Edit tour

Windows Analysis Report
94.exe

Overview

General Information

Sample name:	94.exe
Analysis ID:	1448942
MD5:	35eb15db22e26d961d4151afeedbe67a
SHA1:	754923d156367f31bdd67a990c36d517f54f8c95
SHA256:	94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f
Tags:	exeGozisigned
Infos:

Detection

Ursnif

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Ursnif

Writes or reads registry keys via WMI

Writes registry values via WMI

Connects to many different domains

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Detected potential crypto function

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Use Short Name Path in Command Line

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

94.exe (PID: 1424 cmdline: "C:\Users\user\Desktop\94.exe" MD5: 35EB15DB22E26D961D4151AFEEDBE67A)

WmiPrvSE.exe (PID: 5708 cmdline: C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding MD5: 64ACA4F48771A5BA50CD50F2410632AD)

iexplore.exe (PID: 1080 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding MD5: CFE2E6942AC1B72981B3105E22D3224E)

iexplore.exe (PID: 2552 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:17410 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)

ssvagent.exe (PID: 2228 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)

iexplore.exe (PID: 6924 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:3552266 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)

iexplore.exe (PID: 5500 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:3552268 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)

iexplore.exe (PID: 6468 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding MD5: CFE2E6942AC1B72981B3105E22D3224E)

iexplore.exe (PID: 2632 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6468 CREDAT:17410 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)

iexplore.exe (PID: 1880 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding MD5: CFE2E6942AC1B72981B3105E22D3224E)

iexplore.exe (PID: 1488 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1880 CREDAT:17410 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Gozi, Ursnif	2000 Ursnif aka Snifula2006 Gozi v1.0, Gozi CRM, CRM, Papras2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*)-> 2010 Gozi Prinimalka -> Vawtrak/NeverquestIn 2006, Gozi v1.0 ('Gozi CRM' aka 'CRM') aka Papras was first observed.It was offered as a CaaS, known as 76Service. This first version of Gozi was developed by Nikita Kurmin, and he borrowed code from Ursnif aka Snifula, a spyware developed by Alexey Ivanov around 2000, and some other kits. Gozi v1.0 thus had a formgrabber module and often is classified as Ursnif aka Snifula.In September 2010, the source code of a particular Gozi CRM dll version was leaked, which led to Vawtrak/Neverquest (in combination with Pony) via Gozi Prinimalka (a slightly modified Gozi v1.0) and Gozi v2.0 (aka 'Gozi ISFB' aka 'ISFB' aka Pandemyia). This version came with a webinject module.	No Attribution	http://blog.malwaremustdie.org/2013/02/the-infection-of-styx-exploit-kit.html http://researchcenter.paloaltonetworks.com/2017/02/unit42-banking-trojans-ursnif-global-distribution-networks-identified/ https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/gozi-italian-shellcode-dance https://0xtoxin.github.io/threat%20breakdown/Gozi-Italy-Campaign/	https://malpedia.caad.fkie.fraunhofer.de/details/win.gozi

Malware Configuration

Threatname: Ursnif

{"RSA Public Key": "AMjVytXMgqIPwwBufHXLEl1MPT94c30AZikKp5M8X0A51wUAowHSitNKgnfJAOrLV3476+KEAGBOI8C48MIRD9cd8ibgat6qt/Plwr0BxgEEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "c2_domain": ["microsoft.com", "avast.com"], "botnet": "4780", "server": "12", "serpent_key": "10291029JSJUYUON", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "10", "dga_base_url": "constitution.org/usdeclar.txt", "dga_tld": "com ru org", "DGA_count": "10"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2556321005.0000000003048000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.1701589948.0000000003048000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.1701204196.0000000003048000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.1701790227.0000000003048000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.1696611759.0000000003048000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.1701331883.0000000003048000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.1695722003.0000000003048000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.2490198024.0000000003048000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.1701872197.0000000003048000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.1701711329.0000000003048000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: 94.exe PID: 1424	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine|base64offset|contains: w, Image: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, NewProcessName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, OriginalFileName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, ParentCommandLine: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:17410 /prefetch:2, ParentImage: C:\Program Files (x86)\Internet Explorer\iexplore.exe, ParentProcessId: 2552, ParentProcessName: iexplore.exe, ProcessCommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, ProcessId: 2228, ProcessName: ssvagent.exe

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Program Files\Internet Explorer\iexplore.exe, ProcessId: 1080, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe

Snort Signatures

ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) - Source IP: 192.168.2.9 - Destination IP: 20.76.201.171

Timestamp:	05/29/24-15:25:42.506906
SID:	2033204
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) - Source IP: 192.168.2.9 - Destination IP: 20.76.201.171

Timestamp:	05/29/24-15:24:55.552631
SID:	2033203
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Ursnif Variant CnC Beacon 8 M2 - Source IP: 192.168.2.9 - Destination IP: 23.201.254.50

Timestamp:	05/29/24-15:26:08.600920
SID:	2831963
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Ursnif Variant CnC Beacon 8 M2 - Source IP: 192.168.2.9 - Destination IP: 104.122.38.56

Timestamp:	05/29/24-15:26:07.873198
SID:	2831963
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Ursnif Variant CnC Beacon 8 M1 - Source IP: 192.168.2.9 - Destination IP: 23.201.254.50

Timestamp:	05/29/24-15:26:08.600920
SID:	2831962
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) - Source IP: 192.168.2.9 - Destination IP: 23.201.254.50

Timestamp:	05/29/24-15:26:08.600920
SID:	2033203
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Ursnif Variant CnC Beacon 8 M1 - Source IP: 192.168.2.9 - Destination IP: 104.122.38.56

Timestamp:	05/29/24-15:26:07.873198
SID:	2831962
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) - Source IP: 192.168.2.9 - Destination IP: 104.122.38.56

Timestamp:	05/29/24-15:26:07.873198
SID:	2033203
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Ursnif Variant CnC Beacon 8 M2 - Source IP: 192.168.2.9 - Destination IP: 20.76.201.171

Timestamp:	05/29/24-15:25:42.506906
SID:	2831963
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Ursnif Variant CnC Beacon 8 M1 - Source IP: 192.168.2.9 - Destination IP: 20.76.201.171

Timestamp:	05/29/24-15:24:55.552631
SID:	2831962
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Ursnif Variant CnC Beacon 8 M1 - Source IP: 192.168.2.9 - Destination IP: 20.76.201.171

Timestamp:	05/29/24-15:25:42.506906
SID:	2831962
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 94.exe

Avira: detected

Found malware configuration

Source: 00000000.00000003.1438280913.0000000000660000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Ursnif {"RSA Public Key": "AMjVytXMgqIPwwBufHXLEl1MPT94c30AZikKp5M8X0A51wUAowHSitNKgnfJAOrLV3476+KEAGBOI8C48MIRD9cd8ibgat6qt/Plwr0BxgEEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "c2_domain": ["microsoft.com", "avast.com"], "botnet": "4780", "server": "12", "serpent_key": "10291029JSJUYUON", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "10", "dga_base_url": "constitution.org/usdeclar.txt", "dga_tld": "com ru org", "DGA_count": "10"}

Multi AV Scanner detection for submitted file

Source: 94.exe

ReversingLabs: Detection: 58%

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\94.exe

Unpacked PE file: 0.2.94.exe.690000.0.unpack

Source: 94.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.178.52:443 -> 192.168.2.9:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.178.52:443 -> 192.168.2.9:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.155.119:443 -> 192.168.2.9:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.155.119:443 -> 192.168.2.9:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.49.110.165:443 -> 192.168.2.9:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.49.110.165:443 -> 192.168.2.9:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.214.218.223:443 -> 192.168.2.9:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.214.218.223:443 -> 192.168.2.9:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.228:443 -> 192.168.2.9:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.228:443 -> 192.168.2.9:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.245.175.102:443 -> 192.168.2.9:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.245.175.102:443 -> 192.168.2.9:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.119.252:443 -> 192.168.2.9:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.119.252:443 -> 192.168.2.9:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.2.44:443 -> 192.168.2.9:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.2.44:443 -> 192.168.2.9:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.39.58:443 -> 192.168.2.9:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.39.58:443 -> 192.168.2.9:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.9:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.34:443 -> 192.168.2.9:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.34:443 -> 192.168.2.9:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.165.183.15:443 -> 192.168.2.9:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.165.183.15:443 -> 192.168.2.9:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.6:443 -> 192.168.2.9:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.6:443 -> 192.168.2.9:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.252.13:443 -> 192.168.2.9:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.252.13:443 -> 192.168.2.9:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.139.243.30:443 -> 192.168.2.9:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.139.243.30:443 -> 192.168.2.9:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.206.155:443 -> 192.168.2.9:58443 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.206.155:443 -> 192.168.2.9:58442 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.238:443 -> 192.168.2.9:58446 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.36.181:443 -> 192.168.2.9:58450 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.36.181:443 -> 192.168.2.9:58449 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.130:443 -> 192.168.2.9:58454 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.130:443 -> 192.168.2.9:58453 version: TLS 1.2

Source: 94.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: c:\speed\Money\Help\open\canDid.pdbP[l >l source: 94.exe, 00000000.00000002.2555223671.00000000006BD000.00000002.00000001.01000000.00000003.sdmp, 94.exe, 00000000.00000000.1300894363.00000000006BD000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: c:\speed\Money\Help\open\canDid.pdbP[C >C source: 94.exe
Source:	Binary string: c:\speed\Money\Help\open\canDid.pdb source: 94.exe

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2831962 ETPRO TROJAN Ursnif Variant CnC Beacon 8 M1 192.168.2.9:49713 -> 20.76.201.171:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.9:49713 -> 20.76.201.171:80
Source: Traffic	Snort IDS: 2831963 ETPRO TROJAN Ursnif Variant CnC Beacon 8 M2 192.168.2.9:49745 -> 20.76.201.171:80
Source: Traffic	Snort IDS: 2831962 ETPRO TROJAN Ursnif Variant CnC Beacon 8 M1 192.168.2.9:49745 -> 20.76.201.171:80
Source: Traffic	Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.9:49745 -> 20.76.201.171:80
Source: Traffic	Snort IDS: 2831963 ETPRO TROJAN Ursnif Variant CnC Beacon 8 M2 192.168.2.9:49753 -> 104.122.38.56:80
Source: Traffic	Snort IDS: 2831962 ETPRO TROJAN Ursnif Variant CnC Beacon 8 M1 192.168.2.9:49753 -> 104.122.38.56:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.9:49753 -> 104.122.38.56:80
Source: Traffic	Snort IDS: 2831963 ETPRO TROJAN Ursnif Variant CnC Beacon 8 M2 192.168.2.9:49755 -> 23.201.254.50:80
Source: Traffic	Snort IDS: 2831962 ETPRO TROJAN Ursnif Variant CnC Beacon 8 M1 192.168.2.9:49755 -> 23.201.254.50:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.9:49755 -> 23.201.254.50:80

Source: unknown

Network traffic detected: DNS query count 32

Source: Joe Sandbox View	IP Address: 18.165.183.15 18.165.183.15
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 87.248.119.252 87.248.119.252
Source: Joe Sandbox View	IP Address: 34.117.39.58 34.117.39.58
Source: Joe Sandbox View	IP Address: 104.19.178.52 104.19.178.52

Source: Joe Sandbox View

JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3

Source: unknown	TCP traffic detected without corresponding DNS query: 216.239.36.181
Source: unknown	TCP traffic detected without corresponding DNS query: 216.239.36.181
Source: unknown	TCP traffic detected without corresponding DNS query: 216.239.36.181
Source: unknown	TCP traffic detected without corresponding DNS query: 216.239.36.181
Source: unknown	TCP traffic detected without corresponding DNS query: 216.239.36.181
Source: unknown	TCP traffic detected without corresponding DNS query: 216.239.36.181
Source: unknown	TCP traffic detected without corresponding DNS query: 216.239.36.181
Source: unknown	TCP traffic detected without corresponding DNS query: 216.239.36.181
Source: unknown	TCP traffic detected without corresponding DNS query: 216.239.36.181
Source: unknown	TCP traffic detected without corresponding DNS query: 216.239.36.181
Source: unknown	TCP traffic detected without corresponding DNS query: 216.239.36.181
Source: unknown	TCP traffic detected without corresponding DNS query: 216.239.36.181
Source: unknown	TCP traffic detected without corresponding DNS query: 216.239.36.181
Source: unknown	TCP traffic detected without corresponding DNS query: 216.239.36.181
Source: unknown	TCP traffic detected without corresponding DNS query: 216.239.36.181
Source: unknown	TCP traffic detected without corresponding DNS query: 216.239.36.181
Source: unknown	TCP traffic detected without corresponding DNS query: 216.239.36.181
Source: unknown	TCP traffic detected without corresponding DNS query: 216.239.36.181
Source: unknown	TCP traffic detected without corresponding DNS query: 216.239.36.181
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://www.microsoft.com/images/fmgSs_2BZ3KjVxH/wHKkQ2B1uFMy7FTfvh/sDI1FTCZR/I89wys9_2BKDqr00ppU8/aclhk8xtXfWJvSN_2BB/_2BeW5YNyQMfCbr8JTsTk5/j9IVMv21hSYQw/o93EGoMO/FQluQM82vi57OIE1eg6jgjU/K4vGAWxNl2/B.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: wcpstatic.microsoft.comConnection: Keep-AliveCookie: MS-CV=srX4Mi324EutVIl7.1
Source: global traffic	HTTP traffic detected: GET /next/1/ms.jsll-3.min.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://www.microsoft.com/images/fmgSs_2BZ3KjVxH/wHKkQ2B1uFMy7FTfvh/sDI1FTCZR/I89wys9_2BKDqr00ppU8/aclhk8xtXfWJvSN_2BB/_2BeW5YNyQMfCbr8JTsTk5/j9IVMv21hSYQw/o93EGoMO/FQluQM82vi57OIE1eg6jgjU/K4vGAWxNl2/B.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: js.monitor.azure.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/OtAutoBlock.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: cdn.cookielaw.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scripttemplates/otSDKStub.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: cdn.cookielaw.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/b680e9a8-3d45-4e4a-998f-7d05f89e4486.json HTTP/1.1Accept: /Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHOrigin: https://www.avast.comAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: cdn.cookielaw.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Accept: application/jsonReferer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHOrigin: https://www.avast.comAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: geolocation.onetrust.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1716989171027 HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedReferer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHOrigin: https://www.avast.comAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: dpm.demdex.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.33.0/otBannerSdk.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: cdn.cookielaw.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dest5.html?d_nsid=0 HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: symantec.demdex.netConnection: Keep-AliveCookie: demdex=50343037636937159680511059771190338789
Source: global traffic	HTTP traffic detected: GET /consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/c3e7d6d5-2708-484c-a3a5-b8aa447868be/en.json HTTP/1.1Accept: /Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHOrigin: https://www.avast.comAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: cdn.cookielaw.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=411&dpuuid=Zlcs9QAAABtdXQNe HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: dpm.demdex.netCookie: demdex=50343037636937159680511059771190338789
Source: global traffic	HTTP traffic detected: GET /pagead/landing?gcs=G111&gcd=13t3t3t3t5&rnd=566323352.1716989172&url=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi&dma=0&npa=0&gtm=45He45m0n71PZ48F8v71039428za200&auid=1692554832.1716989172 HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /c/hotjar-470805.js?sv=7 HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.hotjar.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wi/ytc.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: s.yimg.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.33.0/assets/otCenterRounded.json HTTP/1.1Accept: /Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHOrigin: https://www.avast.comAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: cdn.cookielaw.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/mhubc.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: mstatic.avast.comConnection: Keep-AliveCookie: AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19873%7CMCMID%7C50143117599020028650530509156322338900%7CMCAAMLH-1717593971%7C6%7CMCAAMB-1717593971%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1716996371s%7CNONE%7CvVersion%7C5.5.0; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; sdl_cid=1735890227.1716989172; _gcl_au=1.1.1692554832.1716989172
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.33.0/assets/otCommonStyles.css HTTP/1.1Accept: /Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHOrigin: https://www.avast.comAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: cdn.cookielaw.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /active/avastcom.jsp HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.upsellit.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.33.0/assets/v2/otPcPanel.json HTTP/1.1Accept: /Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHOrigin: https://www.avast.comAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: cdn.cookielaw.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /pagead/landing?gcs=G111&gcd=13t3t3t3t5&rnd=566323352.1716989172&url=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi&dma=0&npa=0&gtm=45He45m0n71PZ48F8v71039428za200&auid=1692554832.1716989172 HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: googleads.g.doubleclick.net
Source: global traffic	HTTP traffic detected: GET /modules.7b6d7646601d8cd7fb5f.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: script.hotjar.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wi/config/10156543.json HTTP/1.1Accept: /Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHOrigin: https://www.avast.comAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.yimg.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /activityi;src=4711400;type=globa0;cat=avast0;ord=1;num=1850339154548;npa=0;auiddc=1692554832.1716989172;u2=Product;u7=www.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi;u8=;u17=undefined;pscdl=noapi;frm=0;gtm=45fe45m0v9181661103z871039428za201zb71039428;gcs=G111;gcd=13t3t3t3t5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi? HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: 4711400.fls.doubleclick.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: connect.facebook.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /trustboxes/5419b6ffb0d04a076446a9af/index.html?businessunitId=46d31466000064000500a775&templateId=5419b6ffb0d04a076446a9af HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: widget.trustpilot.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /logos/static/powered_by_logo.svg HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: cdn.cookielaw.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /g/collect?v=2&tid=G-WZQ6MQ6RF3&cid=716345675.1716989174&gtm=45je45m0v894455947za200zb868619592&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t5&npa=0&frm=0 HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: stats.g.doubleclick.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /trustboxes/5419b6ffb0d04a076446a9af/main.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?businessunitId=46d31466000064000500a775&templateId=5419b6ffb0d04a076446a9afAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: widget.trustpilot.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /g/collect?v=2&tid=G-WZQ6MQ6RF3&gtm=45je45m0v894455947za200zb868619592&_p=1716989170681&_gaz=1&gcs=G111&gcd=13t3t3t3t5&npa=0&dma=0&cid=716345675.1716989174&ul=en-ch&sr=1280x1024&ir=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1716989174&sct=1&seg=0&dl=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi&dt=404%20Not%20Found&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.admin_gtm_version=GTM-WPC6R3K%7C99%7Cfalse&ep.client_consent=C0001%3A1%2C%20C0003%3A1%2C%20C0002%3A1%2C%20BG270%3A1%2C%20C0004%3A1%2C%20C0005%3A1&ep.client_cid=1735890227.1716989172&ep.screen_src_cookie=999_a8e__null&ep.screen_unlocalized_path=www.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi&ep.server_info=-%7C-%7C-&ep.session_secchua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20WOW64%3B%20Trident%2F7.0%3B%20.NET4.0C%3B%20.NET4.0E%3B%20.NET%20CLR%202.0.50727%3B%20.NET%20CLR%203.0.30729%3B%20.NET%20CLR%203.5.30729%3B%20rv%3A11.0)%20like%20Gecko&up.cmp_id=088863c3-1500-47ae-a7ff-6d3bc97cc3f1&tfd=4606 HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: analytics.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/src=4711400;type=globa0;cat=avast0;ord=1;num=1850339154548;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi;u8=;u17=undefined;pscdl=noapi;frm=0;gtm=45fe45m0v9181661103z871039428za201zb71039428;gcs=G111;gcd=13t3t3t3t5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /;q=0.5Referer: https://4711400.fls.doubleclick.net/activityi;src=4711400;type=globa0;cat=avast0;ord=1;num=1850339154548;npa=0;auiddc=1692554832.1716989172;u2=Product;u7=www.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi;u8=;u17=undefined;pscdl=noapi;frm=0;gtm=45fe45m0v9181661103z871039428za201zb71039428;gcs=G111;gcd=13t3t3t3t5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi?Accept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: adservice.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /stats/TrustboxImpression?cmpName=trustpilot&scrollToList=true&noReviews=hide&stars=1%2C2%2C3%2C4%2C5&theme=light&locale=en-ww&url=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi%23pc&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20WOW64%3B%20Trident%2F7.0%3B%20.NET4.0C%3B%20.NET4.0E%3B%20.NET%20CLR%202.0.50727%3B%20.NET%20CLR%203.0.30729%3B%20.NET%20CLR%203.5.30729%3B%20rv%3A11.0)%20like%20Gecko&language=en-CH&platform=Win32&nosettings=1&businessUnitId=46d31466000064000500a775&widgetId=5419b6ffb0d04a076446a9af HTTP/1.1Accept: /Content-type: application/x-www-form-urlencodedReferer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?businessunitId=46d31466000064000500a775&templateId=5419b6ffb0d04a076446a9afAccept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: widget.trustpilot.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-58120669-2&cid=716345675.1716989174&jid=593781856&_u=YDDACUQABAQCACAHKg~&z=956945421 HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: avast.comConnection: Keep-Alive

Source: 94.exe, 00000000.00000003.2489923235.0000000000C94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: !function(b,e,f,g,a,c,d){b.fbq\|\|(a=b.fbq=function(){a.callMethod?a.callMethod.apply(a,arguments):a.queue.push(arguments)},b._fbq\|\|(b._fbq=a),a.push=a,a.loaded=!0,a.version="2.0",a.queue=[],c=e.createElement(f),c.async=!0,c.src=g,d=e.getElementsByTagName(f)[0],d.parentNode.insertBefore(c,d))}(window,document,"script","https://connect.facebook.net/en_US/fbevents.js");fbq("set","autoConfig",!1,"334783782127169");fbq("init","334783782127169");fbq("track","PageView"); <img height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=334783782127169&ev=PageView&noscript=1"> equals www.facebook.com (Facebook)
Source: fbevents[1].js.20.dr	String found in binary or memory: (function(a,b,c,d){var e={exports:{}};e.exports;(function(){var f=a.fbq;f.execStart=a.performance&&a.performance.now&&a.performance.now();if(!function(){var b=a.postMessage\|\|function(){};if(!f){b({action:"FB_LOG",logType:"Facebook Pixel Error",logMessage:"Pixel code is not installed correctly on this page"},"");"error"in console&&console.error("Facebook Pixel Error: Pixel code is not installed correctly on this page");return!1}return!0}())return;f.__fbeventsModules\|\|(f.__fbeventsModules={},f.__fbeventsResolvedModules={},f.getFbeventsModules=function(a){f.__fbeventsResolvedModules[a]\|\|(f.__fbeventsResolvedModules[a]=f.__fbeventsModules[a]());return f.__fbeventsResolvedModules[a]},f.fbIsModuleLoaded=function(a){return!!f.__fbeventsModules[a]},f.ensureModuleRegistered=function(b,a){f.fbIsModuleLoaded(b)\|\|(f.__fbeventsModules[b]=a)});f.ensureModuleRegistered("signalsFBEventsGetIwlUrl",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var b=f.getFbeventsModules("signalsFBEventsGetTier"),c=d();function d(){try{if(a.trustedTypes&&a.trustedTypes.createPolicy){var b=a.trustedTypes;return b.createPolicy("facebook.com/signals/iwl",{createScriptURL:function(a){var b=new URL(a);b=b.hostname.endsWith(".facebook.com")&&b.pathname=="/signals/iwl.js";if(!b)throw new Error("Disallowed script URL");return a}})}}catch(a){}return null}e.exports=function(a,d){d=b(d);d=d==null?"www.facebook.com":"www."+d+".facebook.com";d="https://"+d+"/signals/iwl.js?pixel_id="+a;if(c!=null)return c.createScriptURL(d);else return d}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("signalsFBEventsGetTier",function(){return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEvents.plugins.iwlbootstrapper",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var c=f.getFbeventsModules("SignalsFBEventsIWLBootStrapEvent"),d=f.getFbeventsModules("SignalsFBEventsLogging"),g=f.getFbeventsModules("SignalsFBEventsNetworkConfig"),h=f.getFbeventsModules("SignalsFBEventsPlugin"),i=f.getFbeventsModules("signalsFBEventsGetIwlUrl"),j=f.getFbeventsModules("signalsFBEventsGetTier"),k=d.logUserError,l=/^https:\/\/.\.facebook\.com$/i,m="FACEBOOK_IWL_CONFIG_STORAGE_KEY",n=null;e.exports=new h(function(d,e){try{n=a.sessionStorage?a.sessionStorage:{getItem:function(a){return null},removeItem:function(a){},setItem:function(a,b){}}}catch(a){return}function h(c,d){var e=b.createElement("script");e.async=!0;e.onload=function(){if(!a.FacebookIWL\|\|!a.FacebookIWL.init)return;var b=j(g.ENDPOINT);b!=null&&a.FacebookIWL.set&&a.FacebookIWL.set("tier",b);d()};a.FacebookIWLSessionEnd=func
Source: msapplication.xml1.5.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xacc9a303,0x01dab1cb</date><accdate>0xacc9a303,0x01dab1cb</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml6.5.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xacce67d7,0x01dab1cb</date><accdate>0xacce67d7,0x01dab1cb</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml8.5.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xacd0c9fa,0x01dab1cb</date><accdate>0xacd0c9fa,0x01dab1cb</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: gtm[2].js.20.dr	String found in binary or memory: L.getElementsByTagName("iframe"),oa=R.length,ka=0;ka<oa;ka++)if(!v&&c(R[ka],E.xe)){vI("https://www.youtube.com/iframe_api");v=!0;break}})}}else I(u.vtp_gtmOnSuccess)}var q=["www.youtube.com","www.youtube-nocookie.com"],r={UNSTARTED:-1,ENDED:0,PLAYING:1,PAUSED:2,BUFFERING:3,CUED:5},t,v=!1;Z.__ytl=n;Z.__ytl.D="ytl";Z.__ytl.isVendorTemplate=!0;Z.__ytl.priorityOverride=0;Z.__ytl.isInfrastructure=!1; equals www.youtube.com (Youtube)
Source: js[1].js.20.dr, js[1].js0.20.dr, gtm[2].js.20.dr	String found in binary or memory: Math.round(p);u["gtm.videoCurrentTime"]=Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},bk:function(){e=Db()},pd:function(){d()}}};var ic=ma(["data-gtm-yt-inspected-"]),GC=["www.youtube.com","www.youtube-nocookie.com"],HC,IC=!1; equals www.youtube.com (Youtube)
Source: js[1].js.20.dr, js[1].js0.20.dr	String found in binary or memory: e\|\|f\|\|g.length\|\|h.length))return;var n={Wg:d,Ug:e,Vg:f,Lh:g,Mh:h,xe:m,Ab:b},p=G.YT,q=function(){OC(n)};if(p)return p.ready&&p.ready(q),b;var r=G.onYouTubeIframeAPIReady;G.onYouTubeIframeAPIReady=function(){r&&r();q()};I(function(){for(var t=H.getElementsByTagName("script"),v=t.length,u=0;u<v;u++){var w=t[u].getAttribute("src");if(RC(w,"iframe_api")\|\|RC(w,"player_api"))return b}for(var y=H.getElementsByTagName("iframe"),x=y.length,B=0;B<x;B++)if(!IC&&PC(y[B],n.xe))return yc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: gtm[1].js.20.dr, desusertion[1].js.20.dr	String found in binary or memory: return b}EC.K="internal.enableAutoEventOnTimer";var ic=ma(["data-gtm-yt-inspected-"]),GC=["www.youtube.com","www.youtube-nocookie.com"],HC,IC=!1; equals www.youtube.com (Youtube)
Source: gtm[2].js.20.dr	String found in binary or memory: var TB=function(a,b,c,d,e){var f=Mz("fsl",c?"nv.mwt":"mwt",0),g;g=c?Mz("fsl","nv.ids",[]):Mz("fsl","ids",[]);if(!g.length)return!0;var h=Rz(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);P(121);if("https://www.facebook.com/tr/"===m)return P(122),!0;h["gtm.elementUrl"]=m;h["gtm.formCanceled"]=c;null!=a.getAttribute("name")&&(h["gtm.interactedFormName"]=a.getAttribute("name"));e&&(h["gtm.formSubmitElement"]=e,h["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!yy(h,zy(b, equals www.facebook.com (Facebook)
Source: 94.exe, 00000000.00000003.2489923235.0000000000C94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: { "@context" : "http://schema.org", "@type" : "Organization", "name" : "Avast", "alternateName" : "AVAST Software", "url" : "https://www.avast.com", "logo" : "https://static3.avast.com/web/i/v2/components/logos/avast-logos/seo/logo-avast-224x224px.png?v1", "contactPoint" : [{ "@type" : "ContactPoint", "telephone" : "855-745-3255", "contactType" : "premium support", "contactOption" : "TollFree", "areaServed" : "US" },{ "@type" : "ContactPoint", "telephone" : "855-745-3255", "contactType" : "premium support", "contactOption" : "TollFree", "areaServed" : "CA" }], "sameAs" : [ "https://www.facebook.com/avast", "https://twitter.com/avast_antivirus", "https://www.youtube.com/avast", "https://www.linkedin.com/company/avast-software" ] } <div class="box-container" :class="[promoClass, themeClass, 'size-'+size, multiboxClass, 'boxcount-' + setup.renderedBoxesCount, {'show-toggler': showToggler}]" > <Toggler v-for="(setting, i) in settings" :settingIndex="i" :setup="setup" :selectedIndex="setup.sets[i].selectedIndex" :firstBox="setup.sets[i].firstBox" :lastBox="setup.sets[i].lastBox" :size="size" v-on:change_data="changeIndex" ></Toggler> <Pricebox v-for="(address, index) in setup.renderedBoxes" :size="size" :key="index" :boxOrder="(index+1)" :boxAddress="address" :optionData="getOptionData(address)" :isfake=isfake :boxesCount=setup.renderedBoxesCount firstYearText="Price for the first year." first2YearsText="Price for the first 2 years." first3YearsText="Price for the first 3 years." firstMonthText="Price for the first month." currentText="current price" originalText="original price" saveText='Save $$' legalText='<s>$$</s> A equals www.facebook.com (Facebook)
Source: 94.exe, 00000000.00000003.2489923235.0000000000C94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: { "@context" : "http://schema.org", "@type" : "Organization", "name" : "Avast", "alternateName" : "AVAST Software", "url" : "https://www.avast.com", "logo" : "https://static3.avast.com/web/i/v2/components/logos/avast-logos/seo/logo-avast-224x224px.png?v1", "contactPoint" : [{ "@type" : "ContactPoint", "telephone" : "855-745-3255", "contactType" : "premium support", "contactOption" : "TollFree", "areaServed" : "US" },{ "@type" : "ContactPoint", "telephone" : "855-745-3255", "contactType" : "premium support", "contactOption" : "TollFree", "areaServed" : "CA" }], "sameAs" : [ "https://www.facebook.com/avast", "https://twitter.com/avast_antivirus", "https://www.youtube.com/avast", "https://www.linkedin.com/company/avast-software" ] } <div class="box-container" :class="[promoClass, themeClass, 'size-'+size, multiboxClass, 'boxcount-' + setup.renderedBoxesCount, {'show-toggler': showToggler}]" > <Toggler v-for="(setting, i) in settings" :settingIndex="i" :setup="setup" :selectedIndex="setup.sets[i].selectedIndex" :firstBox="setup.sets[i].firstBox" :lastBox="setup.sets[i].lastBox" :size="size" v-on:change_data="changeIndex" ></Toggler> <Pricebox v-for="(address, index) in setup.renderedBoxes" :size="size" :key="index" :boxOrder="(index+1)" :boxAddress="address" :optionData="getOptionData(address)" :isfake=isfake :boxesCount=setup.renderedBoxesCount firstYearText="Price for the first year." first2YearsText="Price for the first 2 years." first3YearsText="Price for the first 3 years." firstMonthText="Price for the first month." currentText="current price" originalText="original price" saveText='Save $$' legalText='<s>$$</s> A equals www.linkedin.com (Linkedin)
Source: 94.exe, 00000000.00000003.2489923235.0000000000C94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: { "@context" : "http://schema.org", "@type" : "Organization", "name" : "Avast", "alternateName" : "AVAST Software", "url" : "https://www.avast.com", "logo" : "https://static3.avast.com/web/i/v2/components/logos/avast-logos/seo/logo-avast-224x224px.png?v1", "contactPoint" : [{ "@type" : "ContactPoint", "telephone" : "855-745-3255", "contactType" : "premium support", "contactOption" : "TollFree", "areaServed" : "US" },{ "@type" : "ContactPoint", "telephone" : "855-745-3255", "contactType" : "premium support", "contactOption" : "TollFree", "areaServed" : "CA" }], "sameAs" : [ "https://www.facebook.com/avast", "https://twitter.com/avast_antivirus", "https://www.youtube.com/avast", "https://www.linkedin.com/company/avast-software" ] } <div class="box-container" :class="[promoClass, themeClass, 'size-'+size, multiboxClass, 'boxcount-' + setup.renderedBoxesCount, {'show-toggler': showToggler}]" > <Toggler v-for="(setting, i) in settings" :settingIndex="i" :setup="setup" :selectedIndex="setup.sets[i].selectedIndex" :firstBox="setup.sets[i].firstBox" :lastBox="setup.sets[i].lastBox" :size="size" v-on:change_data="changeIndex" ></Toggler> <Pricebox v-for="(address, index) in setup.renderedBoxes" :size="size" :key="index" :boxOrder="(index+1)" :boxAddress="address" :optionData="getOptionData(address)" :isfake=isfake :boxesCount=setup.renderedBoxesCount firstYearText="Price for the first year." first2YearsText="Price for the first 2 years." first3YearsText="Price for the first 3 years." firstMonthText="Price for the first month." currentText="current price" originalText="original price" saveText='Save $$' legalText='<s>$$</s> A equals www.twitter.com (Twitter)
Source: 94.exe, 00000000.00000003.2489923235.0000000000C94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: { "@context" : "http://schema.org", "@type" : "Organization", "name" : "Avast", "alternateName" : "AVAST Software", "url" : "https://www.avast.com", "logo" : "https://static3.avast.com/web/i/v2/components/logos/avast-logos/seo/logo-avast-224x224px.png?v1", "contactPoint" : [{ "@type" : "ContactPoint", "telephone" : "855-745-3255", "contactType" : "premium support", "contactOption" : "TollFree", "areaServed" : "US" },{ "@type" : "ContactPoint", "telephone" : "855-745-3255", "contactType" : "premium support", "contactOption" : "TollFree", "areaServed" : "CA" }], "sameAs" : [ "https://www.facebook.com/avast", "https://twitter.com/avast_antivirus", "https://www.youtube.com/avast", "https://www.linkedin.com/company/avast-software" ] } <div class="box-container" :class="[promoClass, themeClass, 'size-'+size, multiboxClass, 'boxcount-' + setup.renderedBoxesCount, {'show-toggler': showToggler}]" > <Toggler v-for="(setting, i) in settings" :settingIndex="i" :setup="setup" :selectedIndex="setup.sets[i].selectedIndex" :firstBox="setup.sets[i].firstBox" :lastBox="setup.sets[i].lastBox" :size="size" v-on:change_data="changeIndex" ></Toggler> <Pricebox v-for="(address, index) in setup.renderedBoxes" :size="size" :key="index" :boxOrder="(index+1)" :boxAddress="address" :optionData="getOptionData(address)" :isfake=isfake :boxesCount=setup.renderedBoxesCount firstYearText="Price for the first year." first2YearsText="Price for the first 2 years." first3YearsText="Price for the first 3 years." firstMonthText="Price for the first month." currentText="current price" originalText="original price" saveText='Save $$' legalText='<s>$$</s> A equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: assets.onestore.ms
Source: global traffic	DNS traffic detected: DNS query: ajax.aspnetcdn.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: c.s-microsoft.com
Source: global traffic	DNS traffic detected: DNS query: avast.com
Source: global traffic	DNS traffic detected: DNS query: www.avast.com
Source: global traffic	DNS traffic detected: DNS query: cdn.cookielaw.org
Source: global traffic	DNS traffic detected: DNS query: static3.avast.com
Source: global traffic	DNS traffic detected: DNS query: assets.adobedtm.com
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: www.nortonlifelock.com
Source: global traffic	DNS traffic detected: DNS query: geolocation.onetrust.com
Source: global traffic	DNS traffic detected: DNS query: symantec.demdex.net
Source: global traffic	DNS traffic detected: DNS query: cm.everesttech.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: static.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: s.yimg.com
Source: global traffic	DNS traffic detected: DNS query: mstatic.avast.com
Source: global traffic	DNS traffic detected: DNS query: www.upsellit.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: analytics.ff.avast.com
Source: global traffic	DNS traffic detected: DNS query: script.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: 4711400.fls.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: widget.trustpilot.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: ampcid.google.com
Source: global traffic	DNS traffic detected: DNS query: adservice.google.com
Source: global traffic	DNS traffic detected: DNS query: znb3hblkjhhpwrz9k-gendigital.siteintercept.qualtrics.com
Source: global traffic	DNS traffic detected: DNS query: siteintercept.qualtrics.com

Source: unknown

HTTP traffic detected: POST /v4/receive/json/81 HTTP/1.1Accept: */*Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.aviAccept-Language: en-CHContent-Type: text/plain;charset=UTF-8Origin: https://www.avast.comAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: analytics.ff.avast.comContent-Length: 1094Connection: Keep-AliveCache-Control: no-cache

Source: 94.exe	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 2b-8e0ae6[1].js.7.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: 94.exe	String found in binary or memory: http://ocsp.thawte.com0
Source: 94.exe, 00000000.00000003.2489923235.0000000000C94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schema.org
Source: 94.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 94.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 94.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: msapplication.xml.5.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml2.5.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml3.5.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml4.5.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml5.5.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml6.5.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml7.5.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml8.5.dr	String found in binary or memory: http://www.youtube.com/
Source: gtm[2].js.20.dr	String found in binary or memory: https://ad.doubleclick.net
Source: desusertion[1].js.20.dr, gtm[2].js.20.dr	String found in binary or memory: https://ade.googlesyndication.com
Source: js[1].js.20.dr, js[1].js0.20.dr, desusertion[1].js.20.dr, gtm[2].js.20.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: js[1].js.20.dr, js[1].js0.20.dr, desusertion[1].js.20.dr, gtm[2].js.20.dr	String found in binary or memory: https://adservice.googlesyndication.com/pagead/regclk
Source: 94.exe, 00000000.00000003.1701204196.0000000003048000.00000004.00000020.00020000.00000000.sdmp, 94.exe, 00000000.00000003.2358718452.000000000304A000.00000004.00000020.00020000.00000000.sdmp, 94.exe, 00000000.00000002.2555715038.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, 94.exe, 00000000.00000003.2157686163.0000000000C8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: analytics[1].js.20.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: avastcom[1].js.20.dr	String found in binary or memory: https://app.upsellit.com
Source: launch-773db4767ac4.min[1].js.20.dr	String found in binary or memory: https://assets.adobedtm.com/b29989a14bed/ccef52b414db/launch-773db4767ac4.js
Source: js[1].js.20.dr, gtm[1].js.20.dr, js[1].js0.20.dr, desusertion[1].js.20.dr, gtm[2].js.20.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: en[1].js.20.dr	String found in binary or memory: https://cdn.cookielaw.org/logos/static/ot_close.svg
Source: en[1].js.20.dr	String found in binary or memory: https://cdn.cookielaw.org/logos/static/ot_external_link.svg
Source: b680e9a8-3d45-4e4a-998f-7d05f89e4486[1].js.20.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/googleData.json
Source: b680e9a8-3d45-4e4a-998f-7d05f89e4486[1].js.20.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iab2Data.json
Source: b680e9a8-3d45-4e4a-998f-7d05f89e4486[1].js.20.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iabData.json
Source: mhubc[1].js.20.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/promise-polyfill
Source: mhubc[1].js.20.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/url-polyfill
Source: mhubc[1].js.20.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/whatwg-fetch
Source: 94.exe, 00000000.00000003.2490198024.0000000002FC9000.00000004.00000020.00020000.00000000.sdmp, 94.exe, 00000000.00000003.2489923235.0000000000C94000.00000004.00000020.00020000.00000000.sdmp, gtm[2].js.20.dr	String found in binary or memory: https://connect.facebook.net/en_US/fbevents.js
Source: b680e9a8-3d45-4e4a-998f-7d05f89e4486[1].js.20.dr	String found in binary or memory: https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck
Source: b680e9a8-3d45-4e4a-998f-7d05f89e4486[1].js.20.dr	String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: avast[1].css.20.dr	String found in binary or memory: https://getbootstrap.com/)
Source: avast[1].css.20.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: gtm[2].js.20.dr	String found in binary or memory: https://google.com
Source: gtm[2].js.20.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: mhubc[1].js.20.dr	String found in binary or memory: https://mstatic.avast.com/api/
Source: gtm[2].js.20.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: js[1].js.20.dr, gtm[1].js.20.dr, js[1].js0.20.dr, desusertion[1].js.20.dr, gtm[2].js.20.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: avastcom[1].js.20.dr	String found in binary or memory: https://prod.upsellit.com
Source: SIE[1].js.20.dr	String found in binary or memory: https://s.qualtrics.com/spoke/all/jam
Source: SIE[1].js.20.dr	String found in binary or memory: https://siteintercept.qualtrics.com
Source: SIE[1].js.20.dr	String found in binary or memory: https://siteintercept.qualtrics.com/dxjsmodule/
Source: gtm[2].js.20.dr	String found in binary or memory: https://snap.licdn.com/li.lms-analytics/insight.min.js
Source: gtm[2].js.20.dr	String found in binary or memory: https://static.hotjar.com/c/hotjar-
Source: imagestore.dat.20.dr	String found in binary or memory: https://static3.avast.com/10003722/web/i/v3/components/icons/seo/favicon.ico?v=1
Source: imagestore.dat.20.dr	String found in binary or memory: https://static3.avast.com/10003722/web/i/v3/components/icons/seo/favicon.ico?v=1~
Source: 94.exe, 00000000.00000003.2489923235.0000000000C94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static3.avast.com/web/i/v2/components/logos/avast-logos/seo/logo-avast-224x224px.png?v1
Source: js[1].js.20.dr, js[1].js0.20.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: analytics[1].js.20.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: analytics[1].js.20.dr	String found in binary or memory: https://tagassistant.google.com/
Source: js[1].js.20.dr, gtm[1].js.20.dr, js[1].js0.20.dr, desusertion[1].js.20.dr, gtm[2].js.20.dr	String found in binary or memory: https://td.doubleclick.net
Source: 94.exe, 00000000.00000003.2489923235.0000000000C94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.avast.com
Source: {006CCD93-1DBF-11EF-8C2C-ECF4BB45F69D}.dat.18.dr, ~DF9858259E5405C374.TMP.18.dr	String found in binary or memory: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LB
Source: avastcom[1].js.20.dr	String found in binary or memory: https://www.dpbolvw.net/click-2681135-13305660?url=
Source: gtm[2].js.20.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: analytics[1].js.20.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: analytics[1].js.20.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.20.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: gtm[2].js.20.dr	String found in binary or memory: https://www.google.com
Source: analytics[1].js.20.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: gtm[2].js.20.dr	String found in binary or memory: https://www.googleadservices.com
Source: js[1].js.20.dr, gtm[1].js.20.dr, js[1].js0.20.dr, desusertion[1].js.20.dr, gtm[2].js.20.dr	String found in binary or memory: https://www.googletagmanager.com
Source: gtm[2].js.20.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: desusertion[1].js.20.dr, gtm[2].js.20.dr	String found in binary or memory: https://www.googletagmanager.com/dclk/ns/v1.js
Source: analytics[1].js.20.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: 94.exe, 00000000.00000002.2555715038.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-P
Source: fetch.umd.min[1].js.20.dr	String found in binary or memory: https://www.jsdelivr.com/using-sri-with-dynamic-files
Source: js[1].js.20.dr, js[1].js0.20.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: avastcom[1].js.20.dr	String found in binary or memory: https://www.upsellit.com
Source: avastcom[1].js.20.dr	String found in binary or memory: https://www.upsellit.com/active/avastcom_pixel.jsp
Source: avastcom[1].js.20.dr	String found in binary or memory: https://www.upsellit.com/active/avastcom_pixel.jsp?pixel_found2=true
Source: avastcom[1].js.20.dr	String found in binary or memory: https://www.upsellit.com/active/avastcom_pixel.jsp?pixel_found=true
Source: avastcom[1].js.20.dr	String found in binary or memory: https://www.upsellit.com/hound/pixel.jsp?companyID=5568
Source: avastcom[1].js.20.dr	String found in binary or memory: https://www.upsellit.com/launch/blank.jsp?aff_click=
Source: avastcom[1].js.20.dr	String found in binary or memory: https://www.upsellit.com/launch/blank.jsp?avast_pixels=
Source: avastcom[1].js.20.dr	String found in binary or memory: https://www.upsellit.com/launch/blank.jsp?pixel_found=
Source: js[1].js.20.dr, js[1].js0.20.dr, gtm[2].js.20.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58446 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58459
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58449 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58460
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 58450 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 58459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 58460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 58453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58442
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58445
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58444
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58445 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58446
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58449
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58453
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58450
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.178.52:443 -> 192.168.2.9:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.178.52:443 -> 192.168.2.9:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.155.119:443 -> 192.168.2.9:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.155.119:443 -> 192.168.2.9:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.49.110.165:443 -> 192.168.2.9:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.49.110.165:443 -> 192.168.2.9:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.214.218.223:443 -> 192.168.2.9:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.214.218.223:443 -> 192.168.2.9:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.228:443 -> 192.168.2.9:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.228:443 -> 192.168.2.9:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.245.175.102:443 -> 192.168.2.9:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.245.175.102:443 -> 192.168.2.9:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.119.252:443 -> 192.168.2.9:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.119.252:443 -> 192.168.2.9:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.2.44:443 -> 192.168.2.9:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.2.44:443 -> 192.168.2.9:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.39.58:443 -> 192.168.2.9:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.39.58:443 -> 192.168.2.9:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.9:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.34:443 -> 192.168.2.9:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.34:443 -> 192.168.2.9:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.165.183.15:443 -> 192.168.2.9:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.165.183.15:443 -> 192.168.2.9:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.6:443 -> 192.168.2.9:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.6:443 -> 192.168.2.9:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.252.13:443 -> 192.168.2.9:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.252.13:443 -> 192.168.2.9:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.139.243.30:443 -> 192.168.2.9:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.139.243.30:443 -> 192.168.2.9:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.206.155:443 -> 192.168.2.9:58443 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.206.155:443 -> 192.168.2.9:58442 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.238:443 -> 192.168.2.9:58446 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.36.181:443 -> 192.168.2.9:58450 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.36.181:443 -> 192.168.2.9:58449 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.130:443 -> 192.168.2.9:58454 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.130:443 -> 192.168.2.9:58453 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000002.2556321005.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701589948.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701204196.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701790227.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1696611759.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701331883.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1695722003.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2490198024.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701872197.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701711329.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 94.exe PID: 1424, type: MEMORYSTR

E-Banking Fraud

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000002.2556321005.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701589948.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701204196.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701790227.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1696611759.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701331883.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1695722003.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2490198024.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701872197.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701711329.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 94.exe PID: 1424, type: MEMORYSTR

System Summary

Writes or reads registry keys via WMI

Source: C:\Users\user\Desktop\94.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Users\user\Desktop\94.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\94.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Source: C:\Users\user\Desktop\94.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Users\user\Desktop\94.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\94.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Source: C:\Users\user\Desktop\94.exe

Code function: 0_2_00663105 LdrInitializeThunk,NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,

0_2_00663105

Source: C:\Users\user\Desktop\94.exe	Code function: 0_2_0066A29C		0_2_0066A29C
Source: C:\Users\user\Desktop\94.exe	Code function: 0_2_00668FFC		0_2_00668FFC

Source: 94.exe

Static PE information: invalid certificate

Source: 94.exe, 00000000.00000002.2555382590.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametot.exe@ vs 94.exe
Source: 94.exe	Binary or memory string: OriginalFilenametot.exe@ vs 94.exe

Source: 94.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@17/126@34/21

Source: C:\Program Files\Internet Explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery

Jump to behavior

Source: C:\Program Files\Internet Explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF5DFE7FF8AF9B912B.TMP

Jump to behavior

Source: 94.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Internet Explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\94.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 94.exe

ReversingLabs: Detection: 58%

Source: unknown	Process created: C:\Users\user\Desktop\94.exe "C:\Users\user\Desktop\94.exe"
Source: C:\Users\user\Desktop\94.exe	Process created: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:17410 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:3552266 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:3552268 /prefetch:2
Source: unknown	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6468 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1880 CREDAT:17410 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:3552266 /prefetch:2	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:3552268 /prefetch:2	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6468 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1880 CREDAT:17410 /prefetch:2	Jump to behavior

Source: C:\Users\user\Desktop\94.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\94.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\94.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\94.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\94.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\94.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\94.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\94.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\94.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\94.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\94.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: esscli.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Users\user\Desktop\94.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Lync

Jump to behavior

Source: 94.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 94.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 94.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 94.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 94.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 94.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 94.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 94.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: c:\speed\Money\Help\open\canDid.pdbP[l >l source: 94.exe, 00000000.00000002.2555223671.00000000006BD000.00000002.00000001.01000000.00000003.sdmp, 94.exe, 00000000.00000000.1300894363.00000000006BD000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: c:\speed\Money\Help\open\canDid.pdbP[C >C source: 94.exe
Source:	Binary string: c:\speed\Money\Help\open\canDid.pdb source: 94.exe

Source: 94.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 94.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 94.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 94.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 94.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\94.exe

Unpacked PE file: 0.2.94.exe.690000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.bss:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\94.exe

Unpacked PE file: 0.2.94.exe.690000.0.unpack

Source: C:\Users\user\Desktop\94.exe	Code function: 0_2_00669E40 push ecx; ret	0_2_00669E49
Source: C:\Users\user\Desktop\94.exe	Code function: 0_2_0066A28B push ecx; ret	0_2_0066A29B
Source: C:\Users\user\Desktop\94.exe	Code function: 0_2_006AD02F push 00000020h; ret	0_2_006AD052
Source: C:\Users\user\Desktop\94.exe	Code function: 0_2_006ACC93 pushad ; iretd	0_2_006ACC9E
Source: C:\Users\user\Desktop\94.exe	Code function: 0_2_006A9973 push esi; ret	0_2_006A9974
Source: C:\Users\user\Desktop\94.exe	Code function: 0_2_006A8D41 push ecx; retf	0_2_006A8D45
Source: C:\Users\user\Desktop\94.exe	Code function: 0_2_006AC1A5 push dword ptr [ebx+ecx+4Dh]; iretd	0_2_006AC1EF
Source: C:\Users\user\Desktop\94.exe	Code function: 0_2_006AB18E push ebx; iretd	0_2_006AB18F
Source: C:\Users\user\Desktop\94.exe	Code function: 0_2_006AD326 pushfd ; iretd	0_2_006AD327
Source: C:\Users\user\Desktop\94.exe	Code function: 0_2_006AD389 push esi; ret	0_2_006AD3A7
Source: C:\Users\user\Desktop\94.exe	Code function: 0_2_006C6B94 pushfd ; ret	0_2_006C6B95

Hooking and other Techniques for Hiding and Protection

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000002.2556321005.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701589948.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701204196.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701790227.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1696611759.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701331883.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1695722003.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2490198024.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701872197.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701711329.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 94.exe PID: 1424, type: MEMORYSTR

Source: C:\Users\user\Desktop\94.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\94.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\94.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\94.exe TID: 1236

Thread sleep count: 40 > 30

Jump to behavior

Source: C:\Users\user\Desktop\94.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\94.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\94.exe

Code function: 0_2_006A86D0 GetSystemInfo,

0_2_006A86D0

Source: C:\Users\user\Desktop\94.exe

API call chain: ExitProcess graph end node

graph_0-11418

Source: C:\Users\user\Desktop\94.exe

Code function: 0_2_006404F9 VirtualAlloc,VirtualAlloc,LdrInitializeThunk,LdrInitializeThunk,VirtualAlloc,LdrInitializeThunk,LdrInitializeThunk,VirtualFree,FlsFree,FlsFree,VirtualProtect,VirtualProtect,GetProcAddress,LoadLibraryExA,VirtualProtect,VirtualProtect,LdrInitializeThunk,VirtualFree,RtlExitUserThread,RtlExitUserThread,

0_2_006404F9

Source: C:\Users\user\Desktop\94.exe	Code function: 0_2_006404F9 mov eax, dword ptr fs:[00000030h]	0_2_006404F9
Source: C:\Users\user\Desktop\94.exe	Code function: 0_2_006400CB push dword ptr fs:[00000030h]	0_2_006400CB
Source: C:\Users\user\Desktop\94.exe	Code function: 0_2_006C6397 mov eax, dword ptr fs:[00000030h]	0_2_006C6397
Source: C:\Users\user\Desktop\94.exe	Code function: 0_2_006C5F69 push dword ptr fs:[00000030h]	0_2_006C5F69

Source: C:\Users\user\Desktop\94.exe	Code function: 0_2_00691312 InitializeCriticalSection,TlsAlloc,RtlAddVectoredExceptionHandler,GetLastError,		0_2_00691312
Source: C:\Users\user\Desktop\94.exe	Code function: 0_2_00662E1B RtlInitializeCriticalSection,TlsAlloc,RtlAddVectoredExceptionHandler,GetLastError,		0_2_00662E1B

Source: C:\Users\user\Desktop\94.exe

Code function: 0_2_00668B75 cpuid

0_2_00668B75

Source: C:\Users\user\Desktop\94.exe

Code function: 0_2_00661397 GetSystemTimeAsFileTime,HeapFree,

0_2_00661397

Source: C:\Users\user\Desktop\94.exe

Code function: 0_2_00668B75 GetUserNameW,RtlAllocateHeap,HeapFree,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

0_2_00668B75

Source: C:\Users\user\Desktop\94.exe

Code function: 0_2_006911A6 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

0_2_006911A6

Stealing of Sensitive Information

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000002.2556321005.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701589948.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701204196.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701790227.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1696611759.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701331883.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1695722003.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2490198024.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701872197.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701711329.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 94.exe PID: 1424, type: MEMORYSTR

Remote Access Functionality

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000002.2556321005.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701589948.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701204196.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701790227.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1696611759.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701331883.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1695722003.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2490198024.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701872197.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701711329.0000000003048000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 94.exe PID: 1424, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	15 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
94.exe	58%	ReversingLabs	Win32.Trojan.Ursnif
94.exe	100%	Avira	TR/AD.Ursnif.jnkyz

