBDB20DA958C85FDB737CDB4A358F0404A6FA15E2541E670DB888B7C

Uniqueness

Uniqueness Score: -1.00%

Function 6C68C760 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 75COMMON

Download Yara Rule

APIs

_realloc.LIBCMT ref: 6C68C7AD
GetPrivateProfileSectionA.KERNEL32(7655B4B0,00000000,-00000258,?), ref: 6C68C7C2

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

realloc(), xrefs: 6C68C7DB
LoadListFromInfSection, xrefs: 6C68C788, 6C68C7E0
e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h, xrefs: 6C68C792, 6C68C7EA
Unable to find %s, xrefs: 6C68C781
Unable to allocate memory., xrefs: 6C68C7D5
LoadListFromInfSection(): Unable to load %s - [%s]., xrefs: 6C68C812

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$PrivateProfileSection_realloc_strrchr
String ID: LoadListFromInfSection$LoadListFromInfSection(): Unable to load %s - [%s].$Unable to allocate memory.$Unable to find %s$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h$realloc()
API String ID: 2994852080-3670691587
Opcode ID: e8c15f2d80828c249ed1e4d7eb841a5e2a80687aba7781dc82217ef27d4e8bae
Instruction ID: 8d2beb4da2df69d970f5a642b370e52b745ffed0887ae837990b9e97306be121
Opcode Fuzzy Hash: e8c15f2d80828c249ed1e4d7eb841a5e2a80687aba7781dc82217ef27d4e8bae
Instruction Fuzzy Hash: 27112BB2607205BFEB102F95CCC0C9ABBA8EF9135CB204639FA1596A40E73189148B7C

Uniqueness

Uniqueness Score: -1.00%

Function 6C69C24C Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 46libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,6C6A6770,0000000C,6C69C365,00000000,00000000), ref: 6C69C25D
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 6C69C286
GetProcAddress.KERNEL32(?,DecodePointer), ref: 6C69C296
InterlockedIncrement.KERNEL32(6C6A8880), ref: 6C69C2B8
___addlocaleref.LIBCMT ref: 6C69C2DF

Strings

EncodePointer, xrefs: 6C69C27A
KERNEL32.DLL, xrefs: 6C69C258
DecodePointer, xrefs: 6C69C28E

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1389861978-2843748187
Opcode ID: 660d40baa57b0dd8f940c88d47b98afd6f80d4d4d54f1f57cd49a070b3c36c58
Instruction ID: 5be98dc4266c346bea1d8e926612171c1348e5ade925ccb924726a19d0184bb7
Opcode Fuzzy Hash: 660d40baa57b0dd8f940c88d47b98afd6f80d4d4d54f1f57cd49a070b3c36c58
Instruction Fuzzy Hash: D511A371805701EFD7109FB5C840B9ABBF0AF09304F10481AE4AAD7B60DB74E9018F6D

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A60E0 Relevance: 13.7, APIs: 9, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,?,6C6A49FA,00000001,?,00000000,?,?,?), ref: 6C6A612B
GetCPInfo.KERNEL32(?,00000001,?,6C6A49FA,00000001,?), ref: 6C6A6144
MultiByteToWideChar.KERNEL32(?,00000001,?,6C6A49FA,00000000,00000000,?,6C6A49FA,00000001,?,00000000,?,?,?,?,00000000), ref: 6C6A61A8
_memset.LIBCMT ref: 6C6A61E0
MultiByteToWideChar.KERNEL32(?,00000001,?,6C6A49FA,?,00000000,?,?,?,?,?,?,?,6C6A49FA,00000001,?), ref: 6C6A61F7
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,6C6A49FA), ref: 6C6A6212
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,6C6A49FA), ref: 6C6A6238
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,6C6A49FA), ref: 6C6A625D
__freea.LIBCMT ref: 6C6A627F

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ByteCharMultiWide$Info$__freea_memset
String ID:
API String ID: 1700608584-0
Opcode ID: 74e0bfaa38a46033359078df9e5cc2cd4bf5a32f6d76c9de52bcc255037362c2
Instruction ID: d5030f8389ccd92678d960e6ea82107846e96199ef1f931e92138c5326c9a144
Opcode Fuzzy Hash: 74e0bfaa38a46033359078df9e5cc2cd4bf5a32f6d76c9de52bcc255037362c2
Instruction Fuzzy Hash: 26513972905119AFDF009FEDCC809EEBFB9EB09358F204125E924E7650D731DD468BA8

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A480B Relevance: 13.7, APIs: 9, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,6C688CA8,00000001,?,?,?,00000000,?,?,?,6C6A49FA,00000001,?,00000000,?,?), ref: 6C6A483A
GetLastError.KERNEL32(?,6C6A49FA,00000001,?,00000000,?,?,?,?,00000000,?,00000001,00000000,00000000,00000008,?), ref: 6C6A484C
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,00000000,?,?,?,6C6A49FA,00000001,?,00000000), ref: 6C6A48B1
_memset.LIBCMT ref: 6C6A4906
MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,00000000,?,00000001,00000000,00000000,00000008,?,00000000), ref: 6C6A491B
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 6C6A4929
__freea.LIBCMT ref: 6C6A4933
___ansicp.LIBCMT ref: 6C6A495D
GetStringTypeA.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C6A49FA,00000001,?,00000000,?), ref: 6C6A499E

Part of subcall function 6C6A60E0: GetCPInfo.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,?,6C6A49FA,00000001,?,00000000,?,?,?), ref: 6C6A612B
Part of subcall function 6C6A60E0: GetCPInfo.KERNEL32(?,00000001,?,6C6A49FA,00000001,?), ref: 6C6A6144
Part of subcall function 6C6A60E0: _memset.LIBCMT ref: 6C6A61E0
Part of subcall function 6C6A60E0: MultiByteToWideChar.KERNEL32(?,00000001,?,6C6A49FA,?,00000000,?,?,?,?,?,?,?,6C6A49FA,00000001,?), ref: 6C6A61F7
Part of subcall function 6C6A60E0: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,6C6A49FA), ref: 6C6A6212

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: ByteCharMultiWide$StringType$Info_memset$ErrorLast___ansicp__freea
String ID:
API String ID: 3793715485-0
Opcode ID: 4e86523b10191c364d0cdd7c7730333176820e28e3aae87500529eeb82294dc5
Instruction ID: a4fb1ca1cf64270d63b440c768c00adbbcd8a0a9a8d3ec674f0e4ddf684f2d99
Opcode Fuzzy Hash: 4e86523b10191c364d0cdd7c7730333176820e28e3aae87500529eeb82294dc5
Instruction Fuzzy Hash: 48518F7160110AAFDF108FD9DCC09AE7BA9EB06358F205529F924D7650DB70DD62CBAC

Uniqueness

Uniqueness Score: -1.00%

Function 6C68A4AA Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 77COMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 6C68A4E5

Strings

DXGetFileVersion() failed., xrefs: 6C68A554
FRunningOnWinXP, xrefs: 6C68A55B, 6C68A576
GetSystemDirectory(), xrefs: 6C68A571
\ntkrnlpa.exe, xrefs: 6C68A4EF
e:\bt\382730\setup\deliverables\dxupdate\inline.h, xrefs: 6C68A580

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: DirectorySystem
String ID: DXGetFileVersion() failed.$FRunningOnWinXP$GetSystemDirectory()$\ntkrnlpa.exe$e:\bt\382730\setup\deliverables\dxupdate\inline.h
API String ID: 2188284642-2376770108
Opcode ID: 61ee8926bbece4faa33e1acea82b5bb455e485cc85f785446f6de54ba797f294
Instruction ID: be25650f5d16bfc9542591100875ea7e4f735e16b2d07a56cf54e0e8c4f73dd1
Opcode Fuzzy Hash: 61ee8926bbece4faa33e1acea82b5bb455e485cc85f785446f6de54ba797f294
Instruction Fuzzy Hash: 9621F6B1A131146BCB109AA99C84FDB77BCEB06354F800565BD19E39C1DB30DA84CBBD

Uniqueness

Uniqueness Score: -1.00%

Function 6C68A5A7 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 72COMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 6C68A5E2

Strings

FRunningOnNETServer, xrefs: 6C68A645, 6C68A660
DXGetFileVersion() failed., xrefs: 6C68A63E
GetSystemDirectory(), xrefs: 6C68A65B
\ntkrnlpa.exe, xrefs: 6C68A5EC
e:\bt\382730\setup\deliverables\dxupdate\inline.h, xrefs: 6C68A66A

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: DirectorySystem
String ID: DXGetFileVersion() failed.$FRunningOnNETServer$GetSystemDirectory()$\ntkrnlpa.exe$e:\bt\382730\setup\deliverables\dxupdate\inline.h
API String ID: 2188284642-43542712
Opcode ID: e3afa828e792cff086e35afcaa12659cc48a84c899708bdcac7cbd3f3aeeaa39
Instruction ID: 5d9d98bb79356e239bb19f3af7a41294a8872c265485c51378b5abd151566a65
Opcode Fuzzy Hash: e3afa828e792cff086e35afcaa12659cc48a84c899708bdcac7cbd3f3aeeaa39
Instruction Fuzzy Hash: D11106B1A031146BCB509AB68C85ECB37BCEB17354F400566BD15E39C5EA30DA84CBBC

Uniqueness

Uniqueness Score: -1.00%

Function 6C68BC59 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 66COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6C68BCB1