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://stats.g.doubleclick.net/g/collect	0%	URL Reputation	safe
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
https://cdn.cookielaw.org/logos/static/powered_by_logo.svg	0%	URL Reputation	safe
https://www.youtube.com/iframe_api	0%	URL Reputation	safe
https://connect.facebook.net/en_US/fbevents.js	0%	URL Reputation	safe
https://stats.g.doubleclick.net/j/collect	0%	URL Reputation	safe
https://siteintercept.qualtrics.com	0%	URL Reputation	safe
https://siteintercept.qualtrics.com/dxjsmodule/	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
http://www.youtube.com/	0%	URL Reputation	safe
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js	0%	URL Reputation	safe
https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck	0%	URL Reputation	safe
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location	0%	URL Reputation	safe
http://www.amazon.com/	0%	URL Reputation	safe
http://www.twitter.com/	0%	URL Reputation	safe
http://schema.org	0%	URL Reputation	safe
https://cdn.cookielaw.org/vendorlist/googleData.json	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
https://cdn.cookielaw.org/vendorlist/iabData.json	0%	URL Reputation	safe
https://cdn.cookielaw.org/vendorlist/iab2Data.json	0%	URL Reputation	safe
https://cdn.cookielaw.org/scripttemplates/6.33.0/assets/otCenterRounded.json	0%	Avira URL Cloud	safe
https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LB	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
https://www.upsellit.com/launch/blank.jsp?pixel_found=	0%	Avira URL Cloud	safe
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-WZQ6MQ6RF3&cid=716345675.1716989174&gtm=45je45m0v894455947za200zb868619592&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t5&npa=0&frm=0	0%	Avira URL Cloud	safe
https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?businessunitId=46d31466000064000500a775&templateId=5419b6ffb0d04a076446a9af	0%	Avira URL Cloud	safe
http://www.nytimes.com/	0%	URL Reputation	safe
https://static3.avast.com/web/i/v2/components/logos/avast-logos/seo/logo-avast-224x224px.png?v1	0%	Avira URL Cloud	safe
https://cdn.cookielaw.org/consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/c3e7d6d5-2708-484c-a3a5-b8aa447868be/en.json	0%	Avira URL Cloud	safe
https://cdn.jsdelivr.net/npm/whatwg-fetch	0%	Avira URL Cloud	safe
https://www.upsellit.com/launch/blank.jsp?aff_click=	0%	Avira URL Cloud	safe
https://www.jsdelivr.com/using-sri-with-dynamic-files	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
https://cdn.cookielaw.org/scripttemplates/6.33.0/otBannerSdk.js	0%	Avira URL Cloud	safe
http://www.reddit.com/	0%	Avira URL Cloud	safe
https://tagassistant.google.com/	0%	URL Reputation	safe
https://static.hotjar.com/c/hotjar-	0%	URL Reputation	safe
https://ampcid.google.com/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM	0%	Avira URL Cloud	safe
https://adservice.google.com/ddm/fls/z/src=4711400;type=globa0;cat=avast0;ord=1;num=1850339154548;npa=0;auiddc=*;u2=Product;u7=www.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi;u8=;u17=undefined;pscdl=noapi;frm=0;gtm=45fe45m0v9181661103z871039428za201zb71039428;gcs=G111;gcd=13t3t3t3t5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi	0%	Avira URL Cloud	safe
https://getbootstrap.com/)	0%	URL Reputation	safe
https://www.dpbolvw.net/click-2681135-13305660?url=	0%	Avira URL Cloud	safe
https://www.google.com/pagead/landing?gcs=G111&gcd=13t3t3t3t5&rnd=566323352.1716989172&url=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi&dma=0&npa=0&gtm=45He45m0n71PZ48F8v71039428za200&auid=1692554832.1716989172	0%	Avira URL Cloud	safe
https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/main.js	0%	Avira URL Cloud	safe
https://static3.avast.com/10003722/web/i/v3/components/icons/seo/favicon.ico?v=1~	0%	Avira URL Cloud	safe
https://www.upsellit.com/active/avastcom_pixel.jsp	0%	Avira URL Cloud	safe
https://aka.ms/yourcaliforniaprivacychoices	0%	URL Reputation	safe
https://snap.licdn.com/li.lms-analytics/insight.min.js	0%	URL Reputation	safe
https://adservice.google.com/pagead/regclk	0%	Avira URL Cloud	safe
https://td.doubleclick.net	0%	URL Reputation	safe
https://s.qualtrics.com/spoke/all/jam	0%	URL Reputation	safe
https://cdn.cookielaw.org/consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/OtAutoBlock.js	0%	Avira URL Cloud	safe
https://static.hotjar.com/c/hotjar-470805.js?sv=7	0%	Avira URL Cloud	safe
https://www.merchant-center-analytics.goog	0%	URL Reputation	safe
http://www.wikipedia.com/	0%	URL Reputation	safe
https://cdn.cookielaw.org/logos/static/ot_close.svg	0%	URL Reputation	safe
https://static3.avast.com/10003722/web/i/v3/components/icons/seo/favicon.ico?v=1	0%	Avira URL Cloud	safe
https://analytics.google.com/g/collect?v=2&tid=G-WZQ6MQ6RF3&gtm=45je45m0v894455947za200zb868619592&_p=1716989170681&_gaz=1&gcs=G111&gcd=13t3t3t3t5&npa=0&dma=0&cid=716345675.1716989174&ul=en-ch&sr=1280x1024&ir=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1716989174&sct=1&seg=0&dl=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi&dt=404%20Not%20Found&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.admin_gtm_version=GTM-WPC6R3K%7C99%7Cfalse&ep.client_consent=C0001%3A1%2C%20C0003%3A1%2C%20C0002%3A1%2C%20BG270%3A1%2C%20C0004%3A1%2C%20C0005%3A1&ep.client_cid=1735890227.1716989172&ep.screen_src_cookie=999_a8e__null&ep.screen_unlocalized_path=www.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi&ep.server_info=-%7C-%7C-&ep.session_secchua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20WOW64%3B%20Trident%2F7.0%3B%20.NET4.0C%3B%20.NET4.0E%3B%20.NET%20CLR%202.0.50727%3B%20.NET%20CLR%203.0.30729%3B%20.NET%20CLR%203.5.30729%3B%20rv%3A11.0)%20like%20Gecko&up.cmp_id=088863c3-1500-47ae-a7ff-6d3bc97cc3f1&tfd=4606	0%	Avira URL Cloud	safe
https://s.yimg.com/wi/config/10156543.json	0%	Avira URL Cloud	safe
https://prod.upsellit.com	0%	Avira URL Cloud	safe
https://www.upsellit.com/active/avastcom.jsp	0%	Avira URL Cloud	safe
https://assets.adobedtm.com/b29989a14bed/ccef52b414db/launch-773db4767ac4.js	0%	Avira URL Cloud	safe
https://mstatic.avast.com/api/mhubc.js	0%	Avira URL Cloud	safe
https://www.upsellit.com/hound/pixel.jsp?companyID=5568	0%	Avira URL Cloud	safe
https://cdn.cookielaw.org/scripttemplates/6.33.0/assets/v2/otPcPanel.json	0%	Avira URL Cloud	safe
https://www.upsellit.com/active/avastcom_pixel.jsp?pixel_found2=true	0%	Avira URL Cloud	safe
https://4711400.fls.doubleclick.net/activityi;src=4711400;type=globa0;cat=avast0;ord=1;num=1850339154548;npa=0;auiddc=1692554832.1716989172;u2=Product;u7=www.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi;u8=;u17=undefined;pscdl=noapi;frm=0;gtm=45fe45m0v9181661103z871039428za201zb71039428;gcs=G111;gcd=13t3t3t3t5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi?	0%	Avira URL Cloud	safe
https://symantec.demdex.net/dest5.html?d_nsid=0	0%	Avira URL Cloud	safe
https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1716989171027	0%	Avira URL Cloud	safe
https://www.upsellit.com/launch/blank.jsp?avast_pixels=	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/landing?gcs=G111&gcd=13t3t3t3t5&rnd=566323352.1716989172&url=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi&dma=0&npa=0&gtm=45He45m0n71PZ48F8v71039428za200&auid=1692554832.1716989172	0%	Avira URL Cloud	safe
https://s.yimg.com/wi/ytc.js	0%	Avira URL Cloud	safe
https://js.monitor.azure.com/next/1/ms.jsll-3.min.js	0%	Avira URL Cloud	safe
https://cdn.jsdelivr.net/npm/url-polyfill	0%	Avira URL Cloud	safe
https://www.avast.com	0%	Avira URL Cloud	safe
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-58120669-2&cid=716345675.1716989174&jid=593781856&gjid=610409147&_gid=1123961170.1716989175&_u=YDDACUQABAQCACAHKg~&z=1394940328	0%	Avira URL Cloud	safe
http://github.com/requirejs/almond/LICENSE	0%	Avira URL Cloud	safe
https://cdn.cookielaw.org/scripttemplates/6.33.0/assets/otCommonStyles.css	0%	Avira URL Cloud	safe
https://github.com/twbs/bootstrap/blob/main/LICENSE)	0%	Avira URL Cloud	safe
https://cdn.cookielaw.org/logos/static/ot_external_link.svg	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net	0%	Avira URL Cloud	safe
https://cdn.jsdelivr.net/npm/promise-polyfill	0%	Avira URL Cloud	safe
https://widget.trustpilot.com/stats/TrustboxImpression?cmpName=trustpilot&scrollToList=true&noReviews=hide&stars=1%2C2%2C3%2C4%2C5&theme=light&locale=en-ww&url=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi%23pc&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20WOW64%3B%20Trident%2F7.0%3B%20.NET4.0C%3B%20.NET4.0E%3B%20.NET%20CLR%202.0.50727%3B%20.NET%20CLR%203.0.30729%3B%20.NET%20CLR%203.5.30729%3B%20rv%3A11.0)%20like%20Gecko&language=en-CH&platform=Win32&nosettings=1&businessUnitId=46d31466000064000500a775&widgetId=5419b6ffb0d04a076446a9af	0%	Avira URL Cloud	safe
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zlcs9QAAABtdXQNe	0%	Avira URL Cloud	safe
https://script.hotjar.com/modules.7b6d7646601d8cd7fb5f.js	0%	Avira URL Cloud	safe
https://mstatic.avast.com/api/	0%	Avira URL Cloud	safe
https://www.upsellit.com	0%	Avira URL Cloud	safe
https://app.upsellit.com	0%	Avira URL Cloud	safe
https://cdn.cookielaw.org/consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/b680e9a8-3d45-4e4a-998f-7d05f89e4486.json	0%	Avira URL Cloud	safe
https://www.google.com/ads/ga-audiences	0%	Avira URL Cloud	safe
https://analytics.ff.avast.com/v4/receive/json/81	0%	Avira URL Cloud	safe
http://www.live.com/	0%	Avira URL Cloud	safe
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-58120669-2&cid=716345675.1716989174&jid=593781856&_u=YDDACUQABAQCACAHKg~&z=956945421	0%	Avira URL Cloud	safe
https://ad.doubleclick.net	0%	Avira URL Cloud	safe
http://avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi	0%	Avira URL Cloud	safe
https://www.upsellit.com/active/avastcom_pixel.jsp?pixel_found=true	0%	Avira URL Cloud	safe
https://google.com	0%	Avira URL Cloud	safe
http://www.google.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dart.l.doubleclick.net	172.217.18.6	true	false	unknown
ampcid.google.com	142.250.184.238	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
avast.com	104.122.38.56	true	true	unknown
analytics-prod-gcp.ff.avast.com	34.117.223.223	true	false	unknown
adservice.google.com	142.250.186.130	true	false	unknown
stats.g.doubleclick.net	74.125.206.155	true	false	unknown
www.upsellit.com	34.117.39.58	true	false	unknown
scontent.xx.fbcdn.net	157.240.252.13	true	false	unknown
googleads.g.doubleclick.net	216.58.206.34	true	false	unknown
script.hotjar.com	18.165.183.15	true	false	unknown
mstatic.avast.com	20.50.2.44	true	false	unknown
www.google.com	142.250.181.228	true	false	unknown
dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	52.49.110.165	true	false	unknown
widget.trustpilot.com	108.139.243.30	true	false	unknown
cdn.cookielaw.org	104.19.178.52	true	false	unknown
geolocation.onetrust.com	172.64.155.119	true	false	unknown
edge.gycpi.b.yahoodns.net	87.248.119.252	true	false	unknown
static-cdn.hotjar.com	18.245.175.102	true	false	unknown
js.monitor.azure.com	unknown	unknown	false	unknown
www.avast.com	unknown	unknown	false	unknown
cdn.jsdelivr.net	unknown	unknown	false	unknown
siteintercept.qualtrics.com	unknown	unknown	false	unknown
assets.onestore.ms	unknown	unknown	false	unknown
ajax.aspnetcdn.com	unknown	unknown	false	unknown
cm.everesttech.net	unknown	unknown	false	unknown
static.hotjar.com	unknown	unknown	false	unknown
www.nortonlifelock.com	unknown	unknown	false	unknown
dpm.demdex.net	unknown	unknown	false	unknown
4711400.fls.doubleclick.net	unknown	unknown	false	unknown
analytics.ff.avast.com	unknown	unknown	false	unknown
assets.adobedtm.com	unknown	unknown	false	unknown
znb3hblkjhhpwrz9k-gendigital.siteintercept.qualtrics.com	unknown	unknown	false	unknown
connect.facebook.net	unknown	unknown	false	unknown
symantec.demdex.net	unknown	unknown	false	unknown
s.yimg.com	unknown	unknown	false	unknown
c.s-microsoft.com	unknown	unknown	false	unknown
analytics.google.com	unknown	unknown	false	unknown
static3.avast.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?businessunitId=46d31466000064000500a775&templateId=5419b6ffb0d04a076446a9af	false	Avira URL Cloud: safe	unknown
https://cdn.cookielaw.org/logos/static/powered_by_logo.svg	false	URL Reputation: safe	unknown
https://cdn.cookielaw.org/scripttemplates/6.33.0/assets/otCenterRounded.json	false	Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-WZQ6MQ6RF3&cid=716345675.1716989174&gtm=45je45m0v894455947za200zb868619592&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t5&npa=0&frm=0	false	Avira URL Cloud: safe	unknown
https://connect.facebook.net/en_US/fbevents.js	false	URL Reputation: safe	unknown
https://cdn.cookielaw.org/consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/c3e7d6d5-2708-484c-a3a5-b8aa447868be/en.json	false	Avira URL Cloud: safe	unknown
https://cdn.cookielaw.org/scripttemplates/6.33.0/otBannerSdk.js	false	Avira URL Cloud: safe	unknown
https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/main.js	false	Avira URL Cloud: safe	unknown
https://ampcid.google.com/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM	false	Avira URL Cloud: safe	unknown
https://adservice.google.com/ddm/fls/z/src=4711400;type=globa0;cat=avast0;ord=1;num=1850339154548;npa=0;auiddc=*;u2=Product;u7=www.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi;u8=;u17=undefined;pscdl=noapi;frm=0;gtm=45fe45m0v9181661103z871039428za201zb71039428;gcs=G111;gcd=13t3t3t3t5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi	false	Avira URL Cloud: safe	unknown
https://static.hotjar.com/c/hotjar-470805.js?sv=7	false	Avira URL Cloud: safe	unknown
https://www.google.com/pagead/landing?gcs=G111&gcd=13t3t3t3t5&rnd=566323352.1716989172&url=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi&dma=0&npa=0&gtm=45He45m0n71PZ48F8v71039428za200&auid=1692554832.1716989172	false	Avira URL Cloud: safe	unknown
https://cdn.cookielaw.org/consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/OtAutoBlock.js	false	Avira URL Cloud: safe	unknown
https://s.yimg.com/wi/config/10156543.json	false	Avira URL Cloud: safe	unknown
https://analytics.google.com/g/collect?v=2&tid=G-WZQ6MQ6RF3&gtm=45je45m0v894455947za200zb868619592&_p=1716989170681&_gaz=1&gcs=G111&gcd=13t3t3t3t5&npa=0&dma=0&cid=716345675.1716989174&ul=en-ch&sr=1280x1024&ir=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1716989174&sct=1&seg=0&dl=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi&dt=404%20Not%20Found&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.admin_gtm_version=GTM-WPC6R3K%7C99%7Cfalse&ep.client_consent=C0001%3A1%2C%20C0003%3A1%2C%20C0002%3A1%2C%20BG270%3A1%2C%20C0004%3A1%2C%20C0005%3A1&ep.client_cid=1735890227.1716989172&ep.screen_src_cookie=999_a8e__null&ep.screen_unlocalized_path=www.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi&ep.server_info=-%7C-%7C-&ep.session_secchua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20WOW64%3B%20Trident%2F7.0%3B%20.NET4.0C%3B%20.NET4.0E%3B%20.NET%20CLR%202.0.50727%3B%20.NET%20CLR%203.0.30729%3B%20.NET%20CLR%203.5.30729%3B%20rv%3A11.0)%20like%20Gecko&up.cmp_id=088863c3-1500-47ae-a7ff-6d3bc97cc3f1&tfd=4606	false	Avira URL Cloud: safe	unknown
https://www.upsellit.com/active/avastcom.jsp	false	Avira URL Cloud: safe	unknown
https://mstatic.avast.com/api/mhubc.js	false	Avira URL Cloud: safe	unknown
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js	false	URL Reputation: safe	unknown
https://cdn.cookielaw.org/scripttemplates/6.33.0/assets/v2/otPcPanel.json	false	Avira URL Cloud: safe	unknown
https://4711400.fls.doubleclick.net/activityi;src=4711400;type=globa0;cat=avast0;ord=1;num=1850339154548;npa=0;auiddc=1692554832.1716989172;u2=Product;u7=www.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi;u8=;u17=undefined;pscdl=noapi;frm=0;gtm=45fe45m0v9181661103z871039428za201zb71039428;gcs=G111;gcd=13t3t3t3t5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi?	false	Avira URL Cloud: safe	unknown
https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1716989171027	false	Avira URL Cloud: safe	unknown
https://s.yimg.com/wi/ytc.js	false	Avira URL Cloud: safe	unknown
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location	false	URL Reputation: safe	unknown
https://symantec.demdex.net/dest5.html?d_nsid=0	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/landing?gcs=G111&gcd=13t3t3t3t5&rnd=566323352.1716989172&url=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi&dma=0&npa=0&gtm=45He45m0n71PZ48F8v71039428za200&auid=1692554832.1716989172	false	Avira URL Cloud: safe	unknown
https://js.monitor.azure.com/next/1/ms.jsll-3.min.js	false	Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-58120669-2&cid=716345675.1716989174&jid=593781856&gjid=610409147&_gid=1123961170.1716989175&_u=YDDACUQABAQCACAHKg~&z=1394940328	false	Avira URL Cloud: safe	unknown
https://widget.trustpilot.com/stats/TrustboxImpression?cmpName=trustpilot&scrollToList=true&noReviews=hide&stars=1%2C2%2C3%2C4%2C5&theme=light&locale=en-ww&url=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi%23pc&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20WOW64%3B%20Trident%2F7.0%3B%20.NET4.0C%3B%20.NET4.0E%3B%20.NET%20CLR%202.0.50727%3B%20.NET%20CLR%203.0.30729%3B%20.NET%20CLR%203.5.30729%3B%20rv%3A11.0)%20like%20Gecko&language=en-CH&platform=Win32&nosettings=1&businessUnitId=46d31466000064000500a775&widgetId=5419b6ffb0d04a076446a9af	false	Avira URL Cloud: safe	unknown
https://cdn.cookielaw.org/scripttemplates/6.33.0/assets/otCommonStyles.css	false	Avira URL Cloud: safe	unknown
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zlcs9QAAABtdXQNe	false	Avira URL Cloud: safe	unknown
https://script.hotjar.com/modules.7b6d7646601d8cd7fb5f.js	false	Avira URL Cloud: safe	unknown
https://cdn.cookielaw.org/consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/b680e9a8-3d45-4e4a-998f-7d05f89e4486.json	false	Avira URL Cloud: safe	unknown
https://analytics.ff.avast.com/v4/receive/json/81	false	Avira URL Cloud: safe	unknown
http://avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi	true	Avira URL Cloud: safe	unknown
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-58120669-2&cid=716345675.1716989174&jid=593781856&_u=YDDACUQABAQCACAHKg~&z=956945421	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://stats.g.doubleclick.net/g/collect	js[1].js.20.dr, js[1].js0.20.dr	false	URL Reputation: safe	unknown
https://static3.avast.com/web/i/v2/components/logos/avast-logos/seo/logo-avast-224x224px.png?v1	94.exe, 00000000.00000003.2489923235.0000000000C94000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LB	{006CCD93-1DBF-11EF-8C2C-ECF4BB45F69D}.dat.18.dr, ~DF9858259E5405C374.TMP.18.dr	false	Avira URL Cloud: safe	unknown
https://www.upsellit.com/launch/blank.jsp?aff_click=	avastcom[1].js.20.dr	false	Avira URL Cloud: safe	unknown
https://www.upsellit.com/launch/blank.jsp?pixel_found=	avastcom[1].js.20.dr	false	Avira URL Cloud: safe	unknown
https://ampcid.google.com/v1/publisher:getClientId	analytics[1].js.20.dr	false	URL Reputation: safe	unknown
https://www.google.com	gtm[2].js.20.dr	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/iframe_api	js[1].js.20.dr, js[1].js0.20.dr, gtm[2].js.20.dr	false	URL Reputation: safe	unknown
https://cdn.jsdelivr.net/npm/whatwg-fetch	mhubc[1].js.20.dr	false	Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/j/collect	analytics[1].js.20.dr	false	URL Reputation: safe	unknown
http://www.reddit.com/	msapplication.xml5.5.dr	false	Avira URL Cloud: safe	unknown
https://www.dpbolvw.net/click-2681135-13305660?url=	avastcom[1].js.20.dr	false	Avira URL Cloud: safe	unknown
https://www.upsellit.com/active/avastcom_pixel.jsp	avastcom[1].js.20.dr	false	Avira URL Cloud: safe	unknown
https://static3.avast.com/10003722/web/i/v3/components/icons/seo/favicon.ico?v=1~	imagestore.dat.20.dr	false	Avira URL Cloud: safe	unknown
https://siteintercept.qualtrics.com	SIE[1].js.20.dr	false	URL Reputation: safe	unknown
https://siteintercept.qualtrics.com/dxjsmodule/	SIE[1].js.20.dr	false	URL Reputation: safe	unknown
https://static3.avast.com/10003722/web/i/v3/components/icons/seo/favicon.ico?v=1	imagestore.dat.20.dr	false	Avira URL Cloud: safe	unknown
https://adservice.google.com/pagead/regclk	js[1].js.20.dr, js[1].js0.20.dr, desusertion[1].js.20.dr, gtm[2].js.20.dr	false	Avira URL Cloud: safe	unknown
https://cct.google/taggy/agent.js	js[1].js.20.dr, gtm[1].js.20.dr, js[1].js0.20.dr, desusertion[1].js.20.dr, gtm[2].js.20.dr	false	URL Reputation: safe	unknown
https://www.google.%/ads/ga-audiences	analytics[1].js.20.dr	false	URL Reputation: safe	unknown
https://prod.upsellit.com	avastcom[1].js.20.dr	false	Avira URL Cloud: safe	unknown
http://www.youtube.com/	msapplication.xml8.5.dr	false	URL Reputation: safe	unknown
https://assets.adobedtm.com/b29989a14bed/ccef52b414db/launch-773db4767ac4.js	launch-773db4767ac4.min[1].js.20.dr	false	Avira URL Cloud: safe	unknown
https://www.upsellit.com/hound/pixel.jsp?companyID=5568	avastcom[1].js.20.dr	false	Avira URL Cloud: safe	unknown
https://www.upsellit.com/active/avastcom_pixel.jsp?pixel_found2=true	avastcom[1].js.20.dr	false	Avira URL Cloud: safe	unknown
https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck	b680e9a8-3d45-4e4a-998f-7d05f89e4486[1].js.20.dr	false	URL Reputation: safe	unknown
https://www.upsellit.com/launch/blank.jsp?avast_pixels=	avastcom[1].js.20.dr	false	Avira URL Cloud: safe	unknown
http://www.amazon.com/	msapplication.xml.5.dr	false	URL Reputation: safe	unknown
http://www.twitter.com/	msapplication.xml6.5.dr	false	URL Reputation: safe	unknown
http://schema.org	94.exe, 00000000.00000003.2489923235.0000000000C94000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.cookielaw.org/vendorlist/googleData.json	b680e9a8-3d45-4e4a-998f-7d05f89e4486[1].js.20.dr	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	94.exe	false	URL Reputation: safe	unknown
https://cdn.cookielaw.org/vendorlist/iabData.json	b680e9a8-3d45-4e4a-998f-7d05f89e4486[1].js.20.dr	false	URL Reputation: safe	unknown
https://cdn.cookielaw.org/vendorlist/iab2Data.json	b680e9a8-3d45-4e4a-998f-7d05f89e4486[1].js.20.dr	false	URL Reputation: safe	unknown
https://cdn.jsdelivr.net/npm/url-polyfill	mhubc[1].js.20.dr	false	Avira URL Cloud: safe	unknown
http://github.com/requirejs/almond/LICENSE	2b-8e0ae6[1].js.7.dr	false	Avira URL Cloud: safe	unknown
https://cdn.jsdelivr.net/npm/promise-polyfill	mhubc[1].js.20.dr	false	Avira URL Cloud: safe	unknown
https://www.avast.com	94.exe, 00000000.00000003.2489923235.0000000000C94000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.cookielaw.org/logos/static/ot_external_link.svg	en[1].js.20.dr	false	Avira URL Cloud: safe	unknown
http://www.nytimes.com/	msapplication.xml4.5.dr	false	URL Reputation: safe	unknown
https://github.com/twbs/bootstrap/blob/main/LICENSE)	avast[1].css.20.dr	false	Avira URL Cloud: safe	unknown
https://www.jsdelivr.com/using-sri-with-dynamic-files	fetch.umd.min[1].js.20.dr	false	URL Reputation: safe	unknown
http://ocsp.thawte.com0	94.exe	false	URL Reputation: safe	unknown
https://googleads.g.doubleclick.net	gtm[2].js.20.dr	false	Avira URL Cloud: safe	unknown
https://tagassistant.google.com/	analytics[1].js.20.dr	false	URL Reputation: safe	unknown
https://static.hotjar.com/c/hotjar-	gtm[2].js.20.dr	false	URL Reputation: safe	unknown
https://getbootstrap.com/)	avast[1].css.20.dr	false	URL Reputation: safe	unknown
https://app.upsellit.com	avastcom[1].js.20.dr	false	Avira URL Cloud: safe	unknown
https://mstatic.avast.com/api/	mhubc[1].js.20.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/yourcaliforniaprivacychoices	94.exe, 00000000.00000003.1701204196.0000000003048000.00000004.00000020.00020000.00000000.sdmp, 94.exe, 00000000.00000003.2358718452.000000000304A000.00000004.00000020.00020000.00000000.sdmp, 94.exe, 00000000.00000002.2555715038.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, 94.exe, 00000000.00000003.2157686163.0000000000C8D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ad.doubleclick.net	gtm[2].js.20.dr	false	Avira URL Cloud: safe	unknown
https://snap.licdn.com/li.lms-analytics/insight.min.js	gtm[2].js.20.dr	false	URL Reputation: safe	unknown
https://www.upsellit.com	avastcom[1].js.20.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/ads/ga-audiences	analytics[1].js.20.dr	false	Avira URL Cloud: safe	unknown
https://td.doubleclick.net	js[1].js.20.dr, gtm[1].js.20.dr, js[1].js0.20.dr, desusertion[1].js.20.dr, gtm[2].js.20.dr	false	URL Reputation: safe	unknown
https://s.qualtrics.com/spoke/all/jam	SIE[1].js.20.dr	false	URL Reputation: safe	unknown
https://www.merchant-center-analytics.goog	js[1].js.20.dr, js[1].js0.20.dr	false	URL Reputation: safe	unknown
http://www.wikipedia.com/	msapplication.xml7.5.dr	false	URL Reputation: safe	unknown
https://cdn.cookielaw.org/logos/static/ot_close.svg	en[1].js.20.dr	false	URL Reputation: safe	unknown
http://www.live.com/	msapplication.xml3.5.dr	false	Avira URL Cloud: safe	unknown
https://google.com	gtm[2].js.20.dr	false	Avira URL Cloud: safe	unknown
http://www.google.com/	msapplication.xml2.5.dr	false	Avira URL Cloud: safe	unknown
https://www.upsellit.com/active/avastcom_pixel.jsp?pixel_found=true	avastcom[1].js.20.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.165.183.15	script.hotjar.com	United States	3	MIT-GATEWAYSUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.130	adservice.google.com	United States	15169	GOOGLEUS	false
216.58.206.34	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
74.125.206.155	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
87.248.119.252	edge.gycpi.b.yahoodns.net	United Kingdom	203220	YAHOO-DEBDE	false
34.117.39.58	www.upsellit.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
157.240.252.13	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
216.239.36.181	unknown	United States	15169	GOOGLEUS	false
104.19.178.52	cdn.cookielaw.org	United States	13335	CLOUDFLARENETUS	false
104.122.38.56	avast.com	United States	16625	AKAMAI-ASUS	true
20.50.2.44	mstatic.avast.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.6	dart.l.doubleclick.net	United States	15169	GOOGLEUS	false
52.49.110.165	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
172.64.155.119	geolocation.onetrust.com	United States	13335	CLOUDFLARENETUS	false
34.117.223.223	analytics-prod-gcp.ff.avast.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
108.139.243.30	widget.trustpilot.com	United States	16509	AMAZON-02US	false
142.250.181.228	www.google.com	United States	15169	GOOGLEUS	false
52.214.218.223	unknown	United States	16509	AMAZON-02US	false
142.250.184.238	ampcid.google.com	United States	15169	GOOGLEUS	false
18.245.175.102	static-cdn.hotjar.com	United States	16509	AMAZON-02US	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1448942
Start date and time:	2024-05-29 15:23:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	94.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@17/126@34/21
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 27 Number of non-executed functions: 41
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, ielowutil.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 184.28.89.167, 20.76.201.171, 20.70.246.20, 20.112.250.133, 20.231.239.246, 20.236.44.162, 2.18.97.123, 23.197.124.141, 152.199.19.160, 2.18.64.214, 2.18.64.205, 184.28.89.233, 2.23.209.137, 2.23.209.135, 2.23.209.133, 2.23.209.130, 2.23.209.183, 2.23.209.182, 2.23.209.181, 2.23.209.185, 2.23.209.131, 95.101.149.131, 104.102.37.192, 23.201.254.50, 104.102.46.105, 184.28.89.29, 142.250.185.168, 2.19.224.118, 52.30.166.91, 52.209.221.170, 63.34.17.39, 172.217.16.206, 204.79.197.237, 13.107.21.237, 204.79.197.200, 104.18.186.31, 104.18.187.31, 104.17.208.240, 104.17.209.240
Excluded domains from analysis (whitelisted): aijscdn2.afd.azureedge.net, assets.onestore.ms.edgekey.net, slscr.update.microsoft.com, e13678.dscb.akamaiedge.net, cn-assets.adobedtm.com.edgekey.net, e11290.dspg.akamaiedge.net, static3.avast.com.edgekey.net, www.microsoft.com-c-3.edgekey.net, e86303.dscx.akamaiedge.net, ocsp.digicert.com, hlb.apr-52dd2-0.edgecastdns.net, ieonline.microsoft.com, wu-b-net.trafficmanager.net, www.google-analytics.com, e10583.dspg.akamaiedge.net, www.bing.com, fs.microsoft.com, cm.everesttech.net.akadns.net, www.nortonlifelock.com.edgekey.net, assets.onestore.ms.akadns.net, c-s.cms.ms.akadns.net, wwwprod.www-bing-com.akadns.net, c.s-microsoft.com-c.edgekey.net, www.avast.com-2.edgekey.net, e8647.dsca.akamaiedge.net, cdn.jsdelivr.net.cdn.cloudflare.net, bat-bing-com.dual-a-0034.a-msedge.net, e13074.dsca.akamaiedge.net, a1449.dscg2.akamai.net, wu.azureedge.net, www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net, go.microsoft.com, mscomajax.vo.msecnd.net, www.bing.com.edgekey.ne
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtSetValueKey calls found.
VT rate limit hit for: 94.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
87.248.119.252	94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f_dump.bin.exe	Get hash	malicious	Ursnif	Browse
	https://nwwomansclub.wixsite.com/email-verification-a	Get hash	malicious	Unknown	Browse
	http://delicious-decorous-army.glitch.me/public/RRENFCONL0.HTML	Get hash	malicious	HTMLPhisher	Browse
	https://uuyy112200.wixsite.com/my-site-2	Get hash	malicious	Unknown	Browse
	https://in.xero.com/7hv8mDuF13K6MICiXjOmyJk92EdbNVBSqtgAvYsV	Get hash	malicious	Unknown	Browse
	http://testing-1g0.pages.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://dieucestquilfait.wixsite.com/my-site-2/	Get hash	malicious	Unknown	Browse
	http://lasvocaux.wixsite.com/vocaleacceil	Get hash	malicious	Unknown	Browse
	https://msftexperience.qualtrics.com/jfe/form/SV_b1PzoUF1L5qlw1g?Q_DL=FqmbEi7ou0zrWMT_b1PzoUF1L5qlw1g_CGC_M5iNu9qrBGQePsZ&Q_CHL=email	Get hash	malicious	Unknown	Browse
	https://msftexperience.qualtrics.com/jfe/form/SV_b1PzoUF1L5qlw1g?Q_DL=FqmbEi7ou0zrWMT_b1PzoUF1L5qlw1g_CGC_amoao4zyzyiDnT0&Q_CHL=email&Q_PopulateResponse=%7B%22QID1%22:%221%22%7D&Q_PopulateValidate=1	Get hash	malicious	Unknown	Browse
18.165.183.15	http://url7052.hivecpq.com/ls/click?upn=SQuu8rV2N1IDVILly8VUkfuR8jQDizub9VxZa6QHuFHHKkcPzocVB7dujXQ-2Bp-2Bttf-2Bt391TySSwOWKxk1zgVy8XwE7vutbEC88URKnjMtYgyKU1oaki7Mw14zK0gwKMdh-2F0dkptKYJWrHZRpy1xkjg-3D-3DOfNq_NGu8k1VCZ8oOEySK-2FZlly6RBRnxQh3Cf24X10okkJ-2B0vkhkDeKCuK2SQnl7lRX2Vmfu7Z5AazOq7V8ymjQAUriYWT4GlApVar1fC-2F1NUDJeUozGFvhiuwW5nX58Ope7dbZ4tfMejWFnEi4jn-2B436Vev0XFRvlWt4U44JxIwEHuWbsB71o0JWleVoVjoGfh18jgsloziCvwz7x-2B1Cv9MjtPDB10WSR1MDkTljmLr6Ou0-3D	Get hash	malicious	Unknown	Browse
	https://azcra.com	Get hash	malicious	Phisher	Browse
	http://email.praxischool.com/ls/click?upn=idG6t1z7WnEGBsXx-2FNRRRfOTfSLTmUDD6cySTarNj718AlRgIGSlT8zghlsbFlu2geFIQKlQrgIv-2Bdu8BU6hsBPzEe9telQZn3pG1Zo1Vnc-3D1WDC_wgoGgTv9enYVaUqQ1AxuEXfATNQPRnq6Q7HaHrlDTPg8XGvmFcGmvarTjM7VIMa3cMDPhSADmXJsPYpj7DR6A50kKsDeeyNlQyILzmo0CE8ICEecdcbLOFMv260YhDJLBoj4ThcRKOdp6WqTwxS2ooebr8lIdSbbKuO1BQAak2Q84LHM2Q5xz8-2BgUyKC2W-2BRdfBDrfez4-2FeZ6-2FeCcMYAdA-3D-3D	Get hash	malicious	Unknown	Browse
	https://gem.godaddy.com/signups/activate/MS0tRThoK2FMYUxNZnd2R1VzcDFNK3M5b2pnSEh1a29yY2MxQ3VWSkZLeU1VODc2ZU5kMVB5U09mMHJqeGxUQlY0dVVDeDlxKzdMOWJSN1ptZ1lKNm5BSHM3eC0tTTMyQ1JJZjFRR3pXWHVINS0tbEpkNlBBR2djNmhjdW5ncER5YnlhQT09?signup=6868623	Get hash	malicious	Unknown	Browse
	http://url7052.hivecpq.com/ls/click?upn=SQuu8rV2N1IDVILly8VUkfuR8jQDizub9VxZa6QHuFHHKkcPzocVB7dujXQ-2Bp-2BttCIpImehP0qnXdq11C-2BDl9GgtMbVEMoajfkilutk067rSbJ1Ps2y0kZvV0AqeH31iTfWh_400Og1NVsjuHCpoo-2Fm8wRXH62Tpkz18ZzZrfTn1xZ7EG8OtIyQQvfRb-2B-2Fjf9UcZ7ApeTNw0YqeMVSJ7flpOWGAV0OR7sxE-2F5nPfwrj-2FMUx0kh0zltcxd9zPbWYwz-2BLIgR1Nzlw0ia9QuAzWHqrMspdobbtKch3x4izCiyeJGdlurj4NGVhJVB0M2I-2Fb1aUGo9ckEAwYTw8j9N1Bgm1teSCQdUH9LEgKWuqOzz3l1ZfI-3D	Get hash	malicious	Unknown	Browse
	https://tnfuxrz5afjoyz2td5a8.yxz10zi.ru/uvwx8901/#c2FtZWVyYS5hbHNhbG1pQGRwLmFl	Get hash	malicious	Unknown	Browse
	Employee(rob.huggins) 2023 Pay Amendments D920684-0000.html	Get hash	malicious	Unknown	Browse
	https://drilikath.com/cap?userid=hdelcambre@hilcorp.com	Get hash	malicious	Unknown	Browse
	Q2'23 NL Valuation Summary.xlsx	Get hash	malicious	Unknown	Browse
	http://crisgiano.sa.com	Get hash	malicious	Unknown	Browse
104.19.178.52	94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f_dump.bin.exe	Get hash	malicious	Ursnif	Browse
	https://sweet-moonbeam-28ccf4.netlify.app/appeal.html/	Get hash	malicious	Unknown	Browse
	ccsetup624.exe	Get hash	malicious	Unknown	Browse
	http://www.lnkfi.re/1moJNQoc/	Get hash	malicious	Unknown	Browse
	https://mitravarunpandey.github.io/Netflix-Clone.github.io	Get hash	malicious	Unknown	Browse
	https://bnnc-fast.xyz/	Get hash	malicious	Unknown	Browse
	https://qrco.de/n8mxa4i5VHuJk4PMwkLpvyNqgwLBQ0Sb/?zwphvtjquqnl/pub/cc?_ri_=X0Gzc2X%3DAQpglLjHJlYQGXHi3ygqqrREEgoSeza8UICjjze1whbSsXnwpzgE8gG5CszbXAjhO3FqKUWVXtpKX%3DUYRTAADY&_ei_=EM6hiIRZ6IbTRQzpp7EgfWDv5wmb7wtZr_HKt4Y9565l73Y_PqZSaCEhvHs0mzNqB-gBgO3tuO3UzGxLd8-XUq76ZMc933xI6KE-OcN9i_7_vZ1nKFQzNpaL4RiL4mq9EVgUJPIQMWCvlw3G0w1CjXYcIG-BSVUdKxTJ-nET9bFyCwB2_dByO9r2C-jKzARF7AriZjx_pk4nCrXsqa5CQmpAUkWEc-dfHJ9wX73GWCpfF57_v_ES7Af2szUwfyD1crCX8fOSqjBUZSUnMozbxe4aYYiNhDFxL-2jMKdpABJE3vtt_geGts7n8Xf4EYbq7j3d_IMY4o8Q72577S1E3LPhYqvKvmKbTUvvnIMLzsO6OHpvMQd9_ppOuzIIivn9ZEfO3rb9O9j_duNb3MRYEYBN-0s24zFn151NBJlyD6Gq-MjdBvSKqeeKbw5Wfsj_VyMcrEbHNU3N-Fwk31llQYD9Y_KwimheCdKUAFPtoMQQev1yIcv8hHULCmqh0T1-CEH0F10XlSOydOFp_GyqRNIoG2OjudzyH2-uSleZsarzjYlowPA825PtI7w6EzQlva8d5pko8MVh5GhEP_jIa45zP_XmcMGT6AurPE-K2-xcw0R3fJdeI2HLvwr04_2EB8cEsQvXASU8ndzsHdI_YoX-pNX-DGKMx-6o7E8ijo1A4IQu6extYnY-yNU8Vt-z9xT3l2_ybVcDcwUj0ZQbN2JWPhpiuk8AtxJGzNnIrb4fD-PiJQXEveDyN7N9WsWB0Lg4So4GVp3wT2J2c8BxTsaHBlF99Acrgm9dCZjD_F51LbRK0LCxQjX-tsn4QuELhVAmkIDb_mIoHBFMG6pvRiLCwd_1KWrY31qzwPtEFzqzLUjtacn_BU8V3jK4bE2aqaNyrQaB0oaSFT5kgpAzuJ_iH7j8LpQz0TQLZ4tmiAQeKYiG_FGPh3KXElLE7DkhVTs0Oi8Q6tLs6smyQq4eF3hLlTnnZgSTePsTLxmDzrSw-KGeDyW2LkOZ4kbkxvCGN6seSt91qJ5eDDYhrv3-FjtktxugKzF7yfbej64mQyq1x75cGd6er7nAEMPG28MGLOx9idu5hHS8xpH3XiKhrSQQ3YC3jWQ8qY-EF-Q0TcdwfOj9V-oeOy0KZ-xAMn4XoAuVsYtm7dInk0l0GcUOHwbLnVpy8vKxcHhomXAYRvCzxOe9DPAf3WyCg16exynSJ7tVWJIJA2HKvQ30Pkd9jo8ww7nT6bHa-kCAU5sP0R60XwbaOD1Va5lezql219BRJKOoQC3Ce2b6YAtmFxpVQCXmavy8ISfNPYLP7iYDoR3ywadCKdxWiaVT52gr.&_di_=auf9n3qge530sjoc9a8mlfu4dl79cq7siqsd7tr5omthg3894hpg	Get hash	malicious	Unknown	Browse
	https://microsoftedge.microsoft.com/addons/detail/rocketreach-edge-extensio/ldjlhlheoidifojmfkjfijmdhlagakni	Get hash	malicious	Unknown	Browse
	http://info.ipreo.com/Privacy-Policy.html	Get hash	malicious	Unknown	Browse
	http://chocolatefashiononline.com	Get hash	malicious	Unknown	Browse
13.107.246.45	ATT0100556_socage.it_Tuesday, May 28, 2024 (1).html	Get hash	malicious	HTMLPhisher	Browse
	Wave Browser.exe	Get hash	malicious	Unknown	Browse
	94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f_dump.bin.exe	Get hash	malicious	Ursnif	Browse
	https://hbsonlinecouk.atlassian.net/wiki/external/OTBhODE5Njg4ODY2NGIxZjk5NTUyOWZhNjRlMDI4YjE	Get hash	malicious	HTMLPhisher	Browse
	Arcadia Aerospace Industries (AAI) - ILSMart - RFQ4567987654.html	Get hash	malicious	Unknown	Browse
	https://www.yumpu.com/en/document/read/68712704/view-and-print-online-confidential-doc-98372-6-3-2	Get hash	malicious	HTMLPhisher	Browse
	RFQ Various models.xla.xlsx	Get hash	malicious	Unknown	Browse
	HSBC Customer Information.xls	Get hash	malicious	Unknown	Browse
	https://u44668105.ct.sendgrid.net/ls/click?upn=u001.BTMESiTo6NsF48uIW4-2BrJkEc2YVFzyAaMWnWwgGT9cZqZS45ZZqu4Y-2FXJmZd8BXA8cja_AHV3UK6XjfrXMiZ9J4igW-2FDEUbICycoJ744IkX0PR6FoPBD5ixGfLkyQ9ofRFx1gjy-2BP-2BDUWqu7bhyffh6xflqZsbtNZtMLnpgQoCGrYBrKDAQCrs-2BXh7tVhTtmxcULJOM-2BKcO31hWTdcLyh6xHaFmrsv6JFsx6tjkxHhVyYzmDL2WjDZWPIbWyOCKFNxt29pnc1D6Wos9by2AU7AhdVB3KlHpWThOWm6-2FAP-2Buqng4Vq-2BmwndZ6wQGKVc-2FG51viAW-2FpPzuJOGK4hC-2FF-2FfgyonvDWvDkNa4J3BejflmN-2BuGCUZSHoW4H7oETlKRzn4f7VwMbU0WFOF9ZUfOI6CISxhvZQTsnMYzitMow1nPeu-2Flg0-2FzAaZA27HnZ5WdxtR2wKofgxyBDPpPjMUDCXBmEfEWtT8NXGmNaNpBvJDLI13EkOwRxoG67u0CqbvxxYYK-2F5eu2B-2Bg9JTJRxFbICA7lEJgDZLYhBS-2BbGjIrrRDvHg0hAvMhBJ54TVAoWNvYZYG-2FCqbCuzJrUBI0DoaRAGLq44smm73hnjeG06IT3WQV3A8KkhlXB3fqBFue-2Fd4ydFypfr1PkBzxIk-2FPd1H2pJdMYF-2B7HONDoFax8K-2BBkvfgdiIY-3D	Get hash	malicious	Unknown	Browse
	https://paypalgiftcardgenerator.pages.dev/	Get hash	malicious	Unknown	Browse
34.117.39.58	94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f_dump.bin.exe	Get hash	malicious	Ursnif	Browse
	https://s3.amazonaws.com/tryhse45ysw45y7w4/rastgawet78watrf8whasieytrewyafiweauistgsidreyrest.html#/14/204625-1367	Get hash	malicious	Phisher	Browse
	https://jf3su0nc82kocw61.blob.core.windows.net/jf3su0nc82kocw61/1.html?4WNYDE6475pnqu82jukhgadbqc940IQTGHHCQEULWJIX13036XJPP12205G13#13/82-6475/940-13036-12205	Get hash	malicious	HTMLPhisher	Browse
	https://www.jabra.com/software-and-services/jabra-direct	Get hash	malicious	Unknown	Browse
	https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient	Get hash	malicious	Unknown	Browse
	https://trk.klclick3.com/ls/click?upn=Z2YftmlPqOUJRbmpQmhm03VBrbAfNASoybRFQlz9YCOPx1NG1yHHLvlM52XrZrBSjxmEZhpWdOpYWx2nCJqPvGvUp18Fx-2F9VpZPklUWUAKSGRrFhHBnlLNy6OUdgzLS3-2B72KTkMminPUMWceqCQLtSK8y9YKHVPPTqUUY9f8zt1BWagmkFkZhaIjFwQ4T6wdNrNAY84jQS2neg7R86enJAeZ-2BSCvACA1oEVYpSQA9D9Fs-2B7ieo07foOsTABkTj-2BM8wBq_ILWvhtRdUhnsYs3T75zbrql7hmRToExk5CwKJTXgdnM9HwphGc-2BGHfsBMlOCw66f4sSHSyoIYmnvRmZgyVIlmmrp1-2BodGpTjl8JcEVGOo2y0JVQzNfIC4B9fQe4pbuFgxA86UwGPIradNX70btXNwyMDGl6JPDXYGJ2BOZjkhW58Q0TbKRZKk7bwfEal3I5Zcj9joOaYK5WQIWgimIkE8FtXE-2F5xVX92gA4IXRnikpXGJAjC-2B8vH9dggFKXjHq-2Bi-2BwJWDhcaU4uJY49JXvz3dCrAgfxdRARk9o8J1H0xcO1PsY1RKdbNkKgwXVgBAWOv	Get hash	malicious	Unknown	Browse
	https://redirectconnectionchain.com/index.php?fid=1&cid=Zvwv09KqlzuKu3L8MO932zZwzzDnfL4B&clickid=c9f20nt7s46k26o2b6&feedId=100138&campaignId=1002450&creativeId=102815&subscriptionId=1024360308&subscriptionAge=0&creativeButton=2&notificationKey=698182484_1024801305610_1024360308&oclickid=%7Bt5%7D	Get hash	malicious	Unknown	Browse
	http://somalil.norin.co.za/2953779721339779383189?rijujanupomevisupagelaguli=luwevedefakoweviterikawobunawejubawazesaluxuzufevilavazubanabalokuzarujiriroviposobodipebawajojunevazejazurobajemofelivuxovejuzejasezajasaseraxerimorujizadixezujiligomawotezezewimubumojipajujasepogasutavo&keyword=assa%20abl...%20somalil.norin.co.za	Get hash	malicious	Unknown	Browse
	https://storage.googleapis.com/jireuvrvuftg15/jireuvrvuftg15/url.html#cl/17397_md/1919/3099/2030/159751/3006024	Get hash	malicious	Phisher	Browse
	http://xei.aloviec.com/?dD1jJmQ9MjIwMzcmbD01NTMxJmM9MTg1NTUyJmF1PTA=	Get hash	malicious	Phisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
avast.com	PDFCreator-1_5_0_setup.exe	Get hash	malicious	Unknown	Browse	34.127.59.89
analytics-prod-gcp.ff.avast.com	94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f_dump.bin.exe	Get hash	malicious	Ursnif	Browse	34.117.223.223
	ccsetup624.exe	Get hash	malicious	Unknown	Browse	34.117.223.223
	806aab44-6c03-4577-a3c4-83aa13dc7875.tmp	Get hash	malicious	Unknown	Browse	34.117.223.223
	Microstub.exe	Get hash	malicious	Unknown	Browse	34.117.223.223
	Microstub.exe	Get hash	malicious	Unknown	Browse	34.117.223.223
	ccsetup621.zip	Get hash	malicious	Unknown	Browse	34.117.223.223
	https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient	Get hash	malicious	Unknown	Browse	34.117.223.223
	http://www.poweriso-mirror.com/PowerISO8.exe	Get hash	malicious	Unknown	Browse	34.117.223.223
	_.exe	Get hash	malicious	Unknown	Browse	34.117.223.223
	_.exe	Get hash	malicious	Unknown	Browse	34.117.223.223
www.upsellit.com	94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f_dump.bin.exe	Get hash	malicious	Ursnif	Browse	34.117.39.58
	https://s3.amazonaws.com/tryhse45ysw45y7w4/rastgawet78watrf8whasieytrewyafiweauistgsidreyrest.html#/14/204625-1367	Get hash	malicious	Phisher	Browse	34.117.39.58
	https://jf3su0nc82kocw61.blob.core.windows.net/jf3su0nc82kocw61/1.html?4WNYDE6475pnqu82jukhgadbqc940IQTGHHCQEULWJIX13036XJPP12205G13#13/82-6475/940-13036-12205	Get hash	malicious	HTMLPhisher	Browse	34.117.39.58
	https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient	Get hash	malicious	Unknown	Browse	34.117.39.58
	https://trk.klclick3.com/ls/click?upn=Z2YftmlPqOUJRbmpQmhm03VBrbAfNASoybRFQlz9YCOPx1NG1yHHLvlM52XrZrBSjxmEZhpWdOpYWx2nCJqPvGvUp18Fx-2F9VpZPklUWUAKSGRrFhHBnlLNy6OUdgzLS3-2B72KTkMminPUMWceqCQLtSK8y9YKHVPPTqUUY9f8zt1BWagmkFkZhaIjFwQ4T6wdNrNAY84jQS2neg7R86enJAeZ-2BSCvACA1oEVYpSQA9D9Fs-2B7ieo07foOsTABkTj-2BM8wBq_ILWvhtRdUhnsYs3T75zbrql7hmRToExk5CwKJTXgdnM9HwphGc-2BGHfsBMlOCw66f4sSHSyoIYmnvRmZgyVIlmmrp1-2BodGpTjl8JcEVGOo2y0JVQzNfIC4B9fQe4pbuFgxA86UwGPIradNX70btXNwyMDGl6JPDXYGJ2BOZjkhW58Q0TbKRZKk7bwfEal3I5Zcj9joOaYK5WQIWgimIkE8FtXE-2F5xVX92gA4IXRnikpXGJAjC-2B8vH9dggFKXjHq-2Bi-2BwJWDhcaU4uJY49JXvz3dCrAgfxdRARk9o8J1H0xcO1PsY1RKdbNkKgwXVgBAWOv	Get hash	malicious	Unknown	Browse	34.117.39.58
	https://redirectconnectionchain.com/index.php?fid=1&cid=Zvwv09KqlzuKu3L8MO932zZwzzDnfL4B&clickid=c9f20nt7s46k26o2b6&feedId=100138&campaignId=1002450&creativeId=102815&subscriptionId=1024360308&subscriptionAge=0&creativeButton=2&notificationKey=698182484_1024801305610_1024360308&oclickid=%7Bt5%7D	Get hash	malicious	Unknown	Browse	34.117.39.58
	http://somalil.norin.co.za/2953779721339779383189?rijujanupomevisupagelaguli=luwevedefakoweviterikawobunawejubawazesaluxuzufevilavazubanabalokuzarujiriroviposobodipebawajojunevazejazurobajemofelivuxovejuzejasezajasaseraxerimorujizadixezujiligomawotezezewimubumojipajujasepogasutavo&keyword=assa%20abl...%20somalil.norin.co.za	Get hash	malicious	Unknown	Browse	34.117.39.58
	https://storage.googleapis.com/jireuvrvuftg15/jireuvrvuftg15/url.html#cl/17397_md/1919/3099/2030/159751/3006024	Get hash	malicious	Phisher	Browse	34.117.39.58
	http://xei.aloviec.com/?dD1jJmQ9MjIwMzcmbD01NTMxJmM9MTg1NTUyJmF1PTA=	Get hash	malicious	Phisher	Browse	34.117.39.58
	http://url4950.cardamomauction.com/ls/click?upn=egCPuzUzE3IgDlrJllQ8yUBDO8VIETbuALPBUwtYINtrfRoh4niogEH8ew5kcjpQHM6X_5oPQIRm8LVmW-2FxweY307RHB6-2FfahtC57rDiHjDqcmR3wVeFHqU860zUYKXVGazyJpxMz-2BcQ5uK-2BNpDHERkaIkSLRnnlu-2Fc6D63JAIl8JEZb1GxYrBpkUR5dGmGiZ7tVIHJtwdg2sVnEwwf6w1QvIy9Zxou6xRVLuTVo-2BvDlX32eGOdm-2FS4cfnyxoMZpQM-2FzWDOoNZbiI7Zh9oLibZCTy9w-3D-3D#offer/001mu/120/frznm/ijv/41/79	Get hash	malicious	Phisher	Browse	34.117.39.58
s-part-0017.t-0009.t-msedge.net	ATT0100556_socage.it_Tuesday, May 28, 2024 (1).html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f_dump.bin.exe	Get hash	malicious	Ursnif	Browse	13.107.246.45
	https://hbsonlinecouk.atlassian.net/wiki/external/OTBhODE5Njg4ODY2NGIxZjk5NTUyOWZhNjRlMDI4YjE	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Arcadia Aerospace Industries (AAI) - ILSMart - RFQ4567987654.html	Get hash	malicious	Unknown	Browse	13.107.246.45
	RFQ Various models.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://f2677811-d05a-4238-803b-e963ee14674b.inwise.net/Page_5-27-2024_3	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	HSBC Customer Information.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://u44668105.ct.sendgrid.net/ls/click?upn=u001.BTMESiTo6NsF48uIW4-2BrJkEc2YVFzyAaMWnWwgGT9cZqZS45ZZqu4Y-2FXJmZd8BXA8cja_AHV3UK6XjfrXMiZ9J4igW-2FDEUbICycoJ744IkX0PR6FoPBD5ixGfLkyQ9ofRFx1gjy-2BP-2BDUWqu7bhyffh6xflqZsbtNZtMLnpgQoCGrYBrKDAQCrs-2BXh7tVhTtmxcULJOM-2BKcO31hWTdcLyh6xHaFmrsv6JFsx6tjkxHhVyYzmDL2WjDZWPIbWyOCKFNxt29pnc1D6Wos9by2AU7AhdVB3KlHpWThOWm6-2FAP-2Buqng4Vq-2BmwndZ6wQGKVc-2FG51viAW-2FpPzuJOGK4hC-2FF-2FfgyonvDWvDkNa4J3BejflmN-2BuGCUZSHoW4H7oETlKRzn4f7VwMbU0WFOF9ZUfOI6CISxhvZQTsnMYzitMow1nPeu-2Flg0-2FzAaZA27HnZ5WdxtR2wKofgxyBDPpPjMUDCXBmEfEWtT8NXGmNaNpBvJDLI13EkOwRxoG67u0CqbvxxYYK-2F5eu2B-2Bg9JTJRxFbICA7lEJgDZLYhBS-2BbGjIrrRDvHg0hAvMhBJ54TVAoWNvYZYG-2FCqbCuzJrUBI0DoaRAGLq44smm73hnjeG06IT3WQV3A8KkhlXB3fqBFue-2Fd4ydFypfr1PkBzxIk-2FPd1H2pJdMYF-2B7HONDoFax8K-2BBkvfgdiIY-3D	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://paypalgiftcardgenerator.pages.dev/	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://sandnidenokvxzijas.theone-4.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	bot.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	20.70.206.213
	bot.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	40.114.11.117
	bot.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	157.55.40.181
	ATT0100556_socage.it_Tuesday, May 28, 2024 (1).html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.67
	Wave Browser.exe	Get hash	malicious	Unknown	Browse	204.79.197.203
	bot.mpsl-20240528-2108.elf	Get hash	malicious	Mirai, Moobot	Browse	20.80.70.24
	bot.mips-20240528-2110.elf	Get hash	malicious	Mirai, Moobot	Browse	157.55.39.253
	94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f_dump.bin.exe	Get hash	malicious	Ursnif	Browse	20.50.2.44
	ps-updater.exe	Get hash	malicious	Unknown	Browse	20.163.176.155
	update.hta	Get hash	malicious	Unknown	Browse	20.163.176.155
MIT-GATEWAYSUS	http://hbg.design	Get hash	malicious	Unknown	Browse	18.66.122.5
	http://purch.order.no/	Get hash	malicious	Unknown	Browse	18.66.121.138
	https://bellavistainnovaong.com/A1/2f3f/.btf/?w=depau@depau.com	Get hash	malicious	Unknown	Browse	18.65.39.63
	94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f_dump.bin.exe	Get hash	malicious	Ursnif	Browse	18.66.102.53
	https://mail.fnbo-in.selfip.com/x/otp2.html	Get hash	malicious	Unknown	Browse	18.165.201.79
	https://fnbo-in.selfip.com/x/personal.html	Get hash	malicious	Unknown	Browse	18.165.201.79
	https://www.fnbo-in.selfip.com/x/	Get hash	malicious	Unknown	Browse	18.165.201.13
	https://hbsonlinecouk.atlassian.net/wiki/external/OTBhODE5Njg4ODY2NGIxZjk5NTUyOWZhNjRlMDI4YjE	Get hash	malicious	HTMLPhisher	Browse	18.65.39.128
	https://nwwomansclub.wixsite.com/email-verification-a	Get hash	malicious	Unknown	Browse	18.173.206.155
	https://my.ing.3rdrisk.com/	Get hash	malicious	HTMLPhisher	Browse	18.66.27.101
YAHOO-DEBDE	94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f_dump.bin.exe	Get hash	malicious	Ursnif	Browse	87.248.119.252
	https://nwwomansclub.wixsite.com/email-verification-a	Get hash	malicious	Unknown	Browse	87.248.119.252
	https://fbrestriction.wixsite.com/facebook	Get hash	malicious	Unknown	Browse	87.248.119.251
	https://uncovered-fragrant-climb.glitch.me/public/eleventy.js.html	Get hash	malicious	HTMLPhisher	Browse	87.248.119.251
	http://delicious-decorous-army.glitch.me/public/RRENFCONL0.HTML	Get hash	malicious	HTMLPhisher	Browse	87.248.119.252
	https://uuyy112200.wixsite.com/my-site-2	Get hash	malicious	Unknown	Browse	87.248.119.252
	http://servty467.wixsite.com/csuadmin24	Get hash	malicious	Unknown	Browse	87.248.119.251
	https://url.au.m.mimecastprotect.com/s/uuv2CgZowrsOpyOOc26VTV?domain=in.xero.com	Get hash	malicious	Unknown	Browse	87.248.119.251
	https://in.xero.com/7hv8mDuF13K6MICiXjOmyJk92EdbNVBSqtgAvYsV	Get hash	malicious	Unknown	Browse	87.248.119.252
	https://in.xero.com/7hv8mDuF13K6MICiXjOmyJk92EdbNVBSqtgAvYsV	Get hash	malicious	Unknown	Browse	87.248.119.251
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RisePro Stealer	Browse	34.117.186.192
	94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f_dump.bin.exe	Get hash	malicious	Ursnif	Browse	34.117.223.223
	http://palestinehelpcentre.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse	34.117.77.79
	https://nwwomansclub.wixsite.com/email-verification-a	Get hash	malicious	Unknown	Browse	34.117.60.144
	https://submit-request-violation-remove-here.replit.app/index.php	Get hash	malicious	Unknown	Browse	34.117.33.233
	http://login-vip.replit.app/vip/36c63962-0335-4720-9855-3e324d0acc58	Get hash	malicious	Unknown	Browse	34.117.33.233
	http://y6ss1.shop/	Get hash	malicious	Unknown	Browse	34.117.186.192
	https://kruekanlogin.gitbook.io/	Get hash	malicious	Unknown	Browse	34.67.241.53
	https://fbrestriction.wixsite.com/facebook	Get hash	malicious	Unknown	Browse	34.117.60.144

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
6271f898ce5be7dd52b0fc260d0662b3	94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f_dump.bin.exe	Get hash	malicious	Ursnif	Browse	216.239.36.181 104.19.178.52 18.165.183.15 13.107.246.45 142.250.186.130 216.58.206.34 20.50.2.44 172.217.18.6 52.49.110.165 74.125.206.155 172.64.155.119 87.248.119.252 34.117.223.223 108.139.243.30 142.250.181.228 52.214.218.223 142.250.184.238 34.117.39.58 157.240.252.13 18.245.175.102
	https://ca.docusign.net/Signing/EmailStart.aspx?a=c2146805-52c7-48fa-ba02-aa716518fc4f&acct=ed775879-1b04-464f-88a6-342179eccbbc&er=222af835-4e89-4404-9ac1-a4b13d4e0c3a	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	216.239.36.181 104.19.178.52 18.165.183.15 13.107.246.45 142.250.186.130 216.58.206.34 20.50.2.44 172.217.18.6 52.49.110.165 74.125.206.155 172.64.155.119 87.248.119.252 34.117.223.223 108.139.243.30 142.250.181.228 52.214.218.223 142.250.184.238 34.117.39.58 157.240.252.13 18.245.175.102
	https://docsend.com/view/qqrrvyqndwsixgqg	Get hash	malicious	Phisher	Browse	216.239.36.181 104.19.178.52 18.165.183.15 13.107.246.45 142.250.186.130 216.58.206.34 20.50.2.44 172.217.18.6 52.49.110.165 74.125.206.155 172.64.155.119 87.248.119.252 34.117.223.223 108.139.243.30 142.250.181.228 52.214.218.223 142.250.184.238 34.117.39.58 157.240.252.13 18.245.175.102
	#U0426#U0438#U0442#U0430#U0442#U0430.exe	Get hash	malicious	FormBook	Browse	216.239.36.181 104.19.178.52 18.165.183.15 13.107.246.45 142.250.186.130 216.58.206.34 20.50.2.44 172.217.18.6 52.49.110.165 74.125.206.155 172.64.155.119 87.248.119.252 34.117.223.223 108.139.243.30 142.250.181.228 52.214.218.223 142.250.184.238 34.117.39.58 157.240.252.13 18.245.175.102
	NFs_468.msi	Get hash	malicious	VMdetect	Browse	216.239.36.181 104.19.178.52 18.165.183.15 13.107.246.45 142.250.186.130 216.58.206.34 20.50.2.44 172.217.18.6 52.49.110.165 74.125.206.155 172.64.155.119 87.248.119.252 34.117.223.223 108.139.243.30 142.250.181.228 52.214.218.223 142.250.184.238 34.117.39.58 157.240.252.13 18.245.175.102
	fffmpeg.exe	Get hash	malicious	Unknown	Browse	216.239.36.181 104.19.178.52 18.165.183.15 13.107.246.45 142.250.186.130 216.58.206.34 20.50.2.44 172.217.18.6 52.49.110.165 74.125.206.155 172.64.155.119 87.248.119.252 34.117.223.223 108.139.243.30 142.250.181.228 52.214.218.223 142.250.184.238 34.117.39.58 157.240.252.13 18.245.175.102
	http://003999.cc	Get hash	malicious	Unknown	Browse	216.239.36.181 104.19.178.52 18.165.183.15 13.107.246.45 142.250.186.130 216.58.206.34 20.50.2.44 172.217.18.6 52.49.110.165 74.125.206.155 172.64.155.119 87.248.119.252 34.117.223.223 108.139.243.30 142.250.181.228 52.214.218.223 142.250.184.238 34.117.39.58 157.240.252.13 18.245.175.102
	Webex.exe	Get hash	malicious	Unknown	Browse	216.239.36.181 104.19.178.52 18.165.183.15 13.107.246.45 142.250.186.130 216.58.206.34 20.50.2.44 172.217.18.6 52.49.110.165 74.125.206.155 172.64.155.119 87.248.119.252 34.117.223.223 108.139.243.30 142.250.181.228 52.214.218.223 142.250.184.238 34.117.39.58 157.240.252.13 18.245.175.102
	Items.xls	Get hash	malicious	Unknown	Browse	216.239.36.181 104.19.178.52 18.165.183.15 13.107.246.45 142.250.186.130 216.58.206.34 20.50.2.44 172.217.18.6 52.49.110.165 74.125.206.155 172.64.155.119 87.248.119.252 34.117.223.223 108.139.243.30 142.250.181.228 52.214.218.223 142.250.184.238 34.117.39.58 157.240.252.13 18.245.175.102
	https://u44668105.ct.sendgrid.net/ls/click?upn=u001.BTMESiTo6NsF48uIW4-2BrJkEc2YVFzyAaMWnWwgGT9cZqZS45ZZqu4Y-2FXJmZd8BXA8cja_AHV3UK6XjfrXMiZ9J4igW-2FDEUbICycoJ744IkX0PR6FoPBD5ixGfLkyQ9ofRFx1gjy-2BP-2BDUWqu7bhyffh6xflqZsbtNZtMLnpgQoCGrYBrKDAQCrs-2BXh7tVhTtmxcULJOM-2BKcO31hWTdcLyh6xHaFmrsv6JFsx6tjkxHhVyYzmDL2WjDZWPIbWyOCKFNxt29pnc1D6Wos9by2AU7AhdVB3KlHpWThOWm6-2FAP-2Buqng4Vq-2BmwndZ6wQGKVc-2FG51viAW-2FpPzuJOGK4hC-2FF-2FfgyonvDWvDkNa4J3BejflmN-2BuGCUZSHoW4H7oETlKRzn4f7VwMbU0WFOF9ZUfOI6CISxhvZQTsnMYzitMow1nPeu-2Flg0-2FzAaZA27HnZ5WdxtR2wKofgxyBDPpPjMUDCXBmEfEWtT8NXGmNaNpBvJDLI13EkOwRxoG67u0CqbvxxYYK-2F5eu2B-2Bg9JTJRxFbICA7lEJgDZLYhBS-2BbGjIrrRDvHg0hAvMhBJ54TVAoWNvYZYG-2FCqbCuzJrUBI0DoaRAGLq44smm73hnjeG06IT3WQV3A8KkhlXB3fqBFue-2Fd4ydFypfr1PkBzxIk-2FPd1H2pJdMYF-2B7HONDoFax8K-2BBkvfgdiIY-3D	Get hash	malicious	HTMLPhisher	Browse	216.239.36.181 104.19.178.52 18.165.183.15 13.107.246.45 142.250.186.130 216.58.206.34 20.50.2.44 172.217.18.6 52.49.110.165 74.125.206.155 172.64.155.119 87.248.119.252 34.117.223.223 108.139.243.30 142.250.181.228 52.214.218.223 142.250.184.238 34.117.39.58 157.240.252.13 18.245.175.102

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\9L0M3N8I\www.avast[1].xml

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.469670487371862
Encrypted:	false
SSDEEP:	3:D90aKb:JFKb
MD5:	C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
SHA1:	35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966
SHA-256:	B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
SHA-512:	6BE8CEC7C862AFAE5B37AA32DC5BB45912881A3276606DA41BF808A4EF92C318B355E616BF45A257B995520D72B7C08752C0BE445DCEADE5CF79F73480910FED
Malicious:	false
Preview:	<root></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	49120
Entropy (8bit):	0.0017331682157558962
Encrypted:	false
SSDEEP:	3:Ztt:T
MD5:	0392ADA071EB68355BED625D8F9695F3
SHA1:	777253141235B6C6AC92E17E297A1482E82252CC
SHA-256:	B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
SHA-512:	EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{006CCD91-1DBF-11EF-8C2C-ECF4BB45F69D}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	1.9196246493825166
Encrypted:	false
SSDEEP:	24:rim+GW/rJH3mjG//rJHrjRJHqMJRJH69lW8inxIQXd5I:rP+GW4jG/VjyI8
MD5:	CB64348C77E3D47BA0943AEBF5756DEA
SHA1:	A7CF143BD918A72C7CD51F11AE5ED98C6EBF28F8
SHA-256:	4812F2D04373B22CB34E11B40C4C5BBF9B310DAFFE1808C47427D6947E3D4607
SHA-512:	2149AE57C205CBE5EB45C6474A4B4C7AF7855C125FBDDF715780257BEC63C1D4930CE3C3E9BC9A7335D3112ABE5202AD48FDA2DC541E91A314993E8972E9406F
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y..............................................................................................................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................F.r.a.m.e.L.i.s.t...............................................................................................................O._.T.S.k.s.1.s.A.L.8.d.7.x.G.M.L.O.z.0.u.0.X.2.n.Q.=.=.........:.......................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D0D8C526-1DBE-11EF-8C2C-ECF4BB45F69D}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	1.9279394598865196
Encrypted:	false
SSDEEP:	24:rEGW/hukAG//hukrjQyukqMJQyuk69lW8H8kc658iH6:rEGWJuVG/JuAjLuleuW8Ht
MD5:	BFCE444941B9779EF466C99B6FA8E6AD
SHA1:	84DAB5D91EE46D14DBA9AC1119405C6F3B174915
SHA-256:	935841963CB8C2ED75548E7AD62D3FD4A6E2AC017450A87BE1164FAAD14DD228
SHA-512:	084A781ADCD443CC317A6EB331D40156C11FCAD80092C5E4180B3B0EA6110920D0DBE3FBDB9B820443744D36046E030D5303C1C51344076565CCBAD4A8CCF544
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................0._..................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................F.r.a.m.e.L.i.s.t...............................................................................................................O._.T.S.J.8.X.Y.0.L.4.d.7.x.G.M.L.O.z.0.u.0.X.2.n.Q.=.=.........:.......................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F13A0E4B-1DBE-11EF-8C2C-ECF4BB45F69D}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	1.9298152656524816
Encrypted:	false
SSDEEP:	24:rFmGW/EQmrG//EQrjxqMJx69lW8PP8tJqXQt:rFmGWirG/vjQK8X
MD5:	5ED278D039698ED860138D4F1AFD5387
SHA1:	638091CA265E47E568F18C059089C00B2A1F2ED2
SHA-256:	50EDCE12D5A20939D08AC72B0F0FB3C41DAB42333C60807621720CF5FBF81ED7
SHA-512:	821517EEC08C5145D2F763B98891119A7538008DCF8C93714A9DBE969CB9DACCAB99BC4054EA74E48EA601510C2C4DFDBC6B53F1ADBD68483C718852B9B77BDF
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y............................................................................................................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................F.r.a.m.e.L.i.s.t...............................................................................................................O._.T.S.T.A.4.6.8.b.4.d.7.x.G.M.L.O.z.0.u.0.X.2.n.Q.=.=.........:.......................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{006CCD93-1DBF-11EF-8C2C-ECF4BB45F69D}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	2.350291372931957
Encrypted:	false
SSDEEP:	48:rcNGhGD8hT5haD4cRIjpc8hT5haDLcRIjp:s81fajIdc81faOId
MD5:	E1A84519DCFF4707C56F73396B3DE959
SHA1:	43EEDB3F893B345747361C15FEAFB164595ABDA5
SHA-256:	DA01E71A2938985B9DEFA009BB640E33B5672FB3105DB5825C01B92F61642504
SHA-512:	FD07CFC195480495214E2DC7C3714C9277CBF2752E9866DEFEC47DD961264BEAD560CF7AB3233A437F57C22ABF3A72CAC8A125E45177CD95C3790F0479DFEA74
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y..............................................................................................................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................t.......T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D0D8C528-1DBE-11EF-8C2C-ECF4BB45F69D}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.1049840701481237
Encrypted:	false
SSDEEP:	24:rDGpMbGN9lx8FiDiZlEqZTlYSgUuwVYEd:rDGpMbGn8FiDeEgJgUuwC6
MD5:	2694AF2A2ED6F6CD9B1DB4F38BEED82F
SHA1:	05442FBA1AF8F08BFD1ACD77716D373077068E3D
SHA-256:	019289F88BD4D42AFE5B5D77857ACDCB36E6371F21F24ACFE7A4AB41B5143AE1
SHA-512:	1AC4E549B0A9E82277A77586C603D6119315CF9AFBA282DB26F4A96895AECC872CB46788C3ED30B8A23E49BB7C93A6F764F14341FBD53B1D39A46539970CD4C8
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y..........................................................................................j...................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................p.......T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F13A0E4D-1DBE-11EF-8C2C-ECF4BB45F69D}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.1107784682417203
Encrypted:	false
SSDEEP:	12:rlxAFCYbrEgmff7fFBSrEgmf37qFI9lgatz0tKGih9pfIGP5jUy2kw1l7AKso4Iu:rgbGvSGB9lx8KGih9pBNUowv7AypA66
MD5:	981FD4138FB602F3E467872EB45ECE03
SHA1:	EA07338CF11B64DA37124C4AA6157BA51C2D2369
SHA-256:	47443E8FE8F72768E39545A846B708CA7103C3D2D826731717FFA2C4E8FC11D0
SHA-512:	86A47AACA12196F8B80D9FFB1C95D6D8E8250322024CC313163B7F320DBF0A297025BC38DD35765DF6234EFEF9D27245C4F03093F41550878AB520E91ED00676
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y...........................................................................................f..................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................t.......T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (312), with CRLF line terminators
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.036451112449911
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc41EjvsCTD90/QL3WIZK0QhPPqLBVDHkEtMjwu:TMHdNMNxOEbnWimI00OmVbkEtMb
MD5:	3208A34D03B24296D8DD95C97FE9F4A9
SHA1:	85F296002081D5C8B3171D93E96475034F948FF5
SHA-256:	E953B0476AE1D929E435282B55D2EA13787F757A222116411223DEB23597F577
SHA-512:	2A8C0908FAB22950DAAED53B8021B08C3E031237515510393237046AAAB618606A5B72A0726D4A28C33F1E1B863FD00E7B61620F8BD1BA1233F357E5F131D153
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xacce67d7,0x01dab1cb</date><accdate>0xacce67d7,0x01dab1cb</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (310), with CRLF line terminators
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.091848666266551
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4fLGTkdKBGCTD90/QL3WIZK0QhPPqLBkI5kU5EtMjwu:TMHdNMNxe2kdKBNnWimI00Omkak6EtMb
MD5:	D66FD51BC9E5241A8CA300F1804ED2DC
SHA1:	D3A1730132DEA2C81B9F2DCCCDC7D2FEAE7D9336
SHA-256:	589164D17874FEE3299C760B86CA879A9E1EF9D5FFF7893554C518FF960FB151
SHA-512:	0D5EDBB8B802F565EC1D91D4AB351E2D354801DB89CFDAE2A4671BBF09AD5C6A84A3B7772DAC7F19A4135015709F64443D63146ECCE027F75B49F1CA26E33BD6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0xacc4de47,0x01dab1cb</date><accdate>0xacc74086,0x01dab1cb</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Amazon.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (316), with CRLF line terminators
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.041351875619481
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4GLyCTD90/QL3WIZK0QhPPqLByhBcEEtMjwu:TMHdNMNxvLhnWimI00OmmZEtMb
MD5:	0413DB427C39B77C1912D0CBA0F50365
SHA1:	BAEAF9313F8471D60CC5650DF6F7FC3109EC0D0E
SHA-256:	2AA0EEB25F8350D0F76CD572410C3B0E4A46DE08B04283148D832910A1DE9910
SHA-512:	47A582C3C1500EF7C05BA21B208503FBDE51C46DBAD2D5D5CE691C249769DAA7ABAEF65294056E8D33575D94B0D9D8F6B9B97CCD18948C42FEE2F66EDF2C2F65
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0xacd0c9fa,0x01dab1cb</date><accdate>0xacd0c9fa,0x01dab1cb</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Wikipedia.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-314712940\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (333), with CRLF line terminators
Category:	dropped
Size (bytes):	375
Entropy (8bit):	5.160960237668523
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltq08eDPOOKaihMLKBAKBGCTD90/QL3WIZK0QhPPqLBcE5EtMjv:TMHdNMNxtDPOOKabKBAKBNnWimI00OmN
MD5:	B390A2FC38E7376C35CA055EA8595439
SHA1:	8F41B9B1CC06D416A6FA76D31BF41EF0F2EE9509
SHA-256:	30AF520AEBB15F4637CFB6AF268F1686298B5DB81B0D986D75B1C1E1434FF4BC
SHA-512:	440C8FCB7415C9F40687A1390E40C0914B9846AA1A2E9881968CE8381BBCD1FCFBC3A96999C5241D93F56A3193AB40D0B87A2A6F53F93E84741D736AF13E20F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://go.microsoft.com/fwlink/p/?LinkId=255142"/><date>0xacc74086,0x01dab1cb</date><accdate>0xacc74086,0x01dab1cb</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Bing.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (306), with CRLF line terminators
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.047716206189745
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4JbXZX+CTD90/QL3WIZK0QhPPqLBgE5EtMjwu:TMHdNMNxizpVnWimI00Omd5EtMb
MD5:	7E526EE76AA7E5A31ACFB1AE24ECAAC6
SHA1:	C2C7BDF7516290C1E6E91FAB75A044F8DCC51A6A
SHA-256:	CCF180036AFE00DE7B85727A8A88D65AEE3C98DA1CA3971052F7FF5E7C8DCB48
SHA-512:	4947B2211B38DDE7109D522B64F0FBE402C4DFAB7D2B5DD6C202D3457C7A51CC6BF574804745F7FFB9256DC8D016EBA7EF1E1AD0C0BBE1C1E2C88CE8C6F3608C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0xaccc0521,0x01dab1cb</date><accdate>0xaccc0521,0x01dab1cb</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Live.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (312), with CRLF line terminators
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.052459459727855
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4UxGwyCTD90/QL3WIZK0QhPPqLB8K0QU5EtMjwu:TMHdNMNxhGwhnWimI00Om8K075EtMb
MD5:	840AE7A2F9705826C846071AAD8BDED9
SHA1:	86BDC298AA9F0FA709E54168D522D88B5979A2CE
SHA-256:	93C58D097737A3F8371CB4D9EB28014DAEBE1B1BE025B29033D7092962031FC1
SHA-512:	59725E426DAD879B28558B83D9886E282419BA0391AC436D7F3647D472E034A05A439B05C2AC4F26C3333E07A29306FC8589988EC19DC9D2B0C9AEC34276B59D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xacd0c9fa,0x01dab1cb</date><accdate>0xacd0c9fa,0x01dab1cb</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (310), with CRLF line terminators
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.039062157658438
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4QunjvsCTD90/QL3WIZK0QhPPqLBAkEtMjwu:TMHdNMNx0nbnWimI00OmxEtMb
MD5:	00A4A647E97764E02E153154A9A8C876
SHA1:	3E7A689D3751E1411897F9B66363F4B9C70B5E77
SHA-256:	7649D69AF3BF5FF2FA15BFB13ED01928BE2EE7E194168F23413CEA452FFC8E00
SHA-512:	9C62117394596B998B65322C9CCE1DBC3F6596D193EEF5CA470943A4283ABA084D734F147F1A02EE6A0BDDCE6DC7E13A5F232BD65F974603D49007F60BF00F6C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0xacce67d7,0x01dab1cb</date><accdate>0xacce67d7,0x01dab1cb</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Reddit.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (312), with CRLF line terminators
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.0827668116146665
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4oTbXZX+CTD90/QL3WIZK0QhPPqLB6Kq5EtMjwu:TMHdNMNxxzpVnWimI00Om6Kq5EtMb
MD5:	1D2877F549A17AC4A607532FCB0340C7
SHA1:	1A42AE359EC197CB12220629F39997C7433C774B
SHA-256:	4CF7106BE0D98CDD4FAD39544F181E6E876B82D702F49361B6E5BA6FD4A5BBDE
SHA-512:	CAB67AD48D53E5CCD479AB7F54D7F4E5EACE9B06A3FFDF86CC1DC7EB100FA273553DA22D4775FC852E20CA874792F322496A8278124D73CB4BCE7FF45EC27142
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0xaccc0521,0x01dab1cb</date><accdate>0xaccc0521,0x01dab1cb</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\NYTimes.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (314), with CRLF line terminators
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.041232141610921
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4YX2n0d67d6tCTD90/QL3WIZK0QhPPqLB02CqEtMjwu:TMHdNMNxcs656MnWimI00OmVEtMb
MD5:	71410C51BAD8A71BE9B35F1B4B8B2F6F
SHA1:	64A88B483188836BF8D2D8A1AF3DC7A31DC33672
SHA-256:	099D96C060EA28F5574B34F6DCA4912767632CCDA3DB71F2CE207F934BBEE37E
SHA-512:	9D06E696620FC80DE6E2BAD5582DF3BE9F957790BB5E95F5B88A4B8055007874921B04532A1BBA934EC1F5152C48D8764C284112B483EE62C78D2C6CED41685F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xacc9a303,0x01dab1cb</date><accdate>0xacc9a303,0x01dab1cb</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (310), with CRLF line terminators
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.03285064608443
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4In0d67d6tCTD90/QL3WIZK0QhPPqLBiwE5EtMjwu:TMHdNMNxfns656MnWimI00Ome5EtMb
MD5:	36FB34E2362B8AB7C3196A7051543909
SHA1:	B1BB8AC701A2308DE63032153DE51989ED791ED7
SHA-256:	4309E58949F823349E56CE9E75C1EABE5C7E1A2C78E15263E2BF7290866B66E7
SHA-512:	2F590C8AC1E96CC83C6CBA978984986868481F83A254E09A0A6BD64875312E95EFA0A6D8052E8C2A26C08452DA32495C4A4FB60B525491F357E2BCA87FAF70B1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0xacc9a303,0x01dab1cb</date><accdate>0xacc9a303,0x01dab1cb</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Google.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\jhpjx6f\imagestore.dat

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	modified
Size (bytes):	8500
Entropy (8bit):	3.9280010194649657
Encrypted:	false
SSDEEP:	96:jD7GrP22l1+18dqYkGOmNYWa9Kym7BzNTvtdoTL:jDp2l1+XYkSNDyK9hNTv0P
MD5:	48CB7F41CE1235BE789E1D239079FF90
SHA1:	227B098A18DB4523B8DC77D63988E871EE7B449A
SHA-256:	5C0CBD23ED7352E2A88F722EEEA1DCF7253ACB582F37CDEDB51DBC7B20367712
SHA-512:	63CB428068201F14C6C8258C5D698F6DEA9FB9AE977D39E2B80C6B5408EA812E63EED20EF8F68765804138DDFC57B62EA722447E1CF0BC79D56FB57A29356552
Malicious:	false
Preview:	........P.h.t.t.p.s.:././.s.t.a.t.i.c.3...a.v.a.s.t...c.o.m./.1.0.0.0.3.7.2.2./.w.e.b./.i./.v.3./.c.o.m.p.o.n.e.n.t.s./.i.c.o.n.s./.s.e.o./.f.a.v.i.c.o.n...i.c.o.?.v.=.1.~............... .h.......(....... ..... .........#...#................x...z...~...y.F.y...x...x...x...x...y...y.F.}...y...x...............d...x...x...x...x...x...x...x...x...x...y...x..?...a....................w...x...x...x...x...x...x...x...x...{..l...2....5..J.......{...&....v...v...w...x...x...v...x...y..f............y.F.w..).......{...W...D...+....{...}..;...@...i.......!....t.H.y...v..p...............~...e...w...........r.......\|....w...x...x...w......<...0...T...............w...Z...........#....w...x...x...x...w......................P...I................w...x...x...x...x...w.. ...............1...>...............*....w...x...x...x...x...x...y..Q...u.......6....................x...x...x...x...y...x...x...x...v...u..1...................3....v...x...x...x...y.F.x...x...x...x...~.......................y...x...x...x..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\10156543[1].json

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Preview:	{}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\MierB03-SubsetEng-ExtraBold[1].woff

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 25684, version 1.131
Category:	dropped
Size (bytes):	25684
Entropy (8bit):	7.9815970317013685
Encrypted:	false
SSDEEP:	768:RDM0xCONRyJ5M94GO11Etx+wHV/7K4cvdaI:RDM0xC2RyHMgex+u/7K4udL
MD5:	204A77AD74130F9FA40E3DDDEB099FAB
SHA1:	8BA668092FF28DAD21388D4A78DD113EF257BBDF
SHA-256:	71992D43EE79279223DDE04D8F70CCCFDE9241C2B7FFECF3827840F1E5F2BBFC
SHA-512:	660E5A0277BA5F0AB4BC656B149955F6D638677231FC79F0EB4BF942F9E712EC6E2AEF5BA0F86AA1C4B70A0777B05DD1122DD057E59445A13BCFDD68E4A34AC8
Malicious:	false
Preview:	wOFF......dT................................GDEF..Qd.......n._.DGPOS..RL...F..@R.q~XGSUB..c........(.4..OS/2.......X...`k...cmap.............-w.cvt ..............;Vfpgm............b/..gasp..Q\............glyf...$..=...hx.":-head.......6...6..!Phhea.......!...$.q.qhmtx...T...i...$.u..loca............C._.maxp....... ... .l.Vname..N....Y...\....post..QH....... ...sprep..............q\|.........{._.<...........Pr...........................x.c`d``>.......2.N.Lb.. .FN..h................P......W............x.c`arbz........................9.....l....@.......\|...x.31....p...#.P.?H..1.. .....Qa.Wx.].KHTQ........qt\|...Y..CM.MJ...I,...Jj.&2Z. .. (.].... .E-#HZ. $...... ......s.=c..[.%......I..{..7.1..O.?.7....;K[Tqw..Q..../..T.}.n;.\|...U..(k..=...Y#.YbN..Zm.c.Q..3...Z1..y...\R....N......R1.A.fB...!.l.Y'c7./jt)U...a....v.n.K..{..E...!.......&Y.7.)...hk%;V..........$....>.)r.'('....%/.(.\|...O.Wp..W...{.Y..y..F.&....3j .QN[...GL.rL..j..j2.y..5..U.R..*..,...z./(G..l..Z

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\RE1Mu3b[1].png

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4054
Entropy (8bit):	7.797012573497454
Encrypted:	false
SSDEEP:	48:zICvnyRHJ3BRZPcSPQ72N2xoiR4fTJX/rj4sFNMkk5/p1k2lPUmbm39o4aL7V9XH:10nvE724xoiRQJPrjpLKSFl9oX31Z1d
MD5:	9F14C20150A003D7CE4DE57C298F0FBA
SHA1:	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F
SHA-256:	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
SHA-512:	D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487
Malicious:	false
Preview:	.PNG........IHDR.............J.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A00BC639840A11E68CBEB97C2156C7FD" xmpMM:InstanceID="xmp.iid:A00BC638840A11E68CBEB97C2156C7FD" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2C931A470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJR 1.4`$.200...l........wg.y.[k/

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\SIE[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (8035)
Category:	dropped
Size (bytes):	9840
Entropy (8bit):	5.488567579370931
Encrypted:	false
SSDEEP:	192:pIUZupNimxa4/iWrth6arHlDwTddZBobKTPsGD6u0IMmuSRLl7s:0imRnzTxwxBobKTPsGD6JIMmuSk
MD5:	2FE24D95965E947C8614ACC02CE04A41
SHA1:	320C1387EA163C4C063EAAD48EDA9DC4A8D89E78
SHA-256:	A6F8FCDB39ECB00EA8E66E78EDED99F8F82150F7072181BD4298FC3C68E51D56
SHA-512:	F7135CFF539F2CCDB0D9637B5EEC3EC0FAB1D559A6B79C17A53566CD07F81EC452A528C7D0F4324ED44DE6322D93857C2E093B7C0B0250628877F756D6D990A4
Malicious:	false
Preview:	(function () {. if (typeof window.QSI === 'undefined'){. window.QSI = {};. }.. var tempQSIConfig = {"hostedJSLocation":"https://siteintercept.qualtrics.com/dxjsmodule/","baseURL":"https://siteintercept.qualtrics.com","surveyTakingBaseURL":"https://s.qualtrics.com/spoke/all/jam","zoneId":"ZN_b3HblKJHhPwrz9k"};.. // If QSI.config is defined in snippet, merge with QSIConfig from orchestrator-handler.. if (typeof window.QSI.config !== 'undefined' && typeof window.QSI.config === 'object') {. // This merges the user defined QSI.config with the handler defined QSIConfig. // If both objects have a property with the same name,. // then the second object property overwrites the first.. for (var attrname in tempQSIConfig) { window.QSI.config[attrname] = tempQSIConfig[attrname]; }. } else {. window.QSI.config = tempQSIConfig;. }.. window.QSI.shouldStripQueryParamsInQLoc = false;.})();../@preserve.Version 2.7.0./../*@license.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\app-store-badge[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	7163
Entropy (8bit):	4.040245205784672
Encrypted:	false
SSDEEP:	192:IJNfvo2wNarIgzmndx20i5D6hLD7deOE6KQf:IJFbz+8YD7IOEY
MD5:	A011CBC6F8050B1A0476814ED984C7E4
SHA1:	531504AFBAB64EEAB431178D98F39D2DA9A7511B
SHA-256:	7645112B30079D6481A6F1AD8AD331443F1C6B12804CC43B1CA1252E46B677AC
SHA-512:	29E1BD9DE030F8D9D86A8DAE87D8E29B9AD5F1310438BF345DE0A609672FCC8507325DA9E03178E7BAA39A2241F8F43D30A955314E3CC2A18C154B8000C5699F
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="119.664" height="40"><path d="M110.135 0H9.535c-.367 0-.73 0-1.095.002-.306.002-.61.008-.919.013A13.215 13.215 0 005.517.19a6.665 6.665 0 00-1.9.627 6.438 6.438 0 00-1.62 1.18A6.258 6.258 0 00.82 3.617 6.601 6.601 0 00.195 5.52a12.993 12.993 0 00-.179 2.002c-.01.307-.01.615-.015.921V31.56c.005.31.006.61.015.921a12.992 12.992 0 00.18 2.002 6.588 6.588 0 00.624 1.905A6.208 6.208 0 001.998 38a6.274 6.274 0 001.618 1.179 6.7 6.7 0 001.901.63 13.455 13.455 0 002.004.177c.31.007.613.011.919.011.366.002.728.002 1.095.002h100.6c.36 0 .724 0 1.084-.002.304 0 .617-.004.922-.01a13.279 13.279 0 002-.178 6.804 6.804 0 001.908-.63A6.277 6.277 0 00117.666 38a6.395 6.395 0 001.182-1.614 6.604 6.604 0 00.619-1.905 13.506 13.506 0 00.185-2.002c.004-.31.004-.61.004-.921.008-.364.008-.725.008-1.094V9.536c0-.366 0-.73-.008-1.092 0-.306 0-.614-.004-.92a13.507 13.507 0 00-.185-2.003 6.618 6.618 0 00-.62-1.903 6.466 6.466 0 00-2.798-2.8 6.768 6.768 0 00-1.908-.62

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\avast[1].css

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (65310)
Category:	dropped
Size (bytes):	768644
Entropy (8bit):	5.097132777517217
Encrypted:	false
SSDEEP:	12288:laijslnRvvwFsNLVDjLDvM2ayxmPtqt4XNXcrgGtqfqt2:la+slnRvvwFsNLVDjLDvM2ayxmPtqt43
MD5:	A1BF0BF51E655BA2C6E754487BF3F855
SHA1:	EA44A6C2CFE038E8DC412006FFEF869988538A70
SHA-256:	3B86A96FA64E8F0E449D8855BC33E9711CD8D4439C68FCDB4914A385FE9DCB77
SHA-512:	B2C59FC2F6A59F54896F4BC49FC48AAC6F4FC593D845EA1FE3A0A18BA72EE9D8DB518F633471DCEDBA233269A2E60E9388885F2AC5E7444995D626A715F27C64
Malicious:	false
Preview:	/!.=========================================================. Avast styles.=========================================================.* Include only global stuff here.=========================================================.*/#onetrust-consent-sdk .btn{position:relative;font-weight:750;display:inline-flex;align-items:center;z-index:0;text-decoration:none;border-radius:400px;transition:all ease-out .2s;cursor:pointer;color:inherit;background-color:transparent}#onetrust-consent-sdk .btn.with-label{position:relative}#onetrust-consent-sdk .btn.with-label .label{position:absolute;z-index:1;top:0;left:50%;transform:translate(-50%, -50%)}#onetrust-consent-sdk .btn:not(.link):before{content:"";position:absolute;height:100%;width:100%;z-index:-1;transition:all ease-out .2s;top:50%;left:50%;transform:translate(-50%, -50%);border-radius:400px;border-style:solid;border-color:transparent}#onetrust-consent-sdk .btn.disabled,#onetrust-consent-sdk .btn:disabled{cursor:initial;pointer-events:none}#on

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\eVngNF[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.510440455293556
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLKqIeU0GAqwcWWGu:q43tISl6kXiMIWSU6XlI5A4apfGu
MD5:	50C8543CE97B0A162549FC1C2D072FD4
SHA1:	7C9C6362040BE7A7B86E91E5031D90239442AC00
SHA-256:	72FC966C6B38D9273772ECE83B239338BF3CDB38422DB914B7642B0FC5965E54
SHA-512:	C075755974B39E467DFC6C2FA6D8357B27BB402C036F2548C1040140BA0FF5B4F852A915D5D094AFAADFE44E3951DFBA0040D15835B6EF06AE3A84DF66FBB337
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>openresty/1.19.3.1</center>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\error-page[1].css