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

CSetupAPI is not initialized., xrefs: 6C68BC7E
SetupCopyOEMInf(), xrefs: 6C68BCE1
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C68BCF0
Installed file %s as %s, xrefs: 6C68BCC7
InstallDrvInf, xrefs: 6C68BC85, 6C68BCE6

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime_strrchr
String ID: CSetupAPI is not initialized.$InstallDrvInf$Installed file %s as %s$SetupCopyOEMInf()$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 1906172993-1220023449
Opcode ID: 764e7cc3a6d4b7ee1c9220529504c53291bed135eff5bcb2af33c81adf4f530f
Instruction ID: c0b7ca684b75b4fae11f907f8435757e2c7b98b15c01ac4790222716be74c32c
Opcode Fuzzy Hash: 764e7cc3a6d4b7ee1c9220529504c53291bed135eff5bcb2af33c81adf4f530f
Instruction Fuzzy Hash: F7110831643124BBD7109A968C4DEEF3BE8DB86B58F100455F648E6980DFB0A646CAFD

Uniqueness

Uniqueness Score: -1.00%

Function 6C69C855 Relevance: 10.7, APIs: 7, Instructions: 184COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 6C69C86A

Part of subcall function 6C69C80F: __calloc_impl.LIBCMT ref: 6C69C824

GetFileType.KERNEL32(00000024), ref: 6C69C978
___crtInitCritSecAndSpinCount.LIBCMT ref: 6C69C9AC
GetStdHandle.KERNEL32(-000000F6), ref: 6C69CA03
GetFileType.KERNEL32(00000000), ref: 6C69CA15
___crtInitCritSecAndSpinCount.LIBCMT ref: 6C69CA43
SetHandleCount.KERNEL32 ref: 6C69CA6E

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: Count$CritFileHandleInitSpinType___crt$InfoStartup__calloc_impl
String ID:
API String ID: 3691444693-0
Opcode ID: b1454344d70200269c623566db7c2425b255c8752fe1a9014dbcdba8a9fea8bc
Instruction ID: d4b88ae3ebd221c3ca22663b3b93475cad4d7269c6a8bde0ae8b2e6164cdfaca
Opcode Fuzzy Hash: b1454344d70200269c623566db7c2425b255c8752fe1a9014dbcdba8a9fea8bc
Instruction Fuzzy Hash: 45611131A05787AFDB10DB68C884B59BBF0AB03328F248659D5B79BAE0D734D405CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A0841 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,00000000,?), ref: 6C6A0862
_memset.LIBCMT ref: 6C6A08B2
___crtGetStringTypeA.LIBCMT ref: 6C6A08DD
___crtLCMapStringA.LIBCMT ref: 6C6A08FD
___crtLCMapStringA.LIBCMT ref: 6C6A0922

Strings

, xrefs: 6C6A088B

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: String___crt$InfoType_memset
String ID:
API String ID: 406800760-3916222277
Opcode ID: 2058df5142be13c8b2b223cfcd855c111d41f1de68bc177cd47a971758872c58
Instruction ID: f9d44720242bf35404c13137b488528e6fac20a350ea01d0a0ec83e52bb66293
Opcode Fuzzy Hash: 2058df5142be13c8b2b223cfcd855c111d41f1de68bc177cd47a971758872c58
Instruction Fuzzy Hash: E84126715007DC9EEB218BA49C84BFB7BFC9B06708F1454E8D5DB83582D271AE4A8F58

Uniqueness

Uniqueness Score: -1.00%

Function 6C69C0E9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C6AA508,?,6C69C15B,00000000,6C6A4E75,00000314,6C6AA508,00000000,?,?,?,?,6C6A148B,6C6AA508,Microsoft Visual C++ Runtime Library,00012010), ref: 6C69C0FB
TlsGetValue.KERNEL32(0000000D,?,6C69C15B,00000000,6C6A4E75,00000314,6C6AA508,00000000,?,?,?,?,6C6A148B,6C6AA508,Microsoft Visual C++ Runtime Library,00012010), ref: 6C69C112
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,6C69C15B,00000000,6C6A4E75,00000314,6C6AA508,00000000,?,?,?,?,6C6A148B,6C6AA508,Microsoft Visual C++ Runtime Library,00012010), ref: 6C69C127
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 6C69C137

Strings

EncodePointer, xrefs: 6C69C131
KERNEL32.DLL, xrefs: 6C69C122

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: 9fb9e66569718fb1ac37eaca5cb0e2052b7c21d99c7395f804a7adb53841c7c7
Instruction ID: 9ad4481b5c252cffdb41eedf82e73d551824622a5bbcea7897c9f634e8cff0c1
Opcode Fuzzy Hash: 9fb9e66569718fb1ac37eaca5cb0e2052b7c21d99c7395f804a7adb53841c7c7
Instruction Fuzzy Hash: 6CF05B34601146BB9F006BB7DC44D5D3BB9EF4A3A8B104021F825D3560DF30D8018ABC

Uniqueness

Uniqueness Score: -1.00%

Function 6C69C162 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6C69C1F6), ref: 6C69C174
TlsGetValue.KERNEL32(0000000D,?,6C69C1F6), ref: 6C69C18B
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,6C69C1F6), ref: 6C69C1A0
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 6C69C1B0

Strings

KERNEL32.DLL, xrefs: 6C69C19B
DecodePointer, xrefs: 6C69C1AA

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 815d161310eb07467d2a5fe10a3e97eddeb9f77d9377d2fa5828a295d03cdf96
Instruction ID: 5e6d309741fa45b38eb663957b9819931cfa14a60653d0246783c97caa47e39a
Opcode Fuzzy Hash: 815d161310eb07467d2a5fe10a3e97eddeb9f77d9377d2fa5828a295d03cdf96
Instruction Fuzzy Hash: D7F05471702146BB9F006FB6DC84D993BB9EF0A394B204422F829D25A0DB30D951DABD

Uniqueness

Uniqueness Score: -1.00%

Function 6C68C936 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 32libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000004,00000104,?,00000000,?,6C6912B1,setupapi.dll,00000104,6C693D09,6C6A9880,6C6A9880,00000104,?,?,00000000), ref: 6C68C952
GetLastError.KERNEL32(Unable to load %s.,?,6C6912B1,setupapi.dll,00000104,6C693D09,6C6A9880,6C6A9880,00000104,?,?,00000000,?,?,dxupdate.cab), ref: 6C68C967

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

LoadLibrary(), xrefs: 6C68C96E
CDllLoader::LoadLibraryA, xrefs: 6C68C973
e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h, xrefs: 6C68C97D
Unable to load %s., xrefs: 6C68C962

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$ErrorLastLibraryLoad_strrchr
String ID: CDllLoader::LoadLibraryA$LoadLibrary()$Unable to load %s.$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
API String ID: 108046663-2531695590
Opcode ID: 82cc43a5f082b0d48c85d71d34835af52c22c643d48664baa28b34014021a11e
Instruction ID: b01a48ed54f819580a6cd94274b86863c34246e13fc0e20b5968fcf56f70add1
Opcode Fuzzy Hash: 82cc43a5f082b0d48c85d71d34835af52c22c643d48664baa28b34014021a11e
Instruction Fuzzy Hash: 9DF0E572647208BFEB106BA1CC04CC67EE8EB0A794B040925F996D2A00E631C6019ABD

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A150E Relevance: 9.1, APIs: 6, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1dcbe941c06b206eaa00373a934519e13cf3615ccb8bd53badb52e03c12f65
Instruction ID: fa47f9ca3548fc2fbeb68960c354613b86ae3c1168e145852da68b7de9133616
Opcode Fuzzy Hash: ce1dcbe941c06b206eaa00373a934519e13cf3615ccb8bd53badb52e03c12f65
Instruction Fuzzy Hash: E53109B5405601DEC7204FBAC80169677E5AF0737CB249A1AD4F6C7EA0D724E983CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A5814 Relevance: 9.1, APIs: 6, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

___initconout.LIBCMT ref: 6C6A583A

Part of subcall function 6C6A6523: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6C6A583F,?,?,?,6C6A20D0,?), ref: 6C6A6536

WriteConsoleW.KERNEL32(FFFFFFFE,6C6A20D0,00000001,?,00000000,?,?,?,6C6A20D0,?), ref: 6C6A585B
GetLastError.KERNEL32(?,?,6C6A20D0,?), ref: 6C6A586E
GetConsoleOutputCP.KERNEL32(00000000,6C6A20D0,00000001,?,00000005,00000000,00000000,?,?,?,6C6A20D0,?), ref: 6C6A588E
WideCharToMultiByte.KERNEL32(00000000,?,?,6C6A20D0,?), ref: 6C6A5895
WriteConsoleA.KERNEL32(FFFFFFFE,?,00000000,?,00000000,?,?,6C6A20D0,?), ref: 6C6A58B1

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: Console$Write$ByteCharCreateErrorFileLastMultiOutputWide___initconout
String ID:
API String ID: 3734994816-0
Opcode ID: af0e5ee949fe5ddfd2cf1cea6c969e4893f0f8a77c393f403670120bc97a8be5
Instruction ID: c7a4da4f8a42b56635bb730d684d3bfee0cc3eda28cc4171219dcfd27edbc323
Opcode Fuzzy Hash: af0e5ee949fe5ddfd2cf1cea6c969e4893f0f8a77c393f403670120bc97a8be5
Instruction Fuzzy Hash: FA216270A02524AEEB14DBE6D8889EF3B7CEB46728F144619F921865C0D731ED45CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 6C6997C1 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 61sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000005), ref: 6C699827