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	130
Entropy (8bit):	5.12524257117262
Encrypted:	false
SSDEEP:	3:tMpTUiOUDM00eNfxvxEgMzNEZPlV/Yp6o/A:t7iNzNj+zNW9e8
MD5:	C53EE41B2AF58E874C1902E5C25CF5B5
SHA1:	068B86BE4160E968046615ABFA0FFFDE3F6FA58E
SHA-256:	3C0F67E69116DF70D158EB0E613D40CED6133C1DD51EFCD10C72DBBA621AD6A4
SHA-512:	8559C72F27A52C6BC2035FCA575678CD5371D6027F683CA4E308A9F99D87C75DF3680A03C8F79DEBCAEDBA306F563BB8621333D848BA5BDDD0C4C2D86B1BDF50
Malicious:	false
Preview:	@media (min-width: 992px){.trustpilot-widget{width:421px;transform:translateX(-18px)}}../# sourceMappingURL=error-page.css.map /

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\fbevents[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (64347)
Category:	dropped
Size (bytes):	223733
Entropy (8bit):	5.454805985390715
Encrypted:	false
SSDEEP:	3072:H88WClBUIncVuP0bteuvQ+AMPpgArl0xYu5GKndQ:H8lWBU7O0bvQQGArHu5GKnG
MD5:	7C75053C3DC6FBEF27DB57E11E5C63C4
SHA1:	CAFC7264C0B8224F621BFABAF588905552008D49
SHA-256:	E9C370EA9070B144ED45FF5F35C9206112DD1091326FF898F414EF8C12EC85C0
SHA-512:	92F72DC113DC761AAFB2F630C77773C19029C9C0CB995238281AC5109AAA043940B1E681EB9EEACD8E436141BD97928985B679B1515166227097E4772E1FE1B7
Malicious:	false
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\gen-logo[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1349
Entropy (8bit):	4.201219141408615
Encrypted:	false
SSDEEP:	24:t5Iu2eFA8C+w7Li+OMgJbuPogg9+5ZhUqT9VEujfWQofRn3DAx3OvvCIsyAKmq:ae/Ca+9gBqTgU9Jj+NpTAx3+vXsycq
MD5:	17D244683C9737C01686C384F87145E2
SHA1:	44AACB11ECF74D8594C95AF08D9787C654A7D248
SHA-256:	77B31D0E25FFE381DCD42AA468F074882CB5CB0F0B8BF26FA913308CD4D2772C
SHA-512:	AD80BB26C37BC2B8418DBAA31A3E4B3465D00FB5C5481C5E6BD4CF4746ECC103465DAA83137195729E33F7849DCF4B15D9F489F00C7858F3A566C40EA1A7EECF
Malicious:	false
Preview:	<svg width="38" height="18" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M6.947 14.895c2.198 0 4.003-.765 5.18-2.57v2.158h2.414V9.047c0-1.275-.687-1.824-1.982-1.824H7.77V8.32c0 .942.51 1.315 1.373 1.315h1.746c-.274 1.452-1.608 2.53-3.454 2.53-2.237 0-4.022-1.824-4.022-4.709 0-2.57 1.55-4.63 4.297-4.63.588 0 1.06.097 1.491.274.55.216.824.471 1.237.863.352.353.627.608 1.314.608h2.434C13.697 1.688 10.733 0 7.672 0 3.159 0 0 3.454 0 7.79c0 4.378 3.473 7.105 6.947 7.105zm18.966-5.69c0-3.1-2.12-5.121-5.063-5.121-2.963 0-5.376 2.276-5.376 5.514 0 3.277 2.315 5.298 5.317 5.298 1.904 0 3.729-.863 4.611-2.393a6.478 6.478 0 00-.568-.432c-.334-.236-.628-.373-1.02-.373-.373 0-.707.216-1.119.491-.451.294-1.04.452-1.589.452-1.295 0-2.511-.766-2.708-2.335h7.436c.059-.219.079-.807.079-1.101zm-2.944-.843h-4.533c.216-1.315 1.118-2.139 2.354-2.139s2.179.844 2.179 2.12v.019zm3.895 6.121h2.924V9.224c0-1.707.843-2.766 2.257-2.766 1.139 0 1.923.568 1.923 2.001v4.65c0 .883.413 1.394 1.394 1.373h1.53

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\hotjar-470805[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (10320)
Category:	dropped
Size (bytes):	18110
Entropy (8bit):	5.245684370648197
Encrypted:	false
SSDEEP:	384:JbYUyZYjOZYui4pOYYX+bn3yseSelvzgbrb55C:BYUiYCYqVY2fehzgbxQ
MD5:	6B57269A91BB8C13B32EF276D2D69F6D
SHA1:	7C02A3173F76D7DAD3C3779C6D620F9826D614B7
SHA-256:	DA4FCA309F89D2552D8F79BC37AAFD317B58D5F3D2BBA62954FC88A942124972
SHA-512:	44E9D77C35FCCEB45BFE8BFBC643A4A58D07E53535C179329979120D3608F2ABD80021FF4B2C0ED38B3DA33C874FAA9DF3FAF4CE4CD8E778B7062DC8CDAB0DAF
Malicious:	false
Preview:	window.hjSiteSettings = window.hjSiteSettings \|\| {"site_id":470805,"rec_value":0.0,"state_change_listen_mode":"automatic","record":true,"continuous_capture_enabled":true,"recording_capture_keystrokes":false,"session_capture_console_consent":false,"anonymize_digits":true,"anonymize_emails":true,"suppress_all":false,"suppress_all_on_specific_pages":[],"suppress_text":null,"suppress_location":false,"user_attributes_enabled":true,"legal_name":"Avast","privacy_policy_url":"https://www.avast.com/privacy-policy","deferred_page_contents":[],"record_targeting_rules":[],"feedback_widgets":[{"id":397263,"created_epoch_time":1649746901,"effective_show_branding":true,"skin":"light","background":"#ee8031","position":"middle_right","content":{"email":"We may wish to follow up. Enter your email if you're happy for us to contact you.","emotion":"How would you rate your experience?","initial":"Help us improve by sharing your feedback.","thankyou":"Thank you for sharing your feedback with us!"},"connect_

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\icons-16[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	31547
Entropy (8bit):	4.411704240354615
Encrypted:	false
SSDEEP:	768:CtA/zzdvxG8f8cWHpGjHwTnOqnyap0KdEkKwc0xy:CtAfdvxG8f8lOkyap0KdEkKwU
MD5:	4094C1B565F1E08DDA6E895698F5F42A
SHA1:	D65957A616D4DF38B2422BE6374B721CEA9A8579
SHA-256:	39BC8E209C1587F0879833E23FBDE54ABD2A60ACEC0A2F1CE9590D495518571F
SHA-512:	6D752A627FFB742C9B7600D62C0F85D3094E87A2830525D7F954A70235405CCDDB58A8AE758EA83EC40A90542FCF58F305308C444A8F0FF73541302F0F1E99E5
Malicious:	false
Preview:	<svg width="496" height="208" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M1.75 8h12.5m0 0L9.5 3.75M14.25 8L9.5 12.25M301.45 8H296m0 0v5.45M296 8h-5.425M296 8V2.575M332 38l-3.53 3.441a.8.8 0 01-1.131-.014L324 38m-32 4l3.53-3.441a.8.8 0 011.131.014L300 42" stroke="#000" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><circle cx="424" cy="136" r="3" fill="#000"/><path d="M201.371 68.133v-2.2m0 2.2h1.063a1.4 1.4 0 011.4 1.4v1.037m-2.463-2.437h-2.87m-4.633 2.437h2.2m0 0v-1.037a1.4 1.4 0 011.4-1.4h1.033m-2.433 2.437v2.9m2.433-5.337v-2.2m-4.633 7.537h2.2m0 0v.997a1.4 1.4 0 001.4 1.4h1.033m0 2.166v-2.166m0 0h2.9m2.433-2.397h2.167m-2.167 0v.997a1.4 1.4 0 01-1.4 1.4h-1.033m2.433-2.397v-2.9m2.167 0h-2.167m-2.433 5.297v2.166m-2.933-7.5h2.966v2.934h-2.966v-2.934zm-67.659 2.371V67.7a1.2 1.2 0 011.2-1.2h7.113a1.2 1.2 0 011.2 1.2v.229m-11.047 7.004h6.203m7.249.778h-4.809m4.809 0v-4.35a1.2 1.2 0 00-1.2-1.2h-2.409a1.2 1.2 0 00-1.2 1.2v4.35m4.809 0V76.8a1.2 1.2 0 01-1.2 1.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\index[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines (6826)
Category:	dropped
Size (bytes):	7916
Entropy (8bit):	5.103471969926501
Encrypted:	false
SSDEEP:	192:ub6veTxMW8D1J7sU6J+xlqKFSCtXrYJ2EpX+1G8U:xeXC7sUJxlqeSCtXro2Ep3
MD5:	56A7599B9E77FE4786D628B625E7024B
SHA1:	5C36E8DA38B24C64F33D924C788056A0501F0BB2
SHA-256:	E7EED928596FC3D1C1180C26F81E1847C6AAC858CCA19C4A69FD9F1220EF5FF3
SHA-512:	E02DD37A72429C0DBA499851F2BEAE26002E82E015BE3C86C02CDCE82AA3227CB19F8FD4599BAF0129B0E5B86E7D291DA2DDA82682FD3DE5D0A5DA3085810B23
Malicious:	false
Preview:	<!DOCTYPE html>.<html>. <head>. <title>Trustpilot Custom Widget</title>. <meta charset="utf-8" />. <meta name="robots" content="noindex" />. <style>.html,body,div,span,applet,object,iframe,h1,h2,h3,h4,h5,h6,p,blockquote,pre,a,abbr,acronym,address,big,cite,code,del,dfn,em,img,ins,kbd,q,s,samp,small,strike,strong,sub,sup,tt,var,b,u,i,center,dl,dt,dd,ol,ul,li,fieldset,form,label,legend,table,caption,tbody,tfoot,thead,tr,th,td,article,aside,canvas,details,embed,figure,figcaption,footer,header,hgroup,menu,nav,output,ruby,section,summary,time,mark,audio,video{border:0;font:inherit;font-size:100%;margin:0;padding:0;vertical-align:baseline}article,aside,details,figcaption,figure,footer,header,hgroup,menu,nav,section{display:block}body{line-height:1}ol,ul{list-style:none}blockquote,q{quotes:none}blockquote::before,blockquote::after,q::before,q::after{content:"";content:none}table{border-collapse:collapse;border-spacing:0}body{font-family:"Helvetica Neue","Helvetica","Arial","sans-s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\launch-773db4767ac4.min[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (32743)
Category:	dropped
Size (bytes):	205841
Entropy (8bit):	5.356480348534711
Encrypted:	false
SSDEEP:	3072:9SdjG4w1PR0Du9K2iv3FsXui5EZQQuHt8iVA9+zQ:9SdjG4C0D6K2U2XuiWmQuHt8P
MD5:	0743B8CB622D1A3912AE398FD0EDFEC6
SHA1:	C2E197F6E46CD251E8727110512D1DECA5021459
SHA-256:	E44BB2883D3CCD7060AD1FEAAF6A22422E5DC221271C11886CA0BC1946372E7F
SHA-512:	75B30E5758AC145A057FD88B46EA360262E4A7CF6201B6640D34856294EB18B8C3327D34B25ADFB903121775CC3BAA8FC031D3FFF218402305534FE351F2555F
Malicious:	false
Preview:	// For license information, see `https://assets.adobedtm.com/b29989a14bed/ccef52b414db/launch-773db4767ac4.js`..window._satellite=window._satellite\|\|{},window._satellite.container={buildInfo:{minified:!0,buildDate:"2024-04-10T17:18:01Z",turbineBuildDate:"2023-02-22T20:37:26Z",turbineVersion:"27.5.0"},environment:{id:"ENe5f28798d073455d88b6f8f4fd63eb52",stage:"production"},dataElements:{site_language:{modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nortonAnalytics.site_language"}},TCG:{modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nortonAnalytics.test_group"}},site_country:{modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nortonAnalytics.site_country"}},pagename:{modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nortonAnalytics.page_name"}},"site section":{modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nortonAnalytics.site_section"}},"Dynamic A

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\local[1].css

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (788)
Category:	dropped
Size (bytes):	827
Entropy (8bit):	5.079894361738113
Encrypted:	false
SSDEEP:	12:s+3oTW+AHJrqB0AHJrGuNV0DiD+3oTW+xBB0x3uNiD+3oTW+bSRTB0bSRFuYp03n:s0YAprqB0Apr70YPB0/0YEB0g2VJ
MD5:	1E6F5D88860066D6C32149FA68E33AB3
SHA1:	625B31784A9D536241606E09E0302A275225B44B
SHA-256:	D8E25E09B60F2CE43780F3B43594E2BF8F4316EE379DBA926A2B142F5E11DCDB
SHA-512:	47DA66C65671C356A21C8CD3030DB7FA96521F37EAB4D757DE2D9C03A392608266DEEDB5CDFEDFAAAA1FD4B9811D487B346F5D2060FFD542114590B26E1DB437
Malicious:	false
Preview:	@font-face{font-family:"MierB03";src:url("../../../../../o/f/400/MierB03-SubsetEng-Regular.woff2") format("woff2"),url("../../../../../o/f/400/MierB03-SubsetEng-Regular.woff") format("woff");font-style:normal;font-weight:400;font-display:swap}@font-face{font-family:"MierB03";src:url("../../../../../o/f/700/MierB03-SubsetEng-Bold.woff2") format("woff2"),url("../../../../../o/f/700/MierB03-SubsetEng-Bold.woff") format("woff");font-style:normal;font-weight:700;font-display:swap}@font-face{font-family:"MierB03";src:url("../../../../../o/f/800/MierB03-SubsetEng-ExtraBold.woff2") format("woff2"),url("../../../../../o/f/800/MierB03-SubsetEng-ExtraBold.woff") format("woff");font-style:normal;font-weight:750;font-display:swap}body{font-family:"MierB03", "Helvetica", "Arial", sans-serif}../# sourceMappingURL=local.css.map /

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\media-1[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6254
Entropy (8bit):	4.099651029378647
Encrypted:	false
SSDEEP:	96:/ZXSoJD4v9Bb/qzfZlffIfT2jIn7JacTOZas6h4D7W3IblQbgTUgIfAhce3:xXSv//KfmJ7IWh4D1/TUgIfA6O
MD5:	41E86A5BD4191D2EFBFFC3528B375D9D
SHA1:	D606FC90CF7C89C8FADD3BB38242B81363DB4433
SHA-256:	3EA56AA3FEC1B376697A044A924A0A85E9F24B348D025E55351A71C807DF5A5B
SHA-512:	0F2324C497D20B33F7BA67C3E74B07B0F269E69C392E59DFB0BEAF7435EBEC84EF4DFDCBB4E11C07FB58DC6702BA561D32A321CDD3E5C102A965C285C865AF7B
Malicious:	false
Preview:	<svg width="400" height="392" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M238.652 13.761C121.053-35.217 54.452 52.814 11.465 178.697-31.52 304.58 53.377 360.188 149.653 381.761c109.03 24.43 199.463 10.217 242.467-98.612 32.6-82.501-39.326-221.85-153.468-269.388z" fill="#FFF9F5"/><path d="M19.285 112.595c-2.474 2.613-1.766 7.878.847 10.353 2.613 2.475 9.881 4.41 12.357 1.798 2.475-2.613-1.378-9.925-3.991-12.401a6.516 6.516 0 00-9.213.25z" fill="#FFBF00"/><path d="M395.442 284.709c-1.425-3.938-4.933-3.654-8.871-2.229-3.938 1.426-6.814 3.454-5.389 7.392a7.583 7.583 0 1014.26-5.163z" fill="#FFDDBF"/><path d="M69.617 266.463c-1.425-3.938-4.934-3.655-8.871-2.229-3.938 1.426-6.815 3.453-5.39 7.391a7.583 7.583 0 009.712 4.549 7.582 7.582 0 004.55-9.711z" fill="#FFAF9D"/><path d="M230.276 48.88l-19.377-21.799c-1.222-1.374-3.495-.51-3.495 1.329v14.975a4 4 0 01-2.341 3.64l-34.294 15.634a8 8 0 00-3.775 10.98l17.814 34.143a15.984 15.984 0 011.812 7.108l3.195 174.424c.167 9.129 7.615 16

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\one-trust[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (972)
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	5.013859345459063
Encrypted:	false
SSDEEP:	24:bRRpKGkIgdOyMVRF6yGRRpWORR19hrIbXZyXLd:btcdrMVjPGtt/lIb0B
MD5:	2C31476E4A42056CE5898EA8B4FB6D18
SHA1:	4447ED0AAD40E9F79A73EA6D5B49FB9C692C26F4
SHA-256:	4AB1F474E4841BB4F871A578F69D0F19F97BEB7E7FEAC50A7A28ED5113428894
SHA-512:	92A3CB693FEC9BADEC591BDA7B176399EA519997DF9B88EF83776EF03BA5F7E4F20B228C0D8D6447AAA0D8939F97AF6C1D3F85169B9625C284EAAC15AA505F7C
Malicious:	false
Preview:	function OptanonWrapper(){var a=document.getElementById("onetrust-consent-sdk");document.body.prepend(a),function(a){var b="; "+document.cookie,c=b.split("; "+a+"=");if(2==c.length)return c.pop().split(";").shift()}("OptanonAlertBoxClosed")\|\|($(".ot-accordion-layout button").attr("aria-expanded","true"),$(".ot-pc-footer .ot-pc-refuse-all-handler").length>0&&$(".ot-pc-footer .ot-pc-refuse-all-handler").insertAfter("#accept-recommended-btn-handler"));const b=navigator.globalPrivacyControl;if(b){document.getElementById("onetrust-consent-sdk").classList.toggle("gpc-detected")}var c=document.querySelector(".gpc-on"),d=document.getElementById("cookieGPCControlButton"),e=document.querySelector(".banner-actions-container");c&&(e.appendChild(d),b?d.addEventListener("click",function(){OneTrust.Close(),document.body.classList.remove("ot-overflow-hidden")}):d.addEventListener("click",function(){OneTrust.AllowAll(),document.body.classList.remove("ot-overflow-hidden")}))}.//# sourceMappingURL=one-tr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\powered_by_logo[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	5194
Entropy (8bit):	3.976628767895142
Encrypted:	false
SSDEEP:	96:mD6VAMcWnVRSNUrN3Sky4gNeLSYiJ7iFsAkl2+heNm7iprXbep5DkoG23b+WYYY:p9bSNURZyNNnRJqsAehheImprmDkozYV
MD5:	63E737D3544164D2B7F4FBCA416AC807
SHA1:	030370AA38715E4C41589633F69D0BFE8255D46C
SHA-256:	5FA00D047ACD959697B9D7772C31DCD37BEC33C70C6FBF80AB8316205D1D286D
SHA-512:	31EE1BB536C0E50F5568A415EA3308367BFCFD11D2A6F7DFF1C8E3A982F7BE790C240A603CD4C6E187672824B8E5D07646049A28C6A88A7B001EB9A0142F312B
Malicious:	false
Preview:	<svg height="16" width="136" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 136 14.6"><defs><clipPath id="a"><path fill="none" d="M53.76 0H136v14.6H53.76z"/></clipPath></defs><path d="M0 12.3V5.59h2.27a2.62 2.62 0 011.29.28 1.83 1.83 0 01.74.77 2.25 2.25 0 01.25 1.07 2.26 2.26 0 01-.25 1.08 1.77 1.77 0 01-.74.77 2.55 2.55 0 01-1.28.29H.66v-.72h1.59a1.81 1.81 0 00.87-.19 1.1 1.1 0 00.48-.5 1.73 1.73 0 00.15-.73A1.66 1.66 0 003.6 7a1.1 1.1 0 00-.48-.5 1.86 1.86 0 00-.88-.18H.81v6zm7.74.1a2.29 2.29 0 01-1.2-.32 2.29 2.29 0 01-.8-.91 3.06 3.06 0 01-.28-1.36 3.07 3.07 0 01.28-1.37 2.14 2.14 0 012-1.24 2.14 2.14 0 012 1.24A3.07 3.07 0 0110 9.81a3.06 3.06 0 01-.29 1.36 2.11 2.11 0 01-2 1.23zm0-.69a1.31 1.31 0 00.85-.27 1.6 1.6 0 00.5-.69 2.9 2.9 0 00.16-.94 2.85 2.85 0 00-.16-.94 1.67 1.67 0 00-.5-.71 1.37 1.37 0 00-.85-.26 1.35 1.35 0 00-.85.26 1.67 1.67 0 00-.5.71 2.85 2.85 0 00-.16.94 2.9 2.9 0 00.16.94 1.6 1.6 0 00.5.69 1.29 1.29 0 00.85.27zm4.43.59l-1.54-5h.82l1.08 3

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\prodico-32_breachguard_white[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1219
Entropy (8bit):	4.593498476722124
Encrypted:	false
SSDEEP:	24:tzkuOU6joxiRnG7TYhllBjdlUcd3y5DPHAXvzRRcHV7/pjXBDpTYhll7:QU60M5G+WcNbLRC7xrBDA
MD5:	C526F0A4834C12DCDDAB62927102F8B8
SHA1:	BD2E83E856A38B1A5EE1548B741A9C197F97130B
SHA-256:	DD886A8A6D218329AE63D319D5FEB0459FFD3869F2570D312386935B53399868
SHA-512:	6551553FD2708D9C90E39BD5CDBA3DFCE28111AC53BF3D6EFDDFC6968425453818665752267CCAD89DC62F94982029968AF64FFD032048F1E00E0A6D836C531A
Malicious:	false
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M19.525 20.717a.734.734 0 00.725-.843c-.2-1.3-.685-2.414-1.364-3.242-1.893.907-3.68.907-5.574 0-.679.828-1.165 1.941-1.364 3.242-.07.44.276.843.725.843h6.852zM16.098 9.4c1.422 0 2.576 1.165 2.576 2.6 0 1.437-1.154 2.6-2.576 2.6-1.422 0-2.574-1.163-2.574-2.6 0-1.434 1.152-2.6 2.574-2.6z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><path clip-rule="evenodd" d="M6.18 18.496a18.016 18.016 0 01-.63-4.862c.01-1.415.008-2.83.004-4.246A3.176 3.176 0 017.82 6.334c2.273-.678 4.55-1.34 6.827-2.007a4.819 4.819 0 012.708 0c2.276.666 4.554 1.329 6.827 2.007a3.176 3.176 0 012.265 3.054c-.004 1.415-.007 2.83.004 4.246a18.02 18.02 0 01-.63 4.862c-1.145 4.109-4.75 6.967-8.392 9a2.929 2.929 0 01-2.856 0c-3.641-2.033-7.247-4.891-8.391-9zm14.07 1.378a.734.734 0 01-.725.843h-6.852a.734.734 0 01-.725-.843c.2-1.3.685-2.414 1.364-3.242 1.894.907 3.68.907 5.574 0 .679.828 1.165 1.941 1.364 3.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\prodico-32_premium-security_white[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	4.660791464285325
Encrypted:	false
SSDEEP:	24:tzkuHyj2zpZmjl0Up5iA7e2IKiTYhll+wIbU3favg8HhQdYhll7:9S6pZmB14wuUSgk
MD5:	945B6233DADFEB4446D51BF931490F0D
SHA1:	10DB331A389EE3C42A42EA716F854526D4DC3214
SHA-256:	72395798A29BC168B956D804D038DF8790B9C2BE39E4CE91269A52E76678BFF1
SHA-512:	8CE590D422BD6B85D9109E31CA41C9E2ADB01665B24555A2FEF2048500905FD90E7E5A65BBEF4BC59413357D9F3DCEFAF74CFCFD3446BEC9E75FE664A793D2FB
Malicious:	false
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M5.55 13.634c-.013 1.78.247 3.483.63 4.862 1.145 4.109 4.75 6.967 8.392 9a2.929 2.929 0 002.856 0c3.641-2.033 7.247-4.891 8.391-9a18.02 18.02 0 00.631-4.862c-.01-1.415-.008-2.83-.004-4.246a3.176 3.176 0 00-2.265-3.054c-2.273-.678-4.55-1.34-6.827-2.007a4.819 4.819 0 00-2.708 0c-2.276.666-4.554 1.329-6.827 2.007a3.176 3.176 0 00-2.265 3.054c.004 1.415.007 2.83-.004 4.246z" fill="#FFF" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><path d="M18.277 15.077l2.238-1.644c.1-.076.046-.247-.081-.247h-2.747c-.333 0-.474-.117-.57-.432l-.855-2.65c-.052-.105-.292-.132-.326 0l-.854 2.65c-.114.299-.242.432-.57.432h-2.748c-.144 0-.197.16-.081.247l2.218 1.644c.247.174.322.37.204.657l-.855 2.651c-.025.126.109.252.224.165l2.239-1.644c.263-.17.495-.182.752 0l2.26 1.644c.103.104.249-.047.203-.165l-.855-2.65c-.096-.293-.05-.48.204-.658z" stroke="#FF7800" stroke-width="1.2" stroke-linecap="ro

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\prodico-32_secureline-vpn_white[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	452
Entropy (8bit):	4.831287070425481
Encrypted:	false
SSDEEP:	12:tr/kuItbLdk1uFTRXFktUmr0t80B9Yhll7:tzkus1d1fWUzTYhll7
MD5:	50F355DD3AFB228FCAB72C7AB365028C
SHA1:	D305E627CA3FE0F80E775198338DC9C971999B24
SHA-256:	1D317ADF5597D4C31C5924A95ADC3B93145DF8CBC7A4336DE82E9BFD1CA0FCA7
SHA-512:	1EE7F063C6873B8D3874C3B2BFDB38A87C999BCF471596F267B7F284CB185C0F2E3954DBCE540C610299FF125339A3AD7B33E44927898E48FD66D13271620D01
Malicious:	false
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M11.884 17.192v-2.284a4.122 4.122 0 018.244 0v2.284m-4.122 6.438v-2.435m-5.152-12.01c2.876-2.635 7.436-2.666 10.305 0M8.4 6.583c4.211-3.96 11.008-3.995 15.212 0M20.476 17.19h-8.94a2.4 2.4 0 00-2.4 2.4v5.61a2.4 2.4 0 002.4 2.4h8.94a2.4 2.4 0 002.4-2.4v-5.608a2.4 2.4 0 00-2.4-2.4z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\script[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (967), with no line terminators
Category:	dropped
Size (bytes):	967
Entropy (8bit):	5.483374178724849
Encrypted:	false
SSDEEP:	24:exmwOkkMWvTI9x8yQovv4ELsWEIIaWUWOAvQ6grB5:exmwOG9xvx6Mb80
MD5:	960D71F6D3C08C670FCA5D4211831B9E
SHA1:	124FE057BCA5A9AFA7967A037EA6B1F7D12E123A
SHA-256:	795047EFF2368D8E2D0A41AEB1886ACB8B9BC6EB56122A85C9870C30CEE949CA
SHA-512:	97042EFCC20CB805D52C488702243EF040E17AFB5B84530F6EDEFC4BA10134F3A617E9AE9259784CB5D1EDCBFCC622729D1874736CA3CF2CDCC9478494F8BFF5
Malicious:	false
Preview:	var jsllConfig={useDefaultContentName:!0,syncMuid:!0,authMethod:AUTHMETHOD,isLoggedIn:ISLOGGEDIN===undefined\|\|ISLOGGEDIN!=="True"?!1:!0,muidDomain:MUIDDOMAIN\|\|"microsoft.com",useShortNameForContentBlob:!1,instrumentationKey:"aeabeab2b8bd4762b34f8c2080f93dcc-2d4522cb-ac5b-4721-abe1-1e118828927d-7669",advancedConfig:{propertyConfiguration:{gpcDataSharingOptIn:GPC_DataSharingOptIn===undefined?!1:GPC_DataSharingOptIn}},autoCapture:{pageView:!0,onLoad:!0,onUnload:!0,click:!0,scroll:!0,resize:!0,lineage:!0,jsError:!0,addin:!0,perf:!0},coreData:{appId:JSLLAPPID,market:LOCALE,pageName:PAGENAME,pageType:PAYLOADTYPE,referrerUri:document.referrer,requestUri:window.location.href,env:"PROD"},callback:{pageName:PAGENAME,userConsentDetailsCallback:function(){return window.siteConsent?window.siteConsent.getConsent():window.WcpConsent?{Required:!0,Analytics:!1,SocialMedia:!1,Advertising:!1}:{Required:!0,Analytics:!0,SocialMedia:!0,Advertising:!0}}}};awa.init(jsllConfig)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\vue_v2.6.6.min[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Unicode text, UTF-8 text, with very long lines (31996)
Category:	dropped
Size (bytes):	92821
Entropy (8bit):	5.3618745930623435
Encrypted:	false
SSDEEP:	1536:6RbgGojj7dqbQWRs9UhU54vHu5XAXTgyuhL:6RbgGojfdqMqU5qkXsgRhL
MD5:	5CFDB66D6A5DF167E40B5F63D43EFC13
SHA1:	9F9456447D294F8E9AA80737EF9274326159E21F
SHA-256:	3A23F637A459312D4B8F8B187D3F804F4697E4A962555DC41FEA317B33D188B0
SHA-512:	9A8C8E1232831167EB18900019E4048DA18797F5551083EB3B8436F5A61CF205F83162445C057DD053EBAD3AA8D1E9670900D5B3D274DB55DEC3A2AE3B8F7ACB
Malicious:	false
Preview:	!function(a,b){"object"==typeof exports&&"undefined"!=typeof module?module.exports=b():"function"==typeof define&&define.amd?define(b):(a=a\|\|self).Vue=b()}(this,function(){"use strict";function a(a){return null==a}function b(a){return null!=a}function c(a){return!0===a}function d(a){return"string"==typeof a\|\|"number"==typeof a\|\|"symbol"==typeof a\|\|"boolean"==typeof a}function e(a){return null!==a&&"object"==typeof a}function f(a){return"[object Object]"===ad.call(a)}function g(a){var b=parseFloat(String(a));return b>=0&&Math.floor(b)===b&&isFinite(a)}function h(a){return b(a)&&"function"==typeof a.then&&"function"==typeof a["catch"]}function i(a){return null==a?"":Array.isArray(a)\|\|f(a)&&a.toString===ad?JSON.stringify(a,null,2):String(a)}function j(a){var b=parseFloat(a);return isNaN(b)?a:b}function k(a,b){for(var c=Object.create(null),d=a.split(","),e=0;e<d.length;e++)c[d[e]]=!0;return b?function(a){return c[a.toLowerCase()]}:function(a){return c[a]}}function l(a,b){if(a.length){var c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\ytc[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (18187), with no line terminators
Category:	dropped
Size (bytes):	18187
Entropy (8bit):	5.347759003709589
Encrypted:	false
SSDEEP:	384:s40C/Y3uOOpp9W89rzOv4m8Avx2kjEhNgyyuek:VjOOp281UsAlErPyud
MD5:	5C6ED25DCE803FD84288922B8928409E
SHA1:	3CCC10546AE12F160BACAC1E9E422AF091EA4A41
SHA-256:	480B06B23E574B4BF386FDE1A91145A4171F97AEB5EE800E4BE1850F29B1AD91
SHA-512:	FE9265D2E6EA4ACB7E0A87E08BEDFAF48BCBAD62BB7A86E73F9AE21C8437AF3334D2A9733C6BC47A12BBF54F97EC79271CB5300F90231614F407599D1B4C05E5
Malicious:	false
Preview:	!function(e){var t={};function n(r){if(t[r])return t[r].exports;var i=t[r]={i:r,l:!1,exports:{}};return e[r].call(i.exports,i,i.exports,n),i.l=!0,i.exports}n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var i in e)n.d(r,i,function(t){return e[t]}.bind(null,i));return r},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="",n(n.s=0)}([function(e,t,n){"use strict";function r(){if("undefined"==typeof TextEncoder){window.Tex

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\2b-8e0ae6[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (42133)
Category:	dropped
Size (bytes):	138067
Entropy (8bit):	5.225028044529473
Encrypted:	false
SSDEEP:	3072:1f4HuF7pxnISnJ9d1EwgXA7nKRZMK/xw/:1f4Hu1I+kw/
MD5:	B9C3E4320DB870036919F1EE117BDA6E
SHA1:	29B5A9066B5B1F1FE5AFE7EE986E80A49E86606A
SHA-256:	A1FE019388875B696EDB373B51A51C0A8E3BAD52CD489617D042C0722BDB1E48
SHA-512:	A878B55E8C65D880CDF14850BAEE1F82254C797C3284485498368F9128E42DCA46F54D9D92750EEEB547C42CAB9A9823AA9AFAB7D881090EBBFA1135CDD410B6
Malicious:	false
Preview:	(function(){/*. @license almond 0.3.3 Copyright jQuery Foundation and other contributors.. * Released under MIT license, http://github.com/requirejs/almond/LICENSE. /.var requirejs,require,define,__extends;(function(n){function r(n,t){return w.call(n,t)}function s(n,t){var o,s,f,e,h,p,c,b,r,l,w,k,u=t&&t.split("/"),a=i.map,y=a&&a[""]\|\|{};if(n){for(n=n.split("/"),h=n.length-1,i.nodeIdCompat&&v.test(n[h])&&(n[h]=n[h].replace(v,"")),n[0].charAt(0)==="."&&u&&(k=u.slice(0,u.length-1),n=k.concat(n)),r=0;r<n.length;r++)if(w=n[r],w===".")n.splice(r,1),r-=1;else if(w==="..")if(r===0\|\|r===1&&n[2]===".."\|\|n[r-1]==="..")continue;else r>0&&(n.splice(r-1,2),r-=2);n=n.join("/")}if((u\|\|y)&&a){for(o=n.split("/"),r=o.length;r>0;r-=1){if(s=o.slice(0,r).join("/"),u)for(l=u.length;l>0;l-=1)if(f=a[u.slice(0,l).join("/")],f&&(f=f[s],f)){e=f;p=r;break}if(e)break;!c&&y&&y[s]&&(c=y[s],b=r)}!e&&c&&(e=c,p=b);e&&(o.splice(0,p,e),n=o.join("/"))}return n}function y(t,i){return function(){var r=b.call(arguments,0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\SB9JQA0X.gif

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\aa-helper[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (521)
Category:	dropped
Size (bytes):	559
Entropy (8bit):	5.021640599099995
Encrypted:	false
SSDEEP:	12:cwltFGSF949XuDhPgNn1gaSF949XuDhUXAXS/:cw1l949Xu1PgNnA949Xu1UQXq
MD5:	418B70662978F7BD2BAB04A5C2A819A3
SHA1:	E1B68DD2BDE9385BD39AEF2FE6969C1B5A01DCE0
SHA-256:	BF38D4B0DA29AC3E4FF07041AB69400C857A64CDC66CC36333A88CCEEB71848D
SHA-512:	79BAEE6FDCF6AA31D8B2C4EDBE1385976273F78E3E9219EABA3AD47DF8A75673B12F9709303CA62BAFD9423919FE97B3E12CCF9790D1635265185E10418B8FBD
Malicious:	false
Preview:	!function(){"use scrict";function a(a,b){"function"==typeof trackCustomDownload&&trackCustomDownload(a,b,"")}document.querySelectorAll('[data-role="download-link"]').forEach(function(b){b.addEventListener("click",function(){a(this.href,this.getAttribute("data-download-name"))})}),window.addEventListener("pricebox-updated",function(b){b.detail.element.querySelectorAll('[data-role="download-link"]').forEach(function(b){b.addEventListener("click",function(){a(this.href,this.getAttribute("data-download-name"))})})})}();.//# sourceMappingURL=aa-helper.js.map

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\avast-logo-default[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2903
Entropy (8bit):	4.083203542470353
Encrypted:	false
SSDEEP:	48:9LfM566CUltUbVdMonLXE7lJ/09Q9s4w76ODtzfcIsCvWIK+5B+jV9Pp:9LNV2onc/z7w76gzfcINj5Erx
MD5:	6672B70FD96AC4F96B0AE2062123A841
SHA1:	56BC3CEC1806A655931EC78812E3DBBBD640607F
SHA-256:	954D5CF01AE876E8AC27E08326750D0596F63BC0D3D1986DC611DA352BF451E4
SHA-512:	4B4A39C9EC6CB012B23916FB9DD116AAE3379D5815F43D6D2A24B693DE830DB1EC69D7ECC0CBE648FA60D19A5DAD0395E007E30F464421A7E9D0F0C93C0021A9
Malicious:	false
Preview:	<svg width="116" height="36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M114.388 16.038c.792 0 1.44-.648 1.44-1.44v-1.764h-4.464V8.946h-2.466c-.792 0-1.44.648-1.44 1.44v2.466h-.72c-.792 0-1.44.648-1.44 1.44v1.764h2.16v5.706c0 .918.018 1.764.036 2.484.018.738.216 1.458.594 2.16.414.756 1.026 1.296 1.836 1.638.81.342 1.728.522 2.754.54 1.026.018 2.07-.072 3.15-.27V26.64a1.44 1.44 0 00-1.476-1.44c-.36.018-.702 0-1.026-.018-.756-.054-1.296-.342-1.656-.882-.18-.288-.288-.666-.288-1.152-.018-.486-.018-1.026-.018-1.62v-5.49h3.024zM53.406 7.704h-4.14l-7.434 20.61H45c.594 0 1.134-.378 1.35-.936l1.242-3.366h9.198l1.242 3.366c.216.558.738.936 1.35.936h3.15L55.656 9.288a2.412 2.412 0 00-2.25-1.584zm-4.5 12.78l3.276-8.838 3.276 8.838h-6.552zm34.145-8.028c-3.276 0-5.382 1.458-6.48 4.302l2.358.828a1.44 1.44 0 001.584-.45c.504-.63 1.08-1.152 2.502-1.152 1.782 0 2.52.63 2.664 2.322l-4.77.828c-4.41.72-4.95 3.438-4.95 4.932 0 1.494 1.134 4.698 5.4 4.698 2.16 0 3.708-.792 4.716-1.764a1.433 1.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\b680e9a8-3d45-4e4a-998f-7d05f89e4486[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6510
Entropy (8bit):	4.872303848698837
Encrypted:	false
SSDEEP:	192:FIpp+DNDeOapp+DUZkp+D0X+W1pCZpY6vep+DoQLWdcPW:yWFezWUUW0u+0ZpzoWoCWdce
MD5:	50BCB5BABCD79578C8EBACDC424246C1
SHA1:	01F1808E548649B8CF73C22EE1E52E219DB0CD5C
SHA-256:	F69073C0F0C5143545BDC8861AD97105307947B53B1FD8CD2FCB73C5600FD161
SHA-512:	8C4406211491686B099271B63AB1CAA1D288DD2CFBA0D71DC9F5EB2D4CFF312EF35E85EECD7C94B59F9CB5EF6982F97F8F215143B40F9449342870E533919DE6
Malicious:	false
Preview:	{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"6.33.0","OptanonDataJSON":"b680e9a8-3d45-4e4a-998f-7d05f89e4486","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","BulkDomainCheckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"9404da6f-e1b2-4a46-9476-234f1cddce46","Name":"Brazil . All Opt-in","Countries":["br"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","pt":"pt","fr":"fr","hu":"hu","zh-CN":"zh-CN","default":"en","uk":"uk","id":"id","sv":"sv","ko":"ko","zh-TW":"zh-TW","pt-BR":"pt-BR","ms":"ms","el":"el","it":"it","es":"es","cs":"cs","ar":"ar","vi":"vi","th":"th","ja":"ja","tl":"tl","pl":"pl","ro":"ro","he":"he","da":"da","tr":"tr","nl":"nl"},"BannerPushesDown":false,"Default":false,"Global":false,"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\cash[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (15628)
Category:	dropped
Size (bytes):	15661
Entropy (8bit):	5.252589972332973
Encrypted:	false
SSDEEP:	384:Wo0gawA6L564TFsyxult82P1NgNvNjNFNJNININXuL:Wo0Qblxul+U
MD5:	E83EC6654B1962B4EDA2154502BF500C
SHA1:	38617B9284C6CB6523B499D0B8AD75BB844C8FEB
SHA-256:	24D956B826FD0F854AB15CC1AA55D14DFD1C832C7F5BFE2629549F3E6A92F930
SHA-512:	2F33EA1913B31A42EF61F6D789E38C5D17EA82358D50A63981E08CB671F9287DFBBA0A90918DE023F54741B4E145770437B04F17BA4878EDB48C6F53DF657952
Malicious:	false
Preview:	!function(){"use strict";function a(a,b){try{return a(b)}catch(c){return b}}function b(a,b){return a&&(i(b)\|\|j(b))?ra.test(a)?b.getElementsByClassName(a.slice(1)):ta.test(a)?b.getElementsByTagName(a):b.querySelectorAll(a):[]}function c(a){return a.replace(xa,function(a,b){return b.toUpperCase()})}function d(a,b,c){if(c){for(var d=a.length;d--;)if(!1===b.call(a[d],d,a[d]))return a}else for(var d=0,e=a.length;d<e;d++)if(!1===b.call(a[d],d,a[d]))return a;return a}function e(a){for(var b=[],c=1;c<arguments.length;c++)b[c-1]=arguments[c];var d=arguments.length;if(!d)return{};if(1===d)return e(wa,a);for(var f=1;f<d;f++)for(var g in arguments[f])a[g]=arguments[f][g];return a}function f(a,b){var c=a&&(a.matches\|\|a.webkitMatchesSelector\|\|a.msMatchesSelector);return!!c&&!!b&&c.call(a,b)}function g(a){return a instanceof ua}function h(a){return!!a&&a===a.window}function i(a){return!!a&&9===a.nodeType}function j(a){return!!a&&1===a.nodeType}function k(a){return"function"==typeof a}function l(a){re

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\dest5[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines (550)
Category:	dropped
Size (bytes):	6983
Entropy (8bit):	5.483922930498494
Encrypted:	false
SSDEEP:	96:inw1EOb9muLpw47eIDCpXHG5z/QkqJeMnSSyi8c2Kgn/UnNsnA2aI4j4e:iPc/xDCpX8/in/y+2KgMSA26l
MD5:	2C9C2EE145EE280B85A217AD7045FAE5
SHA1:	6ABE394B53B32816ECA642126FD62BCD91D17348
SHA-256:	7BEA17A80A61ED0F54248B4FFC4C718F7C8FF2619742577A73591D62CE074DA8
SHA-512:	3762C5F678EB4858000FCF379EA1C8BEA54F2A211A3F940300876D1697B82012C57B0E614E33770D8F5626B2F4C3B7842B658C926E12974A43A1B0A313E2DB79
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">.<html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>Adobe AudienceManager</title><script type="text/javascript">.var Demdex={version:"6.2",dest:"5",PROTOCOL:"https:"==document.location.protocol?"https:":"http:",COOKIE_DOMAIN:function(){var a=document.domain;/demdex\.net$/i.test(a)&&(a=".demdex.net");return a}(),SIX_MONTHS_IN_MINUTES:259200,THREAD_YIELDING_DELAY:100,errorReportingEnabled:!1,sent:[],errored:[],timesDextpWasCleared:0,dpids:null,cbmacros:["%timestamp%","%rnd%","%did%","%http_proto%"],validators:{isPopulatedString:function(a){return"string"==typeof a&&a.length}},addListener:function(){if(document.addEventListener)return function(a,.b,c){a.addEventListener(b,function(a){"function"==typeof c&&c(a)},!1)};if(document.attachEvent)return function(a,b,c){a.attachEvent("on"+b,function(a){"function"==typeof c&&c(a)})}}(),replaceMacro:f

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\dtyp-thumb-sm[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4661
Entropy (8bit):	4.289945951414576
Encrypted:	false
SSDEEP:	96:YCsKv1sDlOdAwOYbOuQr9Nv1s7MMc5CY+Z5tjNQOAt/dV42GLQ:VvSpfwOYbOLfvS4WftjbQd+tLQ
MD5:	80DF532E02EAEC08EF491B4B4420AB14
SHA1:	5860F53B875350C2559F598A42A13E5B25045CE6
SHA-256:	6781CC289EF1A3359AC96F7D84A0EB0BEF8B8D001FAB80EE8B74C6CFB8B8C805
SHA-512:	C1271A569373BE2B8BA3E570B5BE90605B535FC541878C7E9ED1AE701B990A72E05FC581BFA32D9F41B48A89F1B82920E803DA670D1892BA9100B6F7FA1DB937
Malicious:	false
Preview:	<svg width="200" height="146" fill="none" xmlns="http://www.w3.org/2000/svg"><path opacity=".8" d="M.584 48.47c.859.984 1.846.505 2.83-.354.983-.859 1.59-1.773.73-2.756a2.364 2.364 0 00-3.56 3.11z" fill="#0070F6"/><path d="M29.272 75.75c-1.874-.915-3.03.4-3.946 2.274-.916 1.873-.249 2.706 1.624 3.621 1.874.916 3.14 1.028 4.056-.845a3.775 3.775 0 00-1.734-5.05z" fill="#21455C"/><path d="M114.424 33.25c1.375 1.713 3.068.978 4.782-.398 1.713-1.375 1.451-2.468.076-4.18-1.376-1.714-2.533-2.39-4.246-1.014a3.978 3.978 0 00-.612 5.592z" fill="#D93511"/><path d="M20.526 132a3.158 3.158 0 100-6.316 3.158 3.158 0 000 6.316z" fill="#21455C"/><path opacity=".8" d="M154.737 100.948a2.103 2.103 0 01-2.105 2.105 2.103 2.103 0 01-2.106-2.105c0-1.165.941-2.106 2.106-2.106 1.119 0 2.105.94 2.105 2.106z" fill="#0070F6"/><path opacity=".64" d="M83.161 127.374c2.047 5.696 10.983 3.982 10.983 3.982s6.564-3.285 4.517-8.981c-2.046-5.697-1.606-7.957-10.136-6.658-5.984.911-7.41 5.961-5.364 11.657z" fill="#9AE437

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\en[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	143395
Entropy (8bit):	5.194177982842232
Encrypted:	false
SSDEEP:	1536:g/AS/PCczkJeTNV8NLl+oXtKp0w+kx4k2BBp3Sxufjd5gxJgk8k1+4Cdi4u1SlY7:MAICiN6k8kCzY9L7B
MD5:	42BA75D6C9A4B568FC269E4BBEB7E41F
SHA1:	87CB0939D42D0EB1BD1F1939A72FC89E0F1552CE
SHA-256:	6BB6CE004CA90C4C5DE76DD02D965E41CDD3C0171CD6CC34BB1EB319E4DC64C9
SHA-512:	7667E38D2145F6DEABA30A5CCE293ECC26C2A54DFE7CF56A2F2507223524D6F1476A376D71A1722F6CBDD17D389FEB7926E969753B525B22932AE85DA676DE4D
Malicious:	false
Preview:	{"DomainData":{"pccloseButtonType":"Icon","pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","MainText":"Privacy preference center","MainInfoText":"By clicking \"Accept all\" you allow cookies that improve your experience on our site, help us analyze site performance and usage, and enable us to show relevant marketing content. You can manage cookie settings below. By clicking .Confirm selection. you agree with the current settings. See ","AboutText":"Cookies policy","AboutCookiesText":"Your Privacy","ConfirmText":"Accept all","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.avast.com/cookies-policy","ActiveText":"Active","AlwaysActiveText":"Always Active","PCShowAlwaysActiveToggle":true,"AlertNoticeText":"By clicking \"OK\" you allow cookies that improve your experience on ou

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\favicon[1].ico

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	7886
Entropy (8bit):	3.7939497662625397
Encrypted:	false
SSDEEP:	96:m7GrP22lK18dqYkGOmNYB9Kym7BzNTvtdoTo:mp2lKXYkSNgK9hNTv0M
MD5:	BE87FD81FF4E82E7ED57B0C8951C66D0
SHA1:	4A918234D3225B585DFFB7B6D587ACB3FBB39618
SHA-256:	637B67152DBA0B0B33C8AADB38EA7C86B7A12B37366C7183F898C36C222B04FD
SHA-512:	87EC908135335B4074D412B04188BF05D00F468400D2837BA2CA1C77440B6F2F15BA648F2A8F42B1301D77DF54BF2A00E59416942807CCD90E36F59431638DE7
Malicious:	false
Preview:	............ .h...6......... ......... .... .....&...(....... ..... .........#...#................x...z...~...y.F.y...x...x...x...x...y...y.F.}...y...x...............d...x...x...x...x...x...x...x...x...x...y...x..?...a....................w...x...x...x...x...x...x...x...x...{..l...2....5..J.......{...&....v...v...w...x...x...v...x...y..f............y.F.w..).......{...W...D...+....{...}..;...@...i.......!....t.H.y...v..p...............~...e...w...........r.......\|....w...x...x...w......<...0...T...............w...Z...........#....w...x...x...x...w......................P...I................w...x...x...x...x...w.. ...............1...>...............*....w...x...x...x...x...x...y..Q...u.......6....................x...x...x...x...y...x...x...x...v...u..1...................3....v...x...x...x...y.F.x...x...x...x...~.......................y...x...x...x...y.H.~...y...x...x...w......................;....v...x...x...y...\|...y...z...y...x...x...z...................{...x...x...x...z...y...x...y...z

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\flag-language-selector-v3[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	43043
Entropy (8bit):	4.962717584097643
Encrypted:	false
SSDEEP:	384:lJJI/s9vcKS5Dwvj/3mhVRweqV6nKElg5ka5JW7QDchsn23hFa4Qma1EXMqCGgnU:EIfS6a0Ihs2WCAbJWnmk0KJJ
MD5:	1A6805C49ACD98690EC6B24F6C15D719
SHA1:	70AEEB2F4EBD36A426D2CA2F9729C4FC3CB87C9D
SHA-256:	0360B7A141E00D88183C2EF15B4719825564598C2AAEC00ED994EC7ECFBB1BA9
SHA-512:	95545D1FFE3371784B18819C8C4ECA83F37DDBB0BD871899F035982AC31EF44F3FD8F7B5A40E0C240C8722E571D18FFC48D133096B6FB00A1B7D8C531031DC40
Malicious:	false
Preview:	<svg width="24" height="1248" fill="none" xmlns="http://www.w3.org/2000/svg"><circle cx="12" cy="12" r="12" fill="#fff"/><mask id="a" style="mask-type:alpha" maskUnits="userSpaceOnUse" x="0" y="0" width="24" height="24"><circle cx="12" cy="12" r="12" fill="#fff"/></mask><g mask="url(#a)"><path d="M12 23.5C5.649 23.5.5 18.351.5 12S5.649.5 12 .5 23.5 5.649 23.5 12 18.351 23.5 12 23.5z" fill="#F7FAFC" stroke="#E1EAF0"/><path fill-rule="evenodd" clip-rule="evenodd" d="M16.965 22.928C21.115 21.039 24 16.856 24 12c0-.219-.006-.437-.017-.653l-1.107-1.086a.828.828 0 00-1.28.149l-.144.229a.252.252 0 00.07.341l.292.204c.17.117.227.342.134.526l-1.022 2.03c-.11.218-.4.406-.644.395a.857.857 0 01-.618-.307l-1.758-2.11a.43.43 0 00-.66.549l1.759 2.11c.328.393.816.62 1.33.616.478-.003.794.5.604.94l-1.764 4.078a4.133 4.133 0 01-.625 1.014l-1.585 1.903zm-.09.04A11.958 11.958 0 0112 24C5.373 24 0 18.628 0 12 0 5.373 5.373 0 12 0c.596 0 1.181.043 1.754.127l.808.988c.097.118.12.281.06.422l-.556 1.3a.187.187

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\google-play[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	5199
Entropy (8bit):	4.168854198111166
Encrypted:	false
SSDEEP:	96:DrBL+x5tA6F/PVmBlngTKwsZkujpqdcf1zepSFSJCVC8BQ80gkj8DHGWOK:J+byul+uTJ9szDFiC9BQ8s8iWOK
MD5:	98CEFB5FC432A6FB66254CE8D42DFD78
SHA1:	90D59BA066875499470332D1D713FDB9D8A5631F
SHA-256:	E4E7C1093DE3ED2783883A06CA497F13B007186767F92314E86B7BD9349008BD
SHA-512:	CFE7035592C4BABD683B22862EC63036C349891BAB020FA129C7054C6F4B513086F33BC8B6F503CE58430C1F35DCFC50ABF4B4E35D39BC125EA92591D32F30A4
Malicious:	false
Preview:	<svg width="244" height="72" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M234.963 72H9.037C4.067 72 0 67.95 0 63V9c0-4.95 4.067-9 9.037-9h225.926C239.933 0 244 4.05 244 9v54c0 4.95-4.067 9-9.037 9z" fill="#100F0D"/><path d="M234.963 0H9.037C4.067 0 0 4.05 0 9v54c0 4.95 4.067 9 9.037 9h225.926c4.97 0 9.037-4.05 9.037-9V9c0-4.95-4.067-9-9.037-9zm0 1.44c4.186 0 7.591 3.391 7.591 7.56v54c0 4.169-3.405 7.56-7.591 7.56H9.037c-4.186 0-7.59-3.391-7.59-7.56V9c0-4.169 3.404-7.56 7.59-7.56h225.926z" fill="#A2A2A1"/><path d="M193.278 54h3.372V31.497h-3.372V54zm30.378-14.397l-3.866 9.756h-.116l-4.013-9.756h-3.632l6.018 13.636-3.432 7.585h3.517l9.274-21.22h-3.75zm-19.128 11.841c-1.103 0-2.644-.55-2.644-1.911 0-1.737 1.919-2.403 3.575-2.403 1.482 0 2.181.318 3.082.753-.262 2.084-2.064 3.56-4.013 3.56v.001zm.408-12.333c-2.441 0-4.97 1.072-6.017 3.446l2.994 1.244c.639-1.244 1.831-1.65 3.081-1.65 1.744 0 3.518 1.042 3.546 2.895v.232c-.61-.348-1.919-.869-3.517-.869-3.228 0-6.512 1.766-6.512 5

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\icons-24[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	31305
Entropy (8bit):	4.385799751453472
Encrypted:	false
SSDEEP:	384:ZZee7VAeCPUeCkOuBuctBrSXnNRm5I4j3jQgIzLq7M2oxGXXPLabnfT7mOuC2tKQ:zqzszGucrO9RoCp1xGXXPwf/aCQKQ
MD5:	DED03AA6F0840D4688249276F3574286
SHA1:	A340C02876210ADB246763F7F3D8D172BA6AED82
SHA-256:	8999989CD61F70B3D2D85CFE1BD182BAFE69C341CD9165CA9F8BB8AAFB7DCD4B
SHA-512:	2E7603A35E2F587BDB387E615A525A0304B9F44A526F0EEAE76F226C711B7A4D0802D27DE9338267522F637B075156FBD31F21F9A2CDA769C8B5836186554D59
Malicious:	false
Preview:	<svg width="624" height="264" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.614 12.045h18.749m0 0l-6.511-5.737m6.511 5.737l-6.511 5.737M332 96.4v-5.2m0-2.5v-1.1m9 4.4c0-4.936-4.055-9-9-9-4.91 0-9 4.095-9 9 0 4.9 4.1 9 9 9 4.936 0 9-4.069 9-9z" stroke="#000" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><path d="M369.398 128.259l-.307.515 1.03.615.307-.515-1.03-.615zm3.044 7.395a.6.6 0 00-1.2 0h1.2zm-1.2.874a.6.6 0 101.2 0h-1.2zm1.911-4.989l-.351-.487.351.487zm.334-1.823c0 .55-.269 1.036-.685 1.336l.702.974a2.844 2.844 0 001.183-2.31h-1.2zm-1.645-1.644c.908 0 1.645.736 1.645 1.644h1.2a2.844 2.844 0 00-2.845-2.844v1.2zm-.6 5.289v.4h1.2v-.4h-1.2zm-.814-4.487a1.645 1.645 0 011.414-.802v-1.2c-1.04 0-1.948.557-2.444 1.387l1.03.615zm.814 6.78v.874h1.2v-.874h-1.2zM372 123.6c4.613 0 8.4 3.795 8.4 8.4h1.2c0-5.267-4.323-9.6-9.6-9.6v1.2zm8.4 8.4c0 4.6-3.796 8.4-8.4 8.4v1.2c5.267 0 9.6-4.337 9.6-9.6h-1.2zm-8.4 8.4c-4.569 0-8.4-3.831-8.4-8.4h-1.2c0 5.232 4.368 9.6 9

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\jquery-1.9.1.min[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (32089)
Category:	dropped
Size (bytes):	92629
Entropy (8bit):	5.303443527492463
Encrypted:	false
SSDEEP:	1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe
MD5:	397754BA49E9E0CF4E7C190DA78DDA05
SHA1:	AE49E56999D82802727455F0BA83B63ACD90A22B
SHA-256:	C12F6098E641AACA96C60215800F18F5671039AECF812217FAB3C0D152F6ADB4
SHA-512:	8C64754F77507AB2C24A6FC818419B9DD3F0CECCC9065290E41AFDBEE0743F0DA2CB13B2FBB00AFA525C082F1E697CB3FFD76EF9B902CB81D7C41CA1C641DFFB
Malicious:	false
Preview:	/! jQuery v1.9.1 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license.//@ sourceMappingURL=jquery.min.map./(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexOf,m=l.toString,y=l.hasOwnProperty,v=p.trim,b=function(e,t){return new b.fn.init(e,t,r)},x=/[+-]?(?:\d\.\|)\d+(?:[eE][+-]?\d+\|)/.source,w=/\S+/g,T=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,N=/^(?:(<[\w\W]+>)[^>]\|#([\w-]))$/,C=/^<(\w+)\s\/?>(?:<\/\1>\|)$/,k=/^[\],:{}\s]$/,E=/(?:^\|:\|,)(?:\s\[)+/g,S=/\\(?:["\\\/bfnrt]\|u[\da-fA-F]{4})/g,A=/"[^"\\\r\n]*"\|true\|false\|null\|-?(?:\d+\.\|)\d+(?:[eE][+-]?\d+\|)/g,j=/^-ms-/,D=/-([\da-z])/gi,L=function(e,t){return t.toUpperCase()},H=function(e){(o.addEventListener\|\|"load"===e.type\|\|"complete"===o.readyState)&&(q(),b.ready())},q=function(){o.addEventListener?(o.removeEventListener("DOMContentLoaded",H,!1),e.removeEventListener("load",H,!1)):(o.detachEvent("onreadystatechange",H),e.detachEvent("onload",H)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\media-2[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4510
Entropy (8bit):	4.194684003393459
Encrypted:	false
SSDEEP:	96:ginQT3GHloxyXKa9RkRc1dv4bQqDqPdL0BLZFisphnTtE7pyg3XXM:5aGF1XKqfg9BphhE7pt3XXM
MD5:	5855882D6BA5AB9C1AC58F2B3C8B6074
SHA1:	F07D510B490AAC8E52E62770F5F0F9E54F41A471
SHA-256:	EDA29CE694D516DB6327A2B00A880FC173B3953E68F08A4C4F4BFCBBFEA4C417
SHA-512:	90D8EAC3F8C9E675C7A17C33ADFFED52F98DCAF8FFE97444557B48C6D143CB2A6F5277C0399B33371EB7B2BE71AEE884FE6FB31F9B96D287C5C4DFAD89DAB263
Malicious:	false
Preview:	<svg width="432" height="384" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M31.168 267.574c36.748 73.689 256.344 183.083 326.125 60.299 69.78-122.785 64.025-228.317 12.936-283.447-25.652-27.681-117.257-68.022-232.098-23.65C46.364 56.234-5.94 193.165 31.168 267.574z" fill="#FFF9F5"/><path d="M252.644 96.38c2.881 3.59 6.428 2.049 10.016-.831 3.589-2.88 3.04-5.17.159-8.759-2.88-3.588-5.304-5.003-8.893-2.122a8.333 8.333 0 00-1.282 11.713z" fill="#FFAF9D"/><path d="M74.287 185.4c-3.924-1.917-6.347.839-8.265 4.763-1.917 3.923-.52 5.668 3.403 7.585 3.924 1.918 6.577 2.153 8.495-1.771a7.908 7.908 0 00-3.633-10.577zM55.969 303.22a6.614 6.614 0 100-13.228 6.614 6.614 0 000 13.228z" fill="#FFDDBF"/><path d="M14.198 128.261c1.8 2.06 3.867 1.057 5.927-.742 2.06-1.799 3.331-3.713 1.532-5.773a4.952 4.952 0 00-7.459 6.515zm322.885 109.917c0 2.44-1.97 4.41-4.41 4.41a4.404 4.404 0 01-4.409-4.41 4.404 4.404 0 014.409-4.409c2.346 0 4.41 1.97 4.41 4.409z" fill="#7BB5FB"/><path d="M187.163 293.53

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\mhubc[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	C source, ASCII text, with very long lines (63896), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	281177
Entropy (8bit):	5.401151557185294
Encrypted:	false
SSDEEP:	3072:zs5yDt+KI+99jlx8Ux82h1L2q/Bzgnczbr+i:zfW2hcurzbr+i
MD5:	61821BFA6762B0825D6044FB3D96EB2C
SHA1:	2AF4F23189C925CC1F03FD1B5F6A40D5B0C58E8F
SHA-256:	850144822711BE9C75CD63239D376F4240A38E54167ADDC7F747D4FF54DC7F57
SHA-512:	28F6DD28C6B57B736DABF95F35C204F33048C6AEDEDE62D52E5DEA43F1D589519A3242447EFF82CC5A3F9995425B05206B71DF80472057C013E53095F9BBC1D5
Malicious:	false
Preview:	(function(apiUrl){..function mhubLoadJs(t){const e=document.createElement("script");e.type="text/javascript",e.src=t,document.head.appendChild(e)}window.mhubc={ads:[],push:function(t){window.mhubc.queue.push(t)},queue:window.mhubc&&window.mhubc instanceof Array?window.mhubc:[]},Number.parseInt\|\|(Number.parseInt=parseInt),window.fetch\|\|(mhubLoadJs("https://cdn.jsdelivr.net/npm/promise-polyfill@8.1.3/dist/polyfill.min.js"),mhubLoadJs("https://cdn.jsdelivr.net/npm/whatwg-fetch@3.4.0/dist/fetch.umd.min.js"));try{new URL(window.location.href)}catch(t){mhubLoadJs("https://cdn.jsdelivr.net/npm/url-polyfill@1.1.12/url-polyfill.min.js")}Uint8Array.from\|\|(Uint8Array.from=function(t,e,n){var r,o,i,u,s,l;for(o=(r=t).length,i=new ArrayBuffer(o),u=new Uint8Array(i),s=l=0;0<=o?l<o:l>o;s=0<=o?++l:--l){var p=r[s];e&&(p=n?e.call(n,p,s):e(p,s)),u[s]=p}return u}),HTMLElement.prototype.remove\|\|(HTMLElement.prototype.remove=function(){this.parentElement.removeChild(this)});var util={define:function(t,e,n){w

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\modules.7b6d7646601d8cd7fb5f[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (65450)
Category:	dropped
Size (bytes):	227608
Entropy (8bit):	5.377953692803177
Encrypted:	false
SSDEEP:	3072:bBwvwC5I2wJLOFIGYEFsuRUB41x9bScYC:bBwvwC0J6Ff3sty1zmcYC
MD5:	F50D98FDA6FA5CDDAA6824CA419470D7
SHA1:	042FB764309519C10FC0CFFBAB2C70095AD44265
SHA-256:	0F38A63A4786988C8739A89B8CE5E8599DDEF3C3D283EFF939BE3008CBEEF0F8
SHA-512:	C44348C710D4B72A030859B5E258E6B669D6003CEDDA0EA987F7665DB8C4198D0BDE9AC890973CE1861F78FE41BFCC07ADA84426DFF7F7F50167DC704E0B1EC2
Malicious:	false
Preview:	/! For license information please see modules.7b6d7646601d8cd7fb5f.js.LICENSE.txt /.!function(){var e={4788:function(e,t,n){"use strict";n.d(t,{s:function(){return r}});const r=Object.freeze({IDENTIFY_USER:"identify_user",AUTOTAG_RECORDING:"autotag_recording",TAG_RECORDING:"tag_recording",HEATMAP_HELO:"heatmap_helo",RECORDING_HELO:"recording_helo",REPORT_USER_ID:"report_user_id",MUTATION:"mutation",MOUSE_CLICK:"mouse_click",INPUT_CHOICE_CHANGE:"input_choice_change",KEY_PRESS:"key_press",MOUSE_MOVE:"mouse_move",RELATIVE_MOUSE_MOVE:"relative_mouse_move",CLIPBOARD:"clipboard",PAGE_VISIBILITY:"page_visibility",SCROLL_REACH:"scroll_reach",SCROLL:"scroll",SELECT_CHANGE:"select_change",VIEWPORT_RESIZE:"viewport_resize",SCRIPT_PERFORMANCE:"script_performance",REPORT_CONTENT:"report_content",INSERTED_RULE:"inserted_rule",DELETED_RULE:"deleted_rule"})},6939:function(e,t,n){"use strict";n.d(t,{f:function(){return f},W:function(){return g}});const r=Object.freeze({LIVE:"LIVE",REVIEW_WEBAPP:"REVI

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\mwf-west-european-default.min[1].css

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65532), with no line terminators
Category:	dropped
Size (bytes):	563851
Entropy (8bit):	5.221453271093944
Encrypted:	false
SSDEEP:	6144:2VR57iqbPXlB5UR5vWenR5xWeMFdBjL+ks0EcU0MWEsuWe5fXbHfxlN/FNCn/Lpl:tTP0BKYtf
MD5:	12DD1E4D0485A80184B36D158018DE81
SHA1:	EB2594062E90E3DCD5127679F9C369D3BF39D61C
SHA-256:	A04B5B8B345E79987621008E6CC9BEF2B684663F9A820A0C7460E727A2A4DDC3
SHA-512:	F3A92BF0C681E6D2198970F43B966ABDF8CCBFF3F9BD5136A1CA911747369C49F8C36C69A7E98E0F2AED3163D9D1C5D44EFCE67A178DE479196845721219E12C
Malicious:	false
Preview:	@charset "UTF-8";/! @ms-mwf/mwf - v1.25.0+6321934 \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and the license under which Microsoft received Third Party Code are set forth below together with the full text of such license. Such notices and license are provided solely for your information. Microsoft, not the third party, licenses this Third Party Code to you under the terms in which you received the Microsoft software or the services, unless Microsoft clearly states that such Microsoft terms do NOT apply for a particular Third Party Code. Unless applicable law gives you more rights, Microsoft reserves all other rights not expressly granted under such agreement(s), whether by implication, estoppel or otherwise.//! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\prodico-32_antitrack_white[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	831
Entropy (8bit):	4.495902589061296
Encrypted:	false
SSDEEP:	24:tzkuqvUseRZYRoKyNyGOFhG6V1bMSA8NIOTYhll7:GeReRiNyGOjBV1OUo
MD5:	5C51D97C54C81DC0854B3BBDA79A4A70
SHA1:	3415410A991A453674E3C9D2DEEFD9B76B8D1F83
SHA-256:	769DB1B5B23B294FB8598B7561FC050C40338D501FEE7D0D8F9D2C15544AE6F5
SHA-512:	A691813E01BDF46460121675A031774257EB4188A388E1DA8CAB2DD5B0331368904577E4ED392DEE56C89A55547FC50764599C892FB9A2FD91061ED98EE8F4AE
Malicious:	false
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M14.763 21.606v1.5c0 2.293-1.302 3.9-3.75 3.9-3.384 0-3.725-2.2-3.725-4.95 2.048-1.677 5.174-1.398 7.475-.45zm0 0a3.593 3.593 0 002.45 0m0 0v1.5c0 2.262 1.321 3.9 3.775 3.9 3.384 0 3.724-2.2 3.724-4.95-2.056-1.686-5.19-1.388-7.5-.45zm5.987-10.6c.7.133 1.37.271 2 .45 2.534.717 3.8 1.567 3.8 2.55 0 1-1.267 1.858-3.8 2.575-5.74 1.587-12.66 1.587-18.4 0-2.534-.717-3.8-1.575-3.8-2.575 0-.983 1.266-1.833 3.8-2.55.639-.18 1.3-.317 2-.45m14.4 0c.067.883.092 1.875.075 2.975m-.075-2.975c-.166-2.3-.583-3.967-1.25-5-.733-1.083-1.8-1.292-3.2-.625-2.229 1.061-3.27 1.049-5.5 0-1.417-.667-2.483-.458-3.2.625-.666 1.033-1.084 2.7-1.25 5m0 0a33.29 33.29 0 00-.075 2.975" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\prodico-32_avast-one[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	834
Entropy (8bit):	4.406522236567162
Encrypted:	false
SSDEEP:	24:tzkuE6JCvUrKDJ0BDf4j/r6Tuw4Oi/yoSPa/RjT:Ofvt6lf4j/OTPi/yYZ
MD5:	76FD9CE18484179D9D4EE16EE1D7C825
SHA1:	D875233BF31DDA90016DC8FF8D1F90DF936BC983
SHA-256:	66CDE9481ACAAD1E2F792DEB093BC067C6865F566BDD2787F384B15E71117B3C
SHA-512:	733B78D5969E0E7B785E246949CE4582EBE1902C791CF0AB23153CD30F743ED46F406132979F3E3C9B42C3234229D2964621E68A669DF33D5E1A148F4E8545A2
Malicious:	false
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M26.396 23.465c0-6.838-.604-19.141-10.196-19.265C6.92 4.08 4.92 16.463 5.57 23.415c.372.523.783 1.017 1.227 1.478C9.104 27.28 15.911 27 15.911 27s7.6.008 9.968-2.862c.179-.218.352-.442.517-.674z" fill="#fff"/><path d="M14.18 6.39a3.23 3.23 0 014.747 1.284l7.469 15.792A12.734 12.734 0 0028.8 16.09c.05-7.07-5.641-12.84-12.711-12.89C9.019 3.15 3.249 8.84 3.2 15.91a12.732 12.732 0 002.37 7.504l.3-.066 4.873-1.075c.137-.03.21.155.09.227l-4.036 2.392a12.754 12.754 0 009.114 3.907c4.01.028 7.6-1.792 9.968-4.662l-12.216-12.86a3.23 3.23 0 01.517-4.888zm2.293 14.516l-7.865.682a1.389 1.389 0 11.199-2.737l7.684 1.81c.137.034.122.232-.018.245zm-3.64-6.916l9.536 7.714c.109.089.01.262-.122.212l-11.47-4.347a2.09 2.09 0 112.056-3.58z" fill="#FF7800"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\prodico-32_online-privacy-and-security_white[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	834
Entropy (8bit):	4.4068516180284085
Encrypted:	false
SSDEEP:	24:tzkuE6JCvUrKDjySBDfk/r6Tuw4Oi/yoSPa/R+:Ofvtzlfk/OTPi/yY0
MD5:	5B726129A8C315687E028CDF4E75D0F7
SHA1:	8E15800AE8EA9480D1D63ECFD04C1A07EECB89A2
SHA-256:	AE9317D6E44154976E50735BFE9BACBA5CCBC6DA6E0B87B926EE62F97875E6A2
SHA-512:	6D3C4659DFBEF3E87E70A80C1A70174D3000087FB579A179ABDE3561DFB5176E045042826ED6AD71214AD17FB54AF45A9EF16C43CC3A92A7A74701AB18002BFC
Malicious:	false
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M26.396 23.465c0-6.838-.604-19.141-10.196-19.265C6.92 4.08 4.92 16.463 5.57 23.415c.372.523.783 1.017 1.227 1.478C9.104 27.28 15.911 27 15.911 27s7.6.008 9.968-2.862c.179-.218.352-.442.517-.674z" fill="#FF7800"/><path d="M14.18 6.39a3.23 3.23 0 014.747 1.284l7.469 15.792A12.733 12.733 0 0028.8 16.09c.05-7.07-5.641-12.84-12.711-12.89C9.019 3.15 3.249 8.84 3.2 15.91a12.731 12.731 0 002.37 7.504l.3-.066 4.873-1.075c.137-.03.21.155.09.227l-4.036 2.392a12.754 12.754 0 009.114 3.907c4.01.028 7.6-1.792 9.968-4.662l-12.216-12.86a3.23 3.23 0 01.517-4.888zm2.293 14.516l-7.865.682a1.389 1.389 0 11.199-2.737l7.684 1.81c.137.034.122.232-.018.245zm-3.64-6.916l9.536 7.714c.109.089.01.262-.122.212l-11.47-4.347a2.09 2.09 0 112.056-3.58z" fill="#FFF"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\prodico-32_secure-browser-color[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	5762
Entropy (8bit):	5.106105673726928
Encrypted:	false
SSDEEP:	96:eL1ZZRvumfSrvUOZxxTGCOB+hSGluB+huLDyPP8cgc1PBgVJRyM:eLDZ4zrvUOPxCCU+hSG6+huM5Enz
MD5:	45D1842A532D5CD77F0A0452B7142B2A
SHA1:	523A4B108D1A010AD6AA2D3F05FBB64A61CDF030
SHA-256:	CD83CD7F0DC0E81FF9D5E857E9E25A42AAAA5A8DC2BCEC0A06E8E018989CF2CF
SHA-512:	2C2CFFAA7BFA71841CBD7B02EA52A148C46D16A12A305111EE2694480230BB49FD6F3E4A042BBD7D641344B8FA32499B6FEC8C4ED0B28A2D60DD1B8F29E5D43F
Malicious:	false
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><ellipse cx="15.998" cy="15.997" rx="11.799" ry="11.797" fill="#fff"/><path fill-rule="evenodd" clip-rule="evenodd" d="M15.946 23.642c-1.726-.835-3.145-1.93-4.224-3.255a10.893 10.893 0 01-2-3.814 11.998 11.998 0 01-.466-4.207c2.403-1.677 4.678-2.064 5.841-2.145h.017c.402-.032.682-.032.786-.032h.093c.104 0 .385.002.786.032h.023c1.162.082 3.435.47 5.836 2.145a11.936 11.936 0 01-.454 4.155 10.898 10.898 0 01-1.993 3.839c-1.081 1.337-2.51 2.44-4.245 3.282zm-.126-10.156a1.86 1.86 0 00-1.72 1.673v-.002a1.857 1.857 0 001.127 1.888v2.105c0 .142.114.256.255.256h.949a.256.256 0 00.256-.255v-2.103a1.86 1.86 0 00-.867-3.562z" fill="#fff"/><path fill-rule="evenodd" clip-rule="evenodd" d="M15.932 24.732c-4.506-2.097-7.713-6.552-7.636-11.792.005-.41.032-.815.08-1.22v-.035a12.843 12.843 0 0115.197.014c.047.467.07.937.066 1.408-.042 5.213-3.265 9.618-7.707 11.625zm-.835-14.512c-1.163.08-3.438.468-5.841 2.144-.095 1.42.063 2.845.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\s_code_norton_min[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32083)
Category:	dropped
Size (bytes):	81994
Entropy (8bit):	5.415287416751104
Encrypted:	false
SSDEEP:	1536:qZVMbRJN4CoVUTM2ua1OM7CfEG6xuSqZQx52RLo+oqbH:qaJMYOMu6qZQULDr
MD5:	6BC5AF546D9E136F848F208563F46D6E
SHA1:	4D7173BCE58233286E05AE9146FE7275992382D9
SHA-256:	519C5C52DE1E6E974EC1B3AFC82B30C4986CCCCBFA3E836E7568B5AFEBEA9DB1
SHA-512:	3761999BE848FA31AF5BB4BAD63B13AD235B1BDA8AA2A6E1CAA4531DCBAD659B9633C7BBB6FFA3EFB1AA7A5B79C24884CA5F9C2602F014EE7A47A4A8858BD53F
Malicious:	false
Preview:	/! Norton - v1.0.2 - 2024-04-17 /function s_doPlugins(a){try{var b=localStorage.getItem("strangeTrafficExclude");b&&(a.abort=!0)}catch(c){}var d=a.linkURL;if(void 0!==typeof a.linkType&&"d"==a.linkType&&"string"==typeof d){a.events="event1";var e=d.split("/"),f=e[e.length-1],g=f.substr(f.lastIndexOf(".")+1).toLowerCase();a.eVar1="D=c33",a.prop33=d,a.prop46=g,a.prop47="download",a.prop48=f,a.eVar49="D=c48",a.linkTrackVars="events,prop2,prop33,prop41,prop46,prop47,prop48,prop49,prop59,eVar1,eVar18,eVar27,eVar41,eVar48,eVar49,eVar59",a.linkTrackEvents="event1"}else void 0!==typeof a.linkType&&"e"==a.linkType&&(a.linkTrackVars="None",a.linkTrackEvents="None");a.eVar47="s_code_norton "+s_code_file_modified_date,a.prop21=a.getQueryParam("inid"),!a.prop21&&_numeric_.utils.hasValue(nortonAnalytics,"inid")&&(a.prop21=nortonAnalytics.inid),!a.prop21&&_numeric_.utils.hasValue(nortonAnalytics,"store_inid")&&(a.prop21=nortonAnalytics.store_inid),a.eVar21="D=c21",a.prop35="D=pageName",a.prop21&&(a