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

e:\bt\382730\setup\deliverables\dxupdate\dwnldmgr.cpp, xrefs: 6C6997FB, 6C69984C
CInsEngCallback::OnEngineProblem, xrefs: 6C6997F1, 6C699842
OnEngineProblem(): problem = 0x%X, xrefs: 6C6997CD
The file to be downloaded is not trusted., xrefs: 6C6997E8
Unknown engine problem %d., xrefs: 6C699839

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$Sleep_strrchr
String ID: CInsEngCallback::OnEngineProblem$OnEngineProblem(): problem = 0x%X$The file to be downloaded is not trusted.$Unknown engine problem %d.$e:\bt\382730\setup\deliverables\dxupdate\dwnldmgr.cpp
API String ID: 3675393568-4174456046
Opcode ID: 11b23e9fafc0653d00fc55625e8ee68d631c0179a9ea98c71b7d36eeeb74801d
Instruction ID: 3886e558605d0b4baddc1dd548d37b1a5b4f6cef811480eec398577c05a446cd
Opcode Fuzzy Hash: 11b23e9fafc0653d00fc55625e8ee68d631c0179a9ea98c71b7d36eeeb74801d
Instruction Fuzzy Hash: 8511C635681305BBD7245F16CC45F9A7B64EB89729F20882EFA196EAD0D631A4008F7C

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A35C7 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 6C69B670: __getptd.LIBCMT ref: 6C69B683

__stricmp_l.LIBCMT ref: 6C6A3658
___crtLCMapStringA.LIBCMT ref: 6C6A36B1
___crtLCMapStringA.LIBCMT ref: 6C6A373A

Strings

gil, xrefs: 6C6A37C6, 6C6A37D5, 6C6A37AC, 6C6A366A, 6C6A3639, 6C6A3602
gil, xrefs: 6C6A3614

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: String___crt$__getptd__stricmp_l
String ID: gil$gil
API String ID: 2420264727-2049028779
Opcode ID: 665a74c26f494cce7d5fbcdc2f0d718633214d7b133ed6c8e846ae6f938ced0e
Instruction ID: 6a8971adfcb18af6eb6c7db973b4aa791f37368d5517c498c7bdf450ba665f78
Opcode Fuzzy Hash: 665a74c26f494cce7d5fbcdc2f0d718633214d7b133ed6c8e846ae6f938ced0e
Instruction Fuzzy Hash: DB51FAF0908159ABDB119BD9C454BE97BF0EB03329F2442A5E0A15B9D1D330CE47CB6C

Uniqueness

Uniqueness Score: -1.00%

Function 6C68CE08 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 73COMMON

Download Yara Rule

Strings

IsSectionInInf, xrefs: 6C68CE30, 6C68CE5A
GetSectionNamesFromInf() failed., xrefs: 6C68CE29
Invalid buffer., xrefs: 6C68CE53
e:\bt\382730\setup\deliverables\dxupdate\inline.h, xrefs: 6C68CE3A, 6C68CE64

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$_strrchr
String ID: GetSectionNamesFromInf() failed.$Invalid buffer.$IsSectionInInf$e:\bt\382730\setup\deliverables\dxupdate\inline.h
API String ID: 4138713405-3922201919
Opcode ID: 31fad32a4e5036cd24c30c12f1af247e8d48230a0c0b7e1af02cbafdf8c80c40
Instruction ID: 4056400b27d890856f530f0172268fed58b1f73accdae1443012bc7a98a366af
Opcode Fuzzy Hash: 31fad32a4e5036cd24c30c12f1af247e8d48230a0c0b7e1af02cbafdf8c80c40
Instruction Fuzzy Hash: 71112BB2947105BDEB107B688C89CEFB7A8CB1635CF700A29F50273980E6715E46567D

Uniqueness

Uniqueness Score: -1.00%

Function 6C68CC44 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6C68CC89

Strings

.cab, xrefs: 6C68CCAC
, , xrefs: 6C68CC72, 6C68CCCD
.exe, xrefs: 6C68CC98
DefaultInstall, xrefs: 6C68CCE2

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: _strrchr
String ID: , $.cab$.exe$DefaultInstall
API String ID: 3213747228-64454702
Opcode ID: 3a7f6be37152b4ad2b9904c7404c3035d417fa15cf6aebdf5c5c0396c3f68159
Instruction ID: 430564a9f931657a51ca2ac58ebc9f529a8987bbc07e2563815492325e2d30a5
Opcode Fuzzy Hash: 3a7f6be37152b4ad2b9904c7404c3035d417fa15cf6aebdf5c5c0396c3f68159
Instruction Fuzzy Hash: 89115EB2942216BAE7119E658C41FDB3B98AF46358F140531FE04DBA80F731D61586BD