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\singleDL-secondary[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (6902)
Category:	dropped
Size (bytes):	6949
Entropy (8bit):	5.137250662280694
Encrypted:	false
SSDEEP:	192:iolclWB7AMSMpCppfpiplpSpYpJp0O13WjwYCiwWyX1alsP+:ulWB7AMSMpqpfpiplpSpYpJp0s3WjwYt
MD5:	87719A6A13C941A2F85ABB48227F6569
SHA1:	1A68921D80AB7765FF3E4965DB3A85C76C697A08
SHA-256:	2A162BD99CFF1FDFBB687FAA456E89E4491BE8225394B35583AA9AA37652FB58
SHA-512:	9542796EF4A9B4B188E3C8EF944D51BAE873FB17DECDC14CDAE51E5B42A42D4422EC2489E446B0928BCC7E9A23ACB2E0CED40F0B8EB7D90AA04A33ED9EDD69C6
Malicious:	false
Preview:	!function(){"use strict";if(window.sdl!==undefined)try{var a={buttons:function(){document.addEventListener("click",function(b){if(b.target.closest('a[data-role="download-link"]')){var c=b.target.closest('a[data-role="download-link"]');if(c&&sdl.push({user:{download:{products:[{campaign:a.checkAttribute(c,"data-campaign"),campaignMarker:a.checkAttribute(c,"data-campaign-marker"),sku:a.checkAttribute(c,"data-download-name"),maintenance:0,seats:1,quantity:1,currencyCode:"USD",category:"Consumer",price:0,tax:0,brand:"Avast",link:a.removeUnwantedParamsFromLink(c.href),offerType:"download",localPrice:0,localTax:0}]}},event:"user.download.products"}),document.querySelector('[data-behavior="downloadPopup"]')!==undefined){var d=document.querySelector('[data-behavior="downloadPopup"]');sdl.push({system:{modal:{id:d.id,component:a.checkAttribute(d,"data-cmp-name"),path:"/"+sdlObj.screen.locale+"/"+a.checkAttribute(d,"data-cmp-name")}},event:"system.modal"});var e=new URLSearchParams(window.locati

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\trustpilot[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (22867)
Category:	dropped
Size (bytes):	22906
Entropy (8bit):	5.318649210583925
Encrypted:	false
SSDEEP:	384:65+15324gZqV3QBm2v2fU+3Fy+fdwKvug0jnL+NWt86z33flOfiPCe585YPG4uyD:601M7ZkB+2F3Fy+fdwKvuRjLg4bz3PA8
MD5:	798D6A1C2E992608C71D4CC63BFD15BE
SHA1:	D26FEB8FC59AB573E912E47D1795481F40DE5AC8
SHA-256:	EB4A4944F833547C5C301C0D24853A8A627964251718282B12E68E2583C6EE91
SHA-512:	C9ECDADE13E0EE6868B9448A244CFC9661CF55F87638BF33E4AB2AF3D856EBE689B21D7206A89116BC700EC33F813417C1319F2F66B3D8B6489A178AED1D4D8E
Malicious:	false
Preview:	!function a(b,c,d){function e(g,h){if(!c[g]){if(!b[g]){var i="function"==typeof require&&require;if(!h&&i)return i(g,!0);if(f)return f(g,!0);var j=new Error("Cannot find module '"+g+"'");throw j.code="MODULE_NOT_FOUND",j}var k=c[g]={exports:{}};b[g][0].call(k.exports,function(a){return e(b[g][1][a]\|\|a)},k,k.exports,a,b,c,d)}return c[g].exports}for(var f="function"==typeof require&&require,g=0;g<d.length;g++)e(d[g]);return e}({1:[function(a,b,c){"use strict";function d(){var a=function(){try{return localStorage.getItem(j)}catch(a){return null}}();if(a)return a;var b=j+"=",c=document.cookie,d=c.indexOf(b);return-1<d?c.substring(d+b.length).split(";")[0]:void 0}function e(a,b){!function(a){try{return localStorage.setItem(j,a),!0}catch(a){return!1}}(a)&&(document.cookie=[j+"="+a,"path=/","domain="+function(){for(var a="weird_get_top_level_domain=cookie",b=document.location.hostname.split("."),c=b.length-1;0<=c;c--){var d=b.slice(c).join(".");if(document.cookie=a+";domain=."+d+";",-1<docume

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\url-polyfill.min[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (6414), with no line terminators
Category:	dropped
Size (bytes):	6414
Entropy (8bit):	5.078162658471972
Encrypted:	false
SSDEEP:	192:hgarF763y4oGKWXAt0AGQjMlxAwF+5H1fJy:h7uzoGzFnxAwic
MD5:	6EDC6715EAE2285BB5B67EFFE28A0B1E
SHA1:	D6BF4B9B70B1DD42F3D0C3C4C6119B8AC65198B1
SHA-256:	256642709D572EE04B26B21B7CB36D8BAB55CE2468728CD1B9521366CCD95714
SHA-512:	7A08466640159600044587537D0D254F8B85C42E2C30B3712598F259590E9182AB6CECD76682B2F25CC489C9EB93BCC008A851303085A432F876A6B4DC797B99
Malicious:	false
Preview:	(function(t){var e=function(){try{return!!Symbol.iterator}catch(e){return false}};var r=e();var n=function(t){var e={next:function(){var e=t.shift();return{done:e===void 0,value:e}}};if(r){e[Symbol.iterator]=function(){return e}}return e};var i=function(e){return encodeURIComponent(e).replace(/%20/g,"+")};var o=function(e){return decodeURIComponent(String(e).replace(/\+/g," "))};var a=function(){var a=function(e){Object.defineProperty(this,"_entries",{writable:true,value:{}});var t=typeof e;if(t==="undefined"){}else if(t==="string"){if(e!==""){this._fromString(e)}}else if(e instanceof a){var r=this;e.forEach(function(e,t){r.append(t,e)})}else if(e!==null&&t==="object"){if(Object.prototype.toString.call(e)==="[object Array]"){for(var n=0;n<e.length;n++){var i=e[n];if(Object.prototype.toString.call(i)==="[object Array]"\|\|i.length!==2){this.append(i[0],i[1])}else{throw new TypeError("Expected [string, any] as entry at index "+n+" of URLSearchParams's input")}}}else{for(var o in e){if(e.ha

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\MWFMDL2[1].woff

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 11480, version 0.0
Category:	dropped
Size (bytes):	11480
Entropy (8bit):	7.941998534530738
Encrypted:	false
SSDEEP:	192:QNhlpX236n8/cliy01vRGeJsqVZJZmKgiiwEkyaGG1QfPujdI5v9QtAOcAue2HCZ:QnjX23W8UcvRaqVZdgiiyRQf2+5v9Q0q
MD5:	5ED659CF5FC777935283BBC8AE7CC19A
SHA1:	A0490A2C4ADDD69A146A3B86C56722F89904B2F6
SHA-256:	31B8037945123706CB78D80D4D762695DF8C0755E9F7412E9961953B375708AE
SHA-512:	FCCBE358427808D44F5CDFCF1B0C5521C793716051A3777AAFDE84288FF531F3E68FBC2C2341BBFA7B495A31628EAB221A1F2BD3B0D2CC9DD7C1D3508FDE4A2F
Malicious:	false
Preview:	wOFF......,.......NH........................OS/2...X...H...`JZxhVDMX.............^.qcmap.............ph.cvt ...l... .......fpgm...........Y...gasp...\|............glyf...... ...7.oV."head..'X...0...6.k..hhea..'........$....hmtx..'....v.....F.Eloca..(..........Y..maxp..).... ... ....name..) ..........b.post..,8....... .Q.wprep..,L........x...x.c`f..8.....u..1...4.f...$..........@ .............8.\|...V...)00......x...S......._..m.m.m.m.m;e..y.~.......<p..a.0t.&...a.pa.0B.1..F...Q.ha.0F.3.....q.xa.0A.0L.&...I.da.0E.2L....i.ta.0C.1..f...Y.la.0G.3.....y.\|a..@X0,.....E.ba.DX2,....e.ra..BX1..V...U.ja..FX3.....u.za..A.0l.6...M.fa.E.2l....m.va..C.1..v...].na..G.3......}.~a.p@80......C.a..pD82.....c.q..pB81..N...S.i..pF83.....s.y..pA.0\.....K.e..pE.2\....k.u..pC.1..n...[.m..pG.3......{.}...@x0<.....G.c...Dx2<....g.s...Bx1..^...W.k...Fx3.....w.{...A.0\|.>...O.g...E.2\|....o.w...C.1..~..._.o..08........?..0$........x..AHTq.../..$mk...E#.L.<.X,..D..P..:T.$Y.x....!.u...!J..(.X

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\analytics[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (2343)
Category:	dropped
Size (bytes):	52916
Entropy (8bit):	5.51283890397623
Encrypted:	false
SSDEEP:	768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
MD5:	575B5480531DA4D14E7453E2016FE0BC
SHA1:	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
SHA-256:	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
SHA-512:	174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
Malicious:	false
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r\|\|u();v=v\|\|q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2\|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240\|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192\|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING\|\|[];w.TAGGING[a]=!0};var ba=Array.isArray,c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\avast[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (31948)
Category:	dropped
Size (bytes):	55571
Entropy (8bit):	5.288457362466572
Encrypted:	false
SSDEEP:	768:mK0DELADAYCokxFO7mav6DUIkB3IVz3+j5ilK30fC3660D+OmL60bf1VXSp1mDNc:mTY7PO7okBmzp1EsqY
MD5:	AA76F787DFE8236EEC240D90C65CD70F
SHA1:	EB3F85B7CF8443209F9F5F6D602415103E15CB35
SHA-256:	7F2C05AA46D4E46A9CE214C4EB26CE35440EAD8920082F14CAC9CA1ACDA8B950
SHA-512:	F6BD2788CD68C03605880533D027D6FADFD3C25A134BA65878CFB76513ADEEE76E6997B2EDB68D4802D0A9BE3428BA37A8E6B4C813BEB0C72716BA65DF87DE14
Malicious:	false
Preview:	function loadEmailForm(a){var b="/"+avastGlobals.web.locale;switch(avastGlobals.web.locale){case"en-ww":case"ja-jp":case"ru-ru":case"uk-ua":b=""}fetch("https://"+avastGlobals.web.domain+b+"/email-capture-form-content",{headers:{Accept:"application/json","X-Requested-With":"XMLHttpRequest"}}).then(function(a){return a.text()}).then(function(b){var c=document.querySelector("#email-capture .modal-body");c.innerHTML=b,c.querySelector("#thank-page").classList.add("d-none"),c.querySelector("#session-note").classList.add("d-none"),c.querySelector("#frm-captcha")&&c.querySelector("#frm-captcha").setAttribute("placeholder",c.querySelector("#form-body").getAttribute("data-code")),a!==undefined&&c.querySelector("#frm-captcha").setAttribute("message",a),initAvastForm()})["catch"](function(a){/captcha/.test(a)&&(document.querySelector("#email-capture #form-body").classList.add("d-none"),document.querySelector("#email-capture #thank-page").classList.add("d-none"),document.querySelector("#email-captu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\bootstrap-native-v5[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (31980)
Category:	dropped
Size (bytes):	52987
Entropy (8bit):	5.286522560974398
Encrypted:	false
SSDEEP:	768:UB0nRD8CMagCkqvrgJ8u9tmE3ciR7vAJWrZcvTcVkwPsoMXIaKWW5Tj0gZjObZaL:Lc2gJ7DcJJWNOwCYFR5D/
MD5:	892579F44585CDE98E76132FE6395613
SHA1:	17BC4223935E6468F93E6FBD197E03E19974220F
SHA-256:	1E0B2B302299F23030DCB0FC7DBBCF9560F84A84DCCD115257CF76D3ADA370F2
SHA-512:	C1495A4CD60A0302433033C719DBED2348AD47AE0BAA0000C0966FAE5DBBCCEA7C6775559F697F052B9290B0E111B580CEFC28B8CC17CA1EB71C0D73EE2A1934
Malicious:	false
Preview:	"use strict";function _get(){return _get="undefined"!=typeof Reflect&&Reflect.get?Reflect.get.bind():function(a,b,c){var d=_superPropBase(a,b);if(d){var e=Object.getOwnPropertyDescriptor(d,b);return e.get?e.get.call(arguments.length<3?a:c):e.value}},_get.apply(this,arguments)}function _superPropBase(a,b){for(;!Object.prototype.hasOwnProperty.call(a,b)&&null!==(a=_getPrototypeOf(a)););return a}function _inherits(a,b){if("function"!=typeof b&&null!==b)throw new TypeError("Super expression must either be null or a function");a.prototype=Object.create(b&&b.prototype,{constructor:{value:a,writable:!0,configurable:!0}}),Object.defineProperty(a,"prototype",{writable:!1}),b&&_setPrototypeOf(a,b)}function _setPrototypeOf(a,b){return(_setPrototypeOf=Object.setPrototypeOf?Object.setPrototypeOf.bind():function(a,b){return a.__proto__=b,a})(a,b)}function _createSuper(a){var b=_isNativeReflectConstruct();return function(){var c,d=_getPrototypeOf(a);if(b){var e=_getPrototypeOf(this).constructor;c=Ref

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\ca-ae3ce4[1].css

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Unicode text, UTF-8 text, with very long lines (64241)
Category:	dropped
Size (bytes):	171486
Entropy (8bit):	5.043877429718187
Encrypted:	false
SSDEEP:	3072:jzCPZkTP3bDLH0tfRqQ0xtLfj4ZDSIpTt813viY8R1j35Ap7LQZLPPJH7PAbOCx1:jlZAW9kJeqg
MD5:	B7AF9FB8EB3F12D3BAA37641537BEDC2
SHA1:	A3FBB622FD4D19CDB371F0B71146DD9F2605D8A4
SHA-256:	928ACFBA36CCD911340D2753DB52423F0C7F6FEAA72824E2A1EF6F5667ED4A71
SHA-512:	1023C4D81F68C73E247850F17BF048615DDABB69ACF2429644BDAF8DC2A95930F7A29CEAE6FBD985E1162897483A860C8248557CDA2F1F3D3FF0589158625A49
Malicious:	false
Preview:	@charset "UTF-8";./! \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and the license under which Microsoft received Third Party Code are set forth below together with the full text of such license. Such notices and license are provided solely for your information. Microsoft, not the third party, licenses this Third Party Code to you under the terms in which you received the Microsoft software or the services, unless Microsoft clearly states that such Microsoft terms do NOT apply for a particular Third Party Code. Unless applicable law gives you more rights, Microsoft reserves all other rights not expressly granted under such agreement(s), whether by implication, estoppel or otherwise././! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css /.body{margin:0}.context-uh

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\desusertion[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (4179)
Category:	dropped
Size (bytes):	213189
Entropy (8bit):	5.536117689228579
Encrypted:	false
SSDEEP:	3072:7ydc0Iard8OdKMpba83yCmqjysCBIQGmPa+dQWqzGmRF24xKk75A:Kb8OdKMRF31zQ1PTdQWqzGat2
MD5:	0109E278187339674A34C32BECBCCFB4
SHA1:	DA4E07A8E0377A4958E135631B3C0DA8E0000B16
SHA-256:	D1E8B8A86A1735D96BCBF3D5378A437A3F4535617D0594951C71A28DFF2B637A
SHA-512:	9085812E875336ED8FD32A4BE3E1F97D6B8A10B5DDAF7C266F4BA5E489659A73E634B473459FF0DA9B625C8F40BDD2C0AF7E48D129672ED2EE0D857B244487A3
Malicious:	false
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__rep","vtp_containerId":"DC-4711400","vtp_remoteConfig":["map"],"tag_id":5},{"function":"__ogt_dma","priority":0,"vtp_delegationMode":"ON","vtp_dmaDefault":"DENIED","tag_id":8},{"function":"__ogt_1p_data_v2","priority":0,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\dtyp-thumb-lg[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4287
Entropy (8bit):	4.3546531859688065
Encrypted:	false
SSDEEP:	48:ZyIATAo26sVkgb6/YeR2+Ox9uV2KwG0HSjxafBFt7SPFlaNXNHdAXtgm7YfyIhXm:YTgm5LOWcsxaHN9HJfdhJK4ccbOb
MD5:	EEEDCF9760A2CC6E0F2713E69C2DC787
SHA1:	68FD0715CEF1890539D613805148BDB84058E38D
SHA-256:	8258BFF5A1B2BCEF837103F05B401398829FDE13CF2E0E10D3FC001DAFBF328D
SHA-512:	A54A48C5F807187C6D521947600BEFE942F539D15600411AE5DA393D3EAE9104B6CE8BEC92E4F03C098EBDE61D478A01D29B5A6328F4AACFEAAC460BB8175713
Malicious:	false
Preview:	<svg width="380" height="276" fill="none" xmlns="http://www.w3.org/2000/svg"><path opacity=".8" d="M1.109 91.293c1.632 1.868 3.508.96 5.376-.672 1.869-1.632 3.022-3.37 1.39-5.238a4.492 4.492 0 10-6.766 5.91z" fill="#0070F6"/><path d="M55.617 143.125c-3.56-1.74-5.758.76-7.498 4.32-1.74 3.559-.472 5.141 3.087 6.881 3.56 1.739 5.966 1.952 7.705-1.607a7.173 7.173 0 00-3.294-9.594z" fill="#21455C"/><path d="M217.405 62.374c2.613 3.255 5.83 1.858 9.085-.755 3.256-2.612 2.758-4.69.145-7.944-2.613-3.255-4.812-4.538-8.067-1.926a7.558 7.558 0 00-1.163 10.625z" fill="#D93511"/><path d="M39 250a6 6 0 100-12 6 6 0 000 12z" fill="#21455C"/><path opacity=".8" d="M294 191c0 2.213-1.787 4-4 4s-4-1.787-4-4 1.787-4 4-4c2.128 0 4 1.787 4 4z" fill="#0070F6"/><path opacity=".64" d="M158.007 241.21c3.888 10.823 20.867 7.566 20.867 7.566s12.471-6.242 8.582-17.065c-3.888-10.823-3.052-15.118-19.259-12.649-11.369 1.732-14.079 11.325-10.19 22.148z" fill="#9AE437"/><path opacity=".64" d="M101.902 79.9a8 8 0 01-8 8

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\fetch.umd.min[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (9425)
Category:	dropped
Size (bytes):	9760
Entropy (8bit):	5.245360481788582
Encrypted:	false
SSDEEP:	192:7roSlyL68c+JNKTL7EqNz0OPhhW82A7/vyozr157bko1OMu9K1:vHp+Jrgz0ShsRA7/v/zBJkmGm
MD5:	F362E7011136A2431EC1BFBFC6795628
SHA1:	ED055905D3CD4FE88DDE24EC24CBB85A0D2369C4
SHA-256:	AC38D555FBA5D1B5DCA6D2A860DCF1B3D57EDEAB8D6097FC6D4CCA7404224D2F
SHA-512:	F952A151E7C2C5D6DCE0818416A7B53D8B1792105393028943AEC2062B3618FE5F6AAE7E7014172D847C074885A5FD4EA0E6BF55575ACF4D2D9A15269A611BAC
Malicious:	false
Preview:	/*. Minified by jsDelivr using Terser v3.14.1.. * Original file: /npm/whatwg-fetch@3.4.0/dist/fetch.umd.js. . Do NOT use SRI with dynamically generated files! More information: https://www.jsdelivr.com/using-sri-with-dynamic-files. */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports):"function"==typeof define&&define.amd?define(["exports"],e):e(t.WHATWGFetch={})}(this,function(t){"use strict";var e="undefined"!=typeof globalThis&&globalThis\|\|"undefined"!=typeof self&&self\|\|void 0!==e&&e,r={searchParams:"URLSearchParams"in e,iterable:"Symbol"in e&&"iterator"in Symbol,blob:"FileReader"in e&&"Blob"in e&&function(){try{return new Blob,!0}catch(t){return!1}}(),formData:"FormData"in e,arrayBuffer:"ArrayBuffer"in e};if(r.arrayBuffer)var o=["[object Int8Array]","[object Uint8Array]","[object Uint8ClampedArray]","[object Int16Array]","[object Uint16Array]","[object Int32Array]","[object Uint32Array]","[object Float32Array]","[object Float64Array]"],n=ArrayBuff

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\gtm[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (54560)
Category:	dropped
Size (bytes):	271691
Entropy (8bit):	5.546197251325856
Encrypted:	false
SSDEEP:	6144:58ptPHeUb9GRrAbN0rDSl85Y7PbIOdfJ9V13TdQWqzGaXC1:58ptPHeUwrO0rDSl85Y7ksJ/N71
MD5:	6DF58E31CED0800D3AD6415F00A65978
SHA1:	773A40BA52300B55CE42E432917FBC7A23F51DEC
SHA-256:	4BF9E611D84A2F03F43E496483321EC2D4E47B447BB7802B3430D73DFDC4978C
SHA-512:	E36B208A71362768134ACC0F545F2BA71733339FCBF06E7F48936B54D8A6EDA4E1E51091766B4D7342B89735D7F50C5A816AB7DB74F22DA7D4A6DEFD0C96B1CF
Malicious:	false
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. . (function(w,g){w[g]=w[g]\|\|{};. w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');. .(function(){..var data = {."resource": {. "version":"99",. . "macros":[{"function":"__e"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"error.message"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"error.type"},{"function":"__u","vtp_component":"HOST","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__jsm","vtp_javascript":["template","(function(){var a=\"G-12345678\",b=window.location.hostname,c=window.location.pathname;if(\/\\.avast\\.(com\|ua\|ru\|co\\.jp)\/.test(b))a=\"G-WZQ6MQ6RF3\";else if(\/.avg.com\/.test(b))a=\"G-0DKJC5WS6X\";else if(\/.checkout-(stage\|dev).avast.com\/.test(b)\|\|0===c.indexOf(\"\/www.avast.com\"))a=\"G-PWZC03G2WC\";else if(\/.checkout-(stage\|dev).avg.com\/.test(b)\|\|0===c.indexOf(\"\/www.avg.com\")

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\gtm[2].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (59047)
Category:	dropped
Size (bytes):	600722
Entropy (8bit):	5.538920606400241
Encrypted:	false
SSDEEP:	6144:ozOTgDwQgbQOdbM3931zQbzqdQWqzGagCzNER:iOTCYM3h5Qfrz8
MD5:	32C744307DEE207CC13C9416F376B218
SHA1:	09F4598400B1E56A0649753814C8C1CE90B7FA8E
SHA-256:	0D371051CA1327DE6FA2829C65EBEB228D3F92A921380C22119220876F8EAD92
SHA-512:	63A1C5C62BB7CB50829BA11B634A96FD71C8F9D3DE4FC89729379CE2C0E21FAF9215AAFF03FCF27A481E444B300B52E7424299884FBB204DBFCBACC41FD4CE39
Malicious:	false
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. . (function(w,g){w[g]=w[g]\|\|{};. w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');. .(function(){..var data = {."resource": {. "version":"688",. . "macros":[{"function":"__e"},{"function":"__v","vtp_setDefaultValue":false,"vtp_dataLayerVersion":2,"vtp_name":"contentGroup"},{"function":"__u","vtp_component":"PATH","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__remm","vtp_setDefaultValue":false,"vtp_input":["macro",2],"vtp_fullMatch":false,"vtp_replaceAfterMatch":false,"vtp_ignoreCase":false,"vtp_map":["list",["map","key","\/-c\|\/windows-10-vpn","value","New Content"]]},{"function":"__v","vtp_setDefaultValue":false,"vtp_dataLayerVersion":2,"vtp_name":"pageGroup"},{"function":"__c","vtp_value":"avast.co.jp,avast.com,avast.jobs.cz,avast.ru,avast.ua,nadacnifond.avast.cz,store.digitalriver.com,avastbrowser.com"},{"function":"__jsm","vtp_javascript":["template","(function(){ret

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\js[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (7711)
Category:	dropped
Size (bytes):	301085
Entropy (8bit):	5.611534191134613
Encrypted:	false
SSDEEP:	3072:UsquAcc0Iard8OdwDMSba8oyC+qjysCBIQ+9agdDBqzGmRFuHxK6kgH5T5ECBjoJ:Ssb8OdwDM5FP1zQ+9fdDBqzGaTg/Bm
MD5:	ADAC71A27F25B9D8EE525F40A55D8F03
SHA1:	C141939C5E19BE4D9C9FB5B86A4FB225BD62AA81
SHA-256:	EDFB008B91295CDCCF26DD46E5239476B70B2A429F53E0896FD2633E5B9483DB
SHA-512:	4AA4431534587C9F973E8C5AF2E6E05293BFEC335F5172E27BF9E57FA2198BBA535F5B8C371A11651B12FDFEDAF77F3F507398E74ADFF02FC599FF33B8916B51
Malicious:	false
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"11",. . "macros":[{"function":"__e"},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_auto_events","priority":23,"vtp_enableScroll":false,"vtp_enableOutboundClick":true,"vtp_enableDownload":false,"vtp_enableHistoryEvents":false,"vtp_enableForm":true,"vtp_enableVideo":true,"vtp_enablePageView":true,"tag_id":17},{"function":"__ogt_cross_domain","priority":23,"vtp_rules":["list","avast\\.co\\.jp","avast\\.ua","avast\\.ru"],"tag_id":19},{"function":"__ogt_dma","priority":13,"vtp_delegationMode":"ON","vtp_dmaDefault":"DENIED","tag_id":20},{"function":"__ogt_referral_exclusion","priority":13,"vtp_includeConditions":["list","^avast\\.(com\|ru\|ua\|co\\.jp)$","^ipm\\.avcdn\\.net$"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\location[1].json

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.057426088150192
Encrypted:	false
SSDEEP:	3:YGKeMfQ2pHWiR8HopHW4OE9HsuXU9WyRHfHyY:YGKed2pHD5YEl5k9zyY
MD5:	B04CD3F8043EF04F417D4B0E4BCBBC03
SHA1:	88F259A4AE3045409B3657E7D7A791D321BA9DCE
SHA-256:	59E58524340CD7AD353BE010374B124C242FDDE10A0ED41047FE2FD4BB9E5A2E
SHA-512:	A285C493B939D2A165D80F87FC830F5D02AFCC7A8EA1C5CAF9CAA87ABD286F1C98598FFD83023044BDB23D344C60EEF6A6C4BFEDEDD42A4297A0AC09E22FA5B2
Malicious:	false
Preview:	{"country":"US","state":"NY","stateName":"New York","continent":"NA"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\main[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (55684)
Category:	dropped
Size (bytes):	55725
Entropy (8bit):	5.579475324094455
Encrypted:	false
SSDEEP:	768:2SNnDYGUJBAyEgzQyudtrUp4Bj2bvuSky9QV11yCWnffdj5:BNiPEgzQy+y4B2juSzQT1yCWnHdj5
MD5:	F335340EF8B1DA39FBB38D61304407C9
SHA1:	31E8C5162A8CFC402DD0A7ED43653E4F2B73E85B
SHA-256:	4A9F2AF07DA68F556FF9630DAE187497693ED66E27F84CBF00A15B14936E2BEC
SHA-512:	F8B72B89AC69A4F1EDE604DB16FCE5F5D8BBF09F3736513DCD1D6DFDA8AEF60A2BFB9BFFFB2A3B6CB490B1CEA19FCBF07FC61D23466887A6389F5260A8128433
Malicious:	false
Preview:	.!function r(o,i,a){function s(t,e){if(!i[t]){if(!o[t]){var n="function"==typeof require&&require;if(!e&&n)return n(t,!0);if(l)return l(t,!0);throw(n=new Error("Cannot find module '"+t+"'")).code="MODULE_NOT_FOUND",n}n=i[t]={exports:{}},o[t][0].call(n.exports,function(e){return s(o[t][1][e]\|\|e)},n,n.exports,r,o,i,a)}return i[t].exports}for(var l="function"==typeof require&&require,e=0;e<a.length;e++)s(a[e]);return s}({1:[function(e,t,n){"use strict";(0,e("@trustpilot/trustbox-micro-framework").microCombo)()},{"@trustpilot/trustbox-micro-framework":28}],28:[function(e,t,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.microCombo=void 0;e=e("./trustboxes");n.microCombo=e.microCombo,e.microReviewCount,e.microStar,e.microTrustScore},{"./trustboxes":30}],2:[function(e,t,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.apiCall=void 0;var a=r(e("../xhr")),s=e("../queryString"),l=r(e("../rootUri"));function r(e){return e&&e.__esModule?e:{default:e}}n.apiCa

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\media-1[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6254
Entropy (8bit):	4.099651029378647
Encrypted:	false
SSDEEP:	96:/ZXSoJD4v9Bb/qzfZlffIfT2jIn7JacTOZas6h4D7W3IblQbgTUgIfAhce3:xXSv//KfmJ7IWh4D1/TUgIfA6O
MD5:	41E86A5BD4191D2EFBFFC3528B375D9D
SHA1:	D606FC90CF7C89C8FADD3BB38242B81363DB4433
SHA-256:	3EA56AA3FEC1B376697A044A924A0A85E9F24B348D025E55351A71C807DF5A5B
SHA-512:	0F2324C497D20B33F7BA67C3E74B07B0F269E69C392E59DFB0BEAF7435EBEC84EF4DFDCBB4E11C07FB58DC6702BA561D32A321CDD3E5C102A965C285C865AF7B
Malicious:	false
Preview:	<svg width="400" height="392" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M238.652 13.761C121.053-35.217 54.452 52.814 11.465 178.697-31.52 304.58 53.377 360.188 149.653 381.761c109.03 24.43 199.463 10.217 242.467-98.612 32.6-82.501-39.326-221.85-153.468-269.388z" fill="#FFF9F5"/><path d="M19.285 112.595c-2.474 2.613-1.766 7.878.847 10.353 2.613 2.475 9.881 4.41 12.357 1.798 2.475-2.613-1.378-9.925-3.991-12.401a6.516 6.516 0 00-9.213.25z" fill="#FFBF00"/><path d="M395.442 284.709c-1.425-3.938-4.933-3.654-8.871-2.229-3.938 1.426-6.814 3.454-5.389 7.392a7.583 7.583 0 1014.26-5.163z" fill="#FFDDBF"/><path d="M69.617 266.463c-1.425-3.938-4.934-3.655-8.871-2.229-3.938 1.426-6.815 3.453-5.39 7.391a7.583 7.583 0 009.712 4.549 7.582 7.582 0 004.55-9.711z" fill="#FFAF9D"/><path d="M230.276 48.88l-19.377-21.799c-1.222-1.374-3.495-.51-3.495 1.329v14.975a4 4 0 01-2.341 3.64l-34.294 15.634a8 8 0 00-3.775 10.98l17.814 34.143a15.984 15.984 0 011.812 7.108l3.195 174.424c.167 9.129 7.615 16

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\media-2[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4510
Entropy (8bit):	4.194684003393459
Encrypted:	false
SSDEEP:	96:ginQT3GHloxyXKa9RkRc1dv4bQqDqPdL0BLZFisphnTtE7pyg3XXM:5aGF1XKqfg9BphhE7pt3XXM
MD5:	5855882D6BA5AB9C1AC58F2B3C8B6074
SHA1:	F07D510B490AAC8E52E62770F5F0F9E54F41A471
SHA-256:	EDA29CE694D516DB6327A2B00A880FC173B3953E68F08A4C4F4BFCBBFEA4C417
SHA-512:	90D8EAC3F8C9E675C7A17C33ADFFED52F98DCAF8FFE97444557B48C6D143CB2A6F5277C0399B33371EB7B2BE71AEE884FE6FB31F9B96D287C5C4DFAD89DAB263
Malicious:	false
Preview:	<svg width="432" height="384" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M31.168 267.574c36.748 73.689 256.344 183.083 326.125 60.299 69.78-122.785 64.025-228.317 12.936-283.447-25.652-27.681-117.257-68.022-232.098-23.65C46.364 56.234-5.94 193.165 31.168 267.574z" fill="#FFF9F5"/><path d="M252.644 96.38c2.881 3.59 6.428 2.049 10.016-.831 3.589-2.88 3.04-5.17.159-8.759-2.88-3.588-5.304-5.003-8.893-2.122a8.333 8.333 0 00-1.282 11.713z" fill="#FFAF9D"/><path d="M74.287 185.4c-3.924-1.917-6.347.839-8.265 4.763-1.917 3.923-.52 5.668 3.403 7.585 3.924 1.918 6.577 2.153 8.495-1.771a7.908 7.908 0 00-3.633-10.577zM55.969 303.22a6.614 6.614 0 100-13.228 6.614 6.614 0 000 13.228z" fill="#FFDDBF"/><path d="M14.198 128.261c1.8 2.06 3.867 1.057 5.927-.742 2.06-1.799 3.331-3.713 1.532-5.773a4.952 4.952 0 00-7.459 6.515zm322.885 109.917c0 2.44-1.97 4.41-4.41 4.41a4.404 4.404 0 01-4.409-4.41 4.404 4.404 0 014.409-4.409c2.346 0 4.41 1.97 4.41 4.409z" fill="#7BB5FB"/><path d="M187.163 293.53

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\ms.jsll-3.min[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (65409)
Category:	dropped
Size (bytes):	185160
Entropy (8bit):	5.416088073921403
Encrypted:	false
SSDEEP:	3072:qr01mHNlmzFJALnfgl6KqMeuBDnQgUlzBTIxkLEq:S01ArI2IIMeuDnQzU+Yq
MD5:	B6C6F82EAC50F30FFCC090FA845F53F0
SHA1:	1B84A3B53A340BA59171800DF683D15418DD09D3
SHA-256:	7D960385011DDFE6CC859E56D4302DEDA71FDB2D90655E907C14E77D2DCBC8A5
SHA-512:	96CB5C8177D963CCCC0BD8E026B55BD990DD2784687B703DE61C663E16703892E33A0B84B714252F7361DFC8FA4D1D2CF0AA2F8A4F3EB27DB8BDBA4A52DFE4FB
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 3.2.17. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,n=typeof globalThis!=n?globalThis:e\|\|self,i={},e="__ms$mod__",a={},o=a.esm_ms_jsll_3_2_17={},s="3.2.17",c="oneDS3",u=(u=n)[c]=u[c]\|\|{},l=(l=n)[c="oneDS"]=l[c]\|\|{},n=u[e]=u[e]\|\|{},f=n.v=n.v\|\|[],c=l[e]=l[e]\|\|{},d=c.v=c.v\|\|[];for(r in(c.o=c.o\|\|[]).push(a),t(i),i)u[r]=i[r],f[r]=s,l[r]=i[r],d[r]=s,(o.n=o.n\|\|[]).push(r)}}(this,function(u){"use strict";!function(e,t,n){var r=Object.defineProperty;if(r)try{return r(e,t,n)}catch(i){}typeof n.value!==undefined&&(e[t]=n.value)}(u,"__esModule",{value:!0});var l="function",f="object",fe="undefined",j="prototype",d="hasOwnProperty",g=Object,m=g[j],y=g.assign,C=g.create,e=g.defineProperty,E=m[d],b=null;function K(e){e=!1===(e=void 0===e\|\|e)?null:b;return e\|\|((

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\otCenterRounded[1].json

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9507
Entropy (8bit):	5.3592270038592424
Encrypted:	false
SSDEEP:	192:ebkfPUyAQgtNBIWguxw68uCItctpwfTh3fYwuoOE5YBTi+1POyj/0Pp5b5LfvEf0:PSN9cO51r
MD5:	4D67D7FCE83E8D073C84E4D5B5936E71
SHA1:	E02711957EA1C637BE41485526C65E4B56C55FD3
SHA-256:	1DA25CF82F065474AADCE40A8C7369F6DF48E1847CB95C21BD9083488EFF7390
SHA-512:	1E9D7565BEF92D1C2DA126245D6392176D29A4BE7F1B4623FB367B4C345AA5381EB9022ECD3317CC946B48E2AF89073C80EDCEE0FC121073C88643B191D8E4D0
Malicious:	false
Preview:	. {. "name": "otCenterRounded",. "html": "PGRpdiBpZD0ib25ldHJ1c3QtYmFubmVyLXNkayIgY2xhc3M9Im90Q2VudGVyUm91bmRlZCI+PGRpdiBjbGFzcz0ib3Qtc2RrLWNvbnRhaW5lciIgcm9sZT0iYWxlcnRkaWFsb2ciIGFyaWEtZGVzY3JpYmVkYnk9Im9uZXRydXN0LXBvbGljeS10ZXh0Ij48ZGl2IGNsYXNzPSJvdC1zZGstcm93Ij48ZGl2IGlkPSJvbmV0cnVzdC1ncm91cC1jb250YWluZXIiIGNsYXNzPSJvdC1zZGstdHdlbHZlIG90LXNkay1jb2x1bW5zIj48ZGl2IGlkPSJvbmV0cnVzdC1wb2xpY3kiPjxkaXYgY2xhc3M9ImJhbm5lci1oZWFkZXIiPjxkaXYgY2xhc3M9ImJhbm5lcl9sb2dvIj48L2Rpdj48L2Rpdj48aDIgaWQ9Im9uZXRydXN0LXBvbGljeS10aXRsZSI+VGl0bGU8L2gyPjxwIGlkPSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+dGV4dDxhIGhyZWY9IiMiPnBvbGljeTwvYT48L3A+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRhaW5lciI+PGgzIGNsYXNzPSJvdC1kcGQtdGl0bGUiPjwvaDM+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRlbnQiPjxwIGNsYXNzPSJvdC1kcGQtZGVzYyI+PC9wPjwvZGl2PjwvZGl2PjwvZGl2PjxkaXYgaWQ9ImJhbm5lci1vcHRpb25zIj48ZGl2IGNsYXNzPSJiYW5uZXItb3B0aW9uIj48YnV0dG9uIGFyaWEtZXhwYW5kZWQ9ImZhbHNlIiBjbGFzcz0iYmFubmVyLW9wdGlvbi1pbnB1dCI+PHNwYW4gY2xhc3M9ImJhb

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\polyfill.min[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (3246)
Category:	dropped
Size (bytes):	3247
Entropy (8bit):	4.913458643979489
Encrypted:	false
SSDEEP:	96:ab1NDX3vWjDQsgoyGfXVHbngD1UUXZf1B07Ypq8P:iNgDL2YlGJzi78x
MD5:	FEDA7666367553913201A1B1E718F865
SHA1:	52C296316528D53058D17E532B1C484EF936D7D8
SHA-256:	D66A9E827146C7CFFFF75212032752172352DC9ECA81EFE3FF413EB9E008F73A
SHA-512:	8D53AC7F8BFE79866BF889000411E1D2605B067E01667EADD16EB26A1F5A2978072B4B70FBE1C7DB25FC5CE6D8226B60F81D82CADC7F5F77C59223EE9ACE7B05
Malicious:	false
Preview:	!function(e,n){"object"==typeof exports&&"undefined"!=typeof module?n():"function"==typeof define&&define.amd?define(n):n()}(0,function(){"use strict";function e(e){var n=this.constructor;return this.then(function(t){return n.resolve(e()).then(function(){return t})},function(t){return n.resolve(e()).then(function(){return n.reject(t)})})}function n(e){return!(!e\|\|"undefined"==typeof e.length)}function t(){}function o(e){if(!(this instanceof o))throw new TypeError("Promises must be constructed via new");if("function"!=typeof e)throw new TypeError("not a function");this._state=0,this._handled=!1,this._value=undefined,this._deferreds=[],c(e,this)}function r(e,n){for(;3===e._state;)e=e._value;0!==e._state?(e._handled=!0,o._immediateFn(function(){var t=1===e._state?n.onFulfilled:n.onRejected;if(null!==t){var o;try{o=t(e._value)}catch(r){return void f(n.promise,r)}i(n.promise,o)}else(1===e._state?i:f)(n.promise,e._value)})):e._deferreds.push(n)}function i(e,n){try{if(n===e)throw new TypeErro

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\prodico-32_driver-updater_white[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2415
Entropy (8bit):	4.212491397865705
Encrypted:	false
SSDEEP:	48:cJ8G3HAjCXx8i+2f+KjDHN8V97gPINlW34noKyh9NBrEp8uUClJK0h97bS9w:IBlPHN8VaPqwA/pNC9w
MD5:	3CD7B3CD682B8FA2DCB46F16B59C3CD7
SHA1:	CB26256C73D5A087C82181FC0130018A7F4879CB
SHA-256:	F4D132ACE5766F7D219BAF8A4FD575B048AB64B0CB1ED107D91C4FFF3BF8383E
SHA-512:	47327E5BCC1063FCB1EC387E284AD8287DAA97DCC45EBA9712609ED3488AD2676375B810DC7C776B8E217554342C861C725634CA7098611D076975C47E247CBC
Malicious:	false
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M21.28 28.388a.6.6 0 101.2 0h-1.2zm-11.744 0a.6.6 0 101.2 0h-1.2zM3.6 9.544a.6.6 0 100 1.2v-1.2zm0 11.727a.6.6 0 000 1.2v-1.2zm-.002-5.864a.6.6 0 10.004 1.2l-.004-1.2zm7.138-11.795a.6.6 0 00-1.2 0h1.2zM28.4 10.744a.6.6 0 000-1.2v1.2zm0 11.727a.6.6 0 000-1.2v1.2zM22.48 3.612a.6.6 0 10-1.2 0h1.2zM9.362 16.374l.285-.528-.933-.504.048 1.06.6-.028zm3.303 2.466a.6.6 0 10.57-1.055l-.57 1.055zm9.974-3.2l-.287.528.934.509-.048-1.063-.6.027zm-3.302-2.481a.6.6 0 00-.574 1.054l.574-1.054zM16.6 3.612a.6.6 0 10-1.2 0h1.2zm11.8 12.987a.6.6 0 000-1.2v1.2zm-13 11.789a.6.6 0 001.2 0h-1.2zM9.516 12.724a.6.6 0 001.068.548l-1.068-.548zm12.973 6.55a.6.6 0 00-1.07-.545l1.07.545zM5.836 15.399l-2.238.008.004 1.2 2.239-.008-.005-1.2zm3.24 1.503l3.589 1.938.57-1.055-3.588-1.939-.57 1.056zm13.85-1.788l-3.59-1.955-.573 1.054 3.588 1.955.575-1.054zM16 22.046c-3.168 0-5.895-2.54-6.04-5.7l-1.198.055c.174 3.82 3.447 6.845 7.238 6.845v-

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\prodico-32_free-antivirus_white[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	545
Entropy (8bit):	4.754128613009515
Encrypted:	false
SSDEEP:	12:tr/kuINyGdOU2zhjZmfJsXjMl0UVSzIDh1tiq5Mb0u/Xm/B9Yhll7:tzkuHyj2zpZmjl0Up5iA7e2/TYhll7
MD5:	90847F1EA9446C6C882BCE55658B729F
SHA1:	F4B3EAD41C56B796AE2DB5CE210E9BFAE675D677
SHA-256:	E1A666F4C9298EE14EBF790E41A103BBA3299B145A90E1FE5E124D692F40D211
SHA-512:	6F0F0A083D7F15FCF4A29C66103796326261B96186B198C0AA396452A5114CC8B89643A7FD85A96320907790873AC1B5A2BC0D116B30FB1EB6AC237485EF96F9
Malicious:	false
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M5.55 13.634c-.013 1.78.247 3.483.63 4.862 1.145 4.109 4.75 6.967 8.392 9a2.929 2.929 0 002.856 0c3.641-2.033 7.247-4.891 8.391-9a18.02 18.02 0 00.631-4.862c-.01-1.415-.008-2.83-.004-4.246a3.176 3.176 0 00-2.265-3.054c-2.273-.678-4.55-1.34-6.827-2.007a4.819 4.819 0 00-2.708 0c-2.276.666-4.554 1.329-6.827 2.007a3.176 3.176 0 00-2.265 3.054c.004 1.415.007 2.83-.004 4.246z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\prodico-32_ultimate_white[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1798
Entropy (8bit):	4.3006519243078225
Encrypted:	false
SSDEEP:	48:9S6pZmB1R1HcNBX2YeexjQ4y6WsUSD3/VO:9S91R18NBGYN2sXO
MD5:	8E52094545E485411225964599C1A1A9
SHA1:	5B4B232946B791342CB0AC5A277D8D35558A7B88
SHA-256:	EF6E2C3963D4A8A00D85720E68E78350BC041005F8665A3A131A5B7E9E0B9CA3
SHA-512:	60BA525EEAF2502696564374F0FE2C92FDA3A66BF5DF1CF16F26CE7A3EF0EA6FC8033AC40D8751C6BE5EE2AB0A0254EAEA129C5279C60E62D216647BDBE53A82
Malicious:	false
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M5.55 13.634c-.013 1.78.247 3.483.63 4.862 1.145 4.109 4.75 6.967 8.392 9a2.929 2.929 0 002.856 0c3.641-2.033 7.247-4.891 8.391-9a18.02 18.02 0 00.631-4.862c-.01-1.415-.008-2.83-.004-4.246a3.176 3.176 0 00-2.265-3.054c-2.273-.678-4.55-1.34-6.827-2.007a4.819 4.819 0 00-2.708 0c-2.276.666-4.554 1.329-6.827 2.007a3.176 3.176 0 00-2.265 3.054c.004 1.415.007 2.83-.004 4.246z" fill="#FFF" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/><path d="M15.288 19.314a.6.6 0 10-.848-.848l.848.848zM12.674 16.7l.424.425-.424-.425zm2.614-1.766a.6.6 0 10-.848-.848l.848.848zm1.424-3.12a.6.6 0 10.848.848l-.848-.848zm2.614 2.615l.425.424-.425-.424zm-2.614 1.765a.6.6 0 00.849.849l-.849-.849zm3.039.082a.6.6 0 00-.849.849l.849-.849zm-4.381 0a.6.6 0 00-.849.849l.849-.849zm-3.12-1.423a.6.6 0 00.848-.849l-.849.849zm2.614-2.615l.424-.424-.424.424zm1.765 2.614a.6.6 0 10.849-.848l-.849.848zm-2.19 3.61

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\product-icon-32x32-smb-small-business_white[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	458
Entropy (8bit):	4.829431768551787
Encrypted:	false
SSDEEP:	6:tnr/kumc4slm8A9zQkQNENXG1NwVs/SkizWeBvcp5OhL1W6kzSZV6kzQ0TCV79jb:tr/kuI85p+M1y2SkW1LGBhB9YU
MD5:	960DC631F4792A41E550B03056423D53
SHA1:	805309342C8A793E8C9D1352E124965FE8BB2794
SHA-256:	4C834597DBFEA8CD691579E3526B8DF855291AFEF5DD4BF50EB93DD5F4066509
SHA-512:	5458D71C1B956B9D89DF17A44E2364FFA346F2E03F0B415248CC546E68AB83B4345D650B90232821F8D30A301BEA43D857B410819A180CB7E0017D4BB802E5ED
Malicious:	false
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M17.267 26.4h-1.901v-3.626a.55.55 0 00-.56-.54h-2.154a.55.55 0 00-.56.54V26.4H7.6V7.526c0-1.064.895-1.926 2-1.926h8.257c1.105 0 2 .862 2 1.926V26.4h5.768V15.674c0-1.063-.895-1.925-2-1.925h-1.18m-10.76-3.646v.646m0 2.826v.646m0 2.825v.646m4.087-7.589v.646m0 2.826v.646m0 2.825v.646m6.969.254v.646m0 2.826v.646" stroke="#FFF" stroke-width="1.2" stroke-linecap="square"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\singleDL-primary[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1968)
Category:	dropped
Size (bytes):	2013
Entropy (8bit):	5.180361711570539
Encrypted:	false
SSDEEP:	24:cBPVbhXRkj355vXRkISmh4ryACRLQgKItF7xLpItF7ZQMKi3vnUYjY43zRcSKVe9:mPNQm+7kgKYqZKCvnUYJzRF4lg8V5Sz
MD5:	A1885F85B5342067CA5148C5D70E8D07
SHA1:	B053248C8B377349DB8EDED17532DC286D8045C5
SHA-256:	42163EDC17D2941C9887CCC5F9A3793DE4E5E723DAFB391C8DE32605CA649393
SHA-512:	F7C364C96A39A870540B17F69E655A7A4F8F2A09640127275B37C1EFDB35D25CB20F8B056E3D91E3EFC5644DEE3B94F3E08175C4B4FFB5EF7D1F13501C636D24
Malicious:	false
Preview:	!function(){"use strict";if(window.sdl!==undefined)try{/OptanonConsent=.?(consentId=(.?)(?=&))/.test(document.cookie)&&sdl.push({client:{cmpId:document.cookie.match(/OptanonConsent=.?(consentId=(.?)(?=&))/)[2]}}),/(?<=NotLandingPage&groups=\|groups=).?(?=&\|;\|$)/.test(document.cookie)&&sdl.push({consentGroups:document.cookie.match(/(?<=NotLandingPage&groups=\|groups=).?(?=&\|;\|$)/)[0].replace(/%3A/g,":").replace(/%/g,",").replace(/2C/g," ")}),sdl.push({session:{countryCode:sdlObj.session.countryCode,secChUa:function(){return navigator.userAgentData!==undefined&&navigator.userAgentData.brands.length>0?navigator.userAgentData.brands:[]}(),platform:window.avastGlobals.detect.os.name,mobile:function(){return navigator.userAgentData!==undefined&&navigator.userAgentData.brands.length>0?navigator.userAgentData.mobile:"-"}()},server:{provider:"CMS",platform:"WEB",env:window.location.host.startsWith("web-preview")?"dev":"prod",dataCenter:"-",sdlVersion:"2021-05-05/v1"}});var a=new URLSearchPa

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\userAgentDetect[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (4463)
Category:	dropped
Size (bytes):	4507
Entropy (8bit):	5.3108949664389815
Encrypted:	false
SSDEEP:	96:o+s+bsFloPntic+0cPVf5on/mlZVvHz2EugEka:xs+4FUUTTJa
MD5:	65F6BA39F31CE728D5C279C304790EF1
SHA1:	681A2E099CBDA036E38FB2F45A729C7EEF3A1A3F
SHA-256:	F2C5DF9953D607FEA3E8ABC06C7E6D24682B5C35D5FD0DF704658AEFE9B5D585
SHA-512:	D5B84A2C0CBE50C0B3E7EB3BC1AEA2A4468CE609528FA3BB778B9CCD14C6E50E92C4BF095CB0E845523F5E884CB4CD736CF7C66FAB94CA4B327D814AE15E8E40
Malicious:	false
Preview:	window.avastGlobals=window.avastGlobals\|\|{},function(){"use strict";function a(){c.classList.remove("js-pc"),c.classList.remove("js-android"),c.classList.remove("js-ios"),c.classList.remove("js-mac")}function b(){d=window.location.hash.substring(1),h.includes(d)&&(a(),c.classList.add("js-"+d))}var c=document.documentElement,d=window.location.hash.substring(1),e=navigator.userAgent.toLowerCase(),f=navigator.language.toLowerCase(),g="pc",h=["android","ios","mac","pc"],i="Chrome",j="",k="",l="";if(navigator.userAgentData!==undefined&&navigator.userAgentData.brands.length>0&&navigator.userAgentData.platform!==undefined){k=navigator.userAgentData.platform.toLowerCase(),/windows/.test(k)?k="Windows":/linux/.test(k)?k="Linux":/android/.test(k)?(g="android",k="Android"):/ios/.test(k)?(g="ios",k="IOS"):/macos/.test(k)&&(g="mac",k="Mac");var m=navigator.userAgentData.brands;for(var n in m){var o=m[n];/Chrome/.test(o.brand)?(i="Chrome",j=o.version):/Opera/.test(o.brand)?(i="Opera",j=o.version):/E

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\wcp-consent[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\9UC7QXW7.htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines (908), with no line terminators
Category:	dropped
Size (bytes):	908
Entropy (8bit):	5.868314900030817
Encrypted:	false
SSDEEP:	24:hMiRO9y+wtBTixH21CtY9i94a4uixH21CtY9iy:NOjGTQHooQHot
MD5:	8D0F2F00331A37FE66592620772C520F
SHA1:	A9707942D096B81261A1568F903ECAC9A141F429
SHA-256:	0A94A0FEF1C71DCF9368FE170941983FDD62696593671166647663146D0561FA
SHA-512:	666BD1E9EFE8D8190C11FC29FE740CD48D95BD6D793F3C59F95929F8A2F9D2535D57E34CFA3ECE64716362CF0EB01F199373597E04FB6B0FB199E7FC65A55F74
Malicious:	false
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/src=4711400;type=globa0;cat=avast0;ord=1;num=1850339154548;npa=0;auiddc=*;u2=Product;u7=www.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi;u8=;u17=undefined;pscdl=noapi;frm=0;gtm=45fe45m0v9181661103z871039428za201zb71039428;gcs=G111;gcd=13t3t3t3t5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi"/></body></html>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\MWFMDL2[1].ttf

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	TrueType Font data, 15 tables, 1st "OS/2", 37 names, Microsoft, language 0x403, type 2 string, Normaloby
Category:	dropped
Size (bytes):	20040
Entropy (8bit):	6.19996057371802
Encrypted:	false
SSDEEP:	384:FrnW7NB829nIBLy9oHPGWyFLenP+zQgnZfncO/A/xio:cA2wy9oHhsemzFvcOjo
MD5:	5410C5517F1BBEB51E2D0F43BC6B4309
SHA1:	4ADF2D3A889A8F9D71FAC262297302086A4A03F4
SHA-256:	2F4E38662C0FF2FAB3EB09DCB457CD0778501BFFEE4026F6B0D9364ABB05DB46
SHA-512:	E0EF3BCA5CEF4B6B69CE09FC5295E21A5D151912585AE80703139550BD222EF463CBA856EA7F37E9D8BEF21EEBD7790E3A7D81D580469997A8708B11B00E61BD
Malicious:	false
Preview:	...........pOS/2JZxh.......`VDMX.^.q...\....cmap.ph....<....cvt ...........fpgm..........Ygasp.......`....glyfoV."...l..7.head.k....C(...6hhea......C`...$hmtx.F.E..C.....loca.Y....Dt....maxp......E\... name..b...E\|....post.Q.w..MT... prepx.....Mt.................3.......3.....f..............................MS .@...B......................... ................................................................................................................................................................... . ...!.!..."."...#.#...$.$...%.%...&.&...'.'...(.(...).)....*...+.+...,.,...-.-........././...0.0...1.1...2.2...3.3...4.4...5.5...6.6...7.7...8.8...9.9...:.:...;.;...<.<...=.=...>.>...?.?...@.@...A.A...B.B...C.C...D.D...E.E...F.F...G.G...H.H...I.I...J.J...K.K...L.L...M.M...N.N...O.O...P.P...Q.Q...R.R...S.S...T.T...U.U...V.V...W.W...X.X...Y.Y...Z.Z...[.[...\.\...].]...^.^..._._...`.`...a.a...b.b...c.c...d.d...e.e...f.f...g.g...h.h...i.i...j.j...k.k...l.l...m.m...n.n...o.o...p.p...q.q..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\MierB03-SubsetEng-Bold[1].woff

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 27048, version 1.131
Category:	dropped
Size (bytes):	27048
Entropy (8bit):	7.983411136160395
Encrypted:	false
SSDEEP:	768:nM0xcXxV3DEQVCK+xGbqAiqIonpTzH5PJyN:nM0xcXruobwup358N
MD5:	C9B591134A84EE9A7748EB3640AB6AA6
SHA1:	F07E985600E443C64D46C2FEF97C33B00E8F9441
SHA-256:	8EC0B861A3709F3C0ECB0E13B01EDF1B6E44382440DBDFE6B6D52564142C1E2F
SHA-512:	1C461DDBD5E1DF8793D0086A1A0F79E771B93AC875F90DFFC32BA3E5FB186809CD09E15B875D180451911F6793AB7DD28E1128B97F4D6E05AA9ABA536C2213E8
Malicious:	false
Preview:	wOFF......i........0........................GDEF..V........h.L.2GPOS..Wh......@L.HlGGSUB..h........(.4..OS/2.......W...`j...cmap.............-w.cvt .............g:.fpgm............b/..gasp..V.............glyf...$..B...w...>.head.......6...6..!Shhea.......!...$....hmtx...T...e...$.(..loca................maxp....... ... .l.Vname..T....V...V.i.Cpost..Vl....... ...`prep..............q\|........[.[_.<...........Pr........7..................x.c`d``>............Lf.. .FN....%..............P......W............x.c`a.a.........................9.....l....@.......\|...x.31....p...#.P.?H....L..,..3....x.].KHTQ....9.tT.......r\|...4+S....f.....l..A.TDDA .H"p.m,."2..."ZD+.E..Mn.........9.{.s.=.>U..%...#..3....o.QD.@..b.......)..C.a....,.....Q.W.....U..*..m......e.#.1..=.Fa.R...c.j.]..-8./6...u...mS..N7..Q.yM.)..f...Ze~k....O...T.w.1nM+..m..<s.q...?....}.Hr...r... ..Z7.E...?.i.{.!$.\.....j....#i./.W....q....\|.k...J...g..$.7....?_.].....Z3.z.\.{-r...Bd..S..Oc..a..}.T.9r.ts.7.j1.Q.:D

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\MierB03-SubsetEng-Regular[1].woff

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 25772, version 1.131
Category:	dropped
Size (bytes):	25772
Entropy (8bit):	7.981544706718769
Encrypted:	false
SSDEEP:	384:rKt+M06mlB3arui0WvKrKQbl3FSux+VlqXNvBoqu80r9QwE6HP3Il/OvpOXjB3K8:FM0xJisrKQb65QZ45KyP4lBjB3K3bI
MD5:	F92DA22953F3E076421DDEE8E64D0B64
SHA1:	DCE68313B32C0E085FFA9D5AD3D9EEAD5BB99B1E
SHA-256:	979C1C29B8585B0FD2B034492CA78EE63B589751F8F303323F2722FAEE27F813
SHA-512:	476B18CDFF78A0D889CF8FA5514ACAB80A799728DFF2D5EFEB01F393116729F913CCC62D6FA2AA67C9714573B4CBB4B4E3DA1B1FCAF3F27AA77535F00A4C1F9F
Malicious:	false
Preview:	wOFF......d........,........................GDEF..QP.......h.L.2GPOS..R0......@R...eGSUB..c........(.4..OS/2.......X...`i..cmap.............-w.cvt ..............7kfpgm............b/..gasp..QH............glyf...0..=...e...head.......6...6..!>hhea.......!...$....hmtx...T...r...$.r .loca...............maxp....... ... .l.Yname..N....Y...\....post..Q4....... ...8prep..............q\|........T-.._.<...........Pr........W..................x.c`d``>..........eY&2.E..#'..M................S......W............x.c`a2f..................,......Y.....l....@.......\|...x.31....p...#.P.?H..... .........x.].MHTQ.......(j3N....R...b2...."b.......)W....h....8)..M.T...EA. 7..Q.Q.hQQL.....{.s......t.....SX.'..E...3A...z.qq....$...7g.....^'...0.t.#...9.z....\'.c..f..y1.s.2...C..~. ..2....Q+...+.RR..!b...3~..m..}4.....V..U..k..V.gx.........5U...h=....d...+f..q:MKt.}S.T.62.o....Z......3N....I.I..a....s........v.y:..<s.1MI.B\....8.1s.y...y..../.......&.{. .$..Qc0*....&..........C..$..#....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\OtAutoBlock[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (64511)
Category:	dropped
Size (bytes):	74120
Entropy (8bit):	5.520421884516039
Encrypted:	false
SSDEEP:	1536:e6U9QHv0ExMTU0nQ7Ty9butW5qyM57dVkjC1HzksNaRYE:msvyRYE
MD5:	897FBC0DCE23DE62B64428F0A899E64E
SHA1:	C37354409EA9147176D91D550B14D51EF539FB46
SHA-256:	3DE319AFC4CDE15B775270AC3836C5EB8AA8FFE3DE96340F52DF0D81EEE9E49A
SHA-512:	35A125B531F0153E5CA6580C0E959E16B0A2078126D46E4006B133FED13A192E9EB4098284D6A373B57AF06F60556CD7F57A7AABD7CE1A82B73E19B20A84457F
Malicious:	false
Preview:	!function(){function n(d){for(var f,a,g,b,c=[],e=0;e<x.length;e++){var h=x[e];if(h.Tag===d){c=h.CategoryId;break}var l=(f=h.Tag,b=g=a=void 0,a=-1!==(b=f).indexOf("http:")?b.replace("http:",""):b.replace("https:",""),-1!==(g=a.indexOf("?"))?a.replace(a.substring(g),""):a);if(d&&(-1!==d.indexOf(l)\|\|-1!==h.Tag.indexOf(d))){c=h.CategoryId;break}}if(!c.length&&z){var r=function(k){var v=document.createElement("a");v.href=k;k=v.hostname.split(".");return-1!==k.indexOf("www")\|\|2<k.length?k.slice(1).join("."):.v.hostname}(d);A.some(function(k){return k===r})&&(c=["C0004"])}return c}function m(d){return d&&window.OptanonActiveGroups&&d.every(function(f){return-1!==window.OptanonActiveGroups.indexOf(f)})}function p(d){return-1!==(d.getAttribute("class")\|\|"").indexOf("optanon-category")}function q(d){return d.hasAttribute("data-ot-ignore")}function t(d,f){d=d.join("-");var a=f.getAttribute("class")\|\|"";-1===a.indexOf("optanon-category-"+d)&&(d=w(d,a),f.setAttribute("class",d))}function w(d,f){ret

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\avast-logo-inverse[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2877
Entropy (8bit):	4.052337689336677
Encrypted:	false
SSDEEP:	48:9LfM566CUltUbVdMonLXE7TJ/09Qjks4w73ihizfcIsCvWIK+5B+jV9Pp:9LNV2onG/a7w73ihizfcINj5Erx
MD5:	CA3944DC6C14B8CB08491522A17305C1
SHA1:	4E7A365749B01D5D1F6F4D66AD1DAF35D6F36A31
SHA-256:	63B2334F1A7B6023ACC55F36FC44424D050C65BF421CA871EBCF967E1DEA7FF6
SHA-512:	446355072B700B0F9551C68B7431121033E8C9CA938B879D0A61E8EC45526AFB8CF7A3E7E5328934AA5254A35BCDA60EA73FAF44D962DC782F77318CD81AEFB4
Malicious:	false
Preview:	<svg width="116" height="36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M114.388 16.038c.792 0 1.44-.648 1.44-1.44v-1.764h-4.464V8.946h-2.466c-.792 0-1.44.648-1.44 1.44v2.466h-.72c-.792 0-1.44.648-1.44 1.44v1.764h2.16v5.706c0 .918.018 1.764.036 2.484.018.738.216 1.458.594 2.16.414.756 1.026 1.296 1.836 1.638.81.342 1.728.522 2.754.54 1.026.018 2.07-.072 3.15-.27V26.64a1.44 1.44 0 00-1.476-1.44c-.36.018-.702 0-1.026-.018-.756-.054-1.296-.342-1.656-.882-.18-.288-.288-.666-.288-1.152-.018-.486-.018-1.026-.018-1.62v-5.49h3.024zM53.406 7.704h-4.14l-7.434 20.61H45c.594 0 1.134-.378 1.35-.936l1.242-3.366h9.198l1.242 3.366c.216.558.738.936 1.35.936h3.15L55.656 9.288a2.412 2.412 0 00-2.25-1.584zm-4.5 12.78l3.276-8.838 3.276 8.838h-6.552zm34.145-8.028c-3.276 0-5.382 1.458-6.48 4.302l2.358.828a1.44 1.44 0 001.584-.45c.504-.63 1.08-1.152 2.502-1.152 1.782 0 2.52.63 2.664 2.322l-4.77.828c-4.41.72-4.95 3.438-4.95 4.932 0 1.494 1.134 4.698 5.4 4.698 2.16 0 3.708-.792 4.716-1.764a1.433 1.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\avast-logo-inverse[2].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2877
Entropy (8bit):	4.052337689336677
Encrypted:	false
SSDEEP:	48:9LfM566CUltUbVdMonLXE7TJ/09Qjks4w73ihizfcIsCvWIK+5B+jV9Pp:9LNV2onG/a7w73ihizfcINj5Erx
MD5:	CA3944DC6C14B8CB08491522A17305C1
SHA1:	4E7A365749B01D5D1F6F4D66AD1DAF35D6F36A31
SHA-256:	63B2334F1A7B6023ACC55F36FC44424D050C65BF421CA871EBCF967E1DEA7FF6
SHA-512:	446355072B700B0F9551C68B7431121033E8C9CA938B879D0A61E8EC45526AFB8CF7A3E7E5328934AA5254A35BCDA60EA73FAF44D962DC782F77318CD81AEFB4
Malicious:	false
Preview:	<svg width="116" height="36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M114.388 16.038c.792 0 1.44-.648 1.44-1.44v-1.764h-4.464V8.946h-2.466c-.792 0-1.44.648-1.44 1.44v2.466h-.72c-.792 0-1.44.648-1.44 1.44v1.764h2.16v5.706c0 .918.018 1.764.036 2.484.018.738.216 1.458.594 2.16.414.756 1.026 1.296 1.836 1.638.81.342 1.728.522 2.754.54 1.026.018 2.07-.072 3.15-.27V26.64a1.44 1.44 0 00-1.476-1.44c-.36.018-.702 0-1.026-.018-.756-.054-1.296-.342-1.656-.882-.18-.288-.288-.666-.288-1.152-.018-.486-.018-1.026-.018-1.62v-5.49h3.024zM53.406 7.704h-4.14l-7.434 20.61H45c.594 0 1.134-.378 1.35-.936l1.242-3.366h9.198l1.242 3.366c.216.558.738.936 1.35.936h3.15L55.656 9.288a2.412 2.412 0 00-2.25-1.584zm-4.5 12.78l3.276-8.838 3.276 8.838h-6.552zm34.145-8.028c-3.276 0-5.382 1.458-6.48 4.302l2.358.828a1.44 1.44 0 001.584-.45c.504-.63 1.08-1.152 2.502-1.152 1.782 0 2.52.63 2.664 2.322l-4.77.828c-4.41.72-4.95 3.438-4.95 4.932 0 1.494 1.134 4.698 5.4 4.698 2.16 0 3.708-.792 4.716-1.764a1.433 1.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\avastcom[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (8070), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	117196
Entropy (8bit):	5.325404134701927
Encrypted:	false
SSDEEP:	1536:5Jme6Jx35bfJOAFnBoUE8rW8ShCtek53Ho62aiv3jpb9I36+rr05qiCzQVpIINey:nW3HOmn5Ymo6JhzKf
MD5:	E13946C5229D83FD5B0F71FC794CC607
SHA1:	5EB3E216D6BA188F56CC8C8DF9AE811F958B0A7D
SHA-256:	C794957E69E244AC34A368676AF7B22A354208A981A61C8AD29E44EC79BC4344
SHA-512:	2B5534C5B2EA09D4375A757E6A721C19A802DB72E7220056E63F3EEF432A5E7EC348B2C858AC180C87AC2F78B59CE197B97140A84DDBBD4DFF31B251CB925EAE
Malicious:	false
Preview:	Array.prototype.filter\|\|(Array.prototype.filter=function(t,e){"use strict";if("Function"!=typeof t&&"function"!=typeof t\|\|!this)throw new TypeError;var r=this.length>>>0,o=new Array(r),n=this,l=0,i=-1;if(void 0===e)for(;++i!==r;)i in this&&t(n[i],i,n)&&(o[l++]=n[i]);else for(;++i!==r;)i in this&&t.call(e,n[i],i,n)&&(o[l++]=n[i]);return o.length=l,o}),Array.prototype.forEach\|\|(Array.prototype.forEach=function(t){var e,r;if(null==this)throw new TypeError('"this" is null or not defined');var o=Object(this),n=o.length>>>0;if("function"!=typeof t)throw new TypeError(t+" is not a function");for(arguments.length>1&&(e=arguments[1]),r=0;r<n;){var l;r in o&&(l=o[r],t.call(e,l,r,o)),r++}}),window.NodeList&&!NodeList.prototype.forEach&&(NodeList.prototype.forEach=Array.prototype.forEach),Array.prototype.indexOf\|\|(Array.prototype.indexOf=function(t,e){var r;if(null==this)throw new TypeError('"this" is null or not defined');var o=Object(this),n=o.length>>>0;if(0===n)return-1;var l=0\|e;if(l>=n)retur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\bat[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Unicode text, UTF-8 text, with very long lines (46429), with no line terminators
Category:	dropped
Size (bytes):	46430
Entropy (8bit):	5.303853365298302
Encrypted:	false
SSDEEP:	768:OaOFhhR5OIahpjfRys3LzQR04TYYyDMOWPKQ:OaOFnRqDRtzQ64IfWiQ
MD5:	72BCA04FD669EB89FC65D59052D0FC00
SHA1:	27E60AEF86F0CB1B2F6B6ED9DF9A4E3BA88EFD21
SHA-256:	823804A7807864B44093A3843788F4CD076E89CF4A6FDEB8D153AE5C2C2DF721
SHA-512:	56058E4C927563CA37DEC4979AF28A415EA3042A389C0BA22738C76D39131317A703A38A95EAB9D913F116F7C2D1DA62A0A87750F47DECA2DDB3447D64303B12
Malicious:	false
Preview:	function UET(o){this.stringExists=function(n){return n&&n.length>0};this.domain="bat.bing.com";this.domainCl="bat.bing.net";this.URLLENGTHLIMIT=4096;this.pageLoadEvt="pageLoad";this.customEvt="custom";this.pageViewEvt="page_view";o.Ver=o.Ver!==undefined&&(o.Ver==="1"\|\|o.Ver===1)?1:2;this.uetConfig={};this.uetConfig.consent={enabled:!1,adStorageAllowed:!0,adStorageUpdated:!1,hasWaited:!1,waitForUpdate:0};this.uetConfig.tcf={enabled:!1,vendorId:1126,hasLoaded:!1,timeoutId:null,gdprApplies:undefined,adStorageAllowed:undefined,measurementAllowed:undefined,personalizationAllowed:undefined};this.beaconParams={};this.supportsCORS=this.supportsXDR=!1;this.paramValidations={string_currency:{type:"regex",regex:/^[a-zA-Z]{3}$/,error:"{p} value must be ISO standard currency code"},number:{type:"num",digits:3,max:999999999999},integer:{type:"num",digits:0,max:999999999999},hct_los:{type:"num",digits:0,max:30},date:{type:"regex",regex:/^\d{4}-\d{2}-\d{2}$/,error:"{p} value must be in YYYY-MM-DD date

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\chrome[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1312
Entropy (8bit):	5.275801237602774
Encrypted:	false
SSDEEP:	24:t4dlu7laoBLQVnDBLlFZxBLy9dprGKwJRHxsGbGEvq9HxsG7G1bU05HxsGEG68CH:KKaaLQVdLlFZzLy7pUTH9iWaH9C+SH9y
MD5:	6A04E8861C9EE16F79F09D7D5F414BB7
SHA1:	529AFD9F8D68E495EEEFEC4056677DCC142A1E23
SHA-256:	BE615DA0C96133A9D7CE2242DB668D15D9BDC62F8F4A40AB6FC218D3604D3BC7
SHA-512:	3BDBFADF5909B47FD8CAA5E5B0B089F5F3C1EC9E09016083A4515D363B515AA9241B373F7E83B58F0C3196B4AF36FC3ADFB730813B3640BDD0D2089D74AEE438
Malicious:	false
Preview:	<svg width="64" height="64" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_18418_27150)"><path d="M59.706 16a32 32 0 00-55.424 0l1.92 34.56L59.706 16z" fill="url(#paint0_linear_18418_27150)"/><path d="M18.144 40L4.288 16A32 32 0 0032 64l31.36-32-45.216 8z" fill="url(#paint1_linear_18418_27150)"/><path d="M45.856 40L32 64a32 32 0 0027.706-48H32l13.856 24z" fill="url(#paint2_linear_18418_27150)"/><path d="M32 48a16.001 16.001 0 0011.314-27.314A16 16 0 1032 48z" fill="#fff"/><path d="M32 44.672a12.673 12.673 0 100-25.346 12.673 12.673 0 000 25.346z" fill="#1A73E8"/></g><defs><linearGradient id="paint0_linear_18418_27150" x1="4.288" y1="20" x2="59.706" y2="20" gradientUnits="userSpaceOnUse"><stop stop-color="#D93025"/><stop offset="1" stop-color="#EA4335"/></linearGradient><linearGradient id="paint1_linear_18418_27150" x1="35.462" y1="61.997" x2="7.75" y2="13.997" gradientUnits="userSpaceOnUse"><stop stop-color="#1E8E3E"/><stop offset="1" stop-color="#34A853"/></li