Uniqueness

Uniqueness Score: -1.00%

Function 6C68B0A6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 29COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00000000,6C6921D7,?,?,?,?,\msi.dll,00000000,?,?,00000104), ref: 6C68B0B2
GetLastError.KERNEL32(?,?,?,?,\msi.dll,00000000,?,?,00000104), ref: 6C68B0BC

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

FreeLibrary(), xrefs: 6C68B0C9
CDllLoader::FreeLibrary, xrefs: 6C68B0CE
e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h, xrefs: 6C68B0D8

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$ErrorFreeLastLibrary_strrchr
String ID: CDllLoader::FreeLibrary$FreeLibrary()$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
API String ID: 2808663981-1330908120
Opcode ID: d5a5be3ca950f04e487388ca26c10fe0d5de367dcae2437c3ee5bb2f4fa2d80d
Instruction ID: 4c50e00cb847a354047dfaef607b3fc3552f7d1312484ce2a2ecf61c46178e92
Opcode Fuzzy Hash: d5a5be3ca950f04e487388ca26c10fe0d5de367dcae2437c3ee5bb2f4fa2d80d
Instruction Fuzzy Hash: CFE086717171116BFB706AF66C09B9726DC9F81B59F154829F8B0E2881FA60C501457D

Uniqueness

Uniqueness Score: -1.00%

Function 6C68A206 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 21COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,6C68AFFD), ref: 6C68A210
GetLastError.KERNEL32 ref: 6C68A21A

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

FreeLibrary(), xrefs: 6C68A227
UnLoadSfcDLL, xrefs: 6C68A22C
e:\bt\382730\setup\deliverables\dxupdate\instcat.cpp, xrefs: 6C68A233

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$ErrorFreeLastLibrary_strrchr
String ID: FreeLibrary()$UnLoadSfcDLL$e:\bt\382730\setup\deliverables\dxupdate\instcat.cpp
API String ID: 2808663981-1868216810
Opcode ID: f3b9119b525eca568b19f155599ba81478204d6ffc85094b69a8d86daad15498
Instruction ID: 12d0a8ec6983cdba54b3d23b4f0472417c738f543adc51323ec07fa6fda62ad5
Opcode Fuzzy Hash: f3b9119b525eca568b19f155599ba81478204d6ffc85094b69a8d86daad15498
Instruction Fuzzy Hash: 60E0EC7470720066FF206AA24CC9B1635687B02B89F948418A821E1882E726D100C93D

Uniqueness

Uniqueness Score: -1.00%

Function 6C691B7B Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,6C69411A,000000FF,?,00000104,?,00000000), ref: 6C691BAD
GetLastError.KERNEL32(00000000), ref: 6C691BB8

Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BF2
Part of subcall function 6C689BC1: __wstrtime.LIBCMT ref: 6C689BFB
Part of subcall function 6C689BC1: _strrchr.LIBCMT ref: 6C689C41

Strings

MultiByteToWideChar(), xrefs: 6C691BBF
e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp, xrefs: 6C691BCE
CFusion::GetAssemblyList, xrefs: 6C691BC4

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: __wstrtime$ByteCharErrorLastMultiWide_strrchr
String ID: CFusion::GetAssemblyList$MultiByteToWideChar()$e:\bt\382730\setup\deliverables\dxupdate\dxupdate.cpp
API String ID: 1615087234-1850757137
Opcode ID: 6838c7caf1812db14b11f6e10d21b839632320cd6b212c292b4c224d25a95afa
Instruction ID: db3dc72f5820c48d33f18af3f5b4a310003d26a2f960193cf974702c0b277c03
Opcode Fuzzy Hash: 6838c7caf1812db14b11f6e10d21b839632320cd6b212c292b4c224d25a95afa
Instruction Fuzzy Hash: 6D0186B17052097BDB009BA58C45FEA77AC9B0A754F200559F626E76C1EAB0EA048B6C

Uniqueness

Uniqueness Score: -1.00%

Function 6C69D115 Relevance: 7.5, APIs: 5, Instructions: 44timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 6C69D149
GetCurrentProcessId.KERNEL32 ref: 6C69D155
GetCurrentThreadId.KERNEL32 ref: 6C69D15D
GetTickCount.KERNEL32 ref: 6C69D165
QueryPerformanceCounter.KERNEL32(?), ref: 6C69D171