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\cmp-countdown[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (743)
Category:	dropped
Size (bytes):	785
Entropy (8bit):	5.306213986254662
Encrypted:	false
SSDEEP:	24:cbwNVuu3IlHuOouMUR3+kIdxBa5KGfa3z:Ou+Hu1uMuukIdxBa56D
MD5:	826C178D8ED6886E4807FCD9088E6CAB
SHA1:	B412CC003F588EC4CF4C71B0E3F0A5A88F78352D
SHA-256:	B132E3C40C34D62FBD045FB30DCAC6B77D85B1C520AFADADB92548F5D4DBF517
SHA-512:	9C4284FFC97AC561971D5B8AF8A18037C924462F95D904DB22B8965730311DEAF9E2A014CC708313734FA4D5025319ABFC16244C64ECF889ED9DEC673432AC48
Malicious:	false
Preview:	!function(){"use strict";try{if(document.querySelector(".cmp-countdown"))var a=document.querySelector(".cmp-countdown"),b=a.dataset.expiration,c=new Date(b).getTime(),d=a.querySelector(".days .numbers"),e=a.querySelector(".hrs .numbers"),f=a.querySelector(".mins .numbers"),g=a.querySelector(".sec .numbers"),h=setInterval(function(){var b=(new Date).getTime(),i=c-b,j=Math.floor(i/864e5),k=Math.floor(i%864e5/36e5),l=Math.floor(i%36e5/6e4),m=Math.floor(i%6e4/1e3);d.innerHTML=j<10?"0"+j:j,e.innerHTML=k<10?"0"+k:k,f.innerHTML=l<10?"0"+l:l,g.innerHTML=m<10?"0"+m:m,i<0&&(clearInterval(h),a.remove())},1e3)}catch(i){"undefined"!=typeof sdl&&(console.error(i),sdl.push({system:{error:{type:i.name,message:i.message}},event:"system.error"}))}}();.//# sourceMappingURL=cmp-countdown.js.map

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\cmp-sticky-bars[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (978)
Category:	dropped
Size (bytes):	1022
Entropy (8bit):	5.155402665459105
Encrypted:	false
SSDEEP:	24:cs9tETnnWNx/l73oWA5PKvK0S7IQYhZapGfxq:RAT4ra5CCvIZ28q
MD5:	70CA310D708E515399CF80D8B7BBFAE3
SHA1:	2CFA0951F3F78BB3E62C0FCE41DBA10C2F1565A5
SHA-256:	EDF958A4619728E7CF17EF834E1B3EA0584CDFAAF63AB5DDDF88651C341B5627
SHA-512:	55CAAAC6032DD32AAAEFF0559E8FB5937050708E2976E40671BB08B02D0F1E60F1D2E00C09C132CCFBF1C2962642D05BEC466C11C964D4CB807AE8384359E7FD
Malicious:	false
Preview:	!function(){"use strict";function a(a){f.forEach(function(b){b.setAttribute("tabindex",a)})}function b(b){e.forEach(function(c){b?(c.classList.add("is-sticky"),a(0)):(c.classList.remove("is-sticky"),a(-1))})}function c(){var a=!1;h&&h.length>0&&h.forEach(function(b){var c=b.querySelector(".tr.table-header-tr");a=a\|\|d(c,64,null,!0)&&d(b)}),a?g?g.classList.add("hidden"):b(!1):g?(b(!1),a\|\|g.classList.remove("hidden")):b(d(i,null,null,!0)?!0:!1)}try{var d=avm.require("avast.web.waypoints"),e=document.querySelectorAll(".sticky-bar"),f=document.querySelectorAll(".sticky-bar a"),g=document.querySelector(".message-bar.sticky-message"),h=document.querySelectorAll(".table.sticky"),i=".sticky-waypoint";a(-1),(document.querySelector(i)\|\|g)&&(window.addEventListener("scroll",function(){c()}),window.addEventListener("resize",function(){c()}))}catch(j){"undefined"!=typeof sdl&&(console.error(j),sdl.push({system:{error:{type:j.name,message:j.message}},event:"system.error"}))}}();.//# sourceMappingURL=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\favicon[1].ico

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\js[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (7711)
Category:	dropped
Size (bytes):	301059
Entropy (8bit):	5.61146781927832
Encrypted:	false
SSDEEP:	3072:UsquAcc0Iard8OdwDM4ba8oqC+qjysCBIQ+9agdDBqzGmRmuHxK6kgH5T5ECBjo4:Ssb8OdwDMb9P1zQ+9fdDBqzGaIg/Bj
MD5:	358EC1185D4C85450FC1F57942F4E59D
SHA1:	851D38654CA571F40500FEA5801DBEB6FC646E14
SHA-256:	C83456BB6DD8507FBEE5E0C142E465835B03AB315F79D019860CE6861D6271C2
SHA-512:	EBF2B69E5041D3505CD449B17C6B5882065AFE8C929CEE39E5BF02F9ECE1539D01332521DE824229F203EF3DD15BBC6C8E94FFDEFFA06EE6B646609494C3FFFF
Malicious:	false
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"11",. . "macros":[{"function":"__e"},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_auto_events","priority":23,"vtp_enableScroll":false,"vtp_enableOutboundClick":true,"vtp_enableDownload":false,"vtp_enableHistoryEvents":false,"vtp_enableForm":true,"vtp_enableVideo":true,"vtp_enablePageView":true,"tag_id":17},{"function":"__ogt_cross_domain","priority":23,"vtp_rules":["list","avast\\.co\\.jp","avast\\.ua","avast\\.ru"],"tag_id":19},{"function":"__ogt_dma","priority":13,"vtp_delegationMode":"ON","vtp_dmaDefault":"DENIED","tag_id":20},{"function":"__ogt_referral_exclusion","priority":13,"vtp_includeConditions":["list","^avast\\.(com\|ru\|ua\|co\\.jp)$","^ipm\\.avcdn\\.net$"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\mwfmdl2-v3.54[1].woff

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 26288, version 0.0
Category:	dropped
Size (bytes):	26288
Entropy (8bit):	7.984195877171481
Encrypted:	false
SSDEEP:	768:56JqQaQphRbTHiKNF5z/02h5KpJW3pPOA8Y9g/:gdTTH5XKpJWdH1W/
MD5:	D0263DC03BE4C393A90BDA733C57D6DB
SHA1:	8A032B6DEAB53A33234C735133B48518F8643B92
SHA-256:	22B4DF5C33045B645CAFA45B04685F4752E471A2E933BFF5BF14324D87DEEE12
SHA-512:	9511BEF269AE0797ADDF4CD6F2FEC4AD0C4A4E06B3E5BF6138C7678A203022AC4818C7D446D154594504C947DA3061030E82472D2708149C0709B1A070FDD0E3
Malicious:	false
Preview:	wOFF......f........D........................OS/2...X...H...`JM.FVDMX.............^.qcmap..............9cvt ...4... .......fpgm...T.......Y...gasp...D............glyf...P..U5.......head..]....2...6...Chhea..]........$$...hmtx..]..........ye'loca..^............Gmaxp..`.... ... ./..name..`....8....]..Rpost..f........ .Q.wprep..f$........x...x.c`.Pf......:....Q.B3_dHc..`e.bdb... .`@..`......./9.\|...V...)00...-.Wx...S......._..m.m.m.m.m;e..y.~.......<p..a.0t.&...a.pa.0B.1..F...Q.ha.0F.3.....q.xa.0A.0L.&...I.da.0E.2L....i.ta.0C.1..f...Y.la.0G.3.....y.\|a..@X0,.....E.ba.DX2,....e.ra..BX1..V...U.ja..FX3.....u.za..A.0l.6...M.fa.E.2l....m.va..C.1..v...].na..G.3......}.~a.p@80......C.a..pD82.....c.q..pB81..N...S.i..pF83.....s.y..pA.0\.....K.e..pE.2\....k.u..pC.1..n...[.m..pG.3......{.}...@x0<.....G.c...Dx2<....g.s...Bx1..^...W.k...Fx3.....w.{...A.0\|.>...O.g...E.2\|....o.w...C.1..~..._.o..08........?..0$........x...mL.U.............9.x.`[...&BF@X...V.h.Z..h......`n....[..U

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\otBannerSdk[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (65455)
Category:	dropped
Size (bytes):	343588
Entropy (8bit):	5.340863684621744
Encrypted:	false
SSDEEP:	3072:emsbeE0lAMq0uwW6cx2vxbBD0sTpEEH9n81KoyxFNMJJaPAiJ+2UBAv47h9C8:bAMvu/6cx2vxbBDDTrHG1hkMJcb+VBAo
MD5:	656A4FD9013F905080DEBDD038F06B94
SHA1:	6843484EA4BE1A3415EA554BB8B7AAA6E311554A
SHA-256:	0152531ECE5B19AA743208C31FD9F9284282BC97A2EC666DE5CF770A9AEEE0FA
SHA-512:	B88FC90663AB1457ECCB18717AA6B1A9A4F5FB64C0C58A93D4B3DD62D0AC007176571719DB8BD999E679AFFC8F4105E581F983E0ECDF6A94A48B20D7600218F0
Malicious:	false
Preview:	/** . * onetrust-banner-sdk. * v6.33.0. * by OneTrust LLC. * Copyright 2022 . */.!function(){"use strict";var o=function(e,t){return(o=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var o in t)t.hasOwnProperty(o)&&(e[o]=t[o])})(e,t)};var v,e,r=function(){return(r=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function l(s,i,a,l){return new(a=a\|\|Promise)(function(e,t){function o(e){try{r(l.next(e))}catch(e){t(e)}}function n(e){try{r(l.throw(e))}catch(e){t(e)}}function r(t){t.done?e(t.value):new a(function(e){e(t.value)}).then(o,n)}r((l=l.apply(s,i\|\|[])).next())})}function h(o,n){var r,s,i,e,a={label:0,sent:function(){if(1&i[0])throw i[1];return i[1]},trys:[],ops:[]};return e={next:t(0),throw:t(1),return:t(2)},"function"==typeof Symbol&&(e[Symbol.iterator]=function(){return this}),e;function t(t){

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\otCommonStyles[1].css

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (11123)
Category:	dropped
Size (bytes):	21595
Entropy (8bit):	4.996635198401547
Encrypted:	false
SSDEEP:	192:LIsia0zYw49vRn4l7cWQjRkmSxoVGD/4OIZZTg8l9Qonnq3WwmpUkG4HfeXiPcB7:HRc7fQZNGoFQlC2cXaivSYBQY2YpuMc
MD5:	487143B593B69C366E88F0D6F37A7521
SHA1:	24C38C758BD6EC62B838E5E9FB4A3D7A9E2ACB17
SHA-256:	8EDBD08B9BB87F815AD871E44AAE03AF609FC44B1961D608E94EFF3F4E010375
SHA-512:	531294B797609050BBA3CB476A478E653D177BC09643C1E4C78CA38AD6401F1C6646F727D73A612C6A2CDA2086D5E33D8118AFE97FB1459FFBF42AD748DC4D76
Malicious:	false
Preview:	#onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onetrust-vendors-list-handler:hover{color:#1f96db}#onetrust-banner-sdk:focus{outline:2px solid #000;outline-offset:-2px}#onetrust-banner-sdk a:focus{outline:2px solid #000}#onetrust-banner-sdk #onetrust-accept-btn-handler,#onetrust-banner-sdk #onetrust-reject-all-handler,#onetrust-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-image:url("data:image/svg+xml;base64,PHN2ZyB2ZXJzaW9uPSIxLjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHg9IjBweCIgeT0iMHB4IiB3aWR0aD0iMzQ4LjMzM3B4IiBoZWlnaHQ9IjM0OC4zMzNweCIgdmlld0JveD0iMCAwIDM0OC4zMzMgMzQ4LjMzNCIgc3R5bGU9ImVuYWJsZS1iYWNrZ3

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\otPcPanel[1].json

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	49150
Entropy (8bit):	5.523809476276692
Encrypted:	false
SSDEEP:	384:sXusESRaiLBhTbSsEFL/Rvqu41wFQrpagwXt7bRApQoe/4TfCS3HH2Orv5ZKibT0:s+tbcBZj1paRZlzoj7HHfP4F
MD5:	CD46DA23147D575E2E1C368FF7432446
SHA1:	763FB3A733E8A5A721B2CCB6867B4E7E224D8D5F
SHA-256:	AE45F042DB0F3B2D2FFE2BC7F5193A9713B4095048EFE83EB847FD8E0FF70920
SHA-512:	9C7B442B7E4C589DA28F9DEEAE61AAC3EC70AC853696032FB6DBF9B3AA9D9DF11176EEF67AB9B6516D3C9BC870C301F806103CEF29F94C6BBF74DEF6099AE27E
Malicious:	false
Preview:	. {. "name": "otPcPanel",. "html": "PGRpdiBpZD0ib25ldHJ1c3QtcGMtc2RrIiBjbGFzcz0ib3RQY1BhbmVsIG90LWhpZGUgb3QtZmFkZS1pbiIgcm9sZT0iYWxlcnRkaWFsb2ciIGFyaWEtbW9kYWw9InRydWUiIGFyaWEtZGVzY3JpYmVkYnk9Im90LXBjLWRlc2MiPjwhLS0gUEMgSGVhZGVyIC0tPjxkaXYgY2xhc3M9Im90LXBjLWhlYWRlciI+PGRpdiBjbGFzcz0ib3QtcGMtbG9nbyIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJDb21wYW55IExvZ28iPjwvZGl2PjxidXR0b24gaWQ9ImNsb3NlLXBjLWJ0bi1oYW5kbGVyIiBjbGFzcz0ib3QtY2xvc2UtaWNvbiIgYXJpYS1sYWJlbD0iQ2xvc2UiPjwvYnV0dG9uPjwvZGl2PjxkaXYgaWQ9Im90LXBjLWNvbnRlbnQiIGNsYXNzPSJvdC1wYy1zY3JvbGxiYXIiPjxoMiBpZD0ib3QtcGMtdGl0bGUiPllvdXIgUHJpdmFjeTwvaDI+PGRpdiBpZD0ib3QtcGMtZGVzYyI+PC9kaXY+PGJ1dHRvbiBpZD0iYWNjZXB0LXJlY29tbWVuZGVkLWJ0bi1oYW5kbGVyIj5BY2NlcHQgQWxsPC9idXR0b24+PHNlY3Rpb24gY2xhc3M9Im90LXNkay1yb3cgb3QtY2F0LWdycCI+PGgzIGlkPSJvdC1jYXRlZ29yeS10aXRsZSI+TWFuYWdlIENvb2tpZSBQcmVmZXJlbmNlczwvaDM+PGRpdiBjbGFzcz0ib3QtcGxpLWhkciI+PHNwYW4gY2xhc3M9Im90LWxpLXRpdGxlIj5Db25zZW50PC9zcGFuPiA8c3BhbiBjbGFzcz0ib3QtbGktdGl0bGUiPkxlZ2l0LiB

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\otSDKStub[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (21229)
Category:	dropped
Size (bytes):	21230
Entropy (8bit):	5.30756918853866
Encrypted:	false
SSDEEP:	384:TRFZ2wWtdbD5ABwXwLrekrff8eTr+x5RxMcfn9LuJ4vV/:T8wAD5ABwXw+krfflyxzxnn9D/
MD5:	F38B4B593FF524527F3B9A6DD5662FB2
SHA1:	47A807B00876E7096EDC668A82F6A270DE6DECCB
SHA-256:	FDFEA52427FB822BEBDD32B325768E73B40637BD203C100827D4DECE88E431C3
SHA-512:	60FF43642E4648492E4AF94C0A6DCBB6C203D13E45F92157C34B89B9DA49D8F2734CAD61A3FCEAE186701911047AFB8672CB32A1E582160A0E758FAFA64B1C4B
Malicious:	false
Preview:	var OneTrustStub=function(t){"use strict";var a,o,p=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.vendorsServiceData=[],this.IABCookieValue="",this.oneTrustIABCookieName="eupubconsent",this.oneTrustIsIABCrossConsentEnableParam="isIABGlobal",this.isStubReady=!0,this.geolocationCookiesParam="geolocation",this.EUCOUNTRIES=["BE","BG","CZ","DK","DE","EE","IE","GR","ES","FR","IT","CY","LV","LT","LU","HU","MT","NL","AT","PL","PT","RO","SI","SK","FI","SE","GB","HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]]",this.migratedDomainId="[[NewDomainId]]",this.userLocation={country:"",state:""}};(m=g=g\|\|{})[m.Days=1]="Days",m[m.Weeks=7]="Weeks",m[m.Months=30]="Months",m[m.Years=365]="Years",(m=i=i\|\|{}).Name="OTGPPConsent",m[m.ChunkSize=4e3]="ChunkSize

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\prodico-32_cleanup-premium_white[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	920
Entropy (8bit):	4.527724704590433
Encrypted:	false
SSDEEP:	24:tzkumufVNUTJeFDNgkqgS2d9auZ2NccLe6uXsTYhll7:Eu+EgPgS2dEuZ2ucLe6uXj
MD5:	7E10871E86B329BEA808518CFA6B01A4
SHA1:	F6863681EABFED7D7157AA771126D6E2FF86E058
SHA-256:	98078A8C5CEC64A268E3E09A99A8FD0C5220050EDB2B55E8DF3D8CD2D3244230
SHA-512:	D058EC0BD1E4671C3A1DAFF92E7E98F1B6375F14B065FE0FE1E0D4F2FC5A1B81C31AA94B6D7F6FAB7415278759AFDCD009B706A8401CC7006BDEBB18AE7EE22A
Malicious:	false
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M23.843 22.088v5.387m-2.67-2.694h5.34M7.416 22.025l-2.192 2.178m7.632-1.235l3.079-1.416a59.386 59.386 0 001.987-.952m-5.066 2.368l1.82 4.217a.48.48 0 00.781.149l1.787-1.793a2.4 2.4 0 00.7-1.71l-.022-3.231m-5.066 2.368l-4.064-3.94m1.088 5.337l-.917.897m2.299-11.253a78.004 78.004 0 00-1.008 2.003m1.008-2.003l-1.008 2.003m1.008-2.003l-3.366.023a2.4 2.4 0 00-1.683.706L4.424 16.53a.48.48 0 00.16.784l4.208 1.713m2.47-5.02c1.25-2.598 2.77-5.367 5.375-6.794 2.713-1.485 6.01-2.134 9.098-1.8.34.037.613.3.658.64.408 3.046-.235 6.35-1.724 9.016-1.46 2.613-4.19 4.163-6.747 5.53m-7.668-4.588l-1.462 3.016m2.262-3.816l5.68 5.54m.9-10.178c.978-.983 2.637-1.02 3.623-.025a2.58 2.58 0 01.025 3.582c-.97.973-2.642.984-3.624.026-.96-.967-.948-2.593-.025-3.583z" stroke="#FFF" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\prodico-32_secure-browser-pro-color[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	12372
Entropy (8bit):	5.0485583079357355
Encrypted:	false
SSDEEP:	192:eLDZ4zrvjOPxhCf+hnp6+hukN3W8qLpBVh1LzPgwAJe1C5J7BQGz7PIPeETmA1Na:ePZwrvKphCOpNqL31Lz+ZKWL8baCA
MD5:	15C1BE962685D0633C97480DB5356965
SHA1:	CCD6C24766330632EAFD181E65DDFD9B06CEAFC8
SHA-256:	2443673ACEB4E09F5EEC4DA7081D1C461EA0EFDEA4AEEDFE0429C2111DFB177B
SHA-512:	5B0DA7F0C2D173BEEE9704D5571D9A350CE69FC32D7D446A51F7B36A2A6616461BD189EE62CCFD45A91F3D750CD0264C4D9EDE8ECBBD6557985B5D8713E0EF76
Malicious:	false
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><ellipse cx="15.998" cy="15.997" rx="11.799" ry="11.797" fill="#fff"/><path fill-rule="evenodd" clip-rule="evenodd" d="M15.946 23.642c-1.726-.835-3.145-1.93-4.224-3.255a10.893 10.893 0 01-2-3.814 11.998 11.998 0 01-.466-4.207c2.403-1.677 4.678-2.064 5.841-2.145h.017c.402-.032.682-.032.786-.032h.093c.104 0 .385.002.786.032h.023c1.162.082 3.435.47 5.836 2.145a11.936 11.936 0 01-.454 4.155 10.898 10.898 0 01-1.993 3.839c-1.081 1.337-2.51 2.44-4.245 3.282zm-.126-10.156a1.86 1.86 0 00-1.72 1.673v-.002a1.857 1.857 0 001.127 1.888v2.105c0 .142.114.256.255.256h.949a.256.256 0 00.256-.255v-2.103a1.86 1.86 0 00-.867-3.562z" fill="#fff"/><path fill-rule="evenodd" clip-rule="evenodd" d="M15.932 24.732c-4.506-2.097-7.713-6.552-7.636-11.792.005-.41.032-.815.08-1.22v-.035a12.843 12.843 0 0115.197.014c.047.467.07.937.066 1.408-.042 5.213-3.265 9.618-7.707 11.625zm-.835-14.512c-1.163.08-3.438.468-5.841 2.144-.095 1.42.063 2.845.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\prodico-48_avast-one[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	867
Entropy (8bit):	4.395189357450415
Encrypted:	false
SSDEEP:	24:tCbaAuZO8ZOgjK09Z495uBLVinl7No3nsI0GQojT:qSKnu9QnlZoXs+
MD5:	ED56E52B9F307F94D335F07974573E29
SHA1:	2002123C50B58613C70A61A0ECCFD7CC1075BE85
SHA-256:	A969EDB7AB6180D3DB1C9461324C336093D1D5B5AD5B4B4428DA8BCF41031BF6
SHA-512:	4D82E53DCBCE3A3559A6B1F5C0AE74914EC336BB6DAA24313C864A67DDF48B2B3110906AA03368E0CAA9272C20630F213599400150D28EEAD44B84A3953BB225
Malicious:	false
Preview:	<svg width="48" height="48" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M39.594 35.197c0-10.257-.906-28.711-15.294-28.897C10.38 6.12 7.38 24.694 8.354 35.122a19.415 19.415 0 001.842 2.218c3.46 3.58 13.67 3.16 13.67 3.16s11.402.011 14.952-4.293c.269-.327.528-.663.776-1.01z" fill="#fff"/><path d="M21.27 9.585a4.846 4.846 0 017.12 1.926L39.594 35.2a19.1 19.1 0 003.605-11.062c.076-10.607-8.46-19.263-19.065-19.338C13.53 4.726 4.873 13.262 4.8 23.867a19.097 19.097 0 003.554 11.255l.45-.098 7.311-1.613c.206-.046.315.233.135.34l-6.054 3.589a19.13 19.13 0 0013.67 5.86c6.016.042 11.402-2.689 14.952-6.993l-18.323-19.29a4.844 4.844 0 01.776-7.332zm3.44 21.774l-11.797 1.023a2.083 2.083 0 11.297-4.105l11.526 2.715c.206.05.183.347-.027.367zm-5.461-10.374l14.304 11.572c.163.132.016.391-.182.316l-17.206-6.52a3.135 3.135 0 113.084-5.368z" fill="#FF7800"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\product-icon-32x32-smb-home-office_white[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	368
Entropy (8bit):	4.880816344429822
Encrypted:	false
SSDEEP:	6:tnr/kumc4slmFU3jSSpDXlFUXFW9qMHpF2JGcTcW69jI6Ymq8:tr/kuIFUTSYL+MhJSGE6B9YU
MD5:	295D7E3E94320E81A0420D0151AA372E
SHA1:	F3C0537B08EFA4D6EFECAE6FAC5D2B82C57794B2
SHA-256:	C4618A8390B9D1910CFF91745B34EE142E8561F59C73E046E5CA544E66CB8DD8
SHA-512:	C8AE413A749AC2CC0C549F89063D662663F3926B150641D60F181CD98A33AA784AF9762E89E95E2F06684827238330941BAAD30A06087FB5933A68CFCF0BA93F
Malicious:	false
Preview:	<svg width="32" height="32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M24.384 16.541v6.636a1.57 1.57 0 01-1.57 1.57h-4.672v-5.634a1.02 1.02 0 00-1.02-1.02h-2.245a1.02 1.02 0 00-1.02 1.02v5.633H9.186a1.57 1.57 0 01-1.57-1.57v-6.635M5.8 14.64l8.235-8.235a2.746 2.746 0 013.884 0l8.281 8.282" stroke="#FFF" stroke-width="1.2" stroke-linecap="square"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\vue-pricebox[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Unicode text, UTF-8 text, with very long lines (13543)
Category:	dropped
Size (bytes):	13590
Entropy (8bit):	5.2647129218029605
Encrypted:	false
SSDEEP:	192:4xOBNiY/jsMeM+imw8FoPQV+X6CAiXCy22XC44HdLKMUVUqXkYIneDIt1hIkOxMO:OOBHVeM+Tws6R7w7UVLkYIK2hB9O
MD5:	B849D78EB1FA93BBE0FA8E19E8FA4DDE
SHA1:	764C387C8B98FA969239B73FB05FBB14C2C4B40A
SHA-256:	B0CC5214E6F10F306791562D3A3B7230A27920466705F34F95E671CC00C7187D
SHA-512:	4228101476598C7DC96518880E43DB11D01808394240CDE82CF93353C252F19AD3503FCAA13B9451A8D7FFAB25B38BA347394ADE33B6560F11196C61A3466CC7
Malicious:	false
Preview:	!function(){"use strict";function a(a,b){return a>1\|\|!0===b?"multi":1==a?"single":"trial"}function b(a){return"M"!=a.priceFlag&&1!=a.maintenance}function c(a,b){var c=!1;return Object.keys(a.options).forEach(function(d,e){"platform"in a.options[d]&&b.toUpperCase()===a.options[d].platform.toUpperCase()&&(c=e)}),c}function d(a){var b=null!==a?a.getAttribute("data-target"):null,c=null!==a?a.getAttribute("data-period"):null;null!==a&&null!==b&&(a.addEventListener("click",function(){e(b,c)}),a.addEventListener("keypress",function(a){13===a.charCode&&e(b,c)}))}function e(a,b){var c=null!==b&&""!==b?"-"+b:"",d=a+c;if(null===document.getElementById(d)){var e=document.querySelector(".content-holder"),f=new XMLHttpRequest;f.onreadystatechange=function(){if(4==this.readyState&&200==this.status){var a=document.createElement("div");a.innerHTML=this.responseText,e.append(a);new BSN.Modal(document.getElementById(d)).show()}},f.open("GET","https://"+avastGlobals.web.domain+avastGlobals.web.ulocale+"/p

C:\Users\user\AppData\Local\Temp\JavaDeployReg.log

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	267
Entropy (8bit):	4.603712106571068
Encrypted:	false
SSDEEP:	6:o9p1cfm4q51cfHb6mD1cfDLUEHq51cfDLnmD1cf6BFq9q51cf6BFgv:oz1kq51WbXD1OHq515D1rBFq9q51rBFq
MD5:	87C698BE3A79E64F5EF7A89024DECB95
SHA1:	D12BD6F7476577E6910B2B46B99FF9AD44F0F5A0
SHA-256:	5AA4999687D9E637635E7EF0B272C44688B616D5B293DC609C7376352FFDBB8B
SHA-512:	8628135EA59672EB7C512DF18FA809717F2F81A29F5336D5B1D6EA553C5FBC6001010FC1386B6236E109981EFB013AB35336FDF2209A5D02E4DE5120CD16E1E3
Malicious:	false
Preview:	[2024/05/29 09:24:52.609] Latest deploy version: ..[2024/05/29 09:24:52.624] 11.381.2 ..[2024/05/29 09:25:41.796] Latest deploy version: ..[2024/05/29 09:25:41.796] 11.381.2 ..[2024/05/29 09:26:07.188] Latest deploy version: ..[2024/05/29 09:26:07.188] 11.381.2 ..

C:\Users\user\AppData\Local\Temp\~DF06120327B71E3A87.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08218886695036304
Encrypted:	false
SSDEEP:	3:4UbUf/57vf/SpTlKlclllv/nt+lybltll1lRsltFll2/lsllmvf/czUbUf/0:l8Ju4UFAl3+ts2rb8
MD5:	0DAAFC81C57E593044ABA119D8826A53
SHA1:	EC795031AF0C41D03A15EBF9F355C8D3D068E9E2
SHA-256:	78F9EC3C90117B91363D91610DFE8975C97CEF357BA7E3D7788D82738A85105D
SHA-512:	A9373D47378CC1FE5ECB8C391B324F0420564EB2560BEF44F71FAA16D6661614047E7CD7D8B95AD5F14C9240824FC29E589936EFC8806D315745E2DD04713953
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF5DFE7FF8AF9B912B.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08196855197999946
Encrypted:	false
SSDEEP:	3:Nvpx/RUpx/l0lKlclllv/nt+lybltll1lRsltFll2/lsllebUpx/cFL0px/0:NX58t04UFAl3+tsM8kc
MD5:	1CF291B534E7E48B93EEE44AEA6C4E94
SHA1:	BA80069D74ECB908FAC78AEB0383388A405F9344
SHA-256:	2A59ADF3CEBE3B7E1E5414D02257C0B1B0D14041CB46ECAD2B4A6A98AD871FC1
SHA-512:	85AE206DD89E287E30F7456DDB83A17F8459907D67EF50332B8142ED346580B9355347452F63D87DE7CC46E4DA5F3EDEF2307193DD5B20BE9AC513CD52E4B2A0
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF707D442F429D0F01.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.22980907452753305
Encrypted:	false
SSDEEP:	12:i9lgatz0tKGYJh9pfIGP5jUy2+1l7AKso4IpA6kfF:i9lx8KGYJh9pBNUyv7AypA66
MD5:	22E1C17264054554D4F29A0591CD6158
SHA1:	E0F0FB54166E13FC2027CFCD34ADED765751C470
SHA-256:	E7317ED2B72FDE9D0CD3F56F44E4D8C526200D17D4245B9E28FA803EF0B716FD
SHA-512:	7214AF7DBD2F12713F5976DA4B5D59DD64992AD132963ED4C7062B06E4758B70FDFFF582A59617201186A42F0AF4505448B4166E3DC1CF3EF05823AD120EB6A3
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF7E5F63EA0AEB030A.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07874084060851289
Encrypted:	false
SSDEEP:	3:mHc/MrzKc/O2muU0lKlclllv/nt+lybltll1lRsltFll2/lsllm8/cqlzX/0:ycgzKcmBo4UFAl3+tsXnx
MD5:	1000D3A35AB75C593305DA0F244458E4
SHA1:	9467999C6B1A716001820AB1BA6469A05D7E9590
SHA-256:	DCB3CABCBBC5F818B78BDBE9BAE9597024EC5744504AE9344757EC5B17E3D6DF
SHA-512:	C3EEE15A3C4A18A515D75DB42FAE987B30DD2D6A3FEB4746BFF580AA0B357819909CFCCABE62F8F5AE79D587C8A0B14ED2839C0C6A9A9A52B6F01D4E2550938A
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF9858259E5405C374.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.22667008912956776
Encrypted:	false
SSDEEP:	12:i9loat70thTtL/J3fSppD3/8pwXdy2cRI12cIsd:i9lR8hTtL/J3aD/fLcRIjp
MD5:	912E843D05CC0C55AFB2AD926C672DE5
SHA1:	E7A19DD28687EACD23FD67A68AEAE651D2112677
SHA-256:	0BF25CC584813833B0A3F68543AADFC67E8557C21EF88F66C0FB7B44AD872C68
SHA-512:	36AB8460E4145BBF518AE4624E81E6E5575385A0609987710F1A6B24E46B2D225D028E79798FFF913AF81AF85D3415D597B581408491767929EC726C035F7525
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFCC81CF64609DEC31.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.22885284407988063
Encrypted:	false
SSDEEP:	12:i9lsatP0tFiDYJhflXUMd6ejlTlr3YNtIU5UBwtllKlCTQFAncAYIF:i9lx8FiDYJZlEqZTlUgUuwVYEd
MD5:	DDFD41F5C334D0EB6C4E04A401363F34
SHA1:	BF5D8D5492F9E87FFD952EEDA5FA6AEF36A174FD
SHA-256:	969C1AEDA97091A1FCA818E2BCC4F868655696D380D3802A412880A0C6DCFC14
SHA-512:	ECC5A7169F4B73EE2A5281C4EA2E68FBB07E97DBBA1D58E80F65847ADE5EB8A1FFC4D7ED4E58AD6FA1EFDB59A0102BFF702EAB1CB0BA4E17CCEDD4B74E040541
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.516225279133127
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	94.exe
File size:	295'656 bytes
MD5:	35eb15db22e26d961d4151afeedbe67a
SHA1:	754923d156367f31bdd67a990c36d517f54f8c95
SHA256:	94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f
SHA512:	11e036654d7361ed7ce94529569faaac196a647316509618f400f2819a45b09d2e0c35f34bb3e7356c6f747d9297671177c4439664de631d540ffe3fc29d0bc2
SSDEEP:	6144:5QCAmQFgNUpGijhKHGke/TaHUMhn0RM6BfKuTtmaJepw9Eg9o6r:uCAmQFgqRhKM/ninLgfKuTkkXEg9oQ
TLSH:	A654AF10B7A1C039F2B71AFC887983A8A939BD606B3495CB62D61BDF5A356D0DC30357
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[................._.5.....j.......^.}.....g.........L.....[.......n.......i.....Rich............................PE..L......O...

File Icon


Icon Hash:	7d72f0f8f8f87825

Static PE Info

General

Entrypoint:	0x401bf0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x4FE984DA [Tue Jun 26 09:46:02 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	490dfe30d42daec698df74fe55d868c5

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Google LLC
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	17/06/2019 14:45:58 31/12/2039 23:59:59
Subject Chain	CN=Google LLC
Version:	3
Thumbprint MD5:	583B4DD23A03C1E6A3EDA560F90DCC5E
Thumbprint SHA-1:	AB81D9C4F2373C4CFAF2D85A9C58C830CC591D8D
Thumbprint SHA-256:	E02077505209F31286852F80C66E10562880C02CEE8B0ACF52F6EE5C46682E3B
Serial:	D75244BBEE5BE1BB492B37BA146CBBF1

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007F154592B1EBh
call 00007F154592ADE6h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 00433F20h
push 00406060h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF98h
push ebx
push esi
push edi
mov eax, dword ptr [00435004h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0042D018h]
cmp dword ptr [0045025Ch], 00000000h
jne 00007F154592ADE0h
push 00000000h
push 00000000h
push 00000001h
push 00000000h
call dword ptr [0042D014h]
call 00007F154592AF63h
mov dword ptr [ebp-6Ch], eax
call 00007F154592F17Bh
test eax, eax
jne 00007F154592ADDCh
push 0000001Ch
call 00007F154592AF20h
add esp, 04h
call 00007F154592EAD8h
test eax, eax
jne 00007F154592ADDCh
push 00000010h
call 00007F154592AF0Dh
add esp, 04h
push 00000001h
call 00007F154592EA23h
add esp, 04h
call 00007F154592C6BBh
mov dword ptr [ebp-04h], 00000000h
call 00007F154592C29Fh
test eax, eax

Rich Headers

Programming Language:

[C++] VS2010 SP1 build 40219
[ASM] VS2010 SP1 build 40219
[ C ] VS2010 SP1 build 40219
[IMP] VS2008 SP1 build 30729
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3452c	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x51000	0x9e30	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x47400	0xee8	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5b000	0x181c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2d170	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x33d88	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2d000	0x124	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2b690	0x2b800	05598c405630098eec780db6573f8ac2	False	0.642157192887931	data	6.636147279912775	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2d000	0x7bce	0x7c00	1f0f4da4289c57ae1bfd712bcfe55607	False	0.29353578629032256	data	4.687921824376147	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x35000	0x1b260	0x6a00	11caf64cdbe83ca4f4bf99cad97dbe4d	False	0.7372862617924528	Matlab v4 mat-file (little endian) \200, sparse, rows 3141592654, columns 1153374641	6.346126719441471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x51000	0x9e30	0xa000	70d6c9c3dde9879e48d1dd33d113cdd5	False	0.458837890625	data	5.744735045146541	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5b000	0x3098	0x3200	2a18581e235ce5ff0245c7175788d5b8	False	0.40484375	data	4.148811306484194	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x52778	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.3977916863486065
RT_ICON	0x569a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5597510373443984
RT_ICON	0x58f48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5970919324577861
RT_ICON	0x59ff0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.7065573770491803
RT_ICON	0x5a978	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.774822695035461
RT_DIALOG	0x517e0	0xe0	data	English	United States	0.6428571428571429
RT_DIALOG	0x518c0	0x122	data	English	United States	0.5758620689655173
RT_DIALOG	0x519e8	0xc2	dBase III DBT, next free block index 4294901761	English	United States	0.654639175257732
RT_DIALOG	0x51ab0	0xea	data	English	United States	0.6153846153846154
RT_DIALOG	0x51ba0	0x10e	data	English	United States	0.6259259259259259
RT_DIALOG	0x51cb0	0xf4	data	English	United States	0.610655737704918
RT_DIALOG	0x51da8	0xd2	data	English	United States	0.6619047619047619
RT_DIALOG	0x51e80	0x142	data	English	United States	0.5683229813664596
RT_DIALOG	0x51fc8	0x146	data	English	United States	0.558282208588957
RT_DIALOG	0x52110	0xb4	data	English	United States	0.6611111111111111
RT_DIALOG	0x521c8	0x134	data	English	United States	0.564935064935065
RT_DIALOG	0x52300	0x104	data	English	United States	0.5884615384615385
RT_DIALOG	0x52408	0xfa	data	English	United States	0.608
RT_DIALOG	0x52508	0xee	data	English	United States	0.6092436974789915
RT_GROUP_ICON	0x5ade0	0x4c	data	English	United States	0.8026315789473685
RT_VERSION	0x514b0	0x32c	data	English	United States	0.4642857142857143
RT_MANIFEST	0x525f8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

WaitForSingleObject, GetEnvironmentVariableA, GetSystemInfo, VirtualProtect, GetCommandLineA, HeapSetInformation, GetStartupInfoW, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, InterlockedIncrement, InterlockedDecrement, DecodePointer, GetProcAddress, GetModuleHandleW, ExitProcess, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, HeapValidate, IsBadReadPtr, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, GetLastError, HeapCreate, GetModuleFileNameW, WriteFile, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, EnterCriticalSection, LeaveCriticalSection, LoadLibraryW, HeapAlloc, HeapReAlloc, HeapSize, HeapQueryInformation, HeapFree, RtlUnwind, LCMapStringW, MultiByteToWideChar, GetStringTypeW, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, IsProcessorFeaturePresent, SetFilePointer, GetConsoleCP, GetConsoleMode, RaiseException, SetStdHandle, CreateFileW, CloseHandle, FlushFileBuffers

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/29/24-15:25:42.506906	TCP	2033204	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)	49745	80	192.168.2.9	20.76.201.171
05/29/24-15:24:55.552631	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49713	80	192.168.2.9	20.76.201.171
05/29/24-15:26:08.600920	TCP	2831963	ETPRO TROJAN Ursnif Variant CnC Beacon 8 M2	49755	80	192.168.2.9	23.201.254.50
05/29/24-15:26:07.873198	TCP	2831963	ETPRO TROJAN Ursnif Variant CnC Beacon 8 M2	49753	80	192.168.2.9	104.122.38.56
05/29/24-15:26:08.600920	TCP	2831962	ETPRO TROJAN Ursnif Variant CnC Beacon 8 M1	49755	80	192.168.2.9	23.201.254.50
05/29/24-15:26:08.600920	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49755	80	192.168.2.9	23.201.254.50
05/29/24-15:26:07.873198	TCP	2831962	ETPRO TROJAN Ursnif Variant CnC Beacon 8 M1	49753	80	192.168.2.9	104.122.38.56
05/29/24-15:26:07.873198	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49753	80	192.168.2.9	104.122.38.56
05/29/24-15:25:42.506906	TCP	2831963	ETPRO TROJAN Ursnif Variant CnC Beacon 8 M2	49745	80	192.168.2.9	20.76.201.171
05/29/24-15:24:55.552631	TCP	2831962	ETPRO TROJAN Ursnif Variant CnC Beacon 8 M1	49713	80	192.168.2.9	20.76.201.171
05/29/24-15:25:42.506906	TCP	2831962	ETPRO TROJAN Ursnif Variant CnC Beacon 8 M1	49745	80	192.168.2.9	20.76.201.171

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 29, 2024 15:24:58.065535069 CEST	49722	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.065561056 CEST	443	49722	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.065669060 CEST	49722	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.065875053 CEST	49723	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.065897942 CEST	443	49723	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.065913916 CEST	49722	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.065924883 CEST	443	49722	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.066070080 CEST	49723	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.066137075 CEST	49723	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.066143990 CEST	443	49723	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.147264004 CEST	49726	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.147316933 CEST	443	49726	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.147423029 CEST	49726	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.147452116 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.147466898 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.147516966 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.147859097 CEST	49726	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.147865057 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.147874117 CEST	443	49726	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.147876024 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.169287920 CEST	443	49726	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.169580936 CEST	49726	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.169805050 CEST	49726	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.169833899 CEST	443	49726	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.170209885 CEST	49730	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.170217037 CEST	443	49730	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.170294046 CEST	49730	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.170519114 CEST	49730	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.170528889 CEST	443	49730	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.191936970 CEST	443	49730	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.192012072 CEST	49730	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.192038059 CEST	49730	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.192042112 CEST	443	49730	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.192300081 CEST	49735	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.192307949 CEST	443	49735	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.192363024 CEST	49735	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.192409039 CEST	49735	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.192444086 CEST	443	49735	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.192538023 CEST	49735	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.730648041 CEST	443	49723	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.730794907 CEST	49723	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.735136986 CEST	49723	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.735143900 CEST	443	49723	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.735678911 CEST	49723	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.735691071 CEST	443	49723	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.735707998 CEST	443	49723	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.735780001 CEST	49723	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.748198986 CEST	443	49722	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.748291016 CEST	49722	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.751300097 CEST	49722	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.751307011 CEST	443	49722	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.751682997 CEST	443	49722	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.751745939 CEST	49722	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.815327883 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.815423965 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.818593025 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.818602085 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.818734884 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.818741083 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.818933964 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.818988085 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.846134901 CEST	443	49723	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.846157074 CEST	443	49723	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.846172094 CEST	443	49723	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.846297026 CEST	49723	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.846297979 CEST	49723	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.846311092 CEST	443	49723	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.846374989 CEST	49723	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.931097031 CEST	443	49723	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.931114912 CEST	443	49723	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.931186914 CEST	49723	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.931195974 CEST	443	49723	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.932503939 CEST	49723	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.932641983 CEST	443	49723	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.932656050 CEST	443	49723	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.932727098 CEST	49723	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.932729959 CEST	443	49723	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.932774067 CEST	49723	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.932795048 CEST	443	49723	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.932848930 CEST	49723	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.932859898 CEST	443	49723	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.932879925 CEST	443	49723	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.932950974 CEST	49723	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.933800936 CEST	49723	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.933800936 CEST	49723	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.933800936 CEST	49723	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.942651033 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.942719936 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.942723989 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.942754030 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.942780972 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.942795038 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.942795038 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.942819118 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:58.942847967 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:58.942879915 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.028264046 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.028299093 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.028348923 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.028361082 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.028376102 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.028404951 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.029764891 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.029784918 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.029827118 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.029831886 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.029864073 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.029877901 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.117408991 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.117461920 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.117479086 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.117499113 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.117505074 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.117543936 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.117566109 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.118633986 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.118683100 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.118704081 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.118709087 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.118737936 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.118760109 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.119462967 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.119505882 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.119591951 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.119606018 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.119647980 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.121006012 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.121052980 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.121093988 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.121107101 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.121119022 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.121154070 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.207305908 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.207351923 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.207391024 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.207401991 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.207429886 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.207448006 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.207927942 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.207973957 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.207993984 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.207998991 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.208029032 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.208046913 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.208895922 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.208942890 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.208961964 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.208966017 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.208996058 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.209018946 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.209579945 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.209626913 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.209649086 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.209654093 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.209685087 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.209702969 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.209749937 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.209810019 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.209814072 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.209855080 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.209897995 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.209918022 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:24:59.209922075 CEST	443	49727	13.107.246.45	192.168.2.9
May 29, 2024 15:24:59.209944963 CEST	49727	443	192.168.2.9	13.107.246.45
May 29, 2024 15:25:01.336138964 CEST	49722	443	192.168.2.9	13.107.246.45
May 29, 2024 15:26:07.867912054 CEST	49754	80	192.168.2.9	104.122.38.56
May 29, 2024 15:26:07.867964983 CEST	49753	80	192.168.2.9	104.122.38.56
May 29, 2024 15:26:07.872958899 CEST	80	49754	104.122.38.56	192.168.2.9
May 29, 2024 15:26:07.872977018 CEST	80	49753	104.122.38.56	192.168.2.9
May 29, 2024 15:26:07.873050928 CEST	49754	80	192.168.2.9	104.122.38.56
May 29, 2024 15:26:07.873075962 CEST	49753	80	192.168.2.9	104.122.38.56
May 29, 2024 15:26:07.873198032 CEST	49753	80	192.168.2.9	104.122.38.56
May 29, 2024 15:26:07.878071070 CEST	80	49753	104.122.38.56	192.168.2.9
May 29, 2024 15:26:08.572679996 CEST	80	49753	104.122.38.56	192.168.2.9
May 29, 2024 15:26:08.572788000 CEST	49753	80	192.168.2.9	104.122.38.56
May 29, 2024 15:26:10.261832952 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.261882067 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.261940002 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.262785912 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.262824059 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.262885094 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.263729095 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.263756990 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.264558077 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.264569044 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.740325928 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.740427017 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.744678974 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.744724989 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.744993925 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.745014906 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.745079994 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.745137930 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.748764992 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.748847961 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.752226114 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.752247095 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.752393007 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.752409935 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.752579927 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.752635002 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.874782085 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.874849081 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.874871969 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.874932051 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.874983072 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.874983072 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.875008106 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.875055075 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.875067949 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.875118971 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.875129938 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.875193119 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.875205994 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.875262976 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.875834942 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.875891924 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.875902891 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.875961065 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.875972986 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.876049995 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.879690886 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.879827023 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.879842043 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.879894018 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.884982109 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.885023117 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.885036945 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.885049105 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.885061026 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.885078907 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.885098934 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.885111094 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.885144949 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.885144949 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.885155916 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.885180950 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.885205984 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.885205984 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.885216951 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.885248899 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.885637999 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.885675907 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.885682106 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.885689974 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.885721922 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.963356018 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.963430882 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.963432074 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.963454962 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.963471889 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.963646889 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.963669062 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.963717937 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.963807106 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.963845015 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.963855028 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.963891029 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.964221954 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.964262962 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.964267969 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.964302063 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.964306116 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.964339018 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.964344978 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.964382887 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.964884996 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.964937925 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.964942932 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.964982033 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.964997053 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.965002060 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.965014935 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.965043068 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.965046883 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.965084076 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.965738058 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.965784073 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.965787888 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.965823889 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.965827942 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.965866089 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.965867043 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.965878963 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.965912104 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.965935946 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.965948105 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.965998888 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.966603041 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.966653109 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.977124929 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.977190971 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.977215052 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.977255106 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.977271080 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.977293015 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.977443933 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.977489948 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.977621078 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.977670908 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.977677107 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.977706909 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:10.977710009 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.977746964 CEST	49758	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:10.977755070 CEST	443	49758	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.052151918 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.052229881 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.052257061 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.052284002 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.052321911 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.052321911 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.052361012 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.052372932 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.052376032 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.052402020 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.052421093 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.052449942 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.052505970 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.052520037 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.052565098 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.052917004 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.052975893 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.053030968 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.053085089 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.053097010 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.053152084 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.053843975 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.053905010 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.053993940 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.054055929 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.054066896 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.054122925 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.054135084 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.054156065 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.054189920 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.054215908 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.054253101 CEST	49759	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.054281950 CEST	443	49759	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.090662003 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.090706110 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.090781927 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.090826988 CEST	49769	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.090871096 CEST	443	49769	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.090918064 CEST	49769	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.091139078 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.091151953 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.091306925 CEST	49769	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.091317892 CEST	443	49769	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.555087090 CEST	443	49769	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.556210995 CEST	49769	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.556623936 CEST	49769	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.556633949 CEST	443	49769	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.557105064 CEST	49769	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.557111979 CEST	443	49769	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.559364080 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.559487104 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.559894085 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.559900999 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.624471903 CEST	49777	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:11.624526978 CEST	443	49777	52.49.110.165	192.168.2.9
May 29, 2024 15:26:11.624623060 CEST	49777	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:11.624804974 CEST	49778	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:11.624816895 CEST	443	49778	52.49.110.165	192.168.2.9
May 29, 2024 15:26:11.624865055 CEST	49778	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:11.625305891 CEST	49777	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:11.625330925 CEST	443	49777	52.49.110.165	192.168.2.9
May 29, 2024 15:26:11.625355005 CEST	49778	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:11.625363111 CEST	443	49778	52.49.110.165	192.168.2.9
May 29, 2024 15:26:11.723534107 CEST	443	49769	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.723584890 CEST	443	49769	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.723606110 CEST	443	49769	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.723618984 CEST	49769	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.723630905 CEST	443	49769	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.723649025 CEST	49769	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.723655939 CEST	443	49769	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.723680019 CEST	49769	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.723685026 CEST	443	49769	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.723711014 CEST	49769	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.723736048 CEST	49769	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.723740101 CEST	443	49769	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.723757029 CEST	443	49769	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.723916054 CEST	49769	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.723917007 CEST	49769	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.724751949 CEST	49769	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:11.724771023 CEST	443	49769	104.19.178.52	192.168.2.9
May 29, 2024 15:26:11.743493080 CEST	49781	443	192.168.2.9	172.64.155.119
May 29, 2024 15:26:11.743544102 CEST	443	49781	172.64.155.119	192.168.2.9
May 29, 2024 15:26:11.743561029 CEST	49782	443	192.168.2.9	172.64.155.119
May 29, 2024 15:26:11.743570089 CEST	443	49782	172.64.155.119	192.168.2.9
May 29, 2024 15:26:11.743604898 CEST	49781	443	192.168.2.9	172.64.155.119
May 29, 2024 15:26:11.743647099 CEST	49782	443	192.168.2.9	172.64.155.119
May 29, 2024 15:26:11.744004011 CEST	49781	443	192.168.2.9	172.64.155.119
May 29, 2024 15:26:11.744024038 CEST	443	49781	172.64.155.119	192.168.2.9
May 29, 2024 15:26:11.744051933 CEST	49782	443	192.168.2.9	172.64.155.119
May 29, 2024 15:26:11.744060040 CEST	443	49782	172.64.155.119	192.168.2.9
May 29, 2024 15:26:12.213324070 CEST	443	49782	172.64.155.119	192.168.2.9
May 29, 2024 15:26:12.213396072 CEST	49782	443	192.168.2.9	172.64.155.119
May 29, 2024 15:26:12.217067957 CEST	49782	443	192.168.2.9	172.64.155.119
May 29, 2024 15:26:12.217080116 CEST	443	49782	172.64.155.119	192.168.2.9
May 29, 2024 15:26:12.217250109 CEST	49782	443	192.168.2.9	172.64.155.119
May 29, 2024 15:26:12.217258930 CEST	443	49782	172.64.155.119	192.168.2.9
May 29, 2024 15:26:12.217377901 CEST	443	49782	172.64.155.119	192.168.2.9
May 29, 2024 15:26:12.217437029 CEST	49782	443	192.168.2.9	172.64.155.119
May 29, 2024 15:26:12.225349903 CEST	443	49781	172.64.155.119	192.168.2.9
May 29, 2024 15:26:12.225413084 CEST	49781	443	192.168.2.9	172.64.155.119
May 29, 2024 15:26:12.228468895 CEST	49781	443	192.168.2.9	172.64.155.119
May 29, 2024 15:26:12.228476048 CEST	443	49781	172.64.155.119	192.168.2.9
May 29, 2024 15:26:12.228724957 CEST	443	49781	172.64.155.119	192.168.2.9
May 29, 2024 15:26:12.228773117 CEST	49781	443	192.168.2.9	172.64.155.119
May 29, 2024 15:26:12.263108969 CEST	443	49778	52.49.110.165	192.168.2.9
May 29, 2024 15:26:12.263179064 CEST	49778	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:12.266913891 CEST	49778	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:12.266922951 CEST	443	49778	52.49.110.165	192.168.2.9
May 29, 2024 15:26:12.267091036 CEST	49778	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:12.267102003 CEST	443	49778	52.49.110.165	192.168.2.9
May 29, 2024 15:26:12.267178059 CEST	443	49778	52.49.110.165	192.168.2.9
May 29, 2024 15:26:12.267220020 CEST	49778	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:12.268940926 CEST	443	49777	52.49.110.165	192.168.2.9
May 29, 2024 15:26:12.269000053 CEST	49777	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:12.271785975 CEST	49777	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:12.271794081 CEST	443	49777	52.49.110.165	192.168.2.9
May 29, 2024 15:26:12.272088051 CEST	443	49777	52.49.110.165	192.168.2.9
May 29, 2024 15:26:12.272136927 CEST	49777	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:12.362034082 CEST	443	49782	172.64.155.119	192.168.2.9
May 29, 2024 15:26:12.362087965 CEST	49782	443	192.168.2.9	172.64.155.119
May 29, 2024 15:26:12.362095118 CEST	443	49782	172.64.155.119	192.168.2.9
May 29, 2024 15:26:12.362106085 CEST	443	49782	172.64.155.119	192.168.2.9
May 29, 2024 15:26:12.362128019 CEST	49782	443	192.168.2.9	172.64.155.119
May 29, 2024 15:26:12.362145901 CEST	49782	443	192.168.2.9	172.64.155.119
May 29, 2024 15:26:12.362884998 CEST	49782	443	192.168.2.9	172.64.155.119
May 29, 2024 15:26:12.362900019 CEST	443	49782	172.64.155.119	192.168.2.9
May 29, 2024 15:26:12.371756077 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.371790886 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.493844986 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.493889093 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.493913889 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.493947029 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.493958950 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.493959904 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.493959904 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.493959904 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.493973017 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.494024038 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.494050980 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.494518042 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.494523048 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.494524002 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.494524002 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.494534969 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.494604111 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.494604111 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.494604111 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.494612932 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.494961977 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.523911953 CEST	443	49778	52.49.110.165	192.168.2.9
May 29, 2024 15:26:12.523972988 CEST	443	49778	52.49.110.165	192.168.2.9
May 29, 2024 15:26:12.524051905 CEST	49778	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:12.524194956 CEST	49778	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:12.524996996 CEST	49778	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:12.525016069 CEST	443	49778	52.49.110.165	192.168.2.9
May 29, 2024 15:26:12.569701910 CEST	49791	443	192.168.2.9	52.214.218.223
May 29, 2024 15:26:12.569721937 CEST	443	49791	52.214.218.223	192.168.2.9
May 29, 2024 15:26:12.569758892 CEST	49792	443	192.168.2.9	52.214.218.223
May 29, 2024 15:26:12.569776058 CEST	49791	443	192.168.2.9	52.214.218.223
May 29, 2024 15:26:12.569783926 CEST	443	49792	52.214.218.223	192.168.2.9
May 29, 2024 15:26:12.569823027 CEST	49792	443	192.168.2.9	52.214.218.223
May 29, 2024 15:26:12.570065975 CEST	49791	443	192.168.2.9	52.214.218.223
May 29, 2024 15:26:12.570074081 CEST	443	49791	52.214.218.223	192.168.2.9
May 29, 2024 15:26:12.570187092 CEST	49792	443	192.168.2.9	52.214.218.223
May 29, 2024 15:26:12.570198059 CEST	443	49792	52.214.218.223	192.168.2.9
May 29, 2024 15:26:12.582484007 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.582583904 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.582619905 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.582653999 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.582686901 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.582720995 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.582720995 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.582720995 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.582720995 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.582729101 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.583422899 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.583427906 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.583785057 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.583848000 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.583851099 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.583851099 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.583859921 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.583914042 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.583930969 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.584511042 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.584511042 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.584511042 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.584517956 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.584639072 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.584723949 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.584781885 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.584811926 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.584968090 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.584968090 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.584975004 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.585058928 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.585563898 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.585613012 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.585621119 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.585629940 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.587800026 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.671384096 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.671463013 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.671763897 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.671828032 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.671863079 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.672010899 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.672019005 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.672056913 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.672061920 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.672101974 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.672126055 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.672174931 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.672219992 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.672276974 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.672307968 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.672355890 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.672389984 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.672436953 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.672540903 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.672729015 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.672894955 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.672950029 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.673027039 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.673082113 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.673135042 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.673183918 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.673744917 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.673810005 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.673918009 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.673976898 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.674616098 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.674695969 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.674732924 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.674787998 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.674838066 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.674887896 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.675622940 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.675697088 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.763190031 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.763262987 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.763453960 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.763504982 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.763695002 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.763758898 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.763978958 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.764034033 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.764082909 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.764183998 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.764198065 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.764215946 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.764254093 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.764281988 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.764312983 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.764406919 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.765254974 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.765314102 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.765366077 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.765419960 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.765467882 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.765516043 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.766185999 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.766242027 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.766379118 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.766426086 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.766479015 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.766525030 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.766571999 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.766628027 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.767294884 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.767363071 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.767467976 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.767528057 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.767647028 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.767702103 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.767793894 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.767844915 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.768469095 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.768553019 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.850090981 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.850171089 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.850219011 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.850275040 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.850326061 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.850369930 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.850405931 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.850459099 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.850506067 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.850564003 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.850624084 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.850677967 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.850720882 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.850764036 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.850830078 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.850878000 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.851392031 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.851469994 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.851492882 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.851547003 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.851628065 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.851699114 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.851711035 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.851763010 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.852394104 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.852458954 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.852475882 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.852498055 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.852516890 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.852603912 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.853369951 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.853427887 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.853457928 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.853468895 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.853497028 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.853518963 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.854417086 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.854473114 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.854513884 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.854531050 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.854547977 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.854573965 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.854620934 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.854731083 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.855262995 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.855318069 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.855349064 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.855355024 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.855385065 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.855396986 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.856249094 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.856292009 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.856319904 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.856326103 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.856367111 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.939363956 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.939429045 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.939441919 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.939457893 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.939508915 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.939572096 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.939620018 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.939635038 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.939642906 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.939667940 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.939683914 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.939713955 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.939768076 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.940021038 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.940068960 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.940083981 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.940090895 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.940140963 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.940157890 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.940161943 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.940201998 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.940223932 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.940320015 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.940325022 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.940367937 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.940383911 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.940422058 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.943181992 CEST	49768	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.943207979 CEST	443	49768	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.996701956 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.996748924 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.996822119 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.997078896 CEST	49798	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:12.997098923 CEST	443	49798	104.19.178.52	192.168.2.9
May 29, 2024 15:26:12.997320890 CEST	49798	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.002612114 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.002623081 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.007564068 CEST	49798	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.007580042 CEST	443	49798	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.087960958 CEST	49799	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:13.088001966 CEST	443	49799	142.250.181.228	192.168.2.9
May 29, 2024 15:26:13.088027000 CEST	49800	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:13.088033915 CEST	443	49800	142.250.181.228	192.168.2.9
May 29, 2024 15:26:13.088061094 CEST	49799	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:13.088089943 CEST	49800	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:13.088377953 CEST	49799	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:13.088395119 CEST	443	49799	142.250.181.228	192.168.2.9
May 29, 2024 15:26:13.088404894 CEST	49800	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:13.088417053 CEST	443	49800	142.250.181.228	192.168.2.9
May 29, 2024 15:26:13.116760015 CEST	49805	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:13.116786957 CEST	443	49805	18.245.175.102	192.168.2.9
May 29, 2024 15:26:13.116842031 CEST	49805	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:13.117404938 CEST	49806	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:13.117424011 CEST	443	49806	18.245.175.102	192.168.2.9
May 29, 2024 15:26:13.117525101 CEST	49806	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:13.117808104 CEST	49805	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:13.117821932 CEST	443	49805	18.245.175.102	192.168.2.9
May 29, 2024 15:26:13.118093014 CEST	49806	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:13.118105888 CEST	443	49806	18.245.175.102	192.168.2.9
May 29, 2024 15:26:13.189728022 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:13.189754963 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:13.189778090 CEST	49810	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:13.189784050 CEST	443	49810	87.248.119.252	192.168.2.9
May 29, 2024 15:26:13.189851046 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:13.189888000 CEST	49810	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:13.190052032 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:13.190066099 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:13.190190077 CEST	49810	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:13.190201998 CEST	443	49810	87.248.119.252	192.168.2.9
May 29, 2024 15:26:13.192711115 CEST	443	49791	52.214.218.223	192.168.2.9
May 29, 2024 15:26:13.192820072 CEST	49791	443	192.168.2.9	52.214.218.223
May 29, 2024 15:26:13.197671890 CEST	49791	443	192.168.2.9	52.214.218.223
May 29, 2024 15:26:13.197678089 CEST	443	49791	52.214.218.223	192.168.2.9
May 29, 2024 15:26:13.197882891 CEST	49791	443	192.168.2.9	52.214.218.223
May 29, 2024 15:26:13.197886944 CEST	443	49791	52.214.218.223	192.168.2.9
May 29, 2024 15:26:13.197923899 CEST	443	49791	52.214.218.223	192.168.2.9
May 29, 2024 15:26:13.198606014 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:13.198627949 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:13.198640108 CEST	49791	443	192.168.2.9	52.214.218.223
May 29, 2024 15:26:13.198673964 CEST	49812	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:13.198700905 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:13.198700905 CEST	443	49812	20.50.2.44	192.168.2.9
May 29, 2024 15:26:13.198892117 CEST	49812	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:13.199101925 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:13.199115038 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:13.199182034 CEST	49812	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:13.199193954 CEST	443	49812	20.50.2.44	192.168.2.9
May 29, 2024 15:26:13.217360020 CEST	443	49792	52.214.218.223	192.168.2.9
May 29, 2024 15:26:13.217592955 CEST	49792	443	192.168.2.9	52.214.218.223
May 29, 2024 15:26:13.220510006 CEST	49792	443	192.168.2.9	52.214.218.223
May 29, 2024 15:26:13.220515013 CEST	443	49792	52.214.218.223	192.168.2.9
May 29, 2024 15:26:13.220913887 CEST	443	49792	52.214.218.223	192.168.2.9
May 29, 2024 15:26:13.221738100 CEST	49792	443	192.168.2.9	52.214.218.223
May 29, 2024 15:26:13.450006008 CEST	443	49791	52.214.218.223	192.168.2.9
May 29, 2024 15:26:13.450041056 CEST	443	49791	52.214.218.223	192.168.2.9
May 29, 2024 15:26:13.450058937 CEST	49791	443	192.168.2.9	52.214.218.223
May 29, 2024 15:26:13.450072050 CEST	443	49791	52.214.218.223	192.168.2.9
May 29, 2024 15:26:13.450092077 CEST	49791	443	192.168.2.9	52.214.218.223
May 29, 2024 15:26:13.450133085 CEST	49791	443	192.168.2.9	52.214.218.223
May 29, 2024 15:26:13.450136900 CEST	443	49791	52.214.218.223	192.168.2.9
May 29, 2024 15:26:13.450158119 CEST	443	49791	52.214.218.223	192.168.2.9
May 29, 2024 15:26:13.450192928 CEST	49791	443	192.168.2.9	52.214.218.223
May 29, 2024 15:26:13.452727079 CEST	49791	443	192.168.2.9	52.214.218.223
May 29, 2024 15:26:13.452738047 CEST	443	49791	52.214.218.223	192.168.2.9
May 29, 2024 15:26:13.466232061 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.466345072 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.471148968 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.471154928 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.471874952 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.471879959 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.499391079 CEST	443	49798	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.499471903 CEST	49798	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.499959946 CEST	49798	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.499964952 CEST	443	49798	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.621478081 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.621537924 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.621556997 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.621567965 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.621588945 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.621618032 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.621619940 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.621628046 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.621654034 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.621702909 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.621711016 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.621716022 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.621761084 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.621767044 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.621820927 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.622324944 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.622520924 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.626177073 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.626245975 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.626266956 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.626271963 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.626341105 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.630526066 CEST	49777	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:13.672511101 CEST	443	49777	52.49.110.165	192.168.2.9
May 29, 2024 15:26:13.710753918 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.710819006 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.710819960 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.710844040 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.710880041 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.710900068 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.710905075 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.710962057 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.710962057 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.711272001 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.711441040 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.711455107 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.711499929 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.711529970 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.711563110 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.711572886 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.711572886 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.711580992 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.711756945 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.711777925 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.711782932 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.711818933 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.711819887 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.711819887 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.711827993 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.711860895 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.711864948 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.711963892 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.711999893 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.712022066 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.712027073 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.712079048 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.712500095 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.712790966 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.712858915 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.712891102 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.713645935 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.713651896 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.713867903 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.735061884 CEST	443	49799	142.250.181.228	192.168.2.9
May 29, 2024 15:26:13.735161066 CEST	49799	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:13.737651110 CEST	443	49800	142.250.181.228	192.168.2.9
May 29, 2024 15:26:13.737776995 CEST	49800	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:13.738862991 CEST	49799	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:13.738888979 CEST	443	49799	142.250.181.228	192.168.2.9
May 29, 2024 15:26:13.739128113 CEST	49799	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:13.739139080 CEST	443	49799	142.250.181.228	192.168.2.9
May 29, 2024 15:26:13.739196062 CEST	49799	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:13.740583897 CEST	49800	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:13.740596056 CEST	443	49800	142.250.181.228	192.168.2.9
May 29, 2024 15:26:13.740901947 CEST	443	49800	142.250.181.228	192.168.2.9
May 29, 2024 15:26:13.740988016 CEST	49800	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:13.784498930 CEST	443	49799	142.250.181.228	192.168.2.9
May 29, 2024 15:26:13.799448967 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.799586058 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.799598932 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.799704075 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.799757957 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.799766064 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.799830914 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.799835920 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.799870014 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.799877882 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.799983025 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.800005913 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.800010920 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.800029039 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.800143003 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.800405025 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.800506115 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.800524950 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.800611019 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.800668001 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.800673008 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.800841093 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.801196098 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.801289082 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.801342964 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.801342964 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.801352024 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.801395893 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.802035093 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.802090883 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.802133083 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.802184105 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.802215099 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.802331924 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.803009033 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.803061962 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.813344002 CEST	443	49777	52.49.110.165	192.168.2.9
May 29, 2024 15:26:13.813405991 CEST	443	49777	52.49.110.165	192.168.2.9
May 29, 2024 15:26:13.813412905 CEST	49777	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:13.813441992 CEST	49777	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:13.814543009 CEST	49777	443	192.168.2.9	52.49.110.165
May 29, 2024 15:26:13.814560890 CEST	443	49777	52.49.110.165	192.168.2.9
May 29, 2024 15:26:13.849119902 CEST	443	49806	18.245.175.102	192.168.2.9
May 29, 2024 15:26:13.849194050 CEST	49806	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:13.852834940 CEST	49806	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:13.852844954 CEST	443	49806	18.245.175.102	192.168.2.9
May 29, 2024 15:26:13.853018045 CEST	49806	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:13.853025913 CEST	443	49806	18.245.175.102	192.168.2.9
May 29, 2024 15:26:13.853136063 CEST	443	49806	18.245.175.102	192.168.2.9
May 29, 2024 15:26:13.853194952 CEST	49806	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:13.863677025 CEST	443	49805	18.245.175.102	192.168.2.9
May 29, 2024 15:26:13.863766909 CEST	49805	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:13.866637945 CEST	49805	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:13.866641998 CEST	443	49805	18.245.175.102	192.168.2.9
May 29, 2024 15:26:13.866966009 CEST	443	49805	18.245.175.102	192.168.2.9
May 29, 2024 15:26:13.867374897 CEST	49805	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:13.872322083 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:13.872395992 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:13.873049974 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:13.873250008 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:13.876765013 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:13.876769066 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:13.877016068 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:13.877021074 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:13.877120018 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:13.877898932 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:13.888911009 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.889056921 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.889081001 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.889092922 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.889116049 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.889153957 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.889234066 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.889234066 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.889240026 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.889254093 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.889297962 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.889302969 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.889345884 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.889405966 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.889410019 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.889445066 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.889504910 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.889504910 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.889511108 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.889571905 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.889694929 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.889772892 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.889786005 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.889848948 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.889869928 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.889971018 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.891035080 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.891184092 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.891190052 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.891208887 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.891228914 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.891232967 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.891256094 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.891283035 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.891287088 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.891448021 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.891515970 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.892276049 CEST	49797	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.892302036 CEST	443	49797	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.945768118 CEST	443	49810	87.248.119.252	192.168.2.9
May 29, 2024 15:26:13.945862055 CEST	49810	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:13.946549892 CEST	443	49810	87.248.119.252	192.168.2.9
May 29, 2024 15:26:13.946640015 CEST	49810	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:13.951872110 CEST	49810	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:13.951877117 CEST	443	49810	87.248.119.252	192.168.2.9
May 29, 2024 15:26:13.952159882 CEST	443	49810	87.248.119.252	192.168.2.9
May 29, 2024 15:26:13.952213049 CEST	49810	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:13.971805096 CEST	49798	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.971828938 CEST	443	49798	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.973648071 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.973691940 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.973923922 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.974386930 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.974402905 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.974791050 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:13.974822998 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:13.974895000 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:13.974975109 CEST	49820	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:13.975007057 CEST	443	49820	34.117.39.58	192.168.2.9
May 29, 2024 15:26:13.975191116 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:13.975203991 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:13.975219011 CEST	49820	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:13.975501060 CEST	49820	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:13.975522995 CEST	443	49820	34.117.39.58	192.168.2.9
May 29, 2024 15:26:13.976356983 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.976377010 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:13.976512909 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.976928949 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:13.976947069 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.002809048 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.002908945 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.003299952 CEST	443	49812	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.003431082 CEST	49812	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.008341074 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.008347988 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.008479118 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.008490086 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.008779049 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.009246111 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.013849020 CEST	49812	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.013883114 CEST	443	49812	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.014154911 CEST	443	49812	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.014426947 CEST	49812	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.015007019 CEST	443	49799	142.250.181.228	192.168.2.9
May 29, 2024 15:26:14.015232086 CEST	443	49799	142.250.181.228	192.168.2.9
May 29, 2024 15:26:14.015229940 CEST	49799	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:14.015430927 CEST	49799	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:14.018451929 CEST	49799	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:14.018492937 CEST	443	49799	142.250.181.228	192.168.2.9
May 29, 2024 15:26:14.028134108 CEST	49823	443	192.168.2.9	216.58.206.34
May 29, 2024 15:26:14.028152943 CEST	443	49823	216.58.206.34	192.168.2.9
May 29, 2024 15:26:14.028175116 CEST	49824	443	192.168.2.9	216.58.206.34
May 29, 2024 15:26:14.028212070 CEST	443	49824	216.58.206.34	192.168.2.9
May 29, 2024 15:26:14.028296947 CEST	49823	443	192.168.2.9	216.58.206.34
May 29, 2024 15:26:14.028376102 CEST	49824	443	192.168.2.9	216.58.206.34
May 29, 2024 15:26:14.029505968 CEST	49823	443	192.168.2.9	216.58.206.34
May 29, 2024 15:26:14.029519081 CEST	443	49823	216.58.206.34	192.168.2.9
May 29, 2024 15:26:14.029853106 CEST	49824	443	192.168.2.9	216.58.206.34
May 29, 2024 15:26:14.029867887 CEST	443	49824	216.58.206.34	192.168.2.9
May 29, 2024 15:26:14.054459095 CEST	49826	443	192.168.2.9	34.117.223.223
May 29, 2024 15:26:14.054486036 CEST	443	49826	34.117.223.223	192.168.2.9
May 29, 2024 15:26:14.054575920 CEST	49826	443	192.168.2.9	34.117.223.223
May 29, 2024 15:26:14.054874897 CEST	49826	443	192.168.2.9	34.117.223.223
May 29, 2024 15:26:14.054887056 CEST	443	49826	34.117.223.223	192.168.2.9
May 29, 2024 15:26:14.086195946 CEST	443	49798	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.086242914 CEST	443	49798	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.086328983 CEST	443	49798	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.086330891 CEST	49798	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.086342096 CEST	443	49798	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.086383104 CEST	49798	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.086513042 CEST	443	49798	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.086572886 CEST	49798	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.086577892 CEST	443	49798	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.086613894 CEST	49798	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.086630106 CEST	443	49798	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.086699009 CEST	443	49798	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.086699963 CEST	49798	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.086776018 CEST	49798	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.087271929 CEST	49798	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.087286949 CEST	443	49798	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.151643038 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:14.151707888 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:14.151747942 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:14.151792049 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:14.151839018 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:14.151881933 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:14.151916981 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:14.151956081 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:14.152020931 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:14.152062893 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:14.152107954 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:14.152193069 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:14.152199030 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:14.152240038 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:14.152247906 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:14.152292967 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:14.152367115 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:14.152412891 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:14.152905941 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:14.152970076 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:14.172585011 CEST	443	49806	18.245.175.102	192.168.2.9
May 29, 2024 15:26:14.172662973 CEST	49806	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:14.192231894 CEST	443	49806	18.245.175.102	192.168.2.9
May 29, 2024 15:26:14.192241907 CEST	443	49806	18.245.175.102	192.168.2.9
May 29, 2024 15:26:14.192280054 CEST	443	49806	18.245.175.102	192.168.2.9
May 29, 2024 15:26:14.192308903 CEST	49806	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:14.192320108 CEST	443	49806	18.245.175.102	192.168.2.9
May 29, 2024 15:26:14.192343950 CEST	49806	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:14.192374945 CEST	49806	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:14.194575071 CEST	443	49806	18.245.175.102	192.168.2.9
May 29, 2024 15:26:14.194628000 CEST	49806	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:14.194647074 CEST	443	49806	18.245.175.102	192.168.2.9
May 29, 2024 15:26:14.194677114 CEST	443	49806	18.245.175.102	192.168.2.9
May 29, 2024 15:26:14.194699049 CEST	49806	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:14.194725990 CEST	49806	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:14.194730997 CEST	443	49806	18.245.175.102	192.168.2.9
May 29, 2024 15:26:14.194952011 CEST	49806	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:14.243719101 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:14.243783951 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:14.243793011 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:14.243839979 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:14.243846893 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:14.243855000 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:14.243884087 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:14.243901014 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:14.243906021 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:14.243948936 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:14.243956089 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:14.243969917 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:14.243974924 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:14.246104956 CEST	49828	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:14.246134996 CEST	443	49828	18.165.183.15	192.168.2.9
May 29, 2024 15:26:14.246258020 CEST	49828	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:14.246500015 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:14.246514082 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:14.246589899 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:14.247328997 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:14.247343063 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:14.247363091 CEST	49828	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:14.247392893 CEST	443	49828	18.165.183.15	192.168.2.9
May 29, 2024 15:26:14.269980907 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.270019054 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.270078897 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.270096064 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.270137072 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.270296097 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.270363092 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.271193027 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.271250963 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.274996996 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.275065899 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.358669043 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.358746052 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.358855963 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.358922958 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.359081030 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.359180927 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.359520912 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.359575033 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.359627008 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.359699011 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.360577106 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.360637903 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.360673904 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.360726118 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.360754967 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.360815048 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.447362900 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.447458029 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.447529078 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.447572947 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.447716951 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.447765112 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.447833061 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.447876930 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.448188066 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.448241949 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.448365927 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.448417902 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.448425055 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.448447943 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.448470116 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.448474884 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.448476076 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.448502064 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.448514938 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.448530912 CEST	443	49809	87.248.119.252	192.168.2.9
May 29, 2024 15:26:14.448565960 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.448580980 CEST	49809	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:14.449255943 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.449318886 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.449321032 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.449331045 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.449369907 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.450295925 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.450345993 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.450360060 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.450401068 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.450460911 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.450500011 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.452219009 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.452229977 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.452430010 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.452435970 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.455382109 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.455456018 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.461461067 CEST	443	49820	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.461577892 CEST	49820	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.465378046 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.465621948 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.473017931 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.473032951 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.473155975 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.473160982 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.473262072 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.473314047 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.473875046 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.473897934 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.474019051 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.474024057 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.476041079 CEST	49820	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.476056099 CEST	443	49820	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.476262093 CEST	443	49820	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.476572037 CEST	49820	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.506292105 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.506372929 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.506381989 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.506393909 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.506422997 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.506444931 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.519876957 CEST	49833	443	192.168.2.9	172.217.18.6
May 29, 2024 15:26:14.519913912 CEST	443	49833	172.217.18.6	192.168.2.9
May 29, 2024 15:26:14.520117998 CEST	49833	443	192.168.2.9	172.217.18.6
May 29, 2024 15:26:14.520411015 CEST	49834	443	192.168.2.9	172.217.18.6
May 29, 2024 15:26:14.520417929 CEST	443	49834	172.217.18.6	192.168.2.9
May 29, 2024 15:26:14.520508051 CEST	49834	443	192.168.2.9	172.217.18.6
May 29, 2024 15:26:14.521476030 CEST	49833	443	192.168.2.9	172.217.18.6
May 29, 2024 15:26:14.521486998 CEST	443	49833	172.217.18.6	192.168.2.9
May 29, 2024 15:26:14.526797056 CEST	49834	443	192.168.2.9	172.217.18.6
May 29, 2024 15:26:14.526808977 CEST	443	49834	172.217.18.6	192.168.2.9
May 29, 2024 15:26:14.536905050 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.536966085 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.537091017 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.537149906 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.537199020 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.537245989 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.537381887 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.537442923 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.537750006 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.537801027 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.537834883 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.537883997 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.537940025 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.537986040 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.538137913 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.538191080 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.538234949 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.538280964 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.538289070 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.538297892 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.538352013 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.538379908 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.538388014 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.538395882 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.538405895 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.538435936 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.538440943 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.538486004 CEST	443	49826	34.117.223.223	192.168.2.9
May 29, 2024 15:26:14.538544893 CEST	49826	443	192.168.2.9	34.117.223.223
May 29, 2024 15:26:14.538554907 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.538707972 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.538748980 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.538784027 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.538827896 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.538893938 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.538935900 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.538938046 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.538964987 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.538990021 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.539009094 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.539536953 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.539592028 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.539593935 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.539601088 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.539634943 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.539712906 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.539763927 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.539843082 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.539896965 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.559317112 CEST	49826	443	192.168.2.9	34.117.223.223
May 29, 2024 15:26:14.559328079 CEST	443	49826	34.117.223.223	192.168.2.9
May 29, 2024 15:26:14.559601068 CEST	443	49826	34.117.223.223	192.168.2.9
May 29, 2024 15:26:14.559714079 CEST	49826	443	192.168.2.9	34.117.223.223
May 29, 2024 15:26:14.560075998 CEST	49826	443	192.168.2.9	34.117.223.223
May 29, 2024 15:26:14.560167074 CEST	49826	443	192.168.2.9	34.117.223.223
May 29, 2024 15:26:14.560170889 CEST	443	49826	34.117.223.223	192.168.2.9
May 29, 2024 15:26:14.560779095 CEST	49835	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:14.560822964 CEST	443	49835	108.139.243.30	192.168.2.9
May 29, 2024 15:26:14.560827017 CEST	49836	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:14.560843945 CEST	443	49836	108.139.243.30	192.168.2.9
May 29, 2024 15:26:14.560879946 CEST	49835	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:14.560909986 CEST	49836	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:14.561506987 CEST	49835	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:14.561520100 CEST	443	49835	108.139.243.30	192.168.2.9
May 29, 2024 15:26:14.561614990 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:14.561621904 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:14.561642885 CEST	49838	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:14.561649084 CEST	443	49838	157.240.252.13	192.168.2.9
May 29, 2024 15:26:14.561670065 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:14.561697006 CEST	49838	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:14.561944008 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:14.561955929 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:14.562025070 CEST	49838	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:14.562035084 CEST	443	49838	157.240.252.13	192.168.2.9
May 29, 2024 15:26:14.562294960 CEST	49836	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:14.562305927 CEST	443	49836	108.139.243.30	192.168.2.9
May 29, 2024 15:26:14.574407101 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.574449062 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.574455976 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.574474096 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.574485064 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.574501991 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.574526072 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.574531078 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.574548960 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.574579000 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.575037956 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.575112104 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.575150013 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.575215101 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.575222015 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.575274944 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.575279951 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.575340033 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.575345993 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.575412989 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.576065063 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.576108932 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.579265118 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.580071926 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.580082893 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.580147982 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.583846092 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.583895922 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.583959103 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.583997965 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.584005117 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.584050894 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.588254929 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.588314056 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.588320971 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.588336945 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.588357925 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.588385105 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.588392019 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.588437080 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.588443041 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.588476896 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.588488102 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.588545084 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.588550091 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.588557959 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.588582039 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.588612080 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.588617086 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.588654995 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.588669062 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.588725090 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.592807055 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.592859983 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.592866898 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.593008995 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.594830036 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.594882011 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.594913960 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.594957113 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.595088005 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.595144033 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.595251083 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.595295906 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.621381044 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.621444941 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.621452093 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.621495008 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.621510029 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.621570110 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.621584892 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.621651888 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.621656895 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.621699095 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.621731997 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.621789932 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.621817112 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.621867895 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.621905088 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.622055054 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.622100115 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.622104883 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.622140884 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.622598886 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.622662067 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.624592066 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.624639988 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.624649048 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.624660969 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.624684095 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.624701977 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.624728918 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.624773979 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.625248909 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.625282049 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.625304937 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.625312090 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.625332117 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.625363111 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.625363111 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.625375032 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.625397921 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.625430107 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.625438929 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.625479937 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.625614882 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.625683069 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.625705004 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.625710964 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.625721931 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.625726938 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.625752926 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.625757933 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.625770092 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.625785112 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.625803947 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.625811100 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.625816107 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.625838041 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.625883102 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.625888109 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.626358032 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.626390934 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.626413107 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.626420021 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.626441002 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.626461983 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.626498938 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.626560926 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.626566887 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.626575947 CEST	443	49811	20.50.2.44	192.168.2.9
May 29, 2024 15:26:14.626583099 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.626600027 CEST	49811	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:14.665119886 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.665174007 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.665182114 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.665215969 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.665241003 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.665262938 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.665272951 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.665313005 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.665318966 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.665357113 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.665637970 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.665692091 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.665725946 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.665762901 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.665766954 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.665805101 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.665806055 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.665815115 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.665843010 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.665877104 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.665880919 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.665997982 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.666608095 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.666675091 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.666697979 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.666722059 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.666727066 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.666752100 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.666759014 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.666774988 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.666779995 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.666805029 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.666824102 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.667545080 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.667608023 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.667613983 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.667618036 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.667648077 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.667656898 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.667659044 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.667665958 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.667705059 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.677417994 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.677546024 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.677556992 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.677597046 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.677613974 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.677671909 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.677706957 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.677757978 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.677792072 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.677838087 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.677891016 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.677932978 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.677938938 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.677973986 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.678036928 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.678143978 CEST	443	49824	216.58.206.34	192.168.2.9
May 29, 2024 15:26:14.678150892 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.678226948 CEST	49824	443	192.168.2.9	216.58.206.34
May 29, 2024 15:26:14.681745052 CEST	49824	443	192.168.2.9	216.58.206.34
May 29, 2024 15:26:14.681754112 CEST	443	49824	216.58.206.34	192.168.2.9
May 29, 2024 15:26:14.681864023 CEST	49824	443	192.168.2.9	216.58.206.34
May 29, 2024 15:26:14.681879997 CEST	443	49824	216.58.206.34	192.168.2.9
May 29, 2024 15:26:14.682046890 CEST	443	49824	216.58.206.34	192.168.2.9
May 29, 2024 15:26:14.682148933 CEST	49824	443	192.168.2.9	216.58.206.34
May 29, 2024 15:26:14.682188034 CEST	443	49826	34.117.223.223	192.168.2.9
May 29, 2024 15:26:14.682235956 CEST	49826	443	192.168.2.9	34.117.223.223
May 29, 2024 15:26:14.682250023 CEST	443	49826	34.117.223.223	192.168.2.9
May 29, 2024 15:26:14.682288885 CEST	49826	443	192.168.2.9	34.117.223.223
May 29, 2024 15:26:14.682292938 CEST	443	49826	34.117.223.223	192.168.2.9
May 29, 2024 15:26:14.682317972 CEST	443	49826	34.117.223.223	192.168.2.9
May 29, 2024 15:26:14.682358980 CEST	49826	443	192.168.2.9	34.117.223.223
May 29, 2024 15:26:14.687798977 CEST	443	49823	216.58.206.34	192.168.2.9
May 29, 2024 15:26:14.687860966 CEST	49823	443	192.168.2.9	216.58.206.34
May 29, 2024 15:26:14.691030025 CEST	49823	443	192.168.2.9	216.58.206.34
May 29, 2024 15:26:14.691049099 CEST	443	49823	216.58.206.34	192.168.2.9
May 29, 2024 15:26:14.691284895 CEST	443	49823	216.58.206.34	192.168.2.9
May 29, 2024 15:26:14.691369057 CEST	49823	443	192.168.2.9	216.58.206.34
May 29, 2024 15:26:14.710402012 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.710478067 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.710494041 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.710537910 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.712155104 CEST	49822	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.712198019 CEST	443	49822	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.714237928 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.714359999 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.714418888 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.714484930 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.714509964 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.714586020 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.714607954 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.714663029 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.714706898 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.714746952 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.714788914 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.714966059 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.714967012 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.714996099 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.715018988 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.715044022 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.715095043 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.715182066 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.715188980 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.715238094 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.715255976 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.715303898 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.715357065 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.715415955 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.715447903 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.715497971 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.715526104 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.715570927 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.715607882 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.715657949 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.715696096 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.715749025 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.715778112 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.715821028 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.715861082 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.715912104 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.716404915 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.716445923 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.716450930 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.716495991 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.718276978 CEST	49826	443	192.168.2.9	34.117.223.223
May 29, 2024 15:26:14.718295097 CEST	443	49826	34.117.223.223	192.168.2.9
May 29, 2024 15:26:14.756778955 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.756844044 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.756865978 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.756874084 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.756886005 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.756894112 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.756912947 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.756927967 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.756927967 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.756939888 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.756959915 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.756984949 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.756993055 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.756999969 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.757028103 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.757038116 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.757045031 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.757056952 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.757088900 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.757111073 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.757114887 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.757128000 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.757153988 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.757160902 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.757250071 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.757992983 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.758052111 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.758081913 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.758109093 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.758157969 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.758157969 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.758157969 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.758157969 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.758166075 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.758183956 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.758204937 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.758234024 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.758235931 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.758245945 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.758301020 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.758371115 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.758424044 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.758450985 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.758454084 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.758460999 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.758467913 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.758491993 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.758502960 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.758526087 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.758568048 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.758573055 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.758613110 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.758615017 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.758624077 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.758650064 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.758682966 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.758687019 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.758725882 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.759279966 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.759334087 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.759339094 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.759373903 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.759380102 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.759385109 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.759412050 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.759440899 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.759448051 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.759541035 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.759546041 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.759587049 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.802160978 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.802225113 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.802258968 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.802294016 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.802301884 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.802350998 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.802383900 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.802391052 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.802396059 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.802419901 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.802433968 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.802438974 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.802505016 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.802510977 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.802542925 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.802553892 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.802557945 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.802593946 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.807673931 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.807727098 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.807734966 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.807744980 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.807779074 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.807787895 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.807816029 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.807848930 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.807853937 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.807884932 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.807904005 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.807981968 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.848098993 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.848253965 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.848398924 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.848470926 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.848498106 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.848532915 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.848540068 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.848576069 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.848617077 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.868587971 CEST	49821	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:14.868606091 CEST	443	49821	34.117.39.58	192.168.2.9
May 29, 2024 15:26:14.882827044 CEST	49819	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.882862091 CEST	443	49819	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.890305996 CEST	58442	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:14.890327930 CEST	443	58442	74.125.206.155	192.168.2.9
May 29, 2024 15:26:14.890331984 CEST	58443	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:14.890362024 CEST	443	58443	74.125.206.155	192.168.2.9
May 29, 2024 15:26:14.890409946 CEST	58442	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:14.890448093 CEST	58443	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:14.891103983 CEST	58442	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:14.891117096 CEST	443	58442	74.125.206.155	192.168.2.9
May 29, 2024 15:26:14.891211033 CEST	58443	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:14.891220093 CEST	443	58443	74.125.206.155	192.168.2.9
May 29, 2024 15:26:14.958580017 CEST	443	49824	216.58.206.34	192.168.2.9
May 29, 2024 15:26:14.958635092 CEST	443	49824	216.58.206.34	192.168.2.9
May 29, 2024 15:26:14.958710909 CEST	49824	443	192.168.2.9	216.58.206.34
May 29, 2024 15:26:14.960711956 CEST	49824	443	192.168.2.9	216.58.206.34
May 29, 2024 15:26:14.960727930 CEST	443	49824	216.58.206.34	192.168.2.9
May 29, 2024 15:26:14.977720976 CEST	58444	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.977766037 CEST	58445	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.977771044 CEST	443	58444	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.977792978 CEST	443	58445	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.977869987 CEST	58444	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.977895975 CEST	58445	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.978087902 CEST	58445	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.978101015 CEST	443	58445	104.19.178.52	192.168.2.9
May 29, 2024 15:26:14.978509903 CEST	58444	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:14.978523016 CEST	443	58444	104.19.178.52	192.168.2.9
May 29, 2024 15:26:15.008565903 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.008634090 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.011909962 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.011921883 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.012083054 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.012090921 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.012173891 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.012299061 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.030097961 CEST	49810	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:15.040050983 CEST	443	49828	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.040127039 CEST	49828	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.043052912 CEST	49828	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.043068886 CEST	443	49828	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.043356895 CEST	443	49828	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.043411016 CEST	49828	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.051981926 CEST	58446	443	192.168.2.9	142.250.184.238
May 29, 2024 15:26:15.052017927 CEST	443	58446	142.250.184.238	192.168.2.9
May 29, 2024 15:26:15.052160978 CEST	58446	443	192.168.2.9	142.250.184.238
May 29, 2024 15:26:15.052402020 CEST	58446	443	192.168.2.9	142.250.184.238
May 29, 2024 15:26:15.052413940 CEST	443	58446	142.250.184.238	192.168.2.9
May 29, 2024 15:26:15.072494984 CEST	443	49810	87.248.119.252	192.168.2.9
May 29, 2024 15:26:15.166620970 CEST	443	49833	172.217.18.6	192.168.2.9
May 29, 2024 15:26:15.166740894 CEST	49833	443	192.168.2.9	172.217.18.6
May 29, 2024 15:26:15.169825077 CEST	49833	443	192.168.2.9	172.217.18.6
May 29, 2024 15:26:15.169831038 CEST	443	49833	172.217.18.6	192.168.2.9
May 29, 2024 15:26:15.170126915 CEST	49833	443	192.168.2.9	172.217.18.6
May 29, 2024 15:26:15.170135975 CEST	443	49833	172.217.18.6	192.168.2.9
May 29, 2024 15:26:15.170195103 CEST	443	49833	172.217.18.6	192.168.2.9
May 29, 2024 15:26:15.172508955 CEST	443	49834	172.217.18.6	192.168.2.9
May 29, 2024 15:26:15.172590971 CEST	49834	443	192.168.2.9	172.217.18.6
May 29, 2024 15:26:15.172590971 CEST	49833	443	192.168.2.9	172.217.18.6
May 29, 2024 15:26:15.176630020 CEST	49834	443	192.168.2.9	172.217.18.6
May 29, 2024 15:26:15.176635027 CEST	443	49834	172.217.18.6	192.168.2.9
May 29, 2024 15:26:15.176879883 CEST	443	49834	172.217.18.6	192.168.2.9
May 29, 2024 15:26:15.177453041 CEST	49834	443	192.168.2.9	172.217.18.6
May 29, 2024 15:26:15.221759081 CEST	443	49810	87.248.119.252	192.168.2.9
May 29, 2024 15:26:15.221848011 CEST	443	49810	87.248.119.252	192.168.2.9
May 29, 2024 15:26:15.222037077 CEST	49810	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:15.223433971 CEST	49810	443	192.168.2.9	87.248.119.252
May 29, 2024 15:26:15.223444939 CEST	443	49810	87.248.119.252	192.168.2.9
May 29, 2024 15:26:15.226099968 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.226336002 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.229752064 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.229757071 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.229984045 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.229993105 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.230066061 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.232670069 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.299928904 CEST	443	49838	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.300015926 CEST	49838	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.303955078 CEST	49838	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.303961992 CEST	443	49838	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.304250956 CEST	443	49838	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.304346085 CEST	49838	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.318890095 CEST	443	49835	108.139.243.30	192.168.2.9
May 29, 2024 15:26:15.319000006 CEST	49835	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:15.321893930 CEST	443	49836	108.139.243.30	192.168.2.9
May 29, 2024 15:26:15.322000980 CEST	49836	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:15.322796106 CEST	49835	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:15.322796106 CEST	49835	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:15.322803020 CEST	443	49835	108.139.243.30	192.168.2.9
May 29, 2024 15:26:15.322817087 CEST	443	49835	108.139.243.30	192.168.2.9
May 29, 2024 15:26:15.323275089 CEST	443	49835	108.139.243.30	192.168.2.9
May 29, 2024 15:26:15.323400021 CEST	49835	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:15.325337887 CEST	49836	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:15.325341940 CEST	443	49836	108.139.243.30	192.168.2.9
May 29, 2024 15:26:15.325562954 CEST	443	49836	108.139.243.30	192.168.2.9
May 29, 2024 15:26:15.326028109 CEST	49836	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:15.327306032 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.327368021 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.327410936 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.327459097 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.327477932 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.327502966 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.327558041 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.359394073 CEST	58449	443	192.168.2.9	216.239.36.181
May 29, 2024 15:26:15.359395027 CEST	58450	443	192.168.2.9	216.239.36.181
May 29, 2024 15:26:15.359446049 CEST	443	58449	216.239.36.181	192.168.2.9
May 29, 2024 15:26:15.359466076 CEST	443	58450	216.239.36.181	192.168.2.9
May 29, 2024 15:26:15.359514952 CEST	58449	443	192.168.2.9	216.239.36.181
May 29, 2024 15:26:15.359668970 CEST	58450	443	192.168.2.9	216.239.36.181
May 29, 2024 15:26:15.360156059 CEST	58450	443	192.168.2.9	216.239.36.181
May 29, 2024 15:26:15.360173941 CEST	443	58450	216.239.36.181	192.168.2.9
May 29, 2024 15:26:15.360199928 CEST	58449	443	192.168.2.9	216.239.36.181
May 29, 2024 15:26:15.360213041 CEST	443	58449	216.239.36.181	192.168.2.9
May 29, 2024 15:26:15.409173012 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.409246922 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.409284115 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.409296036 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.409321070 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.409878969 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.425692081 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.425753117 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.425789118 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.425797939 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.425860882 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.425860882 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.453908920 CEST	443	58445	104.19.178.52	192.168.2.9
May 29, 2024 15:26:15.454294920 CEST	58445	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:15.454765081 CEST	58445	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:15.454777002 CEST	443	58445	104.19.178.52	192.168.2.9
May 29, 2024 15:26:15.455070019 CEST	58445	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:15.455075979 CEST	443	58445	104.19.178.52	192.168.2.9
May 29, 2024 15:26:15.458245993 CEST	443	58444	104.19.178.52	192.168.2.9
May 29, 2024 15:26:15.459183931 CEST	58444	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:15.459625959 CEST	58444	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:15.459630966 CEST	443	58444	104.19.178.52	192.168.2.9
May 29, 2024 15:26:15.471553087 CEST	443	49833	172.217.18.6	192.168.2.9
May 29, 2024 15:26:15.471695900 CEST	49833	443	192.168.2.9	172.217.18.6
May 29, 2024 15:26:15.471716881 CEST	443	49833	172.217.18.6	192.168.2.9
May 29, 2024 15:26:15.471770048 CEST	49833	443	192.168.2.9	172.217.18.6
May 29, 2024 15:26:15.472759962 CEST	443	49833	172.217.18.6	192.168.2.9
May 29, 2024 15:26:15.472908974 CEST	443	49833	172.217.18.6	192.168.2.9
May 29, 2024 15:26:15.473033905 CEST	49833	443	192.168.2.9	172.217.18.6
May 29, 2024 15:26:15.475325108 CEST	49833	443	192.168.2.9	172.217.18.6
May 29, 2024 15:26:15.475342035 CEST	443	49833	172.217.18.6	192.168.2.9
May 29, 2024 15:26:15.495090961 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.495157957 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.495194912 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.495222092 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.495243073 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.495397091 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.496016026 CEST	58453	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:15.496038914 CEST	443	58453	142.250.186.130	192.168.2.9
May 29, 2024 15:26:15.496133089 CEST	58453	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:15.496260881 CEST	58454	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:15.496268034 CEST	443	58454	142.250.186.130	192.168.2.9
May 29, 2024 15:26:15.496362925 CEST	58454	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:15.496606112 CEST	58453	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:15.496606112 CEST	58454	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:15.496619940 CEST	443	58453	142.250.186.130	192.168.2.9
May 29, 2024 15:26:15.496634007 CEST	443	58454	142.250.186.130	192.168.2.9
May 29, 2024 15:26:15.496946096 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.497081041 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.497119904 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.497127056 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.497148991 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.497215033 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.498852968 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.498905897 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.498935938 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.498943090 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.498965979 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.499145031 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.500416040 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.500489950 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.500535011 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.500555992 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.500586033 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.502065897 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.517175913 CEST	443	58443	74.125.206.155	192.168.2.9
May 29, 2024 15:26:15.517343998 CEST	58443	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:15.521521091 CEST	58443	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:15.521528006 CEST	443	58443	74.125.206.155	192.168.2.9
May 29, 2024 15:26:15.521812916 CEST	443	58443	74.125.206.155	192.168.2.9
May 29, 2024 15:26:15.521819115 CEST	58443	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:15.521868944 CEST	58443	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:15.522200108 CEST	443	58442	74.125.206.155	192.168.2.9
May 29, 2024 15:26:15.522293091 CEST	58442	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:15.525279999 CEST	58442	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:15.525286913 CEST	443	58442	74.125.206.155	192.168.2.9
May 29, 2024 15:26:15.525618076 CEST	443	58442	74.125.206.155	192.168.2.9
May 29, 2024 15:26:15.525774002 CEST	58442	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:15.532676935 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.532721996 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.532820940 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.532820940 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.532847881 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.532957077 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.564496040 CEST	443	58443	74.125.206.155	192.168.2.9
May 29, 2024 15:26:15.584068060 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.584134102 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.584212065 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.584212065 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.584237099 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.584357023 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.584599972 CEST	443	58445	104.19.178.52	192.168.2.9
May 29, 2024 15:26:15.584650040 CEST	443	58445	104.19.178.52	192.168.2.9
May 29, 2024 15:26:15.584686995 CEST	443	58445	104.19.178.52	192.168.2.9
May 29, 2024 15:26:15.584717989 CEST	443	58445	104.19.178.52	192.168.2.9
May 29, 2024 15:26:15.584717989 CEST	58445	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:15.584743977 CEST	443	58445	104.19.178.52	192.168.2.9
May 29, 2024 15:26:15.584760904 CEST	58445	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:15.584760904 CEST	58445	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:15.584805012 CEST	443	58445	104.19.178.52	192.168.2.9
May 29, 2024 15:26:15.584829092 CEST	58445	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:15.585095882 CEST	58445	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:15.585181952 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.585238934 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.585249901 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.585270882 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.585304022 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.585391045 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.586112022 CEST	58445	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:15.586126089 CEST	443	58445	104.19.178.52	192.168.2.9
May 29, 2024 15:26:15.586133957 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.586164951 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.586250067 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.586250067 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.586263895 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.586363077 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.588037968 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.588059902 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.588124990 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.588140011 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.588634014 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.592992067 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.593005896 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.593049049 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.593096972 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.593121052 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.593152046 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.593240023 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.597654104 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.597681999 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.597774982 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.597774982 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.597789049 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.597861052 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.610371113 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.610416889 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.610502005 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.610502005 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.610517979 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.610693932 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.624288082 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.624313116 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.624406099 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.624414921 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.624686003 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.630125046 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.630173922 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.630248070 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.630263090 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.630285978 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.630320072 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.630408049 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.630438089 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.630455017 CEST	443	49829	18.165.183.15	192.168.2.9
May 29, 2024 15:26:15.630465031 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.630539894 CEST	49829	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:15.658871889 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.658902884 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.658982038 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.658982038 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.658993959 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.659081936 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.691972017 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.691997051 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.692109108 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.692110062 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.692123890 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.692301989 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.700823069 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.700968027 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.714658022 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.714701891 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.714796066 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.714796066 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.714802027 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.714953899 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.733604908 CEST	443	58446	142.250.184.238	192.168.2.9
May 29, 2024 15:26:15.733700991 CEST	58446	443	192.168.2.9	142.250.184.238
May 29, 2024 15:26:15.734380007 CEST	443	58446	142.250.184.238	192.168.2.9
May 29, 2024 15:26:15.735059023 CEST	58446	443	192.168.2.9	142.250.184.238
May 29, 2024 15:26:15.738240004 CEST	58446	443	192.168.2.9	142.250.184.238
May 29, 2024 15:26:15.738245964 CEST	443	58446	142.250.184.238	192.168.2.9
May 29, 2024 15:26:15.738478899 CEST	443	58446	142.250.184.238	192.168.2.9
May 29, 2024 15:26:15.738636971 CEST	58446	443	192.168.2.9	142.250.184.238
May 29, 2024 15:26:15.739063978 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.739094973 CEST	58446	443	192.168.2.9	142.250.184.238
May 29, 2024 15:26:15.739094973 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.739094973 CEST	58446	443	192.168.2.9	142.250.184.238
May 29, 2024 15:26:15.739105940 CEST	443	58446	142.250.184.238	192.168.2.9
May 29, 2024 15:26:15.739198923 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.739198923 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.739207029 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.739489079 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.744982004 CEST	443	49835	108.139.243.30	192.168.2.9
May 29, 2024 15:26:15.745029926 CEST	443	49835	108.139.243.30	192.168.2.9
May 29, 2024 15:26:15.745110989 CEST	49835	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:15.745110989 CEST	49835	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:15.745148897 CEST	443	49835	108.139.243.30	192.168.2.9
May 29, 2024 15:26:15.745364904 CEST	443	49835	108.139.243.30	192.168.2.9
May 29, 2024 15:26:15.745558023 CEST	49835	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:15.745867968 CEST	49835	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:15.745887041 CEST	443	49835	108.139.243.30	192.168.2.9
May 29, 2024 15:26:15.753890038 CEST	49836	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:15.773085117 CEST	443	58443	74.125.206.155	192.168.2.9
May 29, 2024 15:26:15.773163080 CEST	58443	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:15.773323059 CEST	443	58443	74.125.206.155	192.168.2.9
May 29, 2024 15:26:15.773370028 CEST	443	58443	74.125.206.155	192.168.2.9
May 29, 2024 15:26:15.773463964 CEST	58443	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:15.773463964 CEST	58443	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:15.773463964 CEST	58443	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:15.773488045 CEST	443	58443	74.125.206.155	192.168.2.9
May 29, 2024 15:26:15.773657084 CEST	58443	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:15.778455973 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.778484106 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.778712034 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.778734922 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.779067993 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.784589052 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.784632921 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.784667015 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.784672022 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.784699917 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.784780025 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.784977913 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.785037994 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.794544935 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.794583082 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.794622898 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.794629097 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.794801950 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.794801950 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.796498060 CEST	443	49836	108.139.243.30	192.168.2.9
May 29, 2024 15:26:15.803566933 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.803592920 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.803677082 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.803689957 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.803719997 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.803739071 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.815588951 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.815613985 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.815951109 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.815959930 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.816121101 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.827800035 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.827825069 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.827913046 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.827913046 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.827919960 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.828099966 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.831676006 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.831748009 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.835827112 CEST	443	58450	216.239.36.181	192.168.2.9
May 29, 2024 15:26:15.835957050 CEST	58450	443	192.168.2.9	216.239.36.181
May 29, 2024 15:26:15.836822033 CEST	443	58450	216.239.36.181	192.168.2.9
May 29, 2024 15:26:15.837148905 CEST	58450	443	192.168.2.9	216.239.36.181
May 29, 2024 15:26:15.839912891 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.839962006 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.840042114 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.840042114 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.840048075 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.840730906 CEST	58450	443	192.168.2.9	216.239.36.181
May 29, 2024 15:26:15.840730906 CEST	58450	443	192.168.2.9	216.239.36.181
May 29, 2024 15:26:15.840743065 CEST	443	58450	216.239.36.181	192.168.2.9
May 29, 2024 15:26:15.840766907 CEST	443	58450	216.239.36.181	192.168.2.9
May 29, 2024 15:26:15.840773106 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.841188908 CEST	443	58450	216.239.36.181	192.168.2.9
May 29, 2024 15:26:15.841486931 CEST	58450	443	192.168.2.9	216.239.36.181
May 29, 2024 15:26:15.848920107 CEST	443	58449	216.239.36.181	192.168.2.9
May 29, 2024 15:26:15.849030018 CEST	58449	443	192.168.2.9	216.239.36.181
May 29, 2024 15:26:15.849642038 CEST	443	58449	216.239.36.181	192.168.2.9
May 29, 2024 15:26:15.849865913 CEST	58449	443	192.168.2.9	216.239.36.181
May 29, 2024 15:26:15.851223946 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.851264954 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.851310015 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.851345062 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.851345062 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.851483107 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.852291107 CEST	49837	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:15.852307081 CEST	443	49837	157.240.252.13	192.168.2.9
May 29, 2024 15:26:15.852899075 CEST	58449	443	192.168.2.9	216.239.36.181
May 29, 2024 15:26:15.852904081 CEST	443	58449	216.239.36.181	192.168.2.9
May 29, 2024 15:26:15.853130102 CEST	443	58449	216.239.36.181	192.168.2.9
May 29, 2024 15:26:15.853171110 CEST	58449	443	192.168.2.9	216.239.36.181
May 29, 2024 15:26:15.952425957 CEST	443	58450	216.239.36.181	192.168.2.9
May 29, 2024 15:26:15.952685118 CEST	443	58450	216.239.36.181	192.168.2.9
May 29, 2024 15:26:15.952852964 CEST	58450	443	192.168.2.9	216.239.36.181
May 29, 2024 15:26:15.952852964 CEST	58450	443	192.168.2.9	216.239.36.181
May 29, 2024 15:26:15.952931881 CEST	58450	443	192.168.2.9	216.239.36.181
May 29, 2024 15:26:16.012717009 CEST	443	58446	142.250.184.238	192.168.2.9
May 29, 2024 15:26:16.012799978 CEST	58446	443	192.168.2.9	142.250.184.238
May 29, 2024 15:26:16.012816906 CEST	443	58446	142.250.184.238	192.168.2.9
May 29, 2024 15:26:16.013423920 CEST	443	58446	142.250.184.238	192.168.2.9
May 29, 2024 15:26:16.013601065 CEST	58446	443	192.168.2.9	142.250.184.238
May 29, 2024 15:26:16.013601065 CEST	58446	443	192.168.2.9	142.250.184.238
May 29, 2024 15:26:16.095731020 CEST	443	49836	108.139.243.30	192.168.2.9
May 29, 2024 15:26:16.095757961 CEST	443	49836	108.139.243.30	192.168.2.9
May 29, 2024 15:26:16.095901966 CEST	49836	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:16.095918894 CEST	443	49836	108.139.243.30	192.168.2.9
May 29, 2024 15:26:16.096206903 CEST	49836	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:16.104279041 CEST	443	49836	108.139.243.30	192.168.2.9
May 29, 2024 15:26:16.104347944 CEST	443	49836	108.139.243.30	192.168.2.9
May 29, 2024 15:26:16.104370117 CEST	49836	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:16.104837894 CEST	49836	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:16.104837894 CEST	49836	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:16.127264977 CEST	58459	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:16.127299070 CEST	443	58459	108.139.243.30	192.168.2.9
May 29, 2024 15:26:16.127571106 CEST	58459	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:16.127582073 CEST	58460	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:16.127610922 CEST	443	58460	108.139.243.30	192.168.2.9
May 29, 2024 15:26:16.127736092 CEST	58460	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:16.127938032 CEST	58459	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:16.127953053 CEST	443	58459	108.139.243.30	192.168.2.9
May 29, 2024 15:26:16.128068924 CEST	58460	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:16.128078938 CEST	443	58460	108.139.243.30	192.168.2.9
May 29, 2024 15:26:16.135873079 CEST	443	58454	142.250.186.130	192.168.2.9
May 29, 2024 15:26:16.135972977 CEST	58454	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:16.136646032 CEST	443	58454	142.250.186.130	192.168.2.9
May 29, 2024 15:26:16.136763096 CEST	58454	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:16.139805079 CEST	58454	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:16.139805079 CEST	58454	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:16.139815092 CEST	443	58454	142.250.186.130	192.168.2.9
May 29, 2024 15:26:16.139831066 CEST	443	58454	142.250.186.130	192.168.2.9
May 29, 2024 15:26:16.140053988 CEST	443	58454	142.250.186.130	192.168.2.9
May 29, 2024 15:26:16.140486002 CEST	58454	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:16.153615952 CEST	443	58453	142.250.186.130	192.168.2.9
May 29, 2024 15:26:16.153676987 CEST	58453	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:16.154396057 CEST	443	58453	142.250.186.130	192.168.2.9
May 29, 2024 15:26:16.154444933 CEST	58453	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:16.157319069 CEST	58453	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:16.157326937 CEST	443	58453	142.250.186.130	192.168.2.9
May 29, 2024 15:26:16.157589912 CEST	443	58453	142.250.186.130	192.168.2.9
May 29, 2024 15:26:16.157635927 CEST	58453	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:16.314546108 CEST	58446	443	192.168.2.9	142.250.184.238
May 29, 2024 15:26:16.314568996 CEST	443	58446	142.250.184.238	192.168.2.9
May 29, 2024 15:26:16.358036041 CEST	443	58454	142.250.186.130	192.168.2.9
May 29, 2024 15:26:16.358102083 CEST	58454	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:16.358129978 CEST	443	58454	142.250.186.130	192.168.2.9
May 29, 2024 15:26:16.358201027 CEST	58454	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:16.358748913 CEST	58454	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:16.358792067 CEST	443	58454	142.250.186.130	192.168.2.9
May 29, 2024 15:26:16.358938932 CEST	443	58454	142.250.186.130	192.168.2.9
May 29, 2024 15:26:16.358961105 CEST	58454	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:16.358998060 CEST	58454	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:16.414864063 CEST	49836	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:16.414885998 CEST	443	49836	108.139.243.30	192.168.2.9
May 29, 2024 15:26:16.880109072 CEST	443	58459	108.139.243.30	192.168.2.9
May 29, 2024 15:26:16.880228996 CEST	58459	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:16.880935907 CEST	58459	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:16.880944967 CEST	443	58459	108.139.243.30	192.168.2.9
May 29, 2024 15:26:16.883557081 CEST	58459	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:16.883569956 CEST	443	58459	108.139.243.30	192.168.2.9
May 29, 2024 15:26:16.921135902 CEST	443	58460	108.139.243.30	192.168.2.9
May 29, 2024 15:26:16.921891928 CEST	58460	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:17.004020929 CEST	58460	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:17.004044056 CEST	443	58460	108.139.243.30	192.168.2.9
May 29, 2024 15:26:17.217057943 CEST	443	58459	108.139.243.30	192.168.2.9
May 29, 2024 15:26:17.217113972 CEST	443	58459	108.139.243.30	192.168.2.9
May 29, 2024 15:26:17.217252016 CEST	58459	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:17.217252016 CEST	58459	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:17.318212986 CEST	58459	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:17.318238974 CEST	443	58459	108.139.243.30	192.168.2.9
May 29, 2024 15:26:17.397008896 CEST	58442	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:17.440509081 CEST	443	58442	74.125.206.155	192.168.2.9
May 29, 2024 15:26:17.574590921 CEST	443	58442	74.125.206.155	192.168.2.9
May 29, 2024 15:26:17.574651003 CEST	58442	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:17.574665070 CEST	443	58442	74.125.206.155	192.168.2.9
May 29, 2024 15:26:17.574676991 CEST	443	58442	74.125.206.155	192.168.2.9
May 29, 2024 15:26:17.574724913 CEST	58442	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:17.575007915 CEST	58442	443	192.168.2.9	74.125.206.155
May 29, 2024 15:26:17.575020075 CEST	443	58442	74.125.206.155	192.168.2.9
May 29, 2024 15:26:17.580691099 CEST	49800	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:17.628516912 CEST	443	49800	142.250.181.228	192.168.2.9
May 29, 2024 15:26:17.789515018 CEST	443	49800	142.250.181.228	192.168.2.9
May 29, 2024 15:26:17.789611101 CEST	49800	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:17.789622068 CEST	443	49800	142.250.181.228	192.168.2.9
May 29, 2024 15:26:17.789674997 CEST	49800	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:17.789756060 CEST	443	49800	142.250.181.228	192.168.2.9
May 29, 2024 15:26:17.789797068 CEST	443	49800	142.250.181.228	192.168.2.9
May 29, 2024 15:26:17.789848089 CEST	49800	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:17.789879084 CEST	49800	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:17.790654898 CEST	49800	443	192.168.2.9	142.250.181.228
May 29, 2024 15:26:17.790668964 CEST	443	49800	142.250.181.228	192.168.2.9
May 29, 2024 15:26:20.442509890 CEST	49820	443	192.168.2.9	34.117.39.58
May 29, 2024 15:26:20.445760965 CEST	49753	80	192.168.2.9	104.122.38.56
May 29, 2024 15:26:20.445918083 CEST	49754	80	192.168.2.9	104.122.38.56
May 29, 2024 15:26:20.446304083 CEST	49838	443	192.168.2.9	157.240.252.13
May 29, 2024 15:26:20.446347952 CEST	49781	443	192.168.2.9	172.64.155.119
May 29, 2024 15:26:20.446460962 CEST	49792	443	192.168.2.9	52.214.218.223
May 29, 2024 15:26:20.446508884 CEST	49805	443	192.168.2.9	18.245.175.102
May 29, 2024 15:26:20.446508884 CEST	58453	443	192.168.2.9	142.250.186.130
May 29, 2024 15:26:20.446548939 CEST	49812	443	192.168.2.9	20.50.2.44
May 29, 2024 15:26:20.446614027 CEST	58460	443	192.168.2.9	108.139.243.30
May 29, 2024 15:26:20.446614027 CEST	49823	443	192.168.2.9	216.58.206.34
May 29, 2024 15:26:20.446669102 CEST	58444	443	192.168.2.9	104.19.178.52
May 29, 2024 15:26:20.446696043 CEST	49828	443	192.168.2.9	18.165.183.15
May 29, 2024 15:26:20.446710110 CEST	49834	443	192.168.2.9	172.217.18.6
May 29, 2024 15:26:20.446743965 CEST	58449	443	192.168.2.9	216.239.36.181

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 29, 2024 15:24:57.973355055 CEST	58446	53	192.168.2.9	1.1.1.1
May 29, 2024 15:24:57.976658106 CEST	51724	53	192.168.2.9	1.1.1.1
May 29, 2024 15:24:58.139822960 CEST	63338	53	192.168.2.9	1.1.1.1
May 29, 2024 15:24:58.142513037 CEST	54126	53	192.168.2.9	1.1.1.1
May 29, 2024 15:25:44.728435993 CEST	56693	53	192.168.2.9	1.1.1.1
May 29, 2024 15:25:44.733536005 CEST	61078	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:07.848474026 CEST	49479	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:07.857023954 CEST	53	49479	1.1.1.1	192.168.2.9
May 29, 2024 15:26:08.585666895 CEST	62873	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:10.254029989 CEST	50651	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:10.257015944 CEST	52252	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:10.261027098 CEST	53	50651	1.1.1.1	192.168.2.9
May 29, 2024 15:26:10.267075062 CEST	50152	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:11.616103888 CEST	60151	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:11.622050047 CEST	50547	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:11.623734951 CEST	53	60151	1.1.1.1	192.168.2.9
May 29, 2024 15:26:11.735321045 CEST	59884	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:11.742561102 CEST	53	59884	1.1.1.1	192.168.2.9
May 29, 2024 15:26:12.536525965 CEST	64440	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:12.538315058 CEST	64604	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:12.568994045 CEST	53	64440	1.1.1.1	192.168.2.9
May 29, 2024 15:26:13.080240011 CEST	62164	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:13.087291002 CEST	53	62164	1.1.1.1	192.168.2.9
May 29, 2024 15:26:13.107723951 CEST	59484	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:13.114926100 CEST	53	59484	1.1.1.1	192.168.2.9
May 29, 2024 15:26:13.181950092 CEST	53382	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:13.187868118 CEST	50106	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:13.189207077 CEST	53	53382	1.1.1.1	192.168.2.9
May 29, 2024 15:26:13.196593046 CEST	53	50106	1.1.1.1	192.168.2.9
May 29, 2024 15:26:13.965853930 CEST	60146	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:13.973762035 CEST	53	60146	1.1.1.1	192.168.2.9
May 29, 2024 15:26:14.020287991 CEST	57539	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:14.027440071 CEST	53	57539	1.1.1.1	192.168.2.9
May 29, 2024 15:26:14.042428970 CEST	49820	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:14.053392887 CEST	53	49820	1.1.1.1	192.168.2.9
May 29, 2024 15:26:14.236124992 CEST	50005	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:14.244456053 CEST	53	50005	1.1.1.1	192.168.2.9
May 29, 2024 15:26:14.483333111 CEST	61394	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:14.509696960 CEST	53	61394	1.1.1.1	192.168.2.9
May 29, 2024 15:26:14.533860922 CEST	64762	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:14.542810917 CEST	53	64762	1.1.1.1	192.168.2.9
May 29, 2024 15:26:14.550882101 CEST	50842	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:14.558456898 CEST	53	50842	1.1.1.1	192.168.2.9
May 29, 2024 15:26:14.650619984 CEST	55878	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:14.874671936 CEST	60921	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:14.881762028 CEST	53	60921	1.1.1.1	192.168.2.9
May 29, 2024 15:26:14.882148981 CEST	59382	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:14.889146090 CEST	53	59382	1.1.1.1	192.168.2.9
May 29, 2024 15:26:15.043925047 CEST	64031	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:15.051182032 CEST	53	64031	1.1.1.1	192.168.2.9
May 29, 2024 15:26:15.488117933 CEST	56120	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:15.495210886 CEST	53	56120	1.1.1.1	192.168.2.9
May 29, 2024 15:26:19.107115984 CEST	63915	53	192.168.2.9	1.1.1.1
May 29, 2024 15:26:19.967184067 CEST	60907	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 29, 2024 15:24:57.973355055 CEST	192.168.2.9	1.1.1.1	0x514d	Standard query (0)	assets.onestore.ms	A (IP address)	IN (0x0001)	false
May 29, 2024 15:24:57.976658106 CEST	192.168.2.9	1.1.1.1	0x6c18	Standard query (0)	ajax.aspnetcdn.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:24:58.139822960 CEST	192.168.2.9	1.1.1.1	0x2395	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:24:58.142513037 CEST	192.168.2.9	1.1.1.1	0xc44e	Standard query (0)	c.s-microsoft.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:25:44.728435993 CEST	192.168.2.9	1.1.1.1	0xd580	Standard query (0)	assets.onestore.ms	A (IP address)	IN (0x0001)	false
May 29, 2024 15:25:44.733536005 CEST	192.168.2.9	1.1.1.1	0x93da	Standard query (0)	c.s-microsoft.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:07.848474026 CEST	192.168.2.9	1.1.1.1	0x5bbb	Standard query (0)	avast.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:08.585666895 CEST	192.168.2.9	1.1.1.1	0xd8e	Standard query (0)	www.avast.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:10.254029989 CEST	192.168.2.9	1.1.1.1	0xc856	Standard query (0)	cdn.cookielaw.org	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:10.257015944 CEST	192.168.2.9	1.1.1.1	0x1211	Standard query (0)	static3.avast.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:10.267075062 CEST	192.168.2.9	1.1.1.1	0x8fde	Standard query (0)	assets.adobedtm.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:11.616103888 CEST	192.168.2.9	1.1.1.1	0x7a42	Standard query (0)	dpm.demdex.net	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:11.622050047 CEST	192.168.2.9	1.1.1.1	0x9387	Standard query (0)	www.nortonlifelock.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:11.735321045 CEST	192.168.2.9	1.1.1.1	0x2c03	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:12.536525965 CEST	192.168.2.9	1.1.1.1	0x1d84	Standard query (0)	symantec.demdex.net	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:12.538315058 CEST	192.168.2.9	1.1.1.1	0x4fe5	Standard query (0)	cm.everesttech.net	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:13.080240011 CEST	192.168.2.9	1.1.1.1	0xe012	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:13.107723951 CEST	192.168.2.9	1.1.1.1	0xf2c5	Standard query (0)	static.hotjar.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:13.181950092 CEST	192.168.2.9	1.1.1.1	0xe60a	Standard query (0)	s.yimg.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:13.187868118 CEST	192.168.2.9	1.1.1.1	0x87d5	Standard query (0)	mstatic.avast.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:13.965853930 CEST	192.168.2.9	1.1.1.1	0x5a3d	Standard query (0)	www.upsellit.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.020287991 CEST	192.168.2.9	1.1.1.1	0xe8e2	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.042428970 CEST	192.168.2.9	1.1.1.1	0x6600	Standard query (0)	analytics.ff.avast.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.236124992 CEST	192.168.2.9	1.1.1.1	0xf679	Standard query (0)	script.hotjar.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.483333111 CEST	192.168.2.9	1.1.1.1	0x3580	Standard query (0)	4711400.fls.doubleclick.net	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.533860922 CEST	192.168.2.9	1.1.1.1	0x58f	Standard query (0)	widget.trustpilot.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.550882101 CEST	192.168.2.9	1.1.1.1	0xd221	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.650619984 CEST	192.168.2.9	1.1.1.1	0x9036	Standard query (0)	cdn.jsdelivr.net	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.874671936 CEST	192.168.2.9	1.1.1.1	0x2ac3	Standard query (0)	analytics.google.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.882148981 CEST	192.168.2.9	1.1.1.1	0x15d9	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:15.043925047 CEST	192.168.2.9	1.1.1.1	0xea7c	Standard query (0)	ampcid.google.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:15.488117933 CEST	192.168.2.9	1.1.1.1	0xa34d	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:19.107115984 CEST	192.168.2.9	1.1.1.1	0x146b	Standard query (0)	znb3hblkjhhpwrz9k-gendigital.siteintercept.qualtrics.com	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:19.967184067 CEST	192.168.2.9	1.1.1.1	0xae56	Standard query (0)	siteintercept.qualtrics.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 29, 2024 15:24:57.980851889 CEST	1.1.1.1	192.168.2.9	0x514d	No error (0)	assets.onestore.ms	assets.onestore.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:24:57.983557940 CEST	1.1.1.1	192.168.2.9	0x6c18	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:24:58.064909935 CEST	1.1.1.1	192.168.2.9	0x9d23	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:24:58.064909935 CEST	1.1.1.1	192.168.2.9	0x9d23	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:24:58.064909935 CEST	1.1.1.1	192.168.2.9	0x9d23	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
May 29, 2024 15:24:58.146630049 CEST	1.1.1.1	192.168.2.9	0x2395	No error (0)	js.monitor.azure.com	aijscdn2.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:24:58.146630049 CEST	1.1.1.1	192.168.2.9	0x2395	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:24:58.146630049 CEST	1.1.1.1	192.168.2.9	0x2395	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
May 29, 2024 15:24:58.152703047 CEST	1.1.1.1	192.168.2.9	0xc44e	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:25:44.737370014 CEST	1.1.1.1	192.168.2.9	0xd580	No error (0)	assets.onestore.ms	assets.onestore.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:25:44.742656946 CEST	1.1.1.1	192.168.2.9	0x93da	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:07.857023954 CEST	1.1.1.1	192.168.2.9	0x5bbb	No error (0)	avast.com		104.122.38.56	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:08.594569921 CEST	1.1.1.1	192.168.2.9	0xd8e	No error (0)	www.avast.com	www.avast.com-2.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:10.261027098 CEST	1.1.1.1	192.168.2.9	0xc856	No error (0)	cdn.cookielaw.org		104.19.178.52	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:10.261027098 CEST	1.1.1.1	192.168.2.9	0xc856	No error (0)	cdn.cookielaw.org		104.19.177.52	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:10.266546965 CEST	1.1.1.1	192.168.2.9	0x1211	No error (0)	static3.avast.com	static3.avast.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:10.274173021 CEST	1.1.1.1	192.168.2.9	0x8fde	No error (0)	assets.adobedtm.com	cn-assets.adobedtm.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:11.623734951 CEST	1.1.1.1	192.168.2.9	0x7a42	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:11.623734951 CEST	1.1.1.1	192.168.2.9	0x7a42	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:11.623734951 CEST	1.1.1.1	192.168.2.9	0x7a42	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:11.623734951 CEST	1.1.1.1	192.168.2.9	0x7a42	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.49.110.165	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:11.623734951 CEST	1.1.1.1	192.168.2.9	0x7a42	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		18.200.225.135	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:11.623734951 CEST	1.1.1.1	192.168.2.9	0x7a42	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		54.220.209.169	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:11.623734951 CEST	1.1.1.1	192.168.2.9	0x7a42	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.31.109.254	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:11.623734951 CEST	1.1.1.1	192.168.2.9	0x7a42	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.19.228.126	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:11.623734951 CEST	1.1.1.1	192.168.2.9	0x7a42	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.31.161.52	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:11.623734951 CEST	1.1.1.1	192.168.2.9	0x7a42	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		108.128.1.237	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:11.623734951 CEST	1.1.1.1	192.168.2.9	0x7a42	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		54.228.84.202	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:11.638825893 CEST	1.1.1.1	192.168.2.9	0x9387	No error (0)	www.nortonlifelock.com	www.nortonlifelock.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:11.742561102 CEST	1.1.1.1	192.168.2.9	0x2c03	No error (0)	geolocation.onetrust.com		172.64.155.119	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:11.742561102 CEST	1.1.1.1	192.168.2.9	0x2c03	No error (0)	geolocation.onetrust.com		104.18.32.137	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:12.546139956 CEST	1.1.1.1	192.168.2.9	0x4fe5	No error (0)	cm.everesttech.net	cm.everesttech.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:12.568994045 CEST	1.1.1.1	192.168.2.9	0x1d84	No error (0)	symantec.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:12.568994045 CEST	1.1.1.1	192.168.2.9	0x1d84	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:12.568994045 CEST	1.1.1.1	192.168.2.9	0x1d84	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:12.568994045 CEST	1.1.1.1	192.168.2.9	0x1d84	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.214.218.223	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:12.568994045 CEST	1.1.1.1	192.168.2.9	0x1d84	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.31.109.254	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:12.568994045 CEST	1.1.1.1	192.168.2.9	0x1d84	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		54.194.31.123	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:12.568994045 CEST	1.1.1.1	192.168.2.9	0x1d84	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.49.110.165	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:12.568994045 CEST	1.1.1.1	192.168.2.9	0x1d84	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		54.220.209.169	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:12.568994045 CEST	1.1.1.1	192.168.2.9	0x1d84	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		34.251.71.27	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:12.568994045 CEST	1.1.1.1	192.168.2.9	0x1d84	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		34.241.3.170	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:12.568994045 CEST	1.1.1.1	192.168.2.9	0x1d84	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.208.77.120	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:13.087291002 CEST	1.1.1.1	192.168.2.9	0xe012	No error (0)	www.google.com		142.250.181.228	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:13.114926100 CEST	1.1.1.1	192.168.2.9	0xf2c5	No error (0)	static.hotjar.com	static-cdn.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:13.114926100 CEST	1.1.1.1	192.168.2.9	0xf2c5	No error (0)	static-cdn.hotjar.com		18.245.175.102	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:13.114926100 CEST	1.1.1.1	192.168.2.9	0xf2c5	No error (0)	static-cdn.hotjar.com		18.245.175.78	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:13.114926100 CEST	1.1.1.1	192.168.2.9	0xf2c5	No error (0)	static-cdn.hotjar.com		18.245.175.46	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:13.114926100 CEST	1.1.1.1	192.168.2.9	0xf2c5	No error (0)	static-cdn.hotjar.com		18.245.175.16	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:13.189207077 CEST	1.1.1.1	192.168.2.9	0xe60a	No error (0)	s.yimg.com	edge.gycpi.b.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:13.189207077 CEST	1.1.1.1	192.168.2.9	0xe60a	No error (0)	edge.gycpi.b.yahoodns.net		87.248.119.252	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:13.189207077 CEST	1.1.1.1	192.168.2.9	0xe60a	No error (0)	edge.gycpi.b.yahoodns.net		87.248.119.251	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:13.196593046 CEST	1.1.1.1	192.168.2.9	0x87d5	No error (0)	mstatic.avast.com		20.50.2.44	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:13.973762035 CEST	1.1.1.1	192.168.2.9	0x5a3d	No error (0)	www.upsellit.com		34.117.39.58	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.027440071 CEST	1.1.1.1	192.168.2.9	0xe8e2	No error (0)	googleads.g.doubleclick.net		216.58.206.34	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.053392887 CEST	1.1.1.1	192.168.2.9	0x6600	No error (0)	analytics.ff.avast.com	analytics-prod-gcp.ff.avast.com		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:14.053392887 CEST	1.1.1.1	192.168.2.9	0x6600	No error (0)	analytics-prod-gcp.ff.avast.com		34.117.223.223	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.244456053 CEST	1.1.1.1	192.168.2.9	0xf679	No error (0)	script.hotjar.com		18.165.183.15	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.244456053 CEST	1.1.1.1	192.168.2.9	0xf679	No error (0)	script.hotjar.com		18.165.183.49	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.244456053 CEST	1.1.1.1	192.168.2.9	0xf679	No error (0)	script.hotjar.com		18.165.183.129	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.244456053 CEST	1.1.1.1	192.168.2.9	0xf679	No error (0)	script.hotjar.com		18.165.183.87	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.509696960 CEST	1.1.1.1	192.168.2.9	0x3580	No error (0)	4711400.fls.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:14.509696960 CEST	1.1.1.1	192.168.2.9	0x3580	No error (0)	dart.l.doubleclick.net		172.217.18.6	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.542810917 CEST	1.1.1.1	192.168.2.9	0x58f	No error (0)	widget.trustpilot.com		108.139.243.30	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.542810917 CEST	1.1.1.1	192.168.2.9	0x58f	No error (0)	widget.trustpilot.com		108.139.243.56	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.542810917 CEST	1.1.1.1	192.168.2.9	0x58f	No error (0)	widget.trustpilot.com		108.139.243.21	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.542810917 CEST	1.1.1.1	192.168.2.9	0x58f	No error (0)	widget.trustpilot.com		108.139.243.98	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.558456898 CEST	1.1.1.1	192.168.2.9	0xd221	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:14.558456898 CEST	1.1.1.1	192.168.2.9	0xd221	No error (0)	scontent.xx.fbcdn.net		157.240.252.13	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.657676935 CEST	1.1.1.1	192.168.2.9	0x9036	No error (0)	cdn.jsdelivr.net	cdn.jsdelivr.net.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:14.889146090 CEST	1.1.1.1	192.168.2.9	0x15d9	No error (0)	stats.g.doubleclick.net		74.125.206.155	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.889146090 CEST	1.1.1.1	192.168.2.9	0x15d9	No error (0)	stats.g.doubleclick.net		74.125.206.157	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.889146090 CEST	1.1.1.1	192.168.2.9	0x15d9	No error (0)	stats.g.doubleclick.net		74.125.206.154	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:14.889146090 CEST	1.1.1.1	192.168.2.9	0x15d9	No error (0)	stats.g.doubleclick.net		74.125.206.156	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:15.051182032 CEST	1.1.1.1	192.168.2.9	0xea7c	No error (0)	ampcid.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:15.495210886 CEST	1.1.1.1	192.168.2.9	0xa34d	No error (0)	adservice.google.com		142.250.186.130	A (IP address)	IN (0x0001)	false
May 29, 2024 15:26:19.117166042 CEST	1.1.1.1	192.168.2.9	0x146b	No error (0)	znb3hblkjhhpwrz9k-gendigital.siteintercept.qualtrics.com	siteintercept.qprod2.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:19.117166042 CEST	1.1.1.1	192.168.2.9	0x146b	No error (0)	siteintercept.qprod2.net	prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:19.974153996 CEST	1.1.1.1	192.168.2.9	0xae56	No error (0)	siteintercept.qualtrics.com	siteintercept.qprod2.net		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 15:26:19.974153996 CEST	1.1.1.1	192.168.2.9	0xae56	No error (0)	siteintercept.qprod2.net	prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

wcpstatic.microsoft.com

js.monitor.azure.com

cdn.cookielaw.org

geolocation.onetrust.com

dpm.demdex.net

symantec.demdex.net

www.google.com

static.hotjar.com

s.yimg.com

mstatic.avast.com

www.upsellit.com

analytics.ff.avast.com

googleads.g.doubleclick.net

script.hotjar.com

4711400.fls.doubleclick.net

connect.facebook.net

widget.trustpilot.com

stats.g.doubleclick.net

ampcid.google.com

analytics.google.com

adservice.google.com

avast.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49753	104.122.38.56	80	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
May 29, 2024 15:26:07.873198032 CEST	433	OUT	GET /images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: avast.com Connection: Keep-Alive
May 29, 2024 15:26:08.572679996 CEST	758	IN	HTTP/1.1 301 Moved Permanently Server: Google Frontend Content-Type: text/html Content-Length: 175 Location: http://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi x-redirect-by: Redman x-origin-cache: redman-prod-96-d5xf x-cloud-trace-context: 36cfd52c836e11666a928e7c9fd81e94/3079907563581942774 traceparent: 00-36cfd52c836e11666a928e7c9fd81e94-2abe079c6c572bf6-00 Date: Wed, 29 May 2024 13:26:08 GMT Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 39 2e 33 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty/1.19.3.1</center></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49723	13.107.246.45	443	2552	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:24:58 UTC	531	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: https://www.microsoft.com/images/fmgSs_2BZ3KjVxH/wHKkQ2B1uFMy7FTfvh/sDI1FTCZR/I89wys9_2BKDqr00ppU8/aclhk8xtXfWJvSN_2BB/_2BeW5YNyQMfCbr8JTsTk5/j9IVMv21hSYQw/o93EGoMO/FQluQM82vi57OIE1eg6jgjU/K4vGAWxNl2/B.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: wcpstatic.microsoft.com Connection: Keep-Alive Cookie: MS-CV=srX4Mi324EutVIl7.1
2024-05-29 13:24:58 UTC	713	IN	HTTP/1.1 200 OK Date: Wed, 29 May 2024 13:24:58 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 29771 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 347178c2-401e-0094-7d86-b17280000000 x-ms-version: 2009-09-19 x-azure-ref: 20240529T132458Z-16f669959b427jgr80kzk67y440000000du000000000s678 Accept-Ranges: bytes
2024-05-29 13:24:58 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-05-29 13:24:58 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-05-29 13:24:58 UTC	16384	IN	Data Raw: 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c Data Ascii: or"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + l
2024-05-29 13:24:58 UTC	4278	IN	Data Raw: 65 6d 65 6e 74 42 79 49 64 28 22 77 63 70 43 6f 6e 73 65 6e 74 42 61 6e 6e 65 72 43 74 72 6c 22 29 7d 2c 65 2e 65 6d 69 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6f 3d 31 3b 6f 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 74 5b 6f 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 3b 76 61 72 20 6e 3d 74 68 69 73 2e 65 76 65 6e 74 73 5b 65 5d 3b 6e 26 26 6e 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 74 29 7d 29 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 65 2e 61 64 64 45 76 65 6e 74 Data Ascii: ementById("wcpConsentBannerCtrl")},e.emit=function(e){for(var t=[],o=1;o<arguments.length;o++)t[o-1]=arguments[o];var n=this.events[e];n&&n.forEach((function(e){e.apply(null,t)}))},e.prototype.addEventListener=function(e,t,o){e.addEventListener?e.addEvent