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: b7da54b930de07eec4267c8ab6c945dd853ce6755614047731942047a6f2a19f
Instruction ID: 23c6ccd819e9543eeb8a5e6426d04dd08f0b41e1ce55273bdd218ac9c4247eb5
Opcode Fuzzy Hash: b7da54b930de07eec4267c8ab6c945dd853ce6755614047731942047a6f2a19f
Instruction Fuzzy Hash: 9401B176E01224ABCF10DBFAD88869EB7F8EF4E355F560522D821E7214D630A940CB98

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A2670 Relevance: 6.1, APIs: 4, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C6A26F1
WideCharToMultiByte.KERNEL32(680779C0,00000000,?,00000001,?,6C689AF9,00000000,?,?,?,?,?,6C689AF9,?,?,00000000), ref: 6C6A2784
GetLastError.KERNEL32 ref: 6C6A27A2
_memset.LIBCMT ref: 6C6A27C4

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: _memset$ByteCharErrorLastMultiWide
String ID:
API String ID: 773584764-0
Opcode ID: 79f0cea4d39e57e474cbdb80836fb184603f1c741ee03aa250908a405bf402f7
Instruction ID: 66f35cd78bc8e79d320c28dfda61c44575fee3f8591dcb8a1a9f60728838a5aa
Opcode Fuzzy Hash: 79f0cea4d39e57e474cbdb80836fb184603f1c741ee03aa250908a405bf402f7
Instruction Fuzzy Hash: 5F410C71542146AFCF119FDAC8D88DE7B65EF02318B110159E4284B9A1D731DE47CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A2B64 Relevance: 6.1, APIs: 4, Instructions: 125COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 6C6A2B7B

Part of subcall function 6C69F908: __FF_MSGBANNER.LIBCMT ref: 6C69F924

___crtInitCritSecAndSpinCount.LIBCMT ref: 6C6A2BF3
EnterCriticalSection.KERNEL32(00000115,6C6A69E0,00000018,6C6A3092,00000109,00000000,00000000), ref: 6C6A2C1A
LeaveCriticalSection.KERNEL32(00000115), ref: 6C6A2C27

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: CriticalSection$CountCritEnterInitLeaveSpin___crt__mtinitlocknum
String ID:
API String ID: 2663194512-0
Opcode ID: 4be19d341e329dad349babd5cc59fe1bb92140120e1b9b05f2974443292a5141
Instruction ID: a8a2f7f7e08736d9fc82cf9f9f594bfee707555353523ceaee4cf4d50ee30f84
Opcode Fuzzy Hash: 4be19d341e329dad349babd5cc59fe1bb92140120e1b9b05f2974443292a5141
Instruction Fuzzy Hash: 5F41F871A847069ADB148FEAC94878DBBF0AF0332CF24821DD16AD6AD0C774D9468B1D

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A09D9 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6C6A09E5

Part of subcall function 6C69C386: __amsg_exit.LIBCMT ref: 6C69C396

__amsg_exit.LIBCMT ref: 6C6A0A05
InterlockedDecrement.KERNEL32(?), ref: 6C6A0A32
InterlockedIncrement.KERNEL32(055D12F8), ref: 6C6A0A5D

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd
String ID:
API String ID: 2662827482-0
Opcode ID: ffcff73f1723d091f9d447228ccc8743240fb4c9f2e8dbf2d8d212ea0f1df36f
Instruction ID: 4605b64c2fc8ace98142fa91e0fa724cb97100ca9c03d01fc625d59857522068
Opcode Fuzzy Hash: ffcff73f1723d091f9d447228ccc8743240fb4c9f2e8dbf2d8d212ea0f1df36f
Instruction Fuzzy Hash: C2019B32A02651BBDB119FD5854178D7770AF06718F114107E915A7E90CF34AD46CFED

Uniqueness

Uniqueness Score: -1.00%

Function 6C69C305 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,6C69E2CE,6C69AD37,00000000,?,?,?,00000000,?), ref: 6C69C309
___set_flsgetvalue.LIBCMT ref: 6C69C311

Part of subcall function 6C69C1DB: TlsGetValue.KERNEL32(6C69C316), ref: 6C69C1E1
Part of subcall function 6C69C1DB: TlsSetValue.KERNEL32(00000000), ref: 6C69C1FE

TlsGetValue.KERNEL32 ref: 6C69C322
SetLastError.KERNEL32(00000000), ref: 6C69C376

Part of subcall function 6C6A1AFB: __calloc_impl.LIBCMT ref: 6C6A1B0C
Part of subcall function 6C6A1AFB: Sleep.KERNEL32(00000000,?,00000000,00000000,?,6C69C33C,00000001,00000214), ref: 6C6A1B23

Part of subcall function 6C69C162: TlsGetValue.KERNEL32(00000000,?,6C69C1F6), ref: 6C69C174
Part of subcall function 6C69C162: TlsGetValue.KERNEL32(0000000D,?,6C69C1F6), ref: 6C69C18B