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49727	13.107.246.45	443	2552	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:24:58 UTC	491	OUT	GET /next/1/ms.jsll-3.min.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: https://www.microsoft.com/images/fmgSs_2BZ3KjVxH/wHKkQ2B1uFMy7FTfvh/sDI1FTCZR/I89wys9_2BKDqr00ppU8/aclhk8xtXfWJvSN_2BB/_2BeW5YNyQMfCbr8JTsTk5/j9IVMv21hSYQw/o93EGoMO/FQluQM82vi57OIE1eg6jgjU/K4vGAWxNl2/B.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: js.monitor.azure.com Connection: Keep-Alive
2024-05-29 13:24:58 UTC	948	IN	HTTP/1.1 200 OK Date: Wed, 29 May 2024 13:24:58 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 185160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=1800, immutable, no-transform Last-Modified: Mon, 18 Mar 2024 21:32:56 GMT ETag: 0x8DC4792F9DC7438 x-ms-request-id: 984a3394-601e-0096-3be7-af2484000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 3.2.17 x-ms-meta-jssdksrc: [cdn]/next/1/ms.jsll-3.2.17.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240529T132458Z-16f669959b4k284257wnqd0qt8000000065000000000a23k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_REVALIDATED_HIT Accept-Ranges: bytes
2024-05-29 13:24:58 UTC	15436	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 33 2e 32 2e 31 37 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 Data Ascii: /! 1DS JSLL SKU, 3.2.17 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&def
2024-05-29 13:24:59 UTC	16384	IN	Data Raw: 3e 3e 30 2c 6e 3d 30 29 3b 72 65 74 75 72 6e 20 72 7d 76 61 72 20 57 72 3d 65 2c 47 72 3d 22 32 2e 38 2e 31 38 22 2c 58 72 3d 22 2e 22 2b 4b 72 28 36 29 2c 51 72 3d 30 3b 66 75 6e 63 74 69 6f 6e 20 4a 72 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 5b 4d 5d 7c 7c 39 3d 3d 3d 65 5b 4d 5d 7c 7c 21 2b 65 5b 4d 5d 7d 66 75 6e 63 74 69 6f 6e 20 59 72 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 4d 74 28 65 2b 51 72 2b 2b 2b 28 28 74 3d 76 6f 69 64 20 30 21 3d 3d 74 26 26 74 29 3f 22 2e 22 2b 47 72 3a 70 29 2b 58 72 29 7d 66 75 6e 63 74 69 6f 6e 20 24 72 28 65 29 7b 76 61 72 20 61 3d 7b 69 64 3a 59 72 28 22 5f 61 69 44 61 74 61 2d 22 2b 28 65 7c 7c 70 29 2b 22 2e 22 2b 47 72 29 2c 61 63 63 65 70 74 3a 4a 72 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e Data Ascii: >>0,n=0);return r}var Wr=e,Gr="2.8.18",Xr="."+Kr(6),Qr=0;function Jr(e){return 1===e[M]\|\|9===e[M]\|\|!+e[M]}function Yr(e,t){return Mt(e+Qr+++((t=void 0!==t&&t)?"."+Gr:p)+Xr)}function $r(e){var a={id:Yr("_aiData-"+(e\|\|p)+"."+Gr),accept:Jr,get:function(e,t,n
2024-05-29 13:24:59 UTC	16384	IN	Data Raw: 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 4e 26 26 74 6e 28 55 61 29 2c 68 5b 68 65 5d 28 29 26 26 74 6e 28 22 43 6f 72 65 20 73 68 6f 75 6c 64 20 6e 6f 74 20 62 65 20 69 6e 69 74 69 61 6c 69 7a 65 64 20 6d 6f 72 65 20 74 68 61 6e 20 6f 6e 63 65 22 29 2c 43 3d 65 7c 7c 7b 7d 2c 68 5b 76 65 5d 3d 43 2c 59 28 65 5b 6d 65 5d 29 26 26 74 6e 28 22 50 6c 65 61 73 65 20 70 72 6f 76 69 64 65 20 69 6e 73 74 72 75 6d 65 6e 74 61 74 69 6f 6e 20 6b 65 79 22 29 2c 69 3d 72 2c 68 5b 4c 61 5d 3d 72 3b 65 3d 5a 74 28 43 2e 64 69 73 61 62 6c 65 44 62 67 45 78 74 29 2c 21 30 3d 3d 3d 65 26 26 50 26 26 28 69 5b 49 65 5d 28 50 29 2c 50 3d 6e 75 6c 6c 29 2c 69 26 26 21 50 26 26 21 30 21 3d 3d 65 26 26 28 50 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 79 72 29 7b 79 72 3d 7b Data Ascii: on(e,t,n,r){N&&tn(Ua),h[he]()&&tn("Core should not be initialized more than once"),C=e\|\|{},h[ve]=C,Y(e[me])&&tn("Please provide instrumentation key"),i=r,h[La]=r;e=Zt(C.disableDbgExt),!0===e&&P&&(i[Ie](P),P=null),i&&!P&&!0!==e&&(P=function(e){if(!yr){yr={
2024-05-29 13:24:59 UTC	16384	IN	Data Raw: 20 74 2c 6e 3d 6e 75 6c 6c 3b 69 66 28 65 29 74 72 79 7b 65 5b 4c 73 5d 3f 6e 3d 7a 73 28 65 5b 4c 73 5d 29 3a 65 5b 4d 73 5d 26 26 65 5b 4d 73 5d 5b 4c 73 5d 3f 6e 3d 7a 73 28 65 5b 4d 73 5d 5b 4c 73 5d 29 3a 65 2e 65 78 63 65 70 74 69 6f 6e 26 26 65 2e 65 78 63 65 70 74 69 6f 6e 5b 4c 73 5d 3f 6e 3d 7a 73 28 65 2e 65 78 63 65 70 74 69 6f 6e 5b 4c 73 5d 29 3a 6a 73 28 65 29 3f 6e 3d 65 3a 6a 73 28 65 5b 55 73 5d 29 3f 6e 3d 65 5b 55 73 5d 3a 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6f 70 65 72 61 26 26 65 5b 48 73 5d 3f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 65 5b 77 6f 5d 28 22 5c 6e 22 29 2c 72 3d 30 3b 72 3c 6e 5b 68 5d 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 6e 5b 72 5d 3b 6e 5b 72 2b 31 5d 26 26 28 69 Data Ascii: t,n=null;if(e)try{e[Ls]?n=zs(e[Ls]):e[Ms]&&e[Ms][Ls]?n=zs(e[Ms][Ls]):e.exception&&e.exception[Ls]?n=zs(e.exception[Ls]):js(e)?n=e:js(e[Us])?n=e[Us]:window&&window.opera&&e[Hs]?n=function(e){for(var t=[],n=e[wo]("\n"),r=0;r<n[h];r++){var i=n[r];n[r+1]&&(i
2024-05-29 13:24:59 UTC	16384	IN	Data Raw: 64 2c 20 74 72 61 63 65 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 76 28 72 29 2c 7b 65 78 63 65 70 74 69 6f 6e 3a 73 65 28 72 29 7d 29 7d 7d 2c 53 2e 74 72 61 63 6b 4d 65 74 72 69 63 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 72 79 7b 76 61 72 20 6e 3d 54 63 28 65 2c 74 63 5b 52 63 5d 2c 74 63 5b 4d 63 5d 2c 53 5b 4c 63 5d 28 29 2c 74 29 3b 53 5b 47 5d 5b 55 63 5d 28 6e 29 7d 63 61 74 63 68 28 72 29 7b 64 28 31 2c 33 36 2c 22 74 72 61 63 6b 4d 65 74 72 69 63 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 76 28 72 29 2c 7b 65 78 63 65 70 74 69 6f 6e 3a 73 65 28 72 29 7d 29 7d 7d 2c 53 5b 56 63 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b Data Ascii: d, trace will not be collected: "+v(r),{exception:se(r)})}},S.trackMetric=function(e,t){try{var n=Tc(e,tc[Rc],tc[Mc],S[Lc](),t);S[G][Uc](n)}catch(r){d(1,36,"trackMetric failed, metric will not be collected: "+v(r),{exception:se(r)})}},S[Vc]=function(e,t){
2024-05-29 13:24:59 UTC	16384	IN	Data Raw: 26 28 61 2e 73 79 6e 63 3d 33 29 29 2c 65 26 26 28 61 2e 74 61 72 67 65 74 55 72 69 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 22 22 3b 73 77 69 74 63 68 28 74 2e 74 61 67 4e 61 6d 65 29 7b 63 61 73 65 22 41 22 3a 63 61 73 65 22 41 52 45 41 22 3a 65 3d 74 2e 68 72 65 66 7c 7c 22 22 3b 62 72 65 61 6b 3b 63 61 73 65 22 49 4d 47 22 3a 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 29 7b 76 61 72 20 65 3d 4d 75 28 74 2c 4c 75 29 3b 69 66 28 65 26 26 31 3d 3d 3d 65 2e 6c 65 6e 67 74 68 29 7b 69 66 28 65 5b 30 5d 2e 68 72 65 66 29 72 65 74 75 72 6e 20 65 5b 30 5d 2e 68 72 65 66 3b 69 66 28 65 5b 30 5d 2e 73 72 63 29 72 65 74 75 72 6e 20 65 5b 30 5d 2e 73 72 63 7d 7d 72 65 74 75 72 6e 22 22 7d 28 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 49 4e 50 Data Ascii: &(a.sync=3)),e&&(a.targetUri=function(t){var e="";switch(t.tagName){case"A":case"AREA":e=t.href\|\|"";break;case"IMG":e=function(){if(t){var e=Mu(t,Lu);if(e&&1===e.length){if(e[0].href)return e[0].href;if(e[0].src)return e[0].src}}return""}();break;case"INP
2024-05-29 13:24:59 UTC	16384	IN	Data Raw: 72 61 63 6b 45 76 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 29 7b 6e 2e 6c 61 74 65 6e 63 79 3d 6e 2e 6c 61 74 65 6e 63 79 7c 7c 31 2c 6e 2e 62 61 73 65 44 61 74 61 3d 6e 2e 62 61 73 65 44 61 74 61 7c 7c 7b 7d 2c 6e 2e 64 61 74 61 3d 6e 2e 64 61 74 61 7c 7c 7b 7d 2c 75 65 28 65 29 26 26 65 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 6e 2e 64 61 74 61 5b 65 5d 3d 74 7d 29 2c 66 2e 63 6f 72 65 2e 74 72 61 63 6b 28 6e 29 7d 2c 66 2e 74 72 61 63 6b 50 61 67 65 56 69 65 77 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 49 2e 5f 72 65 63 6f 72 64 54 69 6d 65 53 70 61 6e 28 22 64 77 65 6c 6c 54 69 6d 65 22 2c 21 31 29 2c 54 2e 76 3d 30 2c 69 3d 21 31 2c 66 2e 69 64 2e 69 6e 69 74 69 61 6c 69 7a 65 49 64 73 28 29 2c 65 2e 69 64 3d 66 2e 69 64 2e 67 Data Ascii: rackEvent=function(n,e){n.latency=n.latency\|\|1,n.baseData=n.baseData\|\|{},n.data=n.data\|\|{},ue(e)&&ee(e,function(e,t){n.data[e]=t}),f.core.track(n)},f.trackPageView=function(e,t){I._recordTimeSpan("dwellTime",!1),T.v=0,i=!1,f.id.initializeIds(),e.id=f.id.g
2024-05-29 13:24:59 UTC	16384	IN	Data Raw: 7b 6e 3d 21 30 3b 62 72 65 61 6b 7d 7d 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 56 66 28 65 2c 74 2c 6e 2c 72 29 7b 74 26 26 6e 26 26 30 3c 6e 2e 6c 65 6e 67 74 68 26 26 28 72 26 26 4f 66 5b 74 5d 3f 28 65 2e 68 64 72 73 5b 4f 66 5b 74 5d 5d 3d 6e 2c 65 2e 75 73 65 48 64 72 73 3d 21 30 29 3a 65 2e 75 72 6c 2b 3d 22 26 22 2b 74 2b 22 3d 22 2b 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 48 66 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 26 26 28 48 74 28 74 29 3f 65 3d 5b 74 5d 2e 63 6f 6e 63 61 74 28 65 29 3a 46 28 74 29 26 26 28 65 3d 74 2e 63 6f 6e 63 61 74 28 65 29 29 29 2c 65 7d 4d 66 28 63 66 2c 63 66 2c 21 31 29 2c 4d 66 28 6e 66 2c 6e 66 29 2c 4d 66 28 72 66 2c 22 43 6c 69 65 6e 74 2d 49 64 22 29 2c 4d 66 28 73 66 2c 73 66 29 2c 4d 66 28 61 66 Data Ascii: {n=!0;break}}}return n}function Vf(e,t,n,r){t&&n&&0<n.length&&(r&&Of[t]?(e.hdrs[Of[t]]=n,e.useHdrs=!0):e.url+="&"+t+"="+n)}function Hf(e,t){return t&&(Ht(t)?e=[t].concat(e):F(t)&&(e=t.concat(e))),e}Mf(cf,cf,!1),Mf(nf,nf),Mf(rf,"Client-Id"),Mf(sf,sf),Mf(af
2024-05-29 13:24:59 UTC	16384	IN	Data Raw: 74 5b 31 5d 29 2c 30 3c 3d 6e 26 26 30 3c 3d 74 5b 31 5d 26 26 6e 3e 74 5b 31 5d 26 26 28 6e 3d 74 5b 31 5d 29 2c 74 2e 70 75 73 68 28 6e 29 2c 42 5b 65 5d 3d 74 29 7d 29 7d 2c 6c 2e 66 6c 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 6f 69 64 20 30 3d 3d 3d 65 26 26 28 65 3d 21 30 29 2c 55 7c 7c 28 6e 3d 6e 7c 7c 31 2c 65 3f 6e 75 6c 6c 3d 3d 4c 3f 28 63 28 29 2c 6d 28 31 2c 30 2c 6e 29 2c 4c 3d 73 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4c 3d 6e 75 6c 6c 2c 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 74 29 7b 61 28 31 2c 30 2c 74 29 2c 76 28 29 2c 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 44 2e 69 73 43 6f 6d 70 6c 65 74 65 6c 79 49 64 6c 65 28 29 3f 65 28 29 3a 4c 3d 73 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4c 3d 6e 75 6c 6c 2c 6e 28 65 29 7d 2c Data Ascii: t[1]),0<=n&&0<=t[1]&&n>t[1]&&(n=t[1]),t.push(n),B[e]=t)})},l.flush=function(e,t,n){void 0===e&&(e=!0),U\|\|(n=n\|\|1,e?null==L?(c(),m(1,0,n),L=s(function(){L=null,function r(e,t){a(1,0,t),v(),function n(e){D.isCompletelyIdle()?e():L=s(function(){L=null,n(e)},
2024-05-29 13:24:59 UTC	16384	IN	Data Raw: 2c 61 70 3d 43 74 29 2c 73 70 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 63 70 3d 73 70 3b 66 75 6e 63 74 69 6f 6e 20 75 70 28 74 29 7b 76 61 72 20 6e 3d 70 6f 28 29 2c 72 3d 74 61 28 29 3b 72 65 28 75 70 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 67 65 74 54 72 61 63 65 49 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 26 26 74 2e 67 65 74 54 72 61 63 65 43 74 78 26 26 74 2e 67 65 74 54 72 61 63 65 43 74 78 28 29 2e 67 65 74 54 72 61 63 65 49 64 28 29 7c 7c 72 7d 2c 65 2e 67 65 74 4c 61 73 74 50 61 67 65 56 69 65 77 49 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 7d 7d 29 7d 75 70 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 6c 70 3d 75 70 2c 66 70 3d 22 64 75 72 61 74 69 6f 6e 22 2c 64 70 3d 22 70 72 Data Ascii: ,ap=Ct),sp.__ieDyn=1;var cp=sp;function up(t){var n=po(),r=ta();re(up,this,function(e){e.getTraceId=function(){return t&&t.getTraceCtx&&t.getTraceCtx().getTraceId()\|\|r},e.getLastPageViewId=function(){return n}})}up.__ieDyn=1;var lp=up,fp="duration",dp="pr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49759	104.19.178.52	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:10 UTC	518	OUT	GET /consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/OtAutoBlock.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: cdn.cookielaw.org Connection: Keep-Alive
2024-05-29 13:26:10 UTC	902	IN	HTTP/1.1 200 OK Date: Wed, 29 May 2024 13:26:10 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 88b6d08d9b6242f7-EWR CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 64521 Cache-Control: public, max-age=86400 Expires: Thu, 30 May 2024 13:26:10 GMT Last-Modified: Thu, 20 Apr 2023 14:56:08 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: nZV4I5/fwHZhZNKDDJa7QA== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 13b42d61-d01e-002c-3e0e-15d52c000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-05-29 13:26:10 UTC	467	IN	Data Raw: 37 63 31 61 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 64 29 7b 66 6f 72 28 76 61 72 20 66 2c 61 2c 67 2c 62 2c 63 3d 5b 5d 2c 65 3d 30 3b 65 3c 78 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 7b 76 61 72 20 68 3d 78 5b 65 5d 3b 69 66 28 68 2e 54 61 67 3d 3d 3d 64 29 7b 63 3d 68 2e 43 61 74 65 67 6f 72 79 49 64 3b 62 72 65 61 6b 7d 76 61 72 20 6c 3d 28 66 3d 68 2e 54 61 67 2c 62 3d 67 3d 61 3d 76 6f 69 64 20 30 2c 61 3d 2d 31 21 3d 3d 28 62 3d 66 29 2e 69 6e 64 65 78 4f 66 28 22 68 74 74 70 3a 22 29 3f 62 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 3a 22 2c 22 22 29 3a 62 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 73 3a 22 2c 22 22 29 2c 2d 31 21 3d 3d 28 67 3d 61 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 29 3f 61 2e 72 65 70 6c 61 63 65 Data Ascii: 7c1a!function(){function n(d){for(var f,a,g,b,c=[],e=0;e<x.length;e++){var h=x[e];if(h.Tag===d){c=h.CategoryId;break}var l=(f=h.Tag,b=g=a=void 0,a=-1!==(b=f).indexOf("http:")?b.replace("http:",""):b.replace("https:",""),-1!==(g=a.indexOf("?"))?a.replace
2024-05-29 13:26:10 UTC	1369	IN	Data Raw: 64 65 78 4f 66 28 22 77 77 77 22 29 7c 7c 32 3c 6b 2e 6c 65 6e 67 74 68 3f 6b 2e 73 6c 69 63 65 28 31 29 2e 6a 6f 69 6e 28 22 2e 22 29 3a 0a 76 2e 68 6f 73 74 6e 61 6d 65 7d 28 64 29 3b 41 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 20 6b 3d 3d 3d 72 7d 29 26 26 28 63 3d 5b 22 43 30 30 30 34 22 5d 29 7d 72 65 74 75 72 6e 20 63 7d 66 75 6e 63 74 69 6f 6e 20 6d 28 64 29 7b 72 65 74 75 72 6e 20 64 26 26 77 69 6e 64 6f 77 2e 4f 70 74 61 6e 6f 6e 41 63 74 69 76 65 47 72 6f 75 70 73 26 26 64 2e 65 76 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 66 29 7b 72 65 74 75 72 6e 2d 31 21 3d 3d 77 69 6e 64 6f 77 2e 4f 70 74 61 6e 6f 6e 41 63 74 69 76 65 47 72 6f 75 70 73 2e 69 6e 64 65 78 4f 66 28 66 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 70 28 64 Data Ascii: dexOf("www")\|\|2<k.length?k.slice(1).join("."):v.hostname}(d);A.some(function(k){return k===r})&&(c=["C0004"])}return c}function m(d){return d&&window.OptanonActiveGroups&&d.every(function(f){return-1!==window.OptanonActiveGroups.indexOf(f)})}function p(d
2024-05-29 13:26:10 UTC	1369	IN	Data Raw: 70 6d 2e 64 65 6d 64 65 78 2e 6e 65 74 2f 69 62 73 3a 64 70 69 64 5c 78 33 64 31 33 38 37 30 5c 78 32 36 64 70 75 75 69 64 5c 78 33 64 63 6e 76 72 2d 41 51 45 4b 51 5a 47 64 69 39 79 62 33 41 46 30 58 63 43 6f 41 51 41 38 6b 67 45 5c 78 32 36 67 64 70 72 5f 63 6f 6e 73 65 6e 74 5c 78 33 64 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 62 68 2e 63 6f 6e 74 65 78 74 77 65 62 2e 63 6f 6d 2f 62 68 2f 72 74 73 65 74 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 Data Ascii: pm.demdex.net/ibs:dpid\x3d13870\x26dpuuid\x3dcnvr-AQEKQZGdi9yb3AF0XcCoAQA8kgE\x26gdpr_consent\x3d","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://bh.contextweb.com/bh/rtset","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://sync.1rx.io/usersync
2024-05-29 13:26:10 UTC	1369	IN	Data Raw: 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 2f 63 6f 6e 76 65 72 73 61 6e 74 2f 41 51 45 4b 44 62 4d 47 58 77 39 43 67 77 45 67 7a 72 5a 65 41 51 41 38 6b 67 45 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 2e 74 72 69 62 61 6c 66 75 73 69 6f 6e 2e 63 6f 6d 2f 76 69 73 69 74 6f 72 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 2f 65 6d 62 65 64 2f 34 Data Ascii: 4"],"Vendor":null},{"Tag":"https://sync.1rx.io/usersync/conversant/AQEKDbMGXw9CgwEgzrZeAQA8kgE","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://s.tribalfusion.com/visitor","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.youtube.com/embed/4
2024-05-29 13:26:10 UTC	1369	IN	Data Raw: 72 65 6d 69 75 6d 2d 73 65 63 75 72 69 74 79 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 32 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 64 70 6d 2e 64 65 6d 64 65 78 2e 6e 65 74 2f 69 62 73 3a 64 70 69 64 5c 78 33 64 31 33 38 37 30 5c 78 32 36 64 70 75 75 69 64 5c 78 33 64 63 6e 76 72 2d 41 51 45 4c 5f 6a 44 4c 69 67 69 5f 39 51 45 49 73 6f 7a 6a 41 51 41 38 6b 67 45 5c 78 32 36 67 64 70 72 5f 63 6f 6e 73 65 6e 74 5c 78 33 64 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 61 64 73 2e 73 74 69 63 6b 79 61 64 73 74 76 2e 63 6f 6d 2f 75 73 65 72 2d 72 65 67 69 73 Data Ascii: remium-security","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://dpm.demdex.net/ibs:dpid\x3d13870\x26dpuuid\x3dcnvr-AQEL_jDLigi_9QEIsozjAQA8kgE\x26gdpr_consent\x3d","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://ads.stickyadstv.com/user-regis
2024-05-29 13:26:10 UTC	1369	IN	Data Raw: 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 2f 63 6f 6e 76 65 72 73 61 6e 74 2f 41 51 45 4c 5f 6a 44 4c 6f 42 4f 47 6c 41 45 37 4d 30 38 64 41 51 41 38 6b 67 45 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 33 2e 61 76 61 73 74 2e 63 6f 6d 2f 6c 2f 37 33 34 36 32 2f 32 30 32 30 2d 30 36 2d 30 31 2f 39 78 77 34 36 67 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 6d 61 74 63 Data Ascii: "C0004"],"Vendor":null},{"Tag":"https://sync.1rx.io/usersync/conversant/AQEL_jDLoBOGlAE7M08dAQA8kgE","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www3.avast.com/l/73462/2020-06-01/9xw46g","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://matc
2024-05-29 13:26:10 UTC	1369	IN	Data Raw: 74 74 70 73 3a 2f 2f 64 70 6d 2e 64 65 6d 64 65 78 2e 6e 65 74 2f 69 62 73 3a 64 70 69 64 5c 78 33 64 31 33 38 37 30 5c 78 32 36 64 70 75 75 69 64 5c 78 33 64 63 6e 76 72 2d 41 51 45 4b 54 55 6a 36 33 6c 35 68 38 77 45 47 77 43 5a 5a 41 51 41 38 6b 67 45 5c 78 32 36 67 64 70 72 5f 63 6f 6e 73 65 6e 74 5c 78 33 64 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 2f 63 6f 6e 76 65 72 73 61 6e 74 2f 41 51 45 4b 4e 53 42 43 48 33 42 75 71 67 46 70 31 55 31 6a 41 51 41 38 6b 67 45 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e Data Ascii: ttps://dpm.demdex.net/ibs:dpid\x3d13870\x26dpuuid\x3dcnvr-AQEKTUj63l5h8wEGwCZZAQA8kgE\x26gdpr_consent\x3d","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://sync.1rx.io/usersync/conversant/AQEKNSBCH3BuqgFp1U1jAQA8kgE","CategoryId":["C0004"],"Vendor":n
2024-05-29 13:26:10 UTC	1369	IN	Data Raw: 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 2f 63 6f 6e 76 65 72 73 61 6e 74 2f 41 51 45 4c 39 59 68 74 30 45 59 65 65 67 46 6f 64 37 62 69 41 51 41 38 6b 67 45 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 69 62 2e 61 64 6e 78 73 2e 63 6f 6d 2f 73 65 74 75 69 64 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 Data Ascii: oryId":["C0004"],"Vendor":null},{"Tag":"https://sync.1rx.io/usersync/conversant/AQEL9Yht0EYeegFod7biAQA8kgE","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://ib.adnxs.com/setuid","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://sync.1rx.io/users
2024-05-29 13:26:10 UTC	1369	IN	Data Raw: 73 3a 2f 2f 64 70 6d 2e 64 65 6d 64 65 78 2e 6e 65 74 2f 69 62 73 3a 64 70 69 64 5c 78 33 64 31 33 38 37 30 5c 78 32 36 64 70 75 75 69 64 5c 78 33 64 63 6e 76 72 2d 41 51 45 4c 39 59 68 74 37 78 62 57 79 67 46 65 55 4a 78 70 41 51 41 38 6b 67 45 5c 78 32 36 67 64 70 72 5f 63 6f 6e 73 65 6e 74 5c 78 33 64 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 79 6e 63 2e 31 72 78 2e 69 6f 2f 75 73 65 72 73 79 6e 63 2f 63 6f 6e 76 65 72 73 61 6e 74 2f 41 51 45 4b 47 76 6e 61 4b 70 4f 5a 52 51 45 4a 54 6f 77 4a 41 51 41 38 6b 67 45 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c Data Ascii: s://dpm.demdex.net/ibs:dpid\x3d13870\x26dpuuid\x3dcnvr-AQEL9Yht7xbWygFeUJxpAQA8kgE\x26gdpr_consent\x3d","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://sync.1rx.io/usersync/conversant/AQEKGvnaKpOZRQEJTowJAQA8kgE","CategoryId":["C0004"],"Vendor":null
2024-05-29 13:26:10 UTC	1369	IN	Data Raw: 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 33 2e 61 76 61 73 74 2e 63 6f 6d 2f 6c 2f 37 33 34 36 32 2f 32 30 32 31 2d 30 31 2d 30 38 2f 63 37 72 74 6e 70 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 33 2e 61 76 61 73 74 2e 63 6f 6d 2f 31 30 30 30 32 34 34 30 2f 77 65 62 2f 6a 2f 6a 71 75 65 72 79 2e 6a 73 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 33 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 64 70 6d 2e 64 65 6d 64 65 78 2e 6e 65 74 2f 69 62 Data Ascii: d":["C0004"],"Vendor":null},{"Tag":"https://www3.avast.com/l/73462/2021-01-08/c7rtnp","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://static3.avast.com/10002440/web/j/jquery.js","CategoryId":["C0003"],"Vendor":null},{"Tag":"https://dpm.demdex.net/ib

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49758	104.19.178.52	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:10 UTC	487	OUT	GET /scripttemplates/otSDKStub.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: cdn.cookielaw.org Connection: Keep-Alive
2024-05-29 13:26:10 UTC	860	IN	HTTP/1.1 200 OK Date: Wed, 29 May 2024 13:26:10 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Content-MD5: YmFgVUTeB0lXZXM9YgX19A== Last-Modified: Mon, 27 May 2024 07:09:00 GMT x-ms-request-id: 0bf03353-f01e-003c-0d50-b0f5b2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * CF-Cache-Status: HIT Age: 11 Expires: Thu, 30 May 2024 13:26:10 GMT Cache-Control: public, max-age=86400 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 88b6d08dadea8c41-EWR
2024-05-29 13:26:10 UTC	509	IN	Data Raw: 35 32 65 65 0d 0a 76 61 72 20 4f 6e 65 54 72 75 73 74 53 74 75 62 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 2c 6f 2c 70 3d 6e 65 77 20 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 3d 22 4f 70 74 61 6e 6f 6e 43 6f 6e 73 65 6e 74 22 2c 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 48 74 6d 6c 47 72 6f 75 70 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 48 6f 73 74 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 67 65 6e 56 65 6e 64 6f 72 73 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 76 65 6e 64 6f 72 73 53 65 72 76 69 63 65 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 49 41 42 43 6f 6f 6b 69 65 56 61 6c 75 65 3d 22 22 2c 74 68 69 73 2e 6f 6e 65 54 72 75 73 74 49 41 42 Data Ascii: 52eevar OneTrustStub=function(t){"use strict";var a,o,p=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.vendorsServiceData=[],this.IABCookieValue="",this.oneTrustIAB
2024-05-29 13:26:10 UTC	1369	IN	Data Raw: 41 54 22 2c 22 50 4c 22 2c 22 50 54 22 2c 22 52 4f 22 2c 22 53 49 22 2c 22 53 4b 22 2c 22 46 49 22 2c 22 53 45 22 2c 22 47 42 22 2c 22 48 52 22 2c 22 4c 49 22 2c 22 4e 4f 22 2c 22 49 53 22 5d 2c 74 68 69 73 2e 73 74 75 62 46 69 6c 65 4e 61 6d 65 3d 22 6f 74 53 44 4b 53 74 75 62 22 2c 74 68 69 73 2e 44 41 54 41 46 49 4c 45 41 54 54 52 49 42 55 54 45 3d 22 64 61 74 61 2d 64 6f 6d 61 69 6e 2d 73 63 72 69 70 74 22 2c 74 68 69 73 2e 62 61 6e 6e 65 72 53 63 72 69 70 74 4e 61 6d 65 3d 22 6f 74 42 61 6e 6e 65 72 53 64 6b 2e 6a 73 22 2c 74 68 69 73 2e 6d 6f 62 69 6c 65 4f 6e 6c 69 6e 65 55 52 4c 3d 5b 5d 2c 74 68 69 73 2e 69 73 4d 69 67 72 61 74 65 64 55 52 4c 3d 21 31 2c 74 68 69 73 2e 6d 69 67 72 61 74 65 64 43 43 54 49 44 3d 22 5b 5b 4f 6c 64 43 43 54 49 44 5d Data Ascii: AT","PL","PT","RO","SI","SK","FI","SE","GB","HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]
2024-05-29 13:26:10 UTC	1369	IN	Data Raw: 66 28 21 28 61 3d 69 5b 6e 5d 2e 73 70 6c 69 74 28 2f 3a 28 2e 2b 29 2f 29 29 5b 31 5d 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 65 5b 74 68 69 73 2e 63 61 6d 65 6c 69 7a 65 28 61 5b 30 5d 29 5d 3d 61 5b 31 5d 2e 74 72 69 6d 28 29 7d 72 65 74 75 72 6e 20 65 7d 2c 65 29 3b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 68 69 73 2e 69 6d 70 6c 65 6d 65 6e 74 54 68 65 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 2c 6f 3d 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 3b 72 65 74 75 72 6e 20 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 22 73 74 79 6c 65 22 21 Data Ascii: f(!(a=i[n].split(/:(.+)/))[1])return null;e[this.camelize(a[0])]=a[1].trim()}return e},e);function e(){var t=this;this.implementThePolyfill=function(){var a=t,o=Element.prototype.setAttribute;return Element.prototype.setAttribute=function(t,e){if("style"!
2024-05-29 13:26:10 UTC	1369	IN	Data Raw: 6c 65 72 2c 21 31 29 2c 73 2e 61 64 64 46 72 61 6d 65 28 73 2e 4c 4f 43 41 54 4f 52 5f 4e 41 4d 45 29 29 7d 2c 74 68 69 73 2e 72 65 6d 6f 76 65 47 70 70 41 70 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 64 65 6c 65 74 65 20 73 2e 77 69 6e 2e 5f 5f 67 70 70 3b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 69 66 72 61 6d 65 5b 6e 61 6d 65 3d 22 2b 73 2e 4c 4f 43 41 54 4f 52 5f 4e 41 4d 45 2b 22 5d 22 29 5b 30 5d 3b 74 26 26 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 29 7d 2c 74 68 69 73 2e 65 78 65 63 75 74 65 47 70 70 41 70 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 65 3d 30 3b 65 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 Data Ascii: ler,!1),s.addFrame(s.LOCATOR_NAME))},this.removeGppApi=function(){delete s.win.__gpp;var t=document.querySelectorAll("iframe[name="+s.LOCATOR_NAME+"]")[0];t&&t.parentElement.removeChild(t)},this.executeGppApi=function(){for(var t=[],e=0;e<arguments.length
2024-05-29 13:26:10 UTC	1369	IN	Data Raw: 6e 74 28 22 69 66 72 61 6d 65 22 29 29 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 2c 65 2e 6e 61 6d 65 3d 74 2c 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 69 74 6c 65 22 2c 22 47 50 50 20 4c 6f 63 61 74 6f 72 22 29 2c 69 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 29 3a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 73 2e 61 64 64 46 72 61 6d 65 28 74 29 7d 2c 35 29 29 2c 21 6e 7d 2c 74 68 69 73 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 2c 6e 3d 73 2e 77 69 6e 2e 5f 5f 67 70 70 3b 72 65 74 75 72 6e 20 6e 2e 65 76 65 6e 74 73 3d 6e 2e 65 76 65 6e 74 73 7c 7c 5b 5d 2c 6e 75 6c 6c 21 3d 28 69 3d 6e 29 26 Data Ascii: nt("iframe")).style.cssText="display:none",e.name=t,e.setAttribute("title","GPP Locator"),i.body.appendChild(e)):setTimeout(function(){s.addFrame(t)},5)),!n},this.addEventListener=function(t,e){var i,n=s.win.__gpp;return n.events=n.events\|\|[],null!=(i=n)&
2024-05-29 13:26:10 UTC	1369	IN	Data Raw: 29 2c 74 68 69 73 2e 63 61 70 74 75 72 65 4e 6f 6e 63 65 28 29 7d 2c 68 2e 70 72 6f 74 6f 74 79 70 65 2e 63 61 70 74 75 72 65 4e 6f 6e 63 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6e 6f 6e 63 65 3d 70 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 6e 6f 6e 63 65 7c 7c 70 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 6f 6e 63 65 22 29 7c 7c 6e 75 6c 6c 7d 2c 68 2e 70 72 6f 74 6f 74 79 70 65 2e 66 65 74 63 68 42 61 6e 6e 65 72 53 44 4b 44 65 70 65 6e 64 65 6e 63 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 73 65 74 44 6f 6d 61 69 6e 44 61 74 61 46 69 6c 65 55 52 4c 28 29 2c 74 68 69 73 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 70 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d Data Ascii: ),this.captureNonce()},h.prototype.captureNonce=function(){this.nonce=p.stubScriptElement.nonce\|\|p.stubScriptElement.getAttribute("nonce")\|\|null},h.prototype.fetchBannerSDKDependency=function(){this.setDomainDataFileURL(),this.crossOrigin=p.stubScriptElem
2024-05-29 13:26:10 UTC	1369	IN	Data Raw: 6c 6f 63 61 74 69 6f 6e 52 65 73 70 6f 6e 73 65 3f 28 69 3d 69 2e 4f 6e 65 54 72 75 73 74 2e 67 65 6f 6c 6f 63 61 74 69 6f 6e 52 65 73 70 6f 6e 73 65 2c 74 68 69 73 2e 73 65 74 47 65 6f 4c 6f 63 61 74 69 6f 6e 28 69 2e 63 6f 75 6e 74 72 79 43 6f 64 65 2c 69 2e 73 74 61 74 65 43 6f 64 65 29 2c 74 68 69 73 2e 61 64 64 42 61 6e 6e 65 72 53 44 4b 53 63 72 69 70 74 28 74 29 29 3a 28 69 3d 74 68 69 73 2e 72 65 61 64 43 6f 6f 6b 69 65 50 61 72 61 6d 28 70 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 2c 70 2e 67 65 6f 6c 6f 63 61 74 69 6f 6e 43 6f 6f 6b 69 65 73 50 61 72 61 6d 29 29 7c 7c 74 2e 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 3f 28 65 3d 69 2e 73 70 6c 69 74 28 22 3b 22 29 5b 30 5d 2c 69 3d 69 2e 73 70 6c 69 74 28 22 3b 22 29 5b 31 5d 2c 74 Data Ascii: locationResponse?(i=i.OneTrust.geolocationResponse,this.setGeoLocation(i.countryCode,i.stateCode),this.addBannerSDKScript(t)):(i=this.readCookieParam(p.optanonCookieName,p.geolocationCookiesParam))\|\|t.SkipGeolocation?(e=i.split(";")[0],i=i.split(";")[1],t
2024-05-29 13:26:10 UTC	1369	IN	Data Raw: 79 65 72 22 7d 7d 2c 68 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 47 65 6f 4c 6f 63 61 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 70 2e 75 73 65 72 4c 6f 63 61 74 69 6f 6e 3d 7b 63 6f 75 6e 74 72 79 3a 74 2c 73 74 61 74 65 3a 65 3d 76 6f 69 64 20 30 3d 3d 3d 65 3f 22 22 3a 65 7d 7d 2c 68 2e 70 72 6f 74 6f 74 79 70 65 2e 6f 74 46 65 74 63 68 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 69 2c 65 2c 6e 2c 61 29 7b 76 6f 69 64 20 30 3d 3d 3d 65 26 26 28 65 3d 21 31 29 2c 76 6f 69 64 20 30 3d 3d 3d 6e 26 26 28 6e 3d 6e 75 6c 6c 29 3b 76 61 72 20 6f 3d 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 26 26 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 6f 74 50 72 65 76 69 65 77 44 61 74 61 22 29 Data Ascii: yer"}},h.prototype.setGeoLocation=function(t,e){p.userLocation={country:t,state:e=void 0===e?"":e}},h.prototype.otFetch=function(t,i,e,n,a){void 0===e&&(e=!1),void 0===n&&(n=null);var o=window.sessionStorage&&window.sessionStorage.getItem("otPreviewData")
2024-05-29 13:26:10 UTC	1369	IN	Data Raw: 65 67 69 6f 6e 53 65 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 69 2c 6e 2c 61 3d 70 2e 75 73 65 72 4c 6f 63 61 74 69 6f 6e 2c 6f 3d 74 2e 52 75 6c 65 53 65 74 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 21 30 3d 3d 3d 74 2e 44 65 66 61 75 6c 74 7d 29 3b 69 66 28 21 61 2e 63 6f 75 6e 74 72 79 26 26 21 61 2e 73 74 61 74 65 29 72 65 74 75 72 6e 20 6f 26 26 30 3c 6f 2e 6c 65 6e 67 74 68 3f 6f 5b 30 5d 3a 6e 75 6c 6c 3b 66 6f 72 28 76 61 72 20 73 3d 61 2e 73 74 61 74 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 72 3d 61 2e 63 6f 75 6e 74 72 79 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 75 3d 30 3b 75 3c 74 2e 52 75 6c 65 53 65 74 2e 6c 65 6e 67 74 68 3b 75 2b 2b 29 69 66 28 21 30 3d 3d 3d 74 2e 52 75 6c Data Ascii: egionSet=function(t){var e,i,n,a=p.userLocation,o=t.RuleSet.filter(function(t){return!0===t.Default});if(!a.country&&!a.state)return o&&0<o.length?o[0]:null;for(var s=a.state.toLowerCase(),r=a.country.toLowerCase(),u=0;u<t.RuleSet.length;u++)if(!0===t.Rul
2024-05-29 13:26:10 UTC	1369	IN	Data Raw: 68 61 73 49 41 42 47 6c 6f 62 61 6c 53 63 6f 70 65 3d 21 31 2c 70 2e 49 41 42 43 6f 6f 6b 69 65 56 61 6c 75 65 3d 74 68 69 73 2e 67 65 74 43 6f 6f 6b 69 65 28 70 2e 6f 6e 65 54 72 75 73 74 49 41 42 43 6f 6f 6b 69 65 4e 61 6d 65 29 29 3a 70 2e 69 73 53 74 75 62 52 65 61 64 79 3d 21 31 7d 2c 68 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 69 64 61 74 65 49 41 42 47 44 50 52 41 70 70 6c 69 65 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 72 65 61 64 43 6f 6f 6b 69 65 50 61 72 61 6d 28 70 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 2c 70 2e 67 65 6f 6c 6f 63 61 74 69 6f 6e 43 6f 6f 6b 69 65 73 50 61 72 61 6d 29 2e 73 70 6c 69 74 28 22 3b 22 29 5b 30 5d 3b 74 3f 74 68 69 73 2e 69 73 42 6f 6f 6c 65 61 6e 28 74 29 3f 70 2e 6f 6e Data Ascii: hasIABGlobalScope=!1,p.IABCookieValue=this.getCookie(p.oneTrustIABCookieName)):p.isStubReady=!1},h.prototype.validateIABGDPRApplied=function(){var t=this.readCookieParam(p.optanonCookieName,p.geolocationCookiesParam).split(";")[0];t?this.isBoolean(t)?p.on

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49769	104.19.178.52	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:11 UTC	546	OUT	GET /consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/b680e9a8-3d45-4e4a-998f-7d05f89e4486.json HTTP/1.1 Accept: / Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH Origin: https://www.avast.com Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: cdn.cookielaw.org Connection: Keep-Alive
2024-05-29 13:26:11 UTC	902	IN	HTTP/1.1 200 OK Date: Wed, 29 May 2024 13:26:11 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 88b6d092dca241ec-EWR CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 78187 Cache-Control: public, max-age=86400 Expires: Thu, 30 May 2024 13:26:11 GMT Last-Modified: Thu, 20 Apr 2023 14:56:05 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: 3nuR7fmf31a38AgcBfw1VQ== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 65146ab7-001e-005d-1438-443307000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-05-29 13:26:11 UTC	467	IN	Data Raw: 31 39 36 65 0d 0a 7b 22 43 6f 6f 6b 69 65 53 50 41 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 53 61 6d 65 53 69 74 65 4e 6f 6e 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 56 32 43 53 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4d 75 6c 74 69 56 61 72 69 61 6e 74 54 65 73 74 69 6e 67 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 55 73 65 56 32 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 53 44 4b 22 3a 66 61 6c 73 65 2c 22 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 63 72 69 70 74 54 79 70 65 22 3a 22 50 52 4f 44 55 43 54 49 4f 4e 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 36 2e 33 33 2e 30 22 2c 22 4f 70 74 61 6e 6f 6e 44 61 74 61 4a 53 4f 4e 22 3a 22 62 36 38 30 65 39 61 38 Data Ascii: 196e{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"6.33.0","OptanonDataJSON":"b680e9a8
2024-05-29 13:26:11 UTC	1369	IN	Data Raw: 7b 22 49 64 22 3a 22 39 34 30 34 64 61 36 66 2d 65 31 62 32 2d 34 61 34 36 2d 39 34 37 36 2d 32 33 34 66 31 63 64 64 63 65 34 36 22 2c 22 4e 61 6d 65 22 3a 22 42 72 61 7a 69 6c 20 e2 80 93 20 41 6c 6c 20 4f 70 74 2d 69 6e 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 62 72 22 5d 2c 22 53 74 61 74 65 73 22 3a 7b 7d 2c 22 4c 61 6e 67 75 61 67 65 53 77 69 74 63 68 65 72 50 6c 61 63 65 68 6f 6c 64 65 72 22 3a 7b 22 6e 6f 22 3a 22 6e 6f 22 2c 22 68 69 22 3a 22 68 69 22 2c 22 64 65 22 3a 22 64 65 22 2c 22 72 75 22 3a 22 72 75 22 2c 22 66 69 22 3a 22 66 69 22 2c 22 70 74 22 3a 22 70 74 22 2c 22 66 72 22 3a 22 66 72 22 2c 22 68 75 22 3a 22 68 75 22 2c 22 7a 68 2d 43 4e 22 3a 22 7a 68 2d 43 4e 22 2c 22 64 65 66 61 75 6c 74 22 3a 22 65 6e 22 2c 22 75 6b 22 3a 22 Data Ascii: {"Id":"9404da6f-e1b2-4a46-9476-234f1cddce46","Name":"Brazil All Opt-in","Countries":["br"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","pt":"pt","fr":"fr","hu":"hu","zh-CN":"zh-CN","default":"en","uk":"
2024-05-29 13:26:11 UTC	1369	IN	Data Raw: 66 69 22 3a 22 66 69 22 2c 22 70 74 22 3a 22 70 74 22 2c 22 66 72 22 3a 22 66 72 22 2c 22 68 75 22 3a 22 68 75 22 2c 22 7a 68 2d 43 4e 22 3a 22 7a 68 2d 43 4e 22 2c 22 64 65 66 61 75 6c 74 22 3a 22 65 6e 22 2c 22 75 6b 22 3a 22 75 6b 22 2c 22 69 64 22 3a 22 69 64 22 2c 22 73 76 22 3a 22 73 76 22 2c 22 6b 6f 22 3a 22 6b 6f 22 2c 22 7a 68 2d 54 57 22 3a 22 7a 68 2d 54 57 22 2c 22 70 74 2d 42 52 22 3a 22 70 74 2d 42 52 22 2c 22 6d 73 22 3a 22 6d 73 22 2c 22 65 6c 22 3a 22 65 6c 22 2c 22 69 74 22 3a 22 69 74 22 2c 22 65 73 22 3a 22 65 73 22 2c 22 63 73 22 3a 22 63 73 22 2c 22 61 72 22 3a 22 61 72 22 2c 22 76 69 22 3a 22 76 69 22 2c 22 74 68 22 3a 22 74 68 22 2c 22 6a 61 22 3a 22 6a 61 22 2c 22 74 6c 22 3a 22 74 6c 22 2c 22 70 6c 22 3a 22 70 6c 22 2c 22 72 6f Data Ascii: fi":"fi","pt":"pt","fr":"fr","hu":"hu","zh-CN":"zh-CN","default":"en","uk":"uk","id":"id","sv":"sv","ko":"ko","zh-TW":"zh-TW","pt-BR":"pt-BR","ms":"ms","el":"el","it":"it","es":"es","cs":"cs","ar":"ar","vi":"vi","th":"th","ja":"ja","tl":"tl","pl":"pl","ro
2024-05-29 13:26:11 UTC	1369	IN	Data Raw: 61 6d 65 22 3a 22 41 76 61 73 74 20 e2 80 93 20 52 45 4a 45 43 54 20 41 4c 4c 20 e2 80 93 20 54 65 6d 70 6c 61 74 65 22 2c 22 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 47 43 45 6e 61 62 6c 65 22 3a 66 61 6c 73 65 2c 22 49 73 47 50 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 7d 2c 7b 22 49 64 22 3a 22 34 36 61 37 31 64 37 36 2d 30 36 36 35 2d 34 62 66 34 2d 38 34 64 38 2d 33 35 34 63 36 30 33 35 35 39 39 37 22 2c 22 4e 61 6d 65 22 3a 22 47 4c 4f 42 41 4c 20 e2 80 93 20 41 6c 6c 20 4f 70 74 2d 6f 75 74 2c 20 4d 61 72 6b 65 74 69 6e 67 20 4f 70 74 2d 69 6e 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 70 72 22 2c 22 70 73 22 2c 22 70 77 22 2c 22 70 79 22 2c 22 71 61 22 2c 22 61 64 22 2c 22 61 65 22 2c 22 61 66 22 2c 22 61 67 22 2c 22 61 69 22 2c 22 Data Ascii: ame":"Avast REJECT ALL Template","Conditions":[],"GCEnable":false,"IsGPPEnabled":false},{"Id":"46a71d76-0665-4bf4-84d8-354c60355997","Name":"GLOBAL All Opt-out, Marketing Opt-in","Countries":["pr","ps","pw","py","qa","ad","ae","af","ag","ai","
2024-05-29 13:26:11 UTC	1369	IN	Data Raw: 2d 43 4e 22 2c 22 64 65 66 61 75 6c 74 22 3a 22 65 6e 22 2c 22 75 6b 22 3a 22 75 6b 22 2c 22 69 64 22 3a 22 69 64 22 2c 22 73 76 22 3a 22 73 76 22 2c 22 6b 6f 22 3a 22 6b 6f 22 2c 22 7a 68 2d 54 57 22 3a 22 7a 68 2d 54 57 22 2c 22 70 74 2d 42 52 22 3a 22 70 74 2d 42 52 22 2c 22 6d 73 22 3a 22 6d 73 22 2c 22 65 6c 22 3a 22 65 6c 22 2c 22 69 74 22 3a 22 69 74 22 2c 22 65 73 22 3a 22 65 73 22 2c 22 63 73 22 3a 22 63 73 22 2c 22 61 72 22 3a 22 61 72 22 2c 22 76 69 22 3a 22 76 69 22 2c 22 74 68 22 3a 22 74 68 22 2c 22 6a 61 22 3a 22 6a 61 22 2c 22 74 6c 22 3a 22 74 6c 22 2c 22 70 6c 22 3a 22 70 6c 22 2c 22 72 6f 22 3a 22 72 6f 22 2c 22 68 65 22 3a 22 68 65 22 2c 22 64 61 22 3a 22 64 61 22 2c 22 74 72 22 3a 22 74 72 22 2c 22 6e 6c 22 3a 22 6e 6c 22 7d 2c 22 42 Data Ascii: -CN","default":"en","uk":"uk","id":"id","sv":"sv","ko":"ko","zh-TW":"zh-TW","pt-BR":"pt-BR","ms":"ms","el":"el","it":"it","es":"es","cs":"cs","ar":"ar","vi":"vi","th":"th","ja":"ja","tl":"tl","pl":"pl","ro":"ro","he":"he","da":"da","tr":"tr","nl":"nl"},"B
2024-05-29 13:26:11 UTC	575	IN	Data Raw: 32 47 50 43 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 41 73 73 69 67 6e 54 65 6d 70 6c 61 74 65 52 75 6c 65 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6f 6c 6f 63 61 74 69 6f 6e 4a 73 6f 6e 41 70 69 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 54 43 46 32 31 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 52 65 6d 6f 76 65 53 65 74 74 69 6e 67 73 49 63 6f 6e 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 4c 6f 67 6f 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 73 22 3a 74 72 75 65 7d 2c 22 49 73 53 75 70 70 72 65 73 73 42 61 6e 6e 65 72 22 3a 66 61 6c 73 65 2c 22 49 73 53 75 70 70 72 65 73 73 50 43 22 3a 66 61 6c 73 65 2c 22 50 75 62 6c 69 73 68 65 72 43 43 22 3a 22 44 45 22 Data Ascii: 2GPC":true,"CookieV2AssignTemplateRule":true,"CookieV2GeolocationJsonApi":true,"CookieV2TCF21":true,"CookieV2RemoveSettingsIcon":true,"CookieV2BannerLogo":true,"CookieV2GeneralVendors":true},"IsSuppressBanner":false,"IsSuppressPC":false,"PublisherCC":"DE"
2024-05-29 13:26:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49782	172.64.155.119	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:12 UTC	512	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Accept: application/json Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH Origin: https://www.avast.com Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: geolocation.onetrust.com Connection: Keep-Alive
2024-05-29 13:26:12 UTC	370	IN	HTTP/1.1 200 OK Date: Wed, 29 May 2024 13:26:12 GMT Content-Type: application/json Content-Length: 69 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 88b6d096d933426b-EWR
2024-05-29 13:26:12 UTC	69	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 4e 59 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"NY","stateName":"New York","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49778	52.49.110.165	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:12 UTC	632	OUT	GET /id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1716989171027 HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH Origin: https://www.avast.com Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: dpm.demdex.net Connection: Keep-Alive
2024-05-29 13:26:12 UTC	818	IN	HTTP/1.1 200 OK Date: Wed, 29 May 2024 13:26:12 GMT Content-Type: application/json;charset=utf-8 Content-Length: 367 Connection: close X-TID: z7gk8oySTgk= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.avast.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-irl1-2-v061-0b218a75e.edge-irl1.demdex.com 3 ms set-cookie: demdex=50343037636937159680511059771190338789; Max-Age=15552000; Expires=Mon, 25 Nov 2024 13:26:12 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-05-29 13:26:12 UTC	367	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 35 30 31 34 33 31 31 37 35 39 39 30 32 30 30 32 38 36 35 30 35 33 30 35 30 39 31 35 36 33 32 32 33 33 38 39 30 30 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 36 47 31 79 6e 59 63 4c 50 75 69 51 78 59 5a 72 73 7a 5f 70 6b 71 66 4c 47 39 79 4d 58 42 70 62 32 7a 58 35 64 76 4a 64 59 51 4a 7a 50 58 49 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 36 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 7b 22 69 64 22 3a 22 34 31 31 22 2c 22 74 74 6c 22 3a 31 30 30 38 30 2c 22 74 61 67 22 3a 22 69 6d 67 22 2c 22 66 69 72 65 55 52 4c 53 79 6e 63 22 3a 31 2c 22 73 79 6e 63 4f 6e 50 61 67 65 22 3a 31 2c 22 75 72 6c 22 3a 5b 22 2f 2f 63 6d 2e 65 76 65 72 Data Ascii: {"d_mid":"50143117599020028650530509156322338900","id_sync_ttl":604800,"d_blob":"6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y","dcs_region":6,"d_ottl":7200,"ibs":[{"id":"411","ttl":10080,"tag":"img","fireURLSync":1,"syncOnPage":1,"url":["//cm.ever

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49768	104.19.178.52	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:12 UTC	496	OUT	GET /scripttemplates/6.33.0/otBannerSdk.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: cdn.cookielaw.org Connection: Keep-Alive
2024-05-29 13:26:12 UTC	815	IN	HTTP/1.1 200 OK Date: Wed, 29 May 2024 13:26:12 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Content-MD5: snqI9a2h7X2bbSiony0guw== Last-Modified: Wed, 13 Apr 2022 01:38:27 GMT x-ms-request-id: 2bf1b937-c01e-001f-284e-798a87000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 24536 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 88b6d097ad8c41e1-EWR
2024-05-29 13:26:12 UTC	554	IN	Data Raw: 37 63 37 31 0d 0a 2f 2a 2a 20 0a 20 2a 20 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 0a 20 2a 20 76 36 2e 33 33 2e 30 0a 20 2a 20 62 79 20 4f 6e 65 54 72 75 73 74 20 4c 4c 43 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 32 32 20 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 6f 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 26 26 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 74 7d 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 74 29 Data Ascii: 7c71/** * onetrust-banner-sdk * v6.33.0 * by OneTrust LLC * Copyright 2022 */!function(){"use strict";var o=function(e,t){return(o=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var o in t)
2024-05-29 13:26:12 UTC	1369	IN	Data Raw: 29 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 74 72 79 7b 72 28 6c 2e 6e 65 78 74 28 65 29 29 7d 63 61 74 63 68 28 65 29 7b 74 28 65 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 74 72 79 7b 72 28 6c 2e 74 68 72 6f 77 28 65 29 29 7d 63 61 74 63 68 28 65 29 7b 74 28 65 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 72 28 74 29 7b 74 2e 64 6f 6e 65 3f 65 28 74 2e 76 61 6c 75 65 29 3a 6e 65 77 20 61 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 28 74 2e 76 61 6c 75 65 29 7d 29 2e 74 68 65 6e 28 6f 2c 6e 29 7d 72 28 28 6c 3d 6c 2e 61 70 70 6c 79 28 73 2c 69 7c 7c 5b 5d 29 29 2e 6e 65 78 74 28 29 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 68 28 6f 2c 6e 29 7b 76 61 72 20 72 2c 73 2c 69 2c 65 2c 61 3d 7b 6c 61 62 65 6c 3a 30 2c 73 Data Ascii: )(function(e,t){function o(e){try{r(l.next(e))}catch(e){t(e)}}function n(e){try{r(l.throw(e))}catch(e){t(e)}}function r(t){t.done?e(t.value):new a(function(e){e(t.value)}).then(o,n)}r((l=l.apply(s,i\|\|[])).next())})}function h(o,n){var r,s,i,e,a={label:0,s
2024-05-29 13:26:12 UTC	1369	IN	Data Raw: 29 2c 72 3d 30 3b 66 6f 72 28 74 3d 30 3b 74 3c 6f 3b 74 2b 2b 29 66 6f 72 28 76 61 72 20 73 3d 61 72 67 75 6d 65 6e 74 73 5b 74 5d 2c 69 3d 30 2c 61 3d 73 2e 6c 65 6e 67 74 68 3b 69 3c 61 3b 69 2b 2b 2c 72 2b 2b 29 6e 5b 72 5d 3d 73 5b 69 5d 3b 72 65 74 75 72 6e 20 6e 7d 28 65 3d 76 3d 76 7c 7c 7b 7d 29 5b 65 2e 41 43 54 49 56 45 3d 30 5d 3d 22 41 43 54 49 56 45 22 2c 65 5b 65 2e 41 4c 57 41 59 53 5f 41 43 54 49 56 45 3d 31 5d 3d 22 41 4c 57 41 59 53 5f 41 43 54 49 56 45 22 2c 65 5b 65 2e 45 58 50 49 52 45 44 3d 32 5d 3d 22 45 58 50 49 52 45 44 22 2c 65 5b 65 2e 4e 4f 5f 43 4f 4e 53 45 4e 54 3d 33 5d 3d 22 4e 4f 5f 43 4f 4e 53 45 4e 54 22 2c 65 5b 65 2e 4f 50 54 5f 4f 55 54 3d 34 5d 3d 22 4f 50 54 5f 4f 55 54 22 2c 65 5b 65 2e 50 45 4e 44 49 4e 47 3d 35 Data Ascii: ),r=0;for(t=0;t<o;t++)for(var s=arguments[t],i=0,a=s.length;i<a;i++,r++)n[r]=s[i];return n}(e=v=v\|\|{})[e.ACTIVE=0]="ACTIVE",e[e.ALWAYS_ACTIVE=1]="ALWAYS_ACTIVE",e[e.EXPIRED=2]="EXPIRED",e[e.NO_CONSENT=3]="NO_CONSENT",e[e.OPT_OUT=4]="OPT_OUT",e[e.PENDING=5
2024-05-29 13:26:12 UTC	1369	IN	Data Raw: 65 64 69 61 74 65 46 6e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 65 2e 5f 68 61 6e 64 6c 65 64 7c 7c 73 2e 5f 75 6e 68 61 6e 64 6c 65 64 52 65 6a 65 63 74 69 6f 6e 46 6e 28 65 2e 5f 76 61 6c 75 65 29 7d 29 3b 66 6f 72 28 76 61 72 20 74 3d 30 2c 6f 3d 65 2e 5f 64 65 66 65 72 72 65 64 73 2e 6c 65 6e 67 74 68 3b 74 3c 6f 3b 74 2b 2b 29 69 28 65 2c 65 2e 5f 64 65 66 65 72 72 65 64 73 5b 74 5d 29 3b 65 2e 5f 64 65 66 65 72 72 65 64 73 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6f 29 7b 74 68 69 73 2e 6f 6e 46 75 6c 66 69 6c 6c 65 64 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 3f 65 3a 6e 75 6c 6c 2c 74 68 69 73 2e 6f 6e 52 65 6a 65 63 74 65 64 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 3f 74 3a 6e 75 6c 6c Data Ascii: ediateFn(function(){e._handled\|\|s._unhandledRejectionFn(e._value)});for(var t=0,o=e._deferreds.length;t<o;t++)i(e,e._deferreds[t]);e._deferreds=null}function p(e,t,o){this.onFulfilled="function"==typeof e?e:null,this.onRejected="function"==typeof t?t:null
2024-05-29 13:26:12 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 21 63 28 72 29 29 72 65 74 75 72 6e 20 74 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 50 72 6f 6d 69 73 65 2e 72 61 63 65 20 61 63 63 65 70 74 73 20 61 6e 20 61 72 72 61 79 22 29 29 3b 66 6f 72 28 76 61 72 20 6f 3d 30 2c 6e 3d 72 2e 6c 65 6e 67 74 68 3b 6f 3c 6e 3b 6f 2b 2b 29 73 2e 72 65 73 6f 6c 76 65 28 72 5b 6f 5d 29 2e 74 68 65 6e 28 65 2c 74 29 7d 29 7d 2c 73 2e 5f 69 6d 6d 65 64 69 61 74 65 46 6e 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 73 65 74 49 6d 6d 65 64 69 61 74 65 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 73 65 74 49 6d 6d 65 64 69 61 74 65 28 65 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 28 65 2c 30 29 7d 2c 73 2e 5f 75 6e 68 61 6e 64 6c 65 64 52 65 6a 65 63 74 69 Data Ascii: function(e,t){if(!c(r))return t(new TypeError("Promise.race accepts an array"));for(var o=0,n=r.length;o<n;o++)s.resolve(r[o]).then(e,t)})},s._immediateFn="function"==typeof setImmediate?function(e){setImmediate(e)}:function(e){t(e,0)},s._unhandledRejecti
2024-05-29 13:26:12 UTC	1369	IN	Data Raw: 57 69 74 68 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 74 3e 74 68 69 73 2e 6c 65 6e 67 74 68 29 26 26 28 74 3d 74 68 69 73 2e 6c 65 6e 67 74 68 29 2c 74 68 69 73 2e 73 75 62 73 74 72 69 6e 67 28 74 2d 65 2e 6c 65 6e 67 74 68 2c 74 29 3d 3d 3d 65 7d 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 7d 2c 79 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 43 6c 6f 73 65 73 74 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 61 74 63 68 65 73 7c 7c 28 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 61 74 63 68 65 73 3d 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 Data Ascii: With",{value:function(e,t){return(void 0===t\|\|t>this.length)&&(t=this.length),this.substring(t-e.length,t)===e},writable:!0,configurable:!0})},y.prototype.initClosestPolyfill=function(){Element.prototype.matches\|\|(Element.prototype.matches=Element.prototy
2024-05-29 13:26:12 UTC	1369	IN	Data Raw: 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 74 68 69 73 20 69 73 20 6e 75 6c 6c 20 6f 72 20 6e 6f 74 20 64 65 66 69 6e 65 64 22 29 3b 66 6f 72 28 76 61 72 20 74 3d 4f 62 6a 65 63 74 28 74 68 69 73 29 2c 6f 3d 74 2e 6c 65 6e 67 74 68 3e 3e 3e 30 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3e 3e 30 2c 72 3d 6e 3c 30 3f 4d 61 74 68 2e 6d 61 78 28 6f 2b 6e 2c 30 29 3a 4d 61 74 68 2e 6d 69 6e 28 6e 2c 6f 29 2c 73 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 2c 69 3d 76 6f 69 64 20 30 3d 3d 3d 73 3f 6f 3a 73 3e 3e 30 2c 61 3d 69 3c 30 3f 4d 61 74 68 2e 6d 61 78 28 6f 2b 69 2c 30 29 3a 4d 61 74 68 2e 6d 69 6e 28 69 2c 6f 29 3b 72 3c 61 3b 29 74 5b 72 5d 3d 65 2c 72 2b 2b 3b 72 65 74 75 72 6e 20 74 7d 7d 29 7d 2c 79 2e 70 72 6f 74 6f 74 79 70 65 2e Data Ascii: throw new TypeError("this is null or not defined");for(var t=Object(this),o=t.length>>>0,n=arguments[1]>>0,r=n<0?Math.max(o+n,0):Math.min(n,o),s=arguments[2],i=void 0===s?o:s>>0,a=i<0?Math.max(o+i,0):Math.min(i,o);r<a;)t[r]=e,r++;return t}})},y.prototype.
2024-05-29 13:26:12 UTC	1369	IN	Data Raw: 49 2e 42 61 6e 6e 65 72 3d 30 5d 3d 22 42 61 6e 6e 65 72 22 2c 49 5b 49 2e 50 72 65 66 43 65 6e 74 65 72 48 6f 6d 65 3d 31 5d 3d 22 50 72 65 66 43 65 6e 74 65 72 48 6f 6d 65 22 2c 49 5b 49 2e 56 65 6e 64 6f 72 4c 69 73 74 3d 32 5d 3d 22 56 65 6e 64 6f 72 4c 69 73 74 22 2c 49 5b 49 2e 43 6f 6f 6b 69 65 4c 69 73 74 3d 33 5d 3d 22 43 6f 6f 6b 69 65 4c 69 73 74 22 2c 28 5f 3d 4c 3d 4c 7c 7c 7b 7d 29 5b 5f 2e 52 69 67 68 74 41 72 72 6f 77 3d 33 39 5d 3d 22 52 69 67 68 74 41 72 72 6f 77 22 2c 5f 5b 5f 2e 4c 65 66 74 41 72 72 6f 77 3d 33 37 5d 3d 22 4c 65 66 74 41 72 72 6f 77 22 2c 28 77 3d 45 3d 45 7c 7c 7b 7d 29 2e 41 66 74 65 72 54 69 74 6c 65 3d 22 41 66 74 65 72 54 69 74 6c 65 22 2c 77 2e 41 66 74 65 72 44 65 73 63 72 69 70 74 69 6f 6e 3d 22 41 66 74 65 72 Data Ascii: I.Banner=0]="Banner",I[I.PrefCenterHome=1]="PrefCenterHome",I[I.VendorList=2]="VendorList",I[I.CookieList=3]="CookieList",(_=L=L\|\|{})[_.RightArrow=39]="RightArrow",_[_.LeftArrow=37]="LeftArrow",(w=E=E\|\|{}).AfterTitle="AfterTitle",w.AfterDescription="After
2024-05-29 13:26:12 UTC	1369	IN	Data Raw: 64 6f 72 3d 31 5d 3d 22 47 6f 6f 67 6c 65 56 65 6e 64 6f 72 22 2c 5a 5b 5a 2e 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 3d 32 5d 3d 22 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 22 2c 28 74 65 3d 65 65 3d 65 65 7c 7c 7b 7d 29 5b 74 65 2e 44 61 79 73 3d 31 5d 3d 22 44 61 79 73 22 2c 74 65 5b 74 65 2e 57 65 65 6b 73 3d 37 5d 3d 22 57 65 65 6b 73 22 2c 74 65 5b 74 65 2e 4d 6f 6e 74 68 73 3d 33 30 5d 3d 22 4d 6f 6e 74 68 73 22 2c 74 65 5b 74 65 2e 59 65 61 72 73 3d 33 36 35 5d 3d 22 59 65 61 72 73 22 2c 28 6e 65 3d 6f 65 3d 6f 65 7c 7c 7b 7d 29 2e 43 68 65 63 6b 62 6f 78 3d 22 43 68 65 63 6b 62 6f 78 22 2c 6e 65 2e 54 6f 67 67 6c 65 3d 22 54 6f 67 67 6c 65 22 2c 28 73 65 3d 72 65 3d 72 65 7c 7c 7b 7d 29 2e 53 6c 69 64 65 49 6e 3d 22 53 6c 69 64 65 5f 49 6e 22 2c 73 Data Ascii: dor=1]="GoogleVendor",Z[Z.GeneralVendor=2]="GeneralVendor",(te=ee=ee\|\|{})[te.Days=1]="Days",te[te.Weeks=7]="Weeks",te[te.Months=30]="Months",te[te.Years=365]="Years",(ne=oe=oe\|\|{}).Checkbox="Checkbox",ne.Toggle="Toggle",(se=re=re\|\|{}).SlideIn="Slide_In",s
2024-05-29 13:26:12 UTC	1369	IN	Data Raw: 65 3d 22 54 45 53 54 22 2c 48 65 3d 22 4c 4f 43 41 4c 5f 54 45 53 54 22 2c 46 65 3d 22 64 61 74 61 2d 6c 61 6e 67 75 61 67 65 22 2c 52 65 3d 22 6f 74 43 6f 6f 6b 69 65 53 65 74 74 69 6e 67 73 42 75 74 74 6f 6e 2e 6a 73 6f 6e 22 2c 71 65 3d 22 6f 74 43 6f 6f 6b 69 65 53 65 74 74 69 6e 67 73 42 75 74 74 6f 6e 52 74 6c 2e 6a 73 6f 6e 22 2c 4d 65 3d 22 6f 74 43 65 6e 74 65 72 52 6f 75 6e 64 65 64 22 2c 55 65 3d 22 6f 74 46 6c 61 74 22 2c 6a 65 3d 22 6f 74 46 6c 6f 61 74 69 6e 67 52 6f 75 6e 64 65 64 43 6f 72 6e 65 72 22 2c 7a 65 3d 22 6f 74 46 6c 6f 61 74 69 6e 67 46 6c 61 74 22 2c 4b 65 3d 22 6f 74 46 6c 6f 61 74 69 6e 67 52 6f 75 6e 64 65 64 49 63 6f 6e 22 2c 57 65 3d 22 6f 74 46 6c 6f 61 74 69 6e 67 52 6f 75 6e 64 65 64 22 2c 4a 65 3d 22 6f 74 43 68 6f 69 Data Ascii: e="TEST",He="LOCAL_TEST",Fe="data-language",Re="otCookieSettingsButton.json",qe="otCookieSettingsButtonRtl.json",Me="otCenterRounded",Ue="otFlat",je="otFloatingRoundedCorner",ze="otFloatingFlat",Ke="otFloatingRoundedIcon",We="otFloatingRounded",Je="otChoi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49791	52.214.218.223	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:13 UTC	550	OUT	GET /dest5.html?d_nsid=0 HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: symantec.demdex.net Connection: Keep-Alive Cookie: demdex=50343037636937159680511059771190338789
2024-05-29 13:26:13 UTC	606	IN	HTTP/1.1 200 OK Date: Wed, 29 May 2024 13:26:13 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 6983 Connection: close X-TID: SocgLKohRyw= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Accept-Ranges: bytes last-modified: Thu, 9 May 2024 12:24:52 GMT DCS: dcs-prod-irl1-2-v061-0dbfcd180.edge-irl1.demdex.com 0 ms
2024-05-29 13:26:13 UTC	6983	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 41 64 6f 62 65 20 41 75 64 69 65 6e 63 65 4d 61 6e 61 67 65 72 3c 2f 74 69 74 6c 65 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>Adobe AudienceManager</title><script type="text/javas