Part of subcall function 6C69C24C: GetModuleHandleA.KERNEL32(KERNEL32.DLL,6C6A6770,0000000C,6C69C365,00000000,00000000), ref: 6C69C25D
Part of subcall function 6C69C24C: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 6C69C286
Part of subcall function 6C69C24C: GetProcAddress.KERNEL32(?,DecodePointer), ref: 6C69C296
Part of subcall function 6C69C24C: InterlockedIncrement.KERNEL32(6C6A8880), ref: 6C69C2B8
Part of subcall function 6C69C24C: ___addlocaleref.LIBCMT ref: 6C69C2DF

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: Value$AddressErrorLastProc$HandleIncrementInterlockedModuleSleep___addlocaleref___set_flsgetvalue__calloc_impl
String ID:
API String ID: 2909133767-0
Opcode ID: b8aa96d7d6d569bea4a1316961629fe147749373ca553d781d8c47a8cc7555ae
Instruction ID: a459c9f19ff022ab3b2f2df93d4a642df5911239440fe7f762d313cdf4b5b5c4
Opcode Fuzzy Hash: b8aa96d7d6d569bea4a1316961629fe147749373ca553d781d8c47a8cc7555ae
Instruction Fuzzy Hash: E4F0CD33601553B6CB2133FA6D4869E7B70EF47BB4F200115F622959D0DF11D80156DC

Uniqueness

Uniqueness Score: -1.00%

Function 6C6A11B5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C69B670: __getptd.LIBCMT ref: 6C69B683

__isleadbyte_l.LIBCMT ref: 6C6A124A
___crtLCMapStringA.LIBCMT ref: 6C6A1297

Strings

gil, xrefs: 6C6A128B, 6C6A128E

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: String___crt__getptd__isleadbyte_l
String ID: gil
API String ID: 4030240610-1981481053
Opcode ID: 9bc86f789940cf5ca5bc3c68580a2fa4f7fb5825ad2e9f15611dd96a3b52646c
Instruction ID: 7e95c9699380fe3c82aef4ff5be5942b0e9f62e566f57635839af6d1fd8da53d
Opcode Fuzzy Hash: 9bc86f789940cf5ca5bc3c68580a2fa4f7fb5825ad2e9f15611dd96a3b52646c
Instruction Fuzzy Hash: 5731A23190C249EFDB01CBE4C855BEE7FB4AF06308F144199E564DB682D771DA86CB68

Uniqueness

Uniqueness Score: -1.00%

Function 6C69CDD9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

___initmbctable.LIBCMT ref: 6C69CDEE

Part of subcall function 6C6A0E54: __setmbcp.LIBCMT ref: 6C6A0E5F

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe,00000104,?,?,?,6C69A562), ref: 6C69CE05

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe, xrefs: 6C69CDF8, 6C69CDFD

Memory Dump Source

Source File: 00000012.00000002.2551142071.000000006C681000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000012.00000002.2551109745.000000006C680000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551365107.000000006C6A8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2551417952.000000006C6AC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c680000_dxwsetup.jbxd

Similarity

API ID: FileModuleName___initmbctable__setmbcp
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
API String ID: 2741541922-2225787035
Opcode ID: d3c9a9ce9b7f7553b95e11b5e5eb0509c89d334c185d691b199929542d4f791b
Instruction ID: 0d79f830d06e0f8c02acc1a9ac24480c963670cc836ebef4bcde0177ac65a2c5
Opcode Fuzzy Hash: d3c9a9ce9b7f7553b95e11b5e5eb0509c89d334c185d691b199929542d4f791b
Instruction Fuzzy Hash: 4F21A871E0115ABFCB10EBB99C80CCE7BB8FB4236CB640655E526E3641D3315D46CB59

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Palworld.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Apr2007_xinput_x64[1].cab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Aug2005_d3dx9_27_x86[1].cab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Aug2006_xinput_x64[1].cab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Aug2009_D3DCompiler_42_x86[1].cab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Aug2009_d3dx9_42_x86[1].cab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Jun2007_d3dx9_34_x86[1].cab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Jun2008_d3dx9_38_x86[1].cab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Jun2010_d3dcsx_43_x86[1].cab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Nov2007_d3dx9_36_x86[1].cab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Nov2008_d3dx9_40_x86[1].cab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\Oct2006_d3dx9_31_x86[1].cab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\dxupdate[1].cab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Apr2006_d3dx9_30_x86[1].cab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Apr2007_d3dx10_33_x86[1].cab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Apr2007_xinput_x86[1].cab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Aug2006_xinput_x86[1].cab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Aug2007_d3dx10_35_x86[1].cab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Aug2008_d3dx10_39_x86[1].cab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Aug2009_d3dcsx_42_x86[1].cab

Windows Analysis Report
Palworld.exe