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49797	104.19.178.52	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:13 UTC	549	OUT	GET /consent/b680e9a8-3d45-4e4a-998f-7d05f89e4486/c3e7d6d5-2708-484c-a3a5-b8aa447868be/en.json HTTP/1.1 Accept: / Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH Origin: https://www.avast.com Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: cdn.cookielaw.org Connection: Keep-Alive
2024-05-29 13:26:13 UTC	902	IN	HTTP/1.1 200 OK Date: Wed, 29 May 2024 13:26:13 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 88b6d09ecc1f1855-EWR CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 73882 Cache-Control: public, max-age=86400 Expires: Thu, 30 May 2024 13:26:13 GMT Last-Modified: Thu, 20 Apr 2023 14:56:15 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: TxtfAP2G8zKYHm9R69+ggQ== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 67018d25-801e-007c-2821-61177c000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-05-29 13:26:13 UTC	467	IN	Data Raw: 37 63 31 61 0d 0a 7b 22 44 6f 6d 61 69 6e 44 61 74 61 22 3a 7b 22 70 63 63 6c 6f 73 65 42 75 74 74 6f 6e 54 79 70 65 22 3a 22 49 63 6f 6e 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 22 3a 22 59 65 61 72 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 73 22 3a 22 59 65 61 72 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 53 65 63 73 22 3a 22 41 20 66 65 77 20 73 65 63 6f 6e 64 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 22 3a 22 57 65 65 6b 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 73 22 3a 22 57 65 65 6b 73 22 2c 22 70 63 63 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 54 65 78 74 22 3a 22 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 6f 75 74 20 41 63 63 65 70 74 69 6e 67 22 2c 22 4d 61 69 6e 54 65 78 74 22 3a 22 50 72 69 76 61 63 79 20 70 72 65 Data Ascii: 7c1a{"DomainData":{"pccloseButtonType":"Icon","pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","MainText":"Privacy pre
2024-05-29 13:26:13 UTC	1369	IN	Data Raw: 20 59 6f 75 20 63 61 6e 20 6d 61 6e 61 67 65 20 63 6f 6f 6b 69 65 20 73 65 74 74 69 6e 67 73 20 62 65 6c 6f 77 2e 20 42 79 20 63 6c 69 63 6b 69 6e 67 20 e2 80 9c 43 6f 6e 66 69 72 6d 20 73 65 6c 65 63 74 69 6f 6e e2 80 9d 20 79 6f 75 20 61 67 72 65 65 20 77 69 74 68 20 74 68 65 20 63 75 72 72 65 6e 74 20 73 65 74 74 69 6e 67 73 2e 20 53 65 65 26 6e 62 73 70 3b 22 2c 22 41 62 6f 75 74 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 70 6f 6c 69 63 79 22 2c 22 41 62 6f 75 74 43 6f 6f 6b 69 65 73 54 65 78 74 22 3a 22 59 6f 75 72 20 50 72 69 76 61 63 79 22 2c 22 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 41 63 63 65 70 74 20 61 6c 6c 22 2c 22 41 6c 6c 6f 77 41 6c 6c 54 65 78 74 22 3a 22 53 61 76 65 20 53 65 74 74 69 6e 67 73 22 2c 22 43 6f 6f 6b 69 65 73 55 73 65 Data Ascii: You can manage cookie settings below. By clicking Confirm selection you agree with the current settings. See ","AboutText":"Cookies policy","AboutCookiesText":"Your Privacy","ConfirmText":"Accept all","AllowAllText":"Save Settings","CookiesUse
2024-05-29 13:26:13 UTC	1369	IN	Data Raw: 65 6e 64 6f 72 73 22 2c 22 54 68 69 72 64 50 61 72 74 79 43 6f 6f 6b 69 65 4c 69 73 74 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 44 65 74 61 69 6c 73 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 61 6e 61 67 65 50 72 65 66 65 72 65 6e 63 65 73 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 63 6f 6e 73 65 6e 74 20 73 65 74 74 69 6e 67 73 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 6f 72 65 49 6e 66 6f 53 63 72 65 65 6e 52 65 61 64 65 72 22 3a 22 4f 70 65 6e 73 20 69 6e 20 61 20 6e 65 77 20 54 61 62 22 2c 22 43 6f 6f 6b 69 65 4c 69 73 74 54 69 74 6c 65 22 3a 22 22 2c 22 43 6f 6f 6b 69 65 4c 69 73 74 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 47 72 6f 75 70 73 22 3a 5b 7b 22 53 68 6f 77 49 6e 50 6f 70 75 70 22 3a 74 72 75 Data Ascii: endors","ThirdPartyCookieListText":"Cookies Details","PreferenceCenterManagePreferencesText":"Manage consent settings","PreferenceCenterMoreInfoScreenReader":"Opens in a new Tab","CookieListTitle":"","CookieListDescription":"","Groups":[{"ShowInPopup":tru
2024-05-29 13:26:13 UTC	1369	IN	Data Raw: 73 73 61 72 79 20 74 6f 20 73 75 70 70 6f 72 74 20 43 6c 6f 75 64 66 6c 61 72 65 20 42 6f 74 20 4d 61 6e 61 67 65 6d 65 6e 74 2c 20 63 75 72 72 65 6e 74 6c 79 20 69 6e 20 70 72 69 76 61 74 65 20 62 65 74 61 2e 20 41 73 20 70 61 72 74 20 6f 66 20 6f 75 72 20 62 6f 74 20 6d 61 6e 61 67 65 6d 65 6e 74 20 73 65 72 76 69 63 65 2c 20 74 68 69 73 20 63 6f 6f 6b 69 65 20 68 65 6c 70 73 20 6d 61 6e 61 67 65 20 69 6e 63 6f 6d 69 6e 67 20 74 72 61 66 66 69 63 20 74 68 61 74 20 6d 61 74 63 68 65 73 20 63 72 69 74 65 72 69 61 20 61 73 73 6f 63 69 61 74 65 64 20 77 69 74 68 20 62 6f 74 73 2e 5c 6e 54 68 69 73 20 69 73 20 61 20 43 6c 6f 75 64 46 6f 75 6e 64 72 79 20 63 6f 6f 6b 69 65 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 Data Ascii: ssary to support Cloudflare Bot Management, currently in private beta. As part of our bot management service, this cookie helps manage incoming traffic that matches criteria associated with bots.\nThis is a CloudFoundry cookie","DurationType":1,"category"
2024-05-29 13:26:13 UTC	1369	IN	Data Raw: 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 38 39 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 45 67 61 69 6e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 22 43 6f 6f 6b 69 65 61 6b 5f 62 6d 73 63 22 2c 22 69 64 22 3a 22 63 33 62 61 63 64 32 30 2d 61 35 39 37 2d 34 66 37 37 2d 61 36 39 33 2d 35 30 32 33 37 31 39 62 35 36 33 65 22 2c 22 4e 61 6d 65 Data Ascii: sSession":false,"Length":"89","description":"Egain","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":"Cookieak_bmsc","id":"c3bacd20-a597-4f77-a693-5023719b563e","Name
2024-05-29 13:26:13 UTC	1369	IN	Data Raw: 66 37 32 39 34 66 2d 30 63 63 64 2d 34 66 65 30 2d 38 66 62 66 2d 63 32 66 63 34 30 39 38 31 31 32 38 22 2c 22 4e 61 6d 65 22 3a 22 62 69 2d 63 61 72 74 4f 70 65 6e 22 2c 22 48 6f 73 74 22 3a 22 63 68 65 63 6b 6f 75 74 2e 61 76 61 73 74 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c Data Ascii: f7294f-0ccd-4fe0-8fbf-c2fc40981128","Name":"bi-cartOpen","Host":"checkout.avast.com","IsSession":true,"Length":"0","description":"","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":null
2024-05-29 13:26:13 UTC	1369	IN	Data Raw: 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 36 36 32 37 61 33 32 33 2d 32 37 34 33 2d 34 64 63 33 2d 61 37 38 38 2d 65 37 31 30 36 61 33 37 61 62 31 30 22 2c 22 4e 61 6d 65 22 3a 22 43 6f 6f 6b 69 65 43 6f 6e 73 65 6e 74 50 6f 6c 69 63 79 22 2c 22 48 6f 73 74 22 3a 22 70 61 72 74 6e 65 72 73 2e 61 76 61 73 74 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 Data Ascii: urationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":null,"id":"6627a323-2743-4dc3-a788-e7106a37ab10","Name":"CookieConsentPolicy","Host":"partners.avast.com","IsSession":f
2024-05-29 13:26:13 UTC	1369	IN	Data Raw: 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 34 39 39 34 33 38 35 64 2d 30 30 31 32 2d 34 35 38 62 2d 61 38 37 33 2d 61 30 30 36 35 37 39 65 33 38 32 34 22 2c 22 4e 61 6d 65 22 3a 22 45 47 41 49 4e 5f 41 56 5f 43 48 41 54 5f 53 54 41 54 45 5f 44 41 54 41 22 2c 22 48 6f 73 74 22 3a 22 6e 6f 72 74 6f 6e 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 49 66 20 Data Ascii: isThirdParty":false},{"thirdPartyDescription":"","patternKey":null,"thirdPartyKey":null,"firstPartyKey":null,"id":"4994385d-0012-458b-a873-a006579e3824","Name":"EGAIN_AV_CHAT_STATE_DATA","Host":"norton.com","IsSession":true,"Length":"0","description":"If
2024-05-29 13:26:13 UTC	1369	IN	Data Raw: 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 38 61 37 65 35 37 38 66 2d 66 39 65 31 2d 34 36 39 32 2d 38 66 35 64 2d 33 64 34 33 38 34 39 65 65 36 39 37 22 2c 22 4e 61 6d 65 22 3a 22 65 67 42 61 64 67 65 43 6f 75 6e 74 22 2c 22 48 6f 73 74 22 3a 22 6e 6f 72 74 6f 6e 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 45 67 61 69 6e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 Data Ascii: null,"thirdPartyKey":null,"firstPartyKey":null,"id":"8a7e578f-f9e1-4692-8f5d-3d43849ee697","Name":"egBadgeCount","Host":"norton.com","IsSession":true,"Length":"0","description":"Egain","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDes
2024-05-29 13:26:13 UTC	1369	IN	Data Raw: 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 34 34 34 31 64 65 32 63 2d 35 65 38 39 2d 34 62 61 39 2d 62 64 36 36 2d 39 62 32 64 64 33 37 31 39 62 32 31 22 2c 22 4e 61 6d 65 22 3a 22 65 67 43 68 61 74 53 74 61 74 65 42 65 66 6f 72 65 55 6e 6c 6f 61 64 22 2c 22 48 6f 73 74 22 3a 22 6e 6f 72 74 6f 6e 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c Data Ascii: ationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":"","patternKey":null,"thirdPartyKey":null,"firstPartyKey":null,"id":"4441de2c-5e89-4ba9-bd66-9b2dd3719b21","Name":"egChatStateBeforeUnload","Host":"norton.com","IsSession":true,"L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49777	52.49.110.165	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:13 UTC	575	OUT	GET /ibs:dpid=411&dpuuid=Zlcs9QAAABtdXQNe HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Connection: Keep-Alive Host: dpm.demdex.net Cookie: demdex=50343037636937159680511059771190338789
2024-05-29 13:26:13 UTC	891	IN	HTTP/1.1 200 OK Date: Wed, 29 May 2024 13:26:13 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: tWsW2iakRq8= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-1-v061-05e7336b1.edge-irl1.demdex.com 2 ms set-cookie: dpm=50343037636937159680511059771190338789; Max-Age=15552000; Expires=Mon, 25 Nov 2024 13:26:13 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=50343037636937159680511059771190338789; Max-Age=15552000; Expires=Mon, 25 Nov 2024 13:26:13 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-05-29 13:26:13 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49799	142.250.181.228	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:13 UTC	856	OUT	GET /pagead/landing?gcs=G111&gcd=13t3t3t3t5&rnd=566323352.1716989172&url=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi&dma=0&npa=0&gtm=45He45m0n71PZ48F8v71039428za200&auid=1692554832.1716989172 HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.google.com Connection: Keep-Alive
2024-05-29 13:26:14 UTC	1025	IN	HTTP/1.1 302 Found P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Wed, 29 May 2024 13:26:13 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' Location: https://googleads.g.doubleclick.net/pagead/landing?gcs=G111&gcd=13t3t3t3t5&rnd=566323352.1716989172&url=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi&dma=0&npa=0&gtm=45He45m0n71PZ48F8v71039428za200&auid=1692554832.1716989172 X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-29 13:26:14 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49806	18.245.175.102	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:13 UTC	482	OUT	GET /c/hotjar-470805.js?sv=7 HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: static.hotjar.com Connection: Keep-Alive
2024-05-29 13:26:14 UTC	639	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=2592000; includeSubDomains X-Cache-Hit: 1 X-Content-Type-Options: nosniff Date: Wed, 29 May 2024 13:26:14 GMT Cache-Control: max-age=60 ETag: W/6b57269a91bb8c13b32ef276d2d69f6d Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 142b4f65f63057ba48f4e70a85092ee6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: CDG55-P1 X-Amz-Cf-Id: 9AqdmmlCrROfroox1WdacdR2pllNn2Xu5QWuNdAtr1GFTtMRXxWY7w==
2024-05-29 13:26:14 UTC	16384	IN	Data Raw: 34 36 62 65 0d 0a 77 69 6e 64 6f 77 2e 68 6a 53 69 74 65 53 65 74 74 69 6e 67 73 20 3d 20 77 69 6e 64 6f 77 2e 68 6a 53 69 74 65 53 65 74 74 69 6e 67 73 20 7c 7c 20 7b 22 73 69 74 65 5f 69 64 22 3a 34 37 30 38 30 35 2c 22 72 65 63 5f 76 61 6c 75 65 22 3a 30 2e 30 2c 22 73 74 61 74 65 5f 63 68 61 6e 67 65 5f 6c 69 73 74 65 6e 5f 6d 6f 64 65 22 3a 22 61 75 74 6f 6d 61 74 69 63 22 2c 22 72 65 63 6f 72 64 22 3a 74 72 75 65 2c 22 63 6f 6e 74 69 6e 75 6f 75 73 5f 63 61 70 74 75 72 65 5f 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 72 65 63 6f 72 64 69 6e 67 5f 63 61 70 74 75 72 65 5f 6b 65 79 73 74 72 6f 6b 65 73 22 3a 66 61 6c 73 65 2c 22 73 65 73 73 69 6f 6e 5f 63 61 70 74 75 72 65 5f 63 6f 6e 73 6f 6c 65 5f 63 6f 6e 73 65 6e 74 22 3a 66 61 6c 73 65 2c 22 61 Data Ascii: 46bewindow.hjSiteSettings = window.hjSiteSettings \|\| {"site_id":470805,"rec_value":0.0,"state_change_listen_mode":"automatic","record":true,"continuous_capture_enabled":true,"recording_capture_keystrokes":false,"session_capture_console_consent":false,"a
2024-05-29 13:26:14 UTC	1734	IN	Data Raw: 29 7c 7c 22 75 6e 6b 6e 6f 77 6e 22 3b 69 66 28 69 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 68 6a 2e 6d 65 74 72 69 63 73 2e 63 6f 75 6e 74 28 22 73 65 73 73 69 6f 6e 2d 72 65 6a 65 63 74 69 6f 6e 22 2c 7b 74 61 67 3a 7b 72 65 61 73 6f 6e 3a 22 62 6f 74 22 7d 7d 29 2c 76 6f 69 64 20 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 48 6f 74 6a 61 72 20 6e 6f 74 20 6c 61 75 6e 63 68 69 6e 67 20 64 75 65 20 74 6f 20 73 75 73 70 69 63 69 6f 75 73 20 75 73 65 72 41 67 65 6e 74 3a 22 2c 61 29 3b 76 61 72 20 6f 3d 22 68 74 74 70 3a 22 3d 3d 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2c 73 3d 42 6f 6f 6c 65 61 6e 28 77 69 6e 64 6f 77 2e 5f 68 6a 53 65 74 74 69 6e 67 73 2e 70 72 65 76 69 65 77 29 3b 69 66 28 6f 26 26 21 73 29 72 65 Data Ascii: )\|\|"unknown";if(i.test(a))return hj.metrics.count("session-rejection",{tag:{reason:"bot"}}),void console.warn("Hotjar not launching due to suspicious userAgent:",a);var o="http:"===window.location.protocol,s=Boolean(window._hjSettings.preview);if(o&&!s)re
2024-05-29 13:26:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49809	87.248.119.252	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:13 UTC	461	OUT	GET /wi/ytc.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: s.yimg.com Connection: Keep-Alive
2024-05-29 13:26:14 UTC	946	IN	HTTP/1.1 200 OK x-amz-id-2: RAEbI9Q3ulIHnoUXxGQNugEk7/G7F9HE5d6w/mC+u2Z8WIwk8vinYM+4RDza5Sv4ejJOpdxhNo4= x-amz-request-id: RYQZD9YSG5S42NQ8 Date: Wed, 29 May 2024 13:05:58 GMT Last-Modified: Mon, 26 Jun 2023 09:26:35 GMT x-amz-expiration: expiry-date="Wed, 31 Jul 2024 00:00:00 GMT", rule-id="oath-standard-lifecycle" ETag: "5c6ed25dce803fd84288922b8928409e" x-amz-server-side-encryption: AES256 Cache-Control: public,max-age=3600 x-amz-version-id: xC6OTTJGIjCqkMTkbrZpmtbXHK5oaZhW Accept-Ranges: bytes Content-Type: application/javascript Server: ATS Content-Length: 18187 Referrer-Policy: no-referrer-when-downgrade Vary: Origin Age: 1217 ATS-Carp-Promotion: 1 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff ATS-Carp-Promotion: 1
2024-05-29 13:26:14 UTC	1300	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 72 29 7b 69 66 28 74 5b 72 5d 29 72 65 74 75 72 6e 20 74 5b 72 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 69 3d 74 5b 72 5d 3d 7b 69 3a 72 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 72 5d 2e 63 61 6c 6c 28 69 2e 65 78 70 6f 72 74 73 2c 69 2c 69 2e 65 78 70 6f 72 74 73 2c 6e 29 2c 69 2e 6c 3d 21 30 2c 69 2e 65 78 70 6f 72 74 73 7d 6e 2e 6d 3d 65 2c 6e 2e 63 3d 74 2c 6e 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 6e 2e 6f 28 65 2c 74 29 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 72 7d 29 7d 2c 6e 2e 72 3d 66 75 6e Data Ascii: !function(e){var t={};function n(r){if(t[r])return t[r].exports;var i=t[r]={i:r,l:!1,exports:{}};return e[r].call(i.exports,i,i.exports,n),i.l=!0,i.exports}n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=fun
2024-05-29 13:26:14 UTC	1300	IN	Data Raw: 41 74 28 61 29 29 3e 3d 35 36 33 32 30 26 26 6f 3c 3d 35 37 33 34 33 29 29 7b 72 5b 6e 2b 3d 31 5d 3d 32 33 39 2c 72 5b 6e 2b 3d 31 5d 3d 31 39 31 2c 72 5b 6e 2b 3d 31 5d 3d 31 38 39 3b 63 6f 6e 74 69 6e 75 65 7d 69 66 28 61 2b 3d 31 2c 28 69 3d 31 30 32 34 2a 28 69 2d 35 35 32 39 36 29 2b 6f 2d 35 36 33 32 30 2b 36 35 35 33 36 29 3e 36 35 35 33 35 29 7b 72 5b 6e 2b 3d 31 5d 3d 32 34 30 7c 69 3e 3e 3e 31 38 2c 72 5b 6e 2b 3d 31 5d 3d 31 32 38 7c 69 3e 3e 3e 31 32 26 36 33 2c 72 5b 6e 2b 3d 31 5d 3d 31 32 38 7c 69 3e 3e 3e 36 26 36 33 2c 72 5b 6e 2b 3d 31 5d 3d 31 32 38 7c 36 33 26 69 3b 63 6f 6e 74 69 6e 75 65 7d 7d 69 3c 3d 31 32 37 3f 72 5b 6e 2b 3d 31 5d 3d 30 7c 69 3a 69 3c 3d 32 30 34 37 3f 28 72 5b 6e 2b 3d 31 5d 3d 31 39 32 7c 69 3e 3e 3e 36 2c 72 Data Ascii: At(a))>=56320&&o<=57343)){r[n+=1]=239,r[n+=1]=191,r[n+=1]=189;continue}if(a+=1,(i=1024*(i-55296)+o-56320+65536)>65535){r[n+=1]=240\|i>>>18,r[n+=1]=128\|i>>>12&63,r[n+=1]=128\|i>>>6&63,r[n+=1]=128\|63&i;continue}}i<=127?r[n+=1]=0\|i:i<=2047?(r[n+=1]=192\|i>>>6,r
2024-05-29 13:26:14 UTC	1300	IN	Data Raw: 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 76 6f 69 64 20 30 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 61 29 7b 69 66 28 21 74 28 61 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 41 72 72 61 79 2e 66 72 6f 6d 3a 20 77 68 65 6e 20 70 72 6f 76 69 64 65 64 2c 20 74 68 65 20 73 65 63 6f 6e 64 20 61 72 67 75 6d 65 6e 74 20 6d 75 73 74 20 62 65 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 26 26 28 6f 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 29 7d 66 6f 72 28 76 61 72 20 73 2c 75 3d 72 28 69 2e 6c 65 6e 67 74 68 29 2c 64 3d 74 28 6e 29 3f 4f 62 6a 65 63 74 28 6e 65 77 20 6e 28 75 29 29 3a 6e 65 77 20 41 72 72 61 79 28 75 29 2c 63 3d 30 3b 63 3c 75 3b 29 73 3d 69 5b 63 5d 2c 64 5b 63 5d 3d 61 3f 76 Data Ascii: arguments[1]:void 0;if(void 0!==a){if(!t(a))throw new TypeError("Array.from: when provided, the second argument must be a function");arguments.length>2&&(o=arguments[2])}for(var s,u=r(i.length),d=t(n)?Object(new n(u)):new Array(u),c=0;c<u;)s=i[c],d[c]=a?v
2024-05-29 13:26:14 UTC	1300	IN	Data Raw: 63 68 28 65 29 7b 7d 69 66 28 6e 3d 3d 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 62 72 65 61 6b 3b 6e 3d 6e 2e 70 61 72 65 6e 74 7d 72 65 74 75 72 6e 20 74 7d 28 74 29 3b 69 66 28 21 69 29 72 65 74 75 72 6e 20 76 6f 69 64 20 76 28 65 29 3b 76 61 72 20 6f 3d 7b 7d 2c 61 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 22 22 3b 22 5f 5f 74 63 66 61 70 69 4c 6f 63 61 74 6f 72 22 3d 3d 3d 74 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 77 69 6e 64 6f 77 5b 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 69 2c 6f 2c 61 29 7b 76 61 72 20 73 3d 7b 5f 5f 74 63 66 61 70 69 43 61 6c 6c 3a 7b 63 6f 6d 6d 61 6e 64 3a 65 2c 70 61 72 61 6d 65 74 65 72 3a 61 2c 76 65 72 73 69 6f 6e 3a 69 2c 63 61 6c 6c 49 64 3a 72 7d 7d 3b 6e 5b 72 5d 3d 6f 2c 6c 28 74 2c 73 2c 22 2a 22 29 Data Ascii: ch(e){}if(n===window.top)break;n=n.parent}return t}(t);if(!i)return void v(e);var o={},a=Math.random()+"";"__tcfapiLocator"===t?function(e,t,n,r){window[e]=function(e,i,o,a){var s={__tcfapiCall:{command:e,parameter:a,version:i,callId:r}};n[r]=o,l(t,s,"*")
2024-05-29 13:26:14 UTC	1300	IN	Data Raw: 6e 67 3a 6e 2e 75 73 70 53 74 72 69 6e 67 2c 69 73 4f 61 74 68 46 69 72 73 74 50 61 72 74 79 3a 6e 2e 69 73 4f 61 74 68 46 69 72 73 74 50 61 72 74 79 7d 2c 21 30 29 3a 65 28 76 6f 69 64 20 30 2c 21 31 29 7d 29 29 29 7d 2c 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 3b 6d 28 22 5f 5f 74 63 66 61 70 69 22 2c 22 5f 5f 74 63 66 61 70 69 4c 6f 63 61 74 6f 72 22 2c 22 5f 5f 74 63 66 61 70 69 43 61 6c 6c 22 2c 22 5f 5f 74 63 66 61 70 69 52 65 74 75 72 6e 22 29 2c 77 69 6e 64 6f 77 2e 5f 5f 74 63 66 61 70 69 3f 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 3f 28 68 28 65 29 2c 76 28 22 5f 5f 74 63 66 61 70 69 22 29 29 3a 67 28 29 7d 2c 74 3d 73 65 74 54 69 6d 65 6f 75 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 65 28 76 6f 69 64 20 30 2c 21 Data Ascii: ng:n.uspString,isOathFirstParty:n.isOathFirstParty},!0):e(void 0,!1)})))},y=function(){var e,t;m("__tcfapi","__tcfapiLocator","__tcfapiCall","__tcfapiReturn"),window.__tcfapi?(e=function(e,t){t?(h(e),v("__tcfapi")):g()},t=setTimeout((function(){e(void 0,!
2024-05-29 13:26:14 UTC	1300	IN	Data Raw: 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 3a 22 3b 20 65 78 70 69 72 65 73 3d 54 68 75 2c 20 30 31 2d 4a 61 6e 2d 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 4d 54 22 2c 6e 3d 65 2e 6e 61 6d 65 2b 22 3d 22 2b 65 2e 76 61 6c 75 65 2b 74 2b 22 3b 20 70 61 74 68 3d 22 2b 65 2e 70 61 74 68 2b 28 22 22 21 3d 3d 65 2e 64 6f 6d 61 69 6e 3f 22 3b 20 64 6f 6d 61 69 6e 3d 2e 22 2b 65 2e 64 6f 6d 61 69 6e 3a 22 22 29 2b 22 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 22 2c 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 6e 7d 28 7b 6e 61 6d 65 3a 65 2c 76 61 6c 75 65 3a 74 2c 65 78 70 69 72 79 4f 66 66 73 65 74 3a 6e 2c 64 6f 6d 61 69 6e 3a 61 28 29 2c 70 61 74 68 3a 22 2f 22 7d 29 3b 76 61 72 20 72 3d 7b 69 64 3a 74 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 Data Ascii: .toGMTString():"; expires=Thu, 01-Jan-1970 00:00:01 GMT",n=e.name+"="+e.value+t+"; path="+e.path+(""!==e.domain?"; domain=."+e.domain:"")+"; SameSite=Lax",document.cookie=n}({name:e,value:t,expiryOffset:n,domain:a(),path:"/"});var r={id:t,timestamp:(new D
2024-05-29 13:26:14 UTC	1300	IN	Data Raw: 29 7d 7d 76 61 72 20 48 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 30 3b 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 67 65 2e 70 6c 61 69 6e 41 75 69 64 73 29 7b 76 61 72 20 72 3d 41 72 72 61 79 2e 66 72 6f 6d 28 6e 65 77 20 55 69 6e 74 38 41 72 72 61 79 28 65 5b 74 5d 29 29 2e 6d 61 70 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 2e 70 61 64 53 74 61 72 74 28 32 2c 22 30 22 29 7d 29 29 3b 67 65 2e 68 61 73 68 65 64 41 75 69 64 73 5b 6e 5d 3d 72 2e 6a 6f 69 6e 28 22 22 29 2c 74 2b 2b 7d 67 65 2e 61 75 69 64 73 41 72 65 48 61 73 68 65 64 3d 21 30 2c 79 65 28 29 7d 2c 4d 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 74 2e 70 75 73 68 28 Data Ascii: )}}var H=function(e){var t=0;for(var n in ge.plainAuids){var r=Array.from(new Uint8Array(e[t])).map((function(e){return e.toString(16).padStart(2,"0")}));ge.hashedAuids[n]=r.join(""),t++}ge.auidsAreHashed=!0,ye()},M=function(e,t){var n=function(n){t.push(
2024-05-29 13:26:14 UTC	1300	IN	Data Raw: 3b 72 65 74 75 72 6e 28 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 7c 7c 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 29 2e 73 75 62 74 6c 65 2e 64 69 67 65 73 74 28 22 53 48 41 2d 32 35 36 22 2c 74 29 7d 3b 76 61 72 20 56 2c 7a 3d 21 31 3b 66 75 6e 63 74 69 6f 6e 20 59 28 65 29 7b 69 66 28 76 6f 69 64 20 30 21 3d 3d 65 29 7b 76 61 72 20 74 3d 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 2c 6e 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 77 69 2f 63 6f 6e 66 69 67 2f 22 2b 65 2b 22 2e 6a 73 6f 6e 22 3b 74 2e 6f 70 65 6e 28 22 47 45 54 22 2c 6e 2c 21 30 29 2c 74 2e 74 69 6d 65 6f 75 74 3d 32 65 33 2c 74 2e 6f 6e 74 69 6d 65 6f 75 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 71 2d 2d 2c 79 65 28 29 7d 2c 74 2e 73 65 6e 64 28 29 2c 74 2e Data Ascii: ;return(window.crypto\|\|window.msCrypto).subtle.digest("SHA-256",t)};var V,z=!1;function Y(e){if(void 0!==e){var t=new XMLHttpRequest,n="https://s.yimg.com/wi/config/"+e+".json";t.open("GET",n,!0),t.timeout=2e3,t.ontimeout=function(e){q--,ye()},t.send(),t.
2024-05-29 13:26:14 UTC	1300	IN	Data Raw: 6d 61 69 6c 26 26 28 74 2e 75 73 65 72 45 6d 61 69 6c 3d 67 65 2e 65 6d 61 69 6c 73 5b 74 2e 70 69 78 65 6c 49 64 5d 29 2c 74 2e 75 73 65 72 48 61 73 68 65 64 45 6d 61 69 6c 26 26 28 49 65 28 74 2e 75 73 65 72 48 61 73 68 65 64 45 6d 61 69 6c 29 7c 7c 64 65 6c 65 74 65 20 74 2e 75 73 65 72 48 61 73 68 65 64 45 6d 61 69 6c 29 7d 76 61 72 20 24 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 74 2e 70 75 73 68 28 6e 2e 74 61 72 67 65 74 2e 72 65 73 75 6c 74 29 2c 74 2e 6c 65 6e 67 74 68 3d 3d 3d 65 2e 6c 65 6e 67 74 68 26 26 5a 28 74 29 7d 3b 66 6f 72 28 76 61 72 20 72 20 69 6e 20 65 29 65 5b 72 5d 2e 6f 6e 63 6f 6d 70 6c 65 74 65 3d 6e 7d 2c 5a 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 30 3b Data Ascii: mail&&(t.userEmail=ge.emails[t.pixelId]),t.userHashedEmail&&(Ie(t.userHashedEmail)\|\|delete t.userHashedEmail)}var $=function(e,t){var n=function(n){t.push(n.target.result),t.length===e.length&&Z(t)};for(var r in e)e[r].oncomplete=n},Z=function(e){var t=0;
2024-05-29 13:26:14 UTC	1300	IN	Data Raw: 6f 6d 70 6f 6e 65 6e 74 28 70 61 72 73 65 49 6e 74 28 74 2e 67 65 74 54 69 6d 65 7a 6f 6e 65 4f 66 66 73 65 74 28 29 2f 36 30 2c 31 30 29 2b 28 74 2e 67 65 74 54 69 6d 65 7a 6f 6e 65 4f 66 66 73 65 74 28 29 3c 74 2e 79 77 61 53 74 61 6e 64 61 72 64 54 69 6d 65 7a 6f 6e 65 4f 66 66 73 65 74 3f 22 64 22 3a 22 22 29 29 29 2c 65 2e 6a 6f 69 6e 28 22 22 29 7d 28 29 29 2c 72 2e 6a 6f 69 6e 28 22 22 29 7d 76 61 72 20 72 65 3d 5b 7b 6e 61 6d 65 3a 22 74 65 61 6c 69 75 6d 22 2c 69 6e 74 65 72 66 61 63 65 3a 22 75 74 61 67 5f 64 61 74 61 22 7d 2c 7b 6e 61 6d 65 3a 22 67 74 6d 22 2c 69 6e 74 65 72 66 61 63 65 3a 22 67 6f 6f 67 6c 65 5f 74 61 67 5f 6d 61 6e 61 67 65 72 22 7d 2c 7b 6e 61 6d 65 3a 22 61 64 6f 62 65 22 2c 69 6e 74 65 72 66 61 63 65 3a 22 5f 73 61 74 65 Data Ascii: omponent(parseInt(t.getTimezoneOffset()/60,10)+(t.getTimezoneOffset()<t.ywaStandardTimezoneOffset?"d":""))),e.join("")}()),r.join("")}var re=[{name:"tealium",interface:"utag_data"},{name:"gtm",interface:"google_tag_manager"},{name:"adobe",interface:"_sate

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49798	104.19.178.52	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:13 UTC	510	OUT	GET /scripttemplates/6.33.0/assets/otCenterRounded.json HTTP/1.1 Accept: / Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH Origin: https://www.avast.com Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: cdn.cookielaw.org Connection: Keep-Alive
2024-05-29 13:26:14 UTC	809	IN	HTTP/1.1 200 OK Date: Wed, 29 May 2024 13:26:14 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Content-MD5: Lm+fnsoMFVqoUbgeDGGjrQ== Last-Modified: Wed, 13 Apr 2022 01:38:18 GMT x-ms-request-id: e5bae359-d01e-0013-15e6-1d1d8f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 64534 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 88b6d0a1af5c1902-EWR
2024-05-29 13:26:14 UTC	560	IN	Data Raw: 32 35 32 33 0d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 6f 74 43 65 6e 74 65 72 52 6f 75 6e 64 65 64 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 68 74 6d 6c 22 3a 20 22 50 47 52 70 64 69 42 70 5a 44 30 69 62 32 35 6c 64 48 4a 31 63 33 51 74 59 6d 46 75 62 6d 56 79 4c 58 4e 6b 61 79 49 67 59 32 78 68 63 33 4d 39 49 6d 39 30 51 32 56 75 64 47 56 79 55 6d 39 31 62 6d 52 6c 5a 43 49 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 63 32 52 72 4c 57 4e 76 62 6e 52 68 61 57 35 6c 63 69 49 67 63 6d 39 73 5a 54 30 69 59 57 78 6c 63 6e 52 6b 61 57 46 73 62 32 63 69 49 47 46 79 61 57 45 74 5a 47 56 7a 59 33 4a 70 59 6d 56 6b 59 6e 6b 39 49 6d 39 75 5a 58 Data Ascii: 2523 { "name": "otCenterRounded", "html": "PGRpdiBpZD0ib25ldHJ1c3QtYmFubmVyLXNkayIgY2xhc3M9Im90Q2VudGVyUm91bmRlZCI+PGRpdiBjbGFzcz0ib3Qtc2RrLWNvbnRhaW5lciIgcm9sZT0iYWxlcnRkaWFsb2ciIGFyaWEtZGVzY3JpYmVkYnk9Im9uZX
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 30 61 58 52 73 5a 53 49 2b 56 47 6c 30 62 47 55 38 4c 32 67 79 50 6a 78 77 49 47 6c 6b 50 53 4a 76 62 6d 56 30 63 6e 56 7a 64 43 31 77 62 32 78 70 59 33 6b 74 64 47 56 34 64 43 49 2b 64 47 56 34 64 44 78 68 49 47 68 79 5a 57 59 39 49 69 4d 69 50 6e 42 76 62 47 6c 6a 65 54 77 76 59 54 34 38 4c 33 41 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 5a 48 42 6b 4c 57 4e 76 62 6e 52 68 61 57 35 6c 63 69 49 2b 50 47 67 7a 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 6b 63 47 51 74 64 47 6c 30 62 47 55 69 50 6a 77 76 61 44 4d 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 5a 48 42 6b 4c 57 4e 76 62 6e 52 6c 62 6e 51 69 50 6a 78 77 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 6b 63 47 51 74 5a 47 56 7a 59 79 49 2b 50 43 39 77 50 6a Data Ascii: 0aXRsZSI+VGl0bGU8L2gyPjxwIGlkPSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+dGV4dDxhIGhyZWY9IiMiPnBvbGljeTwvYT48L3A+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRhaW5lciI+PGgzIGNsYXNzPSJvdC1kcGQtdGl0bGUiPjwvaDM+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRlbnQiPjxwIGNsYXNzPSJvdC1kcGQtZGVzYyI+PC9wPj
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 64 6a 34 38 4c 32 52 70 64 6a 34 38 4c 32 52 70 64 6a 34 3d 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 63 73 73 22 3a 20 22 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 31 38 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 32 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 43 65 6e 74 65 72 52 6f 75 6e 64 65 64 7b 7a 2d 69 6e 64 65 78 3a 32 31 34 37 34 38 33 36 34 35 3b 74 6f 70 3a 31 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 72 69 67 68 74 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 77 69 64 74 68 3a 36 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 36 35 30 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 2e 35 Data Ascii: dj48L2Rpdj48L2Rpdj4=", "css": "#onetrust-banner-sdk{box-shadow:0 0 18px rgba(0,0,0,.2)}#onetrust-banner-sdk.otCenterRounded{z-index:2147483645;top:10%;position:fixed;right:0;background-color:#fff;width:60%;max-width:650px;border-radius:2.5
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 77 69 64 74 68 3a 61 75 74 6f 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 62 2d 61 64 64 6c 2d 64 65 73 63 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 2d 70 61 72 65 6e 74 7b 70 61 64 64 69 6e 67 3a 31 35 70 78 20 33 30 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 2d 70 61 72 65 6e 74 3a 6e 6f 74 28 2e 68 61 73 2d 72 65 6a 65 63 74 2d 61 6c 6c 2d 62 75 74 74 6f Data Ascii: adding:0;border:0;height:auto;width:auto}#onetrust-banner-sdk .ot-b-addl-desc{display:block}#onetrust-banner-sdk #onetrust-button-group-parent{padding:15px 30px;text-align:center}#onetrust-banner-sdk #onetrust-button-group-parent:not(.has-reject-all-butto
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 2e 63 6f 6f 6b 69 65 2d 73 65 74 74 69 6e 67 2d 6c 69 6e 6b 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 68 61 73 2d 72 65 6a 65 63 74 2d 61 6c 6c 2d 62 75 74 74 6f 6e 20 2e 62 61 6e 6e 65 72 2d 61 63 74 69 6f 6e 73 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 78 2d 77 69 64 74 68 3a 36 30 25 3b 77 69 64 74 68 3a 61 75 74 6f 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 7b 77 69 64 74 68 3a 34 34 70 78 3b 68 65 69 67 68 74 3a 34 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 2d 31 38 70 Data Ascii: st-pc-btn-handler.cookie-setting-link{text-align:left;margin-right:0}#onetrust-banner-sdk .has-reject-all-button .banner-actions-container{max-width:60%;width:auto}#onetrust-banner-sdk .ot-close-icon{width:44px;height:44px;background-size:12px;margin:-18p
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 3b 2d 6d 6f 7a 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 3b 2d 6f 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 61 72 72 6f 77 2d 63 6f 6e 74 61 69 6e 65 72 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 36 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 36 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 36 Data Ascii: webkit-transition:all 300ms ease-in 0s;-moz-transition:all 300ms ease-in 0s;-o-transition:all 300ms ease-in 0s}#onetrust-banner-sdk .ot-arrow-container{display:inline-block;border-top:6px solid transparent;border-bottom:6px solid transparent;border-left:6
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 6c 6f 73 65 2d 62 74 6e 2d 6c 69 6e 6b 20 23 6f 6e 65 74 72 75 73 74 2d 63 6c 6f 73 65 2d 62 74 6e 2d 63 6f 6e 74 61 69 6e 65 72 7b 74 6f 70 3a 31 35 70 78 3b 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 3b 72 69 67 68 74 3a 31 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 63 6c 6f 73 65 2d 62 74 6e 2d 6c 69 6e 6b 20 23 6f 6e 65 74 72 75 73 74 2d 63 6c 6f 73 65 2d 62 74 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 62 75 74 74 6f 6e 7b 70 61 64 64 69 6e 67 3a 30 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 70 72 65 2d 77 72 61 70 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 66 6f 6e Data Ascii: lose-btn-link #onetrust-close-btn-container{top:15px;transform:none;right:15px}#onetrust-banner-sdk.ot-close-btn-link #onetrust-close-btn-container button{padding:0;white-space:pre-wrap;border:none;height:auto;line-height:1.5;text-decoration:underline;fon
2024-05-29 13:26:14 UTC	741	IN	Data Raw: 32 32 70 78 3b 77 69 64 74 68 3a 63 61 6c 63 28 31 30 30 25 20 2d 20 34 34 70 78 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 2d 70 61 72 65 6e 74 7b 70 61 64 64 69 6e 67 3a 31 35 70 78 20 32 32 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 73 7b 70 61 64 64 69 6e 67 3a 30 20 32 32 70 78 3b 77 69 64 74 68 3a 63 61 6c 63 28 31 30 30 25 20 2d 20 34 34 70 78 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 36 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 68 61 73 2d 72 Data Ascii: 22px;width:calc(100% - 44px)}#onetrust-banner-sdk #onetrust-button-group-parent{padding:15px 22px}#onetrust-banner-sdk #banner-options{padding:0 22px;width:calc(100% - 44px)}#onetrust-banner-sdk .banner-option{margin-bottom:6px}#onetrust-banner-sdk .has-r
2024-05-29 13:26:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49811	20.50.2.44	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:14 UTC	857	OUT	GET /api/mhubc.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: mstatic.avast.com Connection: Keep-Alive Cookie: AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19873%7CMCMID%7C50143117599020028650530509156322338900%7CMCAAMLH-1717593971%7C6%7CMCAAMB-1717593971%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1716996371s%7CNONE%7CvVersion%7C5.5.0; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; sdl_cid=1735890227.1716989172; _gcl_au=1.1.1692554832.1716989172
2024-05-29 13:26:14 UTC	527	IN	HTTP/1.1 200 OK Content-Length: 281177 Connection: close Content-Type: application/javascript; charset=utf-8 Date: Wed, 29 May 2024 13:26:13 GMT Cache-Control: public, max-age=86400, private Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Robots-Tag: noindex,nofollow Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self'; img-src 'self'; frame-src 'self'; upgrade-insecure-requests X-Content-Type-Options: nosniff Reffer-Policy: strict-origin
2024-05-29 13:26:14 UTC	3372	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 61 70 69 55 72 6c 29 7b 0d 0a 66 75 6e 63 74 69 6f 6e 20 6d 68 75 62 4c 6f 61 64 4a 73 28 74 29 7b 63 6f 6e 73 74 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 65 2e 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 2c 65 2e 73 72 63 3d 74 2c 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 7d 77 69 6e 64 6f 77 2e 6d 68 75 62 63 3d 7b 61 64 73 3a 5b 5d 2c 70 75 73 68 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 77 69 6e 64 6f 77 2e 6d 68 75 62 63 2e 71 75 65 75 65 2e 70 75 73 68 28 74 29 7d 2c 71 75 65 75 65 3a 77 69 6e 64 6f 77 2e 6d 68 75 62 63 26 26 77 69 6e 64 6f 77 2e 6d 68 75 62 63 20 69 6e 73 74 61 6e 63 65 6f 66 Data Ascii: (function(apiUrl){function mhubLoadJs(t){const e=document.createElement("script");e.type="text/javascript",e.src=t,document.head.appendChild(e)}window.mhubc={ads:[],push:function(t){window.mhubc.queue.push(t)},queue:window.mhubc&&window.mhubc instanceof
2024-05-29 13:26:14 UTC	4096	IN	Data Raw: 28 74 68 69 73 2c 65 2c 74 29 2e 76 7d 7d 29 2c 22 65 73 36 22 2c 22 65 73 33 22 29 2c 24 6a 73 63 6f 6d 70 2e 70 6f 6c 79 66 69 6c 6c 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6f 3d 24 6a 73 63 6f 6d 70 2e 63 68 65 63 6b 53 74 72 69 6e 67 41 72 67 73 28 74 68 69 73 2c 65 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 3b 65 2b 3d 22 22 3b 76 61 72 20 72 3d 6f 2e 6c 65 6e 67 74 68 2c 73 3d 65 2e 6c 65 6e 67 74 68 3b 74 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 30 7c 74 2c 6f 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e 3c 73 26 26 74 3c 72 3b 29 Data Ascii: (this,e,t).v}}),"es6","es3"),$jscomp.polyfill("String.prototype.startsWith",(function(e){return e\|\|function(e,t){var o=$jscomp.checkStringArgs(this,e,"startsWith");e+="";var r=o.length,s=e.length;t=Math.max(0,Math.min(0\|t,o.length));for(var n=0;n<s&&t<r;)
2024-05-29 13:26:14 UTC	4096	IN	Data Raw: 75 6c 65 4c 6f 61 64 65 72 53 74 61 74 65 5f 2e 6d 6f 64 75 6c 65 4e 61 6d 65 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 67 6f 6f 67 2e 6d 6f 64 75 6c 65 20 6d 75 73 74 20 62 65 20 63 61 6c 6c 65 64 20 70 72 69 6f 72 20 74 6f 20 67 6f 6f 67 2e 6d 6f 64 75 6c 65 2e 64 65 63 6c 61 72 65 4c 65 67 61 63 79 4e 61 6d 65 73 70 61 63 65 2e 22 29 3b 67 6f 6f 67 2e 6d 6f 64 75 6c 65 4c 6f 61 64 65 72 53 74 61 74 65 5f 2e 64 65 63 6c 61 72 65 4c 65 67 61 63 79 4e 61 6d 65 73 70 61 63 65 3d 21 30 7d 2c 67 6f 6f 67 2e 64 65 63 6c 61 72 65 4d 6f 64 75 6c 65 49 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 43 4f 4d 50 49 4c 45 44 29 7b 69 66 28 21 67 6f 6f 67 2e 69 73 49 6e 45 73 36 4d 6f 64 75 6c 65 4c 6f 61 64 65 72 5f 28 29 29 74 68 72 6f 77 20 45 72 72 6f 72 Data Ascii: uleLoaderState_.moduleName)throw Error("goog.module must be called prior to goog.module.declareLegacyNamespace.");goog.moduleLoaderState_.declareLegacyNamespace=!0},goog.declareModuleId=function(e){if(!COMPILED){if(!goog.isInEs6ModuleLoader_())throw Error
2024-05-29 13:26:14 UTC	4096	IN	Data Raw: 5f 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 67 6f 6f 67 2e 67 6c 6f 62 61 6c 2e 43 4c 4f 53 55 52 45 5f 4c 4f 41 44 5f 46 49 4c 45 5f 53 59 4e 43 29 72 65 74 75 72 6e 20 67 6f 6f 67 2e 67 6c 6f 62 61 6c 2e 43 4c 4f 53 55 52 45 5f 4c 4f 41 44 5f 46 49 4c 45 5f 53 59 4e 43 28 65 29 3b 74 72 79 7b 76 61 72 20 74 3d 6e 65 77 20 67 6f 6f 67 2e 67 6c 6f 62 61 6c 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 3b 72 65 74 75 72 6e 20 74 2e 6f 70 65 6e 28 22 67 65 74 22 2c 65 2c 21 31 29 2c 74 2e 73 65 6e 64 28 29 2c 30 3d 3d 74 2e 73 74 61 74 75 73 7c 7c 32 30 30 3d 3d 74 2e 73 74 61 74 75 73 3f 74 2e 72 65 73 70 6f 6e 73 65 54 65 78 74 3a 6e 75 6c 6c 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 7d 2c 67 6f 6f 67 2e 74 72 61 6e 73 70 69 Data Ascii: _=function(e){if(goog.global.CLOSURE_LOAD_FILE_SYNC)return goog.global.CLOSURE_LOAD_FILE_SYNC(e);try{var t=new goog.global.XMLHttpRequest;return t.open("get",e,!1),t.send(),0==t.status\|\|200==t.status?t.responseText:null}catch(e){return null}},goog.transpi
2024-05-29 13:26:14 UTC	4096	IN	Data Raw: 6f 72 47 6c 6f 62 61 6c 73 5f 3d 6e 75 6c 6c 2c 67 6f 6f 67 2e 67 65 74 43 73 73 4e 61 6d 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 2e 22 3d 3d 53 74 72 69 6e 67 28 65 29 2e 63 68 61 72 41 74 28 30 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 27 63 6c 61 73 73 4e 61 6d 65 20 70 61 73 73 65 64 20 69 6e 20 67 6f 6f 67 2e 67 65 74 43 73 73 4e 61 6d 65 20 6d 75 73 74 20 6e 6f 74 20 73 74 61 72 74 20 77 69 74 68 20 22 2e 22 2e 20 59 6f 75 20 70 61 73 73 65 64 3a 20 27 2b 65 29 3b 76 61 72 20 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 67 6f 6f 67 2e 63 73 73 4e 61 6d 65 4d 61 70 70 69 6e 67 5f 5b 65 5d 7c 7c 65 7d 2c 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 3d 65 2e 73 70 6c 69 74 28 22 2d 22 29 3b 66 6f 72 28 76 61 72 20 Data Ascii: orGlobals_=null,goog.getCssName=function(e,t){if("."==String(e).charAt(0))throw Error('className passed in goog.getCssName must not start with ".". You passed: '+e);var o=function(e){return goog.cssNameMapping_[e]\|\|e},r=function(e){e=e.split("-");for(var
2024-05-29 13:26:14 UTC	4096	IN	Data Raw: 2e 6e 61 76 69 67 61 74 6f 72 26 26 67 6f 6f 67 2e 67 6c 6f 62 61 6c 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 3f 67 6f 6f 67 2e 67 6c 6f 62 61 6c 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 3a 22 22 3b 72 65 74 75 72 6e 20 61 28 22 65 73 35 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 28 22 5b 31 2c 5d 2e 6c 65 6e 67 74 68 3d 3d 31 22 29 7d 29 29 2c 61 28 22 65 73 36 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 66 2e 6d 61 74 63 68 28 2f 45 64 67 65 5c 2f 28 5c 64 2b 29 28 5c 2e 5c 64 29 2a 2f 69 29 26 26 62 28 27 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 63 6c 61 73 73 20 58 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7b 69 66 28 6e 65 77 2e 74 61 72 67 65 74 21 3d 53 Data Ascii: .navigator&&goog.global.navigator.userAgent?goog.global.navigator.userAgent:"";return a("es5",(function(){return b("[1,].length==1")})),a("es6",(function(){return!f.match(/Edge\/(\d+)(\.\d)*/i)&&b('(()=>{"use strict";class X{constructor(){if(new.target!=S
2024-05-29 13:26:14 UTC	4096	IN	Data Raw: 65 44 65 70 73 4c 6f 61 64 65 64 5f 28 72 2e 72 65 71 75 69 72 65 73 29 7d 7d 3b 74 72 79 7b 72 2e 6c 6f 61 64 28 6e 29 7d 66 69 6e 61 6c 6c 79 7b 6f 3d 21 30 7d 7d 28 29 3b 74 26 26 74 68 69 73 2e 70 61 75 73 65 5f 28 29 7d 2c 67 6f 6f 67 2e 44 65 62 75 67 4c 6f 61 64 65 72 5f 2e 70 72 6f 74 6f 74 79 70 65 2e 70 61 75 73 65 5f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 70 61 75 73 65 64 5f 3d 21 30 7d 2c 67 6f 6f 67 2e 44 65 62 75 67 4c 6f 61 64 65 72 5f 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 73 75 6d 65 5f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 70 61 75 73 65 64 5f 26 26 28 74 68 69 73 2e 70 61 75 73 65 64 5f 3d 21 31 2c 74 68 69 73 2e 6c 6f 61 64 44 65 70 73 5f 28 29 29 7d 2c 67 6f 6f 67 2e 44 65 62 75 67 4c 6f 61 64 65 72 5f 2e 70 Data Ascii: eDepsLoaded_(r.requires)}};try{r.load(n)}finally{o=!0}}();t&&this.pause_()},goog.DebugLoader_.prototype.pause_=function(){this.paused_=!0},goog.DebugLoader_.prototype.resume_=function(){this.paused_&&(this.paused_=!1,this.loadDeps_())},goog.DebugLoader_.p
2024-05-29 13:26:14 UTC	4096	IN	Data Raw: 74 69 6f 6e 28 29 7b 22 6c 6f 61 64 65 64 22 21 3d 73 2e 72 65 61 64 79 53 74 61 74 65 26 26 22 63 6f 6d 70 6c 65 74 65 22 21 3d 73 2e 72 65 61 64 79 53 74 61 74 65 7c 7c 28 65 2e 6c 6f 61 64 65 64 28 29 2c 65 2e 72 65 73 75 6d 65 28 29 29 7d 29 3a 73 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 73 2e 6f 6e 6c 6f 61 64 3d 6e 75 6c 6c 2c 65 2e 6c 6f 61 64 65 64 28 29 7d 2c 73 2e 73 72 63 3d 67 6f 6f 67 2e 54 52 55 53 54 45 44 5f 54 59 50 45 53 5f 50 4f 4c 49 43 59 5f 3f 67 6f 6f 67 2e 54 52 55 53 54 45 44 5f 54 59 50 45 53 5f 50 4f 4c 49 43 59 5f 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 74 68 69 73 2e 70 61 74 68 29 3a 74 68 69 73 2e 70 61 74 68 2c 74 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 73 29 7d 7d 65 6c 73 65 20 67 Data Ascii: tion(){"loaded"!=s.readyState&&"complete"!=s.readyState\|\|(e.loaded(),e.resume())}):s.onload=function(){s.onload=null,e.loaded()},s.src=goog.TRUSTED_TYPES_POLICY_?goog.TRUSTED_TYPES_POLICY_.createScriptURL(this.path):this.path,t.head.appendChild(s)}}else g
2024-05-29 13:26:14 UTC	4096	IN	Data Raw: 73 63 72 69 70 74 22 3e 27 2b 67 6f 6f 67 2e 70 72 6f 74 65 63 74 53 63 72 69 70 74 54 61 67 5f 28 27 67 6f 6f 67 2e 44 65 70 65 6e 64 65 6e 63 79 2e 63 61 6c 6c 62 61 63 6b 5f 28 22 27 2b 74 2b 27 22 29 3b 27 29 2b 22 3c 5c 2f 73 63 72 69 70 74 3e 22 3b 65 2e 77 72 69 74 65 28 67 6f 6f 67 2e 54 52 55 53 54 45 44 5f 54 59 50 45 53 5f 50 4f 4c 49 43 59 5f 3f 67 6f 6f 67 2e 54 52 55 53 54 45 44 5f 54 59 50 45 53 5f 50 4f 4c 49 43 59 5f 2e 63 72 65 61 74 65 48 54 4d 4c 28 72 29 3a 72 29 7d 28 29 3a 6f 28 29 7d 7d 7d 2c 67 6f 6f 67 2e 54 72 61 6e 73 66 6f 72 6d 65 64 44 65 70 65 6e 64 65 6e 63 79 2e 70 72 6f 74 6f 74 79 70 65 2e 74 72 61 6e 73 66 6f 72 6d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 7d 2c 67 6f 6f 67 2e 54 72 61 6e 73 70 69 6c 65 64 44 65 70 65 6e Data Ascii: script">'+goog.protectScriptTag_('goog.Dependency.callback_("'+t+'");')+"<\/script>";e.write(goog.TRUSTED_TYPES_POLICY_?goog.TRUSTED_TYPES_POLICY_.createHTML(r):r)}():o()}}},goog.TransformedDependency.prototype.transform=function(e){},goog.TranspiledDepen
2024-05-29 13:26:14 UTC	4096	IN	Data Raw: 7d 2c 67 6f 6f 67 2e 6f 62 6a 65 63 74 2e 67 65 74 4b 65 79 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6f 3d 5b 5d 2c 72 3d 30 3b 66 6f 72 28 74 20 69 6e 20 65 29 6f 5b 72 2b 2b 5d 3d 74 3b 72 65 74 75 72 6e 20 6f 7d 2c 67 6f 6f 67 2e 6f 62 6a 65 63 74 2e 67 65 74 56 61 6c 75 65 42 79 4b 65 79 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6f 3d 67 6f 6f 67 2e 69 73 41 72 72 61 79 4c 69 6b 65 28 74 29 2c 72 3d 6f 3f 74 3a 61 72 67 75 6d 65 6e 74 73 3b 66 6f 72 28 6f 3d 6f 3f 30 3a 31 3b 6f 3c 72 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 7b 69 66 28 6e 75 6c 6c 3d 3d 65 29 72 65 74 75 72 6e 3b 65 3d 65 5b 72 5b 6f 5d 5d 7d 72 65 74 75 72 6e 20 65 7d 2c 67 6f 6f 67 2e 6f 62 6a 65 63 74 2e 63 6f 6e 74 61 69 6e 73 4b 65 79 3d 66 75 6e Data Ascii: },goog.object.getKeys=function(e){var t,o=[],r=0;for(t in e)o[r++]=t;return o},goog.object.getValueByKeys=function(e,t){var o=goog.isArrayLike(t),r=o?t:arguments;for(o=o?0:1;o<r.length;o++){if(null==e)return;e=e[r[o]]}return e},goog.object.containsKey=fun

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49822	104.19.178.52	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:14 UTC	508	OUT	GET /scripttemplates/6.33.0/assets/otCommonStyles.css HTTP/1.1 Accept: / Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH Origin: https://www.avast.com Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: cdn.cookielaw.org Connection: Keep-Alive
2024-05-29 13:26:14 UTC	826	IN	HTTP/1.1 200 OK Date: Wed, 29 May 2024 13:26:14 GMT Content-Type: text/css Content-Length: 21595 Connection: close Content-MD5: SHFDtZO2nDZuiPDW83p1IQ== Last-Modified: Wed, 13 Apr 2022 01:38:32 GMT ETag: 0x8DA1CEE517188DA x-ms-request-id: 3a2f722b-c01e-000f-154e-144fef000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 64534 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 88b6d0a4d8e141bd-EWR
2024-05-29 13:26:14 UTC	543	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 72 75 73 74 2d 76 65 6e 64 6f 72 73 2d 6c 69 73 74 2d 68 61 6e 64 6c 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 31 66 39 36 64 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 Data Ascii: #onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .one
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 6b 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 3a 31 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 22 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 3b 62 61 73 65 36 34 2c 50 48 4e 32 5a 79 42 32 5a 58 4a 7a 61 57 39 75 50 53 49 78 4c 6a 45 69 49 48 68 74 62 47 35 7a 50 53 4a 6f 64 48 52 77 4f 69 38 76 64 33 64 33 4c 6e 63 7a 4c 6d 39 79 5a 79 38 79 4d 44 41 77 Data Ascii: k #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-image:url("data:image/svg+xml;base64,PHN2ZyB2ZXJzaW9uPSIxLjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAw
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 68 74 3a 31 32 70 78 3b 77 69 64 74 68 3a 31 32 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 70 6f 77 65 72 65 64 2d 62 79 2d 6c 6f 67 6f 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 20 61 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 70 6f 77 65 72 65 64 2d 62 79 2d 6c 6f 67 6f 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 20 61 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 70 6f 77 65 72 65 64 2d 62 79 2d 6c 6f 67 6f 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 70 63 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 20 61 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f Data Ascii: ht:12px;width:12px}#onetrust-banner-sdk .powered-by-logo,#onetrust-banner-sdk .ot-pc-footer-logo a,#onetrust-pc-sdk .powered-by-logo,#onetrust-pc-sdk .ot-pc-footer-logo a,#ot-sync-ntfy .powered-by-logo,#ot-sync-ntfy .ot-pc-footer-logo a{background-size:co
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 3a 63 68 65 63 6b 65 64 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 3a 6e 6f 74 28 3a 63 68 65 63 6b 65 64 29 7b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 69 6e 69 74 69 61 6c 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 3a 64 69 73 61 62 6c 65 64 2b 6c 61 62 65 6c 3a 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 3a 64 69 73 61 62 6c 65 64 2b 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 5b 74 79 Data Ascii: :100%}#onetrust-pc-sdk [type="checkbox"]:checked,#onetrust-pc-sdk [type="checkbox"]:not(:checked){pointer-events:initial}#onetrust-pc-sdk [type="checkbox"]:disabled+label::before,#onetrust-pc-sdk [type="checkbox"]:disabled+label:after,#onetrust-pc-sdk [ty
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 74 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6f 6e 65 74 72 75 73 74 2d 70 63 2d 64 61 72 6b 2d 66 69 6c 74 65 72 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 23 6f 74 2d 73 64 6b 2d 62 74 6e 2e 6f 74 2d 73 64 6b 2d 73 68 6f 77 2d 73 65 74 74 69 6e 67 73 2c 23 6f 74 2d 73 64 6b 2d 62 74 6e 2e 6f 70 74 61 6e 6f 6e 2d 73 68 6f 77 2d 73 65 74 74 69 6e 67 73 7b 63 6f 6c 6f 72 3a 23 36 38 62 36 33 31 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 36 38 62 36 33 31 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 72 6d 61 6c 3b 77 6f 72 64 2d 77 72 61 70 3a Data Ascii: t}#onetrust-pc-sdk.ot-hide{display:none !important}.onetrust-pc-dark-filter.ot-hide{display:none !important}#ot-sdk-btn.ot-sdk-show-settings,#ot-sdk-btn.optanon-show-settings{color:#68b631;border:1px solid #68b631;height:auto;white-space:normal;word-wrap:
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 65 6e 74 73 3a 69 6e 69 74 69 61 6c 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 76 65 6e 2d 68 64 72 3e 70 20 61 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7a 2d 69 6e 64 65 78 3a 32 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 69 6e 69 74 69 61 6c 7d 0a 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2a 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 3a 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 Data Ascii: ents:initial}#onetrust-pc-sdk .ot-ven-hdr>p a{position:relative;z-index:2;pointer-events:initial}#onetrust-banner-sdk,#onetrust-pc-sdk,#ot-sdk-cookie-policy,#ot-sync-ntfy{font-size:16px}#onetrust-banner-sdk *,#onetrust-banner-sdk ::after,#onetrust-banner
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 73 74 2d 70 63 2d 73 64 6b 20 73 70 61 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 31 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 32 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 33 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 34 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 35 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 36 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 70 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 69 6d 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 76 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 62 75 74 74 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 65 63 74 69 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d Data Ascii: st-pc-sdk span,#onetrust-pc-sdk h1,#onetrust-pc-sdk h2,#onetrust-pc-sdk h3,#onetrust-pc-sdk h4,#onetrust-pc-sdk h5,#onetrust-pc-sdk h6,#onetrust-pc-sdk p,#onetrust-pc-sdk img,#onetrust-pc-sdk svg,#onetrust-pc-sdk button,#onetrust-pc-sdk section,#onetrust-
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 64 69 76 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 73 70 61 6e 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 31 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 32 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 33 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 34 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 35 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 36 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 70 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 69 6d 67 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 73 76 67 2c Data Ascii: dk-cookie-policy #ot-pc-content,#ot-sdk-cookie-policy .checkbox,#ot-sync-ntfy div,#ot-sync-ntfy span,#ot-sync-ntfy h1,#ot-sync-ntfy h2,#ot-sync-ntfy h3,#ot-sync-ntfy h4,#ot-sync-ntfy h5,#ot-sync-ntfy h6,#ot-sync-ntfy p,#ot-sync-ntfy img,#ot-sync-ntfy svg,
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 6c 61 62 65 6c 3a 61 66 Data Ascii: st-pc-sdk .checkbox:after,#onetrust-pc-sdk .checkbox:before,#ot-sdk-cookie-policy label:before,#ot-sdk-cookie-policy label:after,#ot-sdk-cookie-policy .checkbox:after,#ot-sdk-cookie-policy .checkbox:before,#ot-sync-ntfy label:before,#ot-sync-ntfy label:af
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 6c 65 66 74 3a 34 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b Data Ascii: left:4%}#onetrust-banner-sdk .ot-sdk-column:first-child,#onetrust-banner-sdk .ot-sdk-columns:first-child,#onetrust-pc-sdk .ot-sdk-column:first-child,#onetrust-pc-sdk .ot-sdk-columns:first-child,#ot-sdk-cookie-policy .ot-sdk-column:first-child,#ot-sdk-cook

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49821	34.117.39.58	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:14 UTC	477	OUT	GET /active/avastcom.jsp HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.upsellit.com Connection: Keep-Alive
2024-05-29 13:26:14 UTC	416	IN	HTTP/1.1 200 OK Server: nginx Strict-Transport-Security: max-age=31536000; includeSubDomains Via: 1.1 google Date: Wed, 29 May 2024 10:33:20 GMT Expires: Thu, 30 May 2024 10:33:20 GMT Cache-Control: max-age=86400 Content-Type: application/x-javascript;charset=ISO-8859-1 Vary: Accept-Encoding Content-Length: 117196 Age: 10374 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-29 13:26:14 UTC	974	IN	Data Raw: 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 74 65 72 7c 7c 28 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 74 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 69 66 28 22 46 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 7c 7c 21 74 68 69 73 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 3b 76 61 72 20 72 3d 74 68 69 73 2e 6c 65 6e 67 74 68 3e 3e 3e 30 2c 6f 3d 6e 65 77 20 41 72 72 61 79 28 72 29 2c 6e 3d 74 68 69 73 2c 6c 3d 30 2c 69 3d 2d 31 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 65 29 66 6f 72 28 3b 2b 2b 69 21 3d 3d 72 3b 29 69 20 69 6e 20 74 68 69 73 26 26 74 28 6e 5b 69 5d 2c 69 2c 6e 29 26 26 28 6f Data Ascii: Array.prototype.filter\|\|(Array.prototype.filter=function(t,e){"use strict";if("Function"!=typeof t&&"function"!=typeof t\|\|!this)throw new TypeError;var r=this.length>>>0,o=new Array(r),n=this,l=0,i=-1;if(void 0===e)for(;++i!==r;)i in this&&t(n[i],i,n)&&(o
2024-05-29 13:26:14 UTC	1390	IN	Data Raw: 2d 31 3b 76 61 72 20 6c 3d 30 7c 65 3b 69 66 28 6c 3e 3d 6e 29 72 65 74 75 72 6e 2d 31 3b 66 6f 72 28 72 3d 4d 61 74 68 2e 6d 61 78 28 6c 3e 3d 30 3f 6c 3a 6e 2d 4d 61 74 68 2e 61 62 73 28 6c 29 2c 30 29 3b 72 3c 6e 3b 29 7b 69 66 28 72 20 69 6e 20 6f 26 26 6f 5b 72 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 72 3b 72 2b 2b 7d 72 65 74 75 72 6e 2d 31 7d 29 2c 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 7c 7c 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 2c 6f 2c 6e 3d 64 6f 63 75 6d 65 6e 74 2c 6c 3d 5b 5d 3b 69 66 28 6e 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 29 72 65 74 75 72 6e 20 6e 2e 71 Data Ascii: -1;var l=0\|e;if(l>=n)return-1;for(r=Math.max(l>=0?l:n-Math.abs(l),0);r<n;){if(r in o&&o[r]===t)return r;r++}return-1}),document.getElementsByClassName\|\|(document.getElementsByClassName=function(t){var e,r,o,n=document,l=[];if(n.querySelectorAll)return n.q
2024-05-29 13:26:14 UTC	1390	IN	Data Raw: 6f 6e 28 6e 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 6e 26 26 28 22 6f 62 6a 65 63 74 22 21 3d 74 79 70 65 6f 66 20 6e 7c 7c 6e 75 6c 6c 3d 3d 3d 6e 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 4f 62 6a 65 63 74 2e 6b 65 79 73 20 63 61 6c 6c 65 64 20 6f 6e 20 6e 6f 6e 2d 6f 62 6a 65 63 74 22 29 3b 76 61 72 20 6c 2c 69 2c 73 3d 5b 5d 3b 66 6f 72 28 6c 20 69 6e 20 6e 29 74 2e 63 61 6c 6c 28 6e 2c 6c 29 26 26 73 2e 70 75 73 68 28 6c 29 3b 69 66 28 65 29 66 6f 72 28 69 3d 30 3b 69 3c 6f 3b 69 2b 2b 29 74 2e 63 61 6c 6c 28 6e 2c 72 5b 69 5d 29 26 26 73 2e 70 75 73 68 28 72 5b 69 5d 29 3b 72 65 74 75 72 6e 20 73 7d 7d 28 29 29 2c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 53 74 72 69 6e 67 2e Data Ascii: on(n){if("function"!=typeof n&&("object"!=typeof n\|\|null===n))throw new TypeError("Object.keys called on non-object");var l,i,s=[];for(l in n)t.call(n,l)&&s.push(l);if(e)for(i=0;i<o;i++)t.call(n,r[i])&&s.push(r[i]);return s}}()),"function"!=typeof String.
2024-05-29 13:26:14 UTC	1390	IN	Data Raw: 6f 6d 6d 6f 6e 73 2e 72 65 70 6f 72 74 5f 65 72 72 6f 72 5f 6e 6f 5f 63 6f 6e 73 6f 6c 65 28 65 72 72 29 3b 0a 09 09 09 09 7d 0a 09 09 09 7d 0a 09 09 7d 2c 0a 09 09 6c 6f 67 5f 73 75 63 63 65 73 73 3a 20 66 75 6e 63 74 69 6f 6e 28 6d 73 67 29 20 7b 0a 09 09 09 69 66 20 28 75 73 69 5f 63 6f 6d 6d 6f 6e 73 2e 64 65 62 75 67 29 20 7b 0a 09 09 09 09 74 72 79 20 7b 0a 09 09 09 09 09 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 25 63 20 55 53 49 20 53 75 63 63 65 73 73 3a 27 2c 20 75 73 69 5f 63 6f 6d 6d 6f 6e 73 2e 6c 6f 67 5f 73 74 79 6c 65 73 2e 73 75 63 63 65 73 73 2c 20 6d 73 67 29 3b 0a 09 09 09 09 7d 20 63 61 74 63 68 28 65 72 72 29 20 7b 0a 09 09 09 09 09 75 73 69 5f 63 6f 6d 6d 6f 6e 73 2e 72 65 70 6f 72 74 5f 65 72 72 6f 72 5f 6e 6f 5f 63 6f 6e 73 6f 6c 65 Data Ascii: ommons.report_error_no_console(err);}}},log_success: function(msg) {if (usi_commons.debug) {try {console.log('%c USI Success:', usi_commons.log_styles.success, msg);} catch(err) {usi_commons.report_error_no_console
2024-05-29 13:26:14 UTC	1390	IN	Data Raw: 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 3b 0a 09 09 09 09 2f 2f 69 66 20 28 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 20 21 3d 20 6c 6f 63 61 74 69 6f 6e 29 20 64 6f 63 48 65 61 64 20 3d 20 70 61 72 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 3b 0a 09 09 09 09 76 61 72 20 6e 65 77 53 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0a 09 09 09 09 6e 65 77 53 63 72 69 70 74 2e 74 79 70 65 20 3d 20 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3b 0a 09 09 09 09 76 61 72 20 75 73 69 5f 61 70 70 65 6e 64 65 72 20 3d 20 22 22 3b 0a 09 09 09 09 69 66 20 28 21 6e 6f 63 61 63 68 65 20 26 26 20 73 6f 75 Data Ascii: ame("head")[0];//if (top.location != location) docHead = parent.document.getElementsByTagName("head")[0];var newScript = document.createElement('script');newScript.type = 'text/javascript';var usi_appender = "";if (!nocache && sou
2024-05-29 13:26:14 UTC	1390	IN	Data Raw: 09 09 76 61 72 20 75 73 69 5f 61 70 70 65 6e 64 20 3d 20 22 22 3b 0a 09 09 09 09 09 69 66 20 28 75 73 69 5f 63 6f 6d 6d 6f 6e 73 2e 67 75 70 28 22 75 73 69 5f 66 6f 72 63 65 5f 64 61 74 65 22 29 20 21 3d 20 22 22 29 20 75 73 69 5f 61 70 70 65 6e 64 20 3d 20 22 26 75 73 69 5f 66 6f 72 63 65 5f 64 61 74 65 3d 22 20 2b 20 75 73 69 5f 63 6f 6d 6d 6f 6e 73 2e 67 75 70 28 22 75 73 69 5f 66 6f 72 63 65 5f 64 61 74 65 22 29 3b 0a 09 09 09 09 09 65 6c 73 65 20 69 66 20 28 74 79 70 65 6f 66 20 75 73 69 5f 63 6f 6f 6b 69 65 73 20 21 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 20 26 26 20 75 73 69 5f 63 6f 6f 6b 69 65 73 2e 67 65 74 28 22 75 73 69 5f 66 6f 72 63 65 5f 64 61 74 65 22 29 20 21 3d 20 6e 75 6c 6c 29 20 75 73 69 5f 61 70 70 65 6e 64 20 3d 20 22 26 75 73 69 Data Ascii: var usi_append = "";if (usi_commons.gup("usi_force_date") != "") usi_append = "&usi_force_date=" + usi_commons.gup("usi_force_date");else if (typeof usi_cookies !== 'undefined' && usi_cookies.get("usi_force_date") != null) usi_append = "&usi
2024-05-29 13:26:14 UTC	1390	IN	Data Raw: 6e 74 4e 6f 64 65 29 3b 0a 09 09 09 09 09 09 7d 0a 09 09 09 09 09 7d 0a 09 09 09 09 7d 0a 09 09 09 7d 20 63 61 74 63 68 20 28 65 29 20 7b 0a 09 09 09 09 75 73 69 5f 63 6f 6d 6d 6f 6e 73 2e 72 65 70 6f 72 74 5f 65 72 72 6f 72 28 65 29 3b 0a 09 09 09 7d 0a 09 09 7d 2c 0a 09 09 6c 6f 61 64 3a 66 75 6e 63 74 69 6f 6e 28 75 73 69 48 61 73 68 2c 20 75 73 69 53 69 74 65 49 44 2c 20 75 73 69 4b 65 79 2c 20 63 61 6c 6c 62 61 63 6b 29 7b 0a 09 09 09 74 72 79 20 7b 0a 09 09 09 09 69 66 20 28 74 79 70 65 6f 66 28 77 69 6e 64 6f 77 5b 22 75 73 69 5f 22 20 2b 20 75 73 69 53 69 74 65 49 44 5d 29 20 21 3d 3d 20 22 75 6e 64 65 66 69 6e 65 64 22 29 20 72 65 74 75 72 6e 3b 0a 09 09 09 09 75 73 69 4b 65 79 20 3d 20 75 73 69 4b 65 79 20 7c 7c 20 22 22 3b 0a 09 09 09 09 76 61 Data Ascii: ntNode);}}}} catch (e) {usi_commons.report_error(e);}},load:function(usiHash, usiSiteID, usiKey, callback){try {if (typeof(window["usi_" + usiSiteID]) !== "undefined") return;usiKey = usiKey \|\| "";va
2024-05-29 13:26:14 UTC	1390	IN	Data Raw: 61 64 5f 73 63 72 69 70 74 28 73 6f 75 72 63 65 2c 20 63 61 6c 6c 62 61 63 6b 29 3b 0a 09 09 09 7d 20 63 61 74 63 68 20 28 65 29 20 7b 0a 09 09 09 09 75 73 69 5f 63 6f 6d 6d 6f 6e 73 2e 72 65 70 6f 72 74 5f 65 72 72 6f 72 28 65 29 3b 0a 09 09 09 7d 0a 09 09 7d 2c 0a 09 09 6c 6f 61 64 5f 6d 61 69 6c 3a 66 75 6e 63 74 69 6f 6e 28 71 73 2c 20 73 69 74 65 49 44 2c 20 63 61 6c 6c 62 61 63 6b 29 20 7b 0a 09 09 09 74 72 79 20 7b 0a 09 09 09 09 76 61 72 20 73 6f 75 72 63 65 20 3d 20 75 73 69 5f 63 6f 6d 6d 6f 6e 73 2e 64 6f 6d 61 69 6e 20 2b 20 22 2f 6d 61 69 6c 2e 6a 73 70 3f 71 73 3d 22 20 2b 20 71 73 20 2b 20 22 26 73 69 74 65 49 44 3d 22 20 2b 20 73 69 74 65 49 44 20 2b 20 22 26 64 6f 6d 61 69 6e 3d 22 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 Data Ascii: ad_script(source, callback);} catch (e) {usi_commons.report_error(e);}},load_mail:function(qs, siteID, callback) {try {var source = usi_commons.domain + "/mail.jsp?qs=" + qs + "&siteID=" + siteID + "&domain=" + encodeURICompone
2024-05-29 13:26:14 UTC	1390	IN	Data Raw: 7b 0a 09 09 09 09 75 73 69 5f 63 6f 6d 6d 6f 6e 73 2e 72 65 70 6f 72 74 5f 65 72 72 6f 72 28 65 29 3b 0a 09 09 09 7d 0a 09 09 7d 2c 0a 09 09 73 65 6e 64 5f 70 72 6f 64 5f 72 65 63 3a 66 75 6e 63 74 69 6f 6e 28 73 69 74 65 49 44 2c 20 69 6e 66 6f 2c 20 72 65 61 6c 5f 74 69 6d 65 29 20 7b 0a 09 09 09 76 61 72 20 72 65 73 75 6c 74 20 3d 20 66 61 6c 73 65 3b 0a 09 09 09 74 72 79 20 7b 0a 09 09 09 09 69 66 20 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 74 6d 6c 22 29 2e 6c 65 6e 67 74 68 20 3e 20 30 20 26 26 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 74 6d 6c 22 29 5b 30 5d 2e 63 6c 61 73 73 4e 61 6d 65 20 21 3d 20 6e 75 6c 6c 20 26 26 20 64 6f 63 75 Data Ascii: {usi_commons.report_error(e);}},send_prod_rec:function(siteID, info, real_time) {var result = false;try {if (document.getElementsByTagName("html").length > 0 && document.getElementsByTagName("html")[0].className != null && docu
2024-05-29 13:26:14 UTC	1390	IN	Data Raw: 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 72 72 2e 6d 65 73 73 61 67 65 29 20 2b 20 27 2d 27 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 72 72 2e 73 74 61 63 6b 29 20 2b 20 22 26 75 72 6c 3d 22 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 29 3b 0a 09 09 09 75 73 69 5f 63 6f 6d 6d 6f 6e 73 2e 6c 6f 67 5f 65 72 72 6f 72 28 65 72 72 2e 6d 65 73 73 61 67 65 29 3b 0a 09 09 09 75 73 69 5f 63 6f 6d 6d 6f 6e 73 2e 64 69 72 28 65 72 72 29 3b 0a 09 09 7d 2c 0a 09 09 72 65 70 6f 72 74 5f 65 72 72 6f 72 5f 6e 6f 5f 63 6f 6e 73 6f 6c 65 3a 66 75 6e 63 74 69 6f 6e 28 65 72 72 29 20 7b 0a 09 09 09 69 66 20 28 65 72 72 20 3d 3d 20 6e 75 6c 6c 29 20 72 65 74 75 72 6e Data Ascii: encodeURIComponent(err.message) + '-' + encodeURIComponent(err.stack) + "&url=" + encodeURIComponent(location.href));usi_commons.log_error(err.message);usi_commons.dir(err);},report_error_no_console:function(err) {if (err == null) return

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49819	104.19.178.52	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:14 UTC	507	OUT	GET /scripttemplates/6.33.0/assets/v2/otPcPanel.json HTTP/1.1 Accept: / Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH Origin: https://www.avast.com Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: cdn.cookielaw.org Connection: Keep-Alive
2024-05-29 13:26:14 UTC	809	IN	HTTP/1.1 200 OK Date: Wed, 29 May 2024 13:26:14 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Content-MD5: A7tMInCwvuWCqK9nIJa+YQ== Last-Modified: Wed, 13 Apr 2022 01:38:20 GMT x-ms-request-id: e8736be7-901e-0084-44ff-214b82000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 73882 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 88b6d0a508c78c83-EWR
2024-05-29 13:26:14 UTC	560	IN	Data Raw: 37 63 37 38 0d 0a 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 6f 74 50 63 50 61 6e 65 6c 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 68 74 6d 6c 22 3a 20 22 50 47 52 70 64 69 42 70 5a 44 30 69 62 32 35 6c 64 48 4a 31 63 33 51 74 63 47 4d 74 63 32 52 72 49 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 52 51 59 31 42 68 62 6d 56 73 49 47 39 30 4c 57 68 70 5a 47 55 67 62 33 51 74 5a 6d 46 6b 5a 53 31 70 62 69 49 67 63 6d 39 73 5a 54 30 69 59 57 78 6c 63 6e 52 6b 61 57 46 73 62 32 63 69 49 47 46 79 61 57 45 74 62 57 39 6b 59 57 77 39 49 6e 52 79 64 57 55 69 49 47 46 79 61 57 45 74 5a 47 56 7a 59 33 4a 70 59 6d 56 6b 59 6e 6b 39 49 6d 39 30 4c 58 42 6a 4c 57 52 6c 63 32 4d 69 50 6a 77 68 4c 53 30 67 55 45 4d 67 Data Ascii: 7c78 { "name": "otPcPanel", "html": "PGRpdiBpZD0ib25ldHJ1c3QtcGMtc2RrIiBjbGFzcz0ib3RQY1BhbmVsIG90LWhpZGUgb3QtZmFkZS1pbiIgcm9sZT0iYWxlcnRkaWFsb2ciIGFyaWEtbW9kYWw9InRydWUiIGFyaWEtZGVzY3JpYmVkYnk9Im90LXBjLWRlc2MiPjwhLS0gUEMg
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 79 31 7a 59 33 4a 76 62 47 78 69 59 58 49 69 50 6a 78 6f 4d 69 42 70 5a 44 30 69 62 33 51 74 63 47 4d 74 64 47 6c 30 62 47 55 69 50 6c 6c 76 64 58 49 67 55 48 4a 70 64 6d 46 6a 65 54 77 76 61 44 49 2b 50 47 52 70 64 69 42 70 5a 44 30 69 62 33 51 74 63 47 4d 74 5a 47 56 7a 59 79 49 2b 50 43 39 6b 61 58 59 2b 50 47 4a 31 64 48 52 76 62 69 42 70 5a 44 30 69 59 57 4e 6a 5a 58 42 30 4c 58 4a 6c 59 32 39 74 62 57 56 75 5a 47 56 6b 4c 57 4a 30 62 69 31 6f 59 57 35 6b 62 47 56 79 49 6a 35 42 59 32 4e 6c 63 48 51 67 51 57 78 73 50 43 39 69 64 58 52 30 62 32 34 2b 50 48 4e 6c 59 33 52 70 62 32 34 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 58 4e 6b 61 79 31 79 62 33 63 67 62 33 51 74 59 32 46 30 4c 57 64 79 63 43 49 2b 50 47 67 7a 49 47 6c 6b 50 53 4a 76 64 43 31 6a Data Ascii: y1zY3JvbGxiYXIiPjxoMiBpZD0ib3QtcGMtdGl0bGUiPllvdXIgUHJpdmFjeTwvaDI+PGRpdiBpZD0ib3QtcGMtZGVzYyI+PC9kaXY+PGJ1dHRvbiBpZD0iYWNjZXB0LXJlY29tbWVuZGVkLWJ0bi1oYW5kbGVyIj5BY2NlcHQgQWxsPC9idXR0b24+PHNlY3Rpb24gY2xhc3M9Im90LXNkay1yb3cgb3QtY2F0LWdycCI+PGgzIGlkPSJvdC1j
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 4a 68 59 32 73 74 59 6e 52 75 4c 57 68 68 62 6d 52 73 5a 58 49 69 49 47 46 79 61 57 45 74 62 47 46 69 5a 57 77 39 49 6b 4a 68 59 32 73 69 50 6a 78 7a 64 6d 63 67 61 57 51 39 49 6d 39 30 4c 57 4a 68 59 32 73 74 59 58 4a 33 49 69 42 34 62 57 78 75 63 7a 30 69 61 48 52 30 63 44 6f 76 4c 33 64 33 64 79 35 33 4d 79 35 76 63 6d 63 76 4d 6a 41 77 4d 43 39 7a 64 6d 63 69 49 48 68 74 62 47 35 7a 4f 6e 68 73 61 57 35 72 50 53 4a 6f 64 48 52 77 4f 69 38 76 64 33 64 33 4c 6e 63 7a 4c 6d 39 79 5a 79 38 78 4f 54 6b 35 4c 33 68 73 61 57 35 72 49 69 42 34 50 53 49 77 63 48 67 69 49 48 6b 39 49 6a 42 77 65 43 49 67 64 6d 6c 6c 64 30 4a 76 65 44 30 69 4d 43 41 77 49 44 51 30 4e 43 34 31 4d 7a 45 67 4e 44 51 30 4c 6a 55 7a 4d 53 49 67 65 47 31 73 4f 6e 4e 77 59 57 4e 6c 50 Data Ascii: JhY2stYnRuLWhhbmRsZXIiIGFyaWEtbGFiZWw9IkJhY2siPjxzdmcgaWQ9Im90LWJhY2stYXJ3IiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB4PSIwcHgiIHk9IjBweCIgdmlld0JveD0iMCAwIDQ0NC41MzEgNDQ0LjUzMSIgeG1sOnNwYWNlP
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 38 63 33 5a 6e 49 48 68 74 62 47 35 7a 50 53 4a 6f 64 48 52 77 4f 69 38 76 64 33 64 33 4c 6e 63 7a 4c 6d 39 79 5a 79 38 79 4d 44 41 77 4c 33 4e 32 5a 79 49 67 65 47 31 73 62 6e 4d 36 65 47 78 70 62 6d 73 39 49 6d 68 30 64 48 41 36 4c 79 39 33 64 33 63 75 64 7a 4d 75 62 33 4a 6e 4c 7a 45 35 4f 54 6b 76 65 47 78 70 62 6d 73 69 49 48 67 39 49 6a 42 77 65 43 49 67 65 54 30 69 4d 48 42 34 49 69 42 32 61 57 56 33 51 6d 39 34 50 53 49 77 49 43 30 7a 4d 43 41 78 4d 54 41 67 4d 54 45 77 49 69 42 68 63 6d 6c 68 4c 57 68 70 5a 47 52 6c 62 6a 30 69 64 48 4a 31 5a 53 49 2b 50 48 52 70 64 47 78 6c 50 6c 4e 6c 59 58 4a 6a 61 43 42 4a 59 32 39 75 50 43 39 30 61 58 52 73 5a 54 34 38 63 47 46 30 61 43 42 6d 61 57 78 73 50 53 49 6a 4d 6d 55 7a 4e 6a 51 30 49 69 42 6b 50 53 Data Ascii: 8c3ZnIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHg9IjBweCIgeT0iMHB4IiB2aWV3Qm94PSIwIC0zMCAxMTAgMTEwIiBhcmlhLWhpZGRlbj0idHJ1ZSI+PHRpdGxlPlNlYXJjaCBJY29uPC90aXRsZT48cGF0aCBmaWxsPSIjMmUzNjQ0IiBkPS
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 4c 54 45 32 4c 6a 67 30 4e 69 77 78 4d 53 34 78 4d 7a 59 4b 49 43 41 67 49 43 41 67 59 79 30 7a 4c 6a 49 7a 4e 43 77 33 4c 6a 67 77 4d 53 30 78 4c 6a 6b 77 4d 79 77 78 4e 43 34 30 4e 6a 63 73 4d 79 34 35 4f 54 6b 73 4d 54 6b 75 4f 54 67 31 62 44 45 30 4d 43 34 33 4e 54 63 73 4d 54 51 77 4c 6a 63 31 4d 33 59 78 4d 7a 67 75 4e 7a 55 31 59 7a 41 73 4e 43 34 35 4e 54 55 73 4d 53 34 34 4d 44 6b 73 4f 53 34 79 4d 7a 49 73 4e 53 34 30 4d 6a 51 73 4d 54 49 75 4f 44 55 30 62 44 63 7a 4c 6a 41 34 4e 53 77 33 4d 79 34 77 4f 44 4d 4b 49 43 41 67 49 43 41 67 59 7a 4d 75 4e 44 49 35 4c 44 4d 75 4e 6a 45 30 4c 44 63 75 4e 7a 45 73 4e 53 34 30 4d 6a 67 73 4d 54 49 75 4f 44 55 78 4c 44 55 75 4e 44 49 34 59 7a 49 75 4d 6a 67 79 4c 44 41 73 4e 43 34 32 4e 69 30 77 4c 6a 51 Data Ascii: LTE2Ljg0NiwxMS4xMzYKICAgICAgYy0zLjIzNCw3LjgwMS0xLjkwMywxNC40NjcsMy45OTksMTkuOTg1bDE0MC43NTcsMTQwLjc1M3YxMzguNzU1YzAsNC45NTUsMS44MDksOS4yMzIsNS40MjQsMTIuODU0bDczLjA4NSw3My4wODMKICAgICAgYzMuNDI5LDMuNjE0LDcuNzEsNS40MjgsMTIuODUxLDUuNDI4YzIuMjgyLDAsNC42Ni0wLjQ
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 6d 39 33 49 6a 34 38 5a 47 6c 32 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 7a 5a 47 73 74 59 32 39 73 64 57 31 75 49 6a 34 38 64 57 77 67 61 57 51 39 49 6d 39 30 4c 57 68 76 63 33 51 74 62 48 4e 30 49 6a 34 38 62 47 6b 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 57 68 76 63 33 51 74 61 58 52 6c 62 53 49 2b 50 47 4a 31 64 48 52 76 62 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 61 47 39 7a 64 43 31 69 62 33 67 69 49 47 46 79 61 57 45 74 5a 58 68 77 59 57 35 6b 5a 57 51 39 49 6d 5a 68 62 48 4e 6c 49 6a 34 38 4c 32 4a 31 64 48 52 76 62 6a 34 38 63 32 56 6a 64 47 6c 76 62 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 59 57 4e 6a 4c 57 68 6b 63 69 49 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 61 47 39 7a 64 43 31 6f 5a 48 49 69 50 6a 78 6f Data Ascii: m93Ij48ZGl2IGNsYXNzPSJvdC1zZGstY29sdW1uIj48dWwgaWQ9Im90LWhvc3QtbHN0Ij48bGkgY2xhc3M9Im90LWhvc3QtaXRlbSI+PGJ1dHRvbiBjbGFzcz0ib3QtaG9zdC1ib3giIGFyaWEtZXhwYW5kZWQ9ImZhbHNlIj48L2J1dHRvbj48c2VjdGlvbiBjbGFzcz0ib3QtYWNjLWhkciI+PGRpdiBjbGFzcz0ib3QtaG9zdC1oZHIiPjxo
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 6c 32 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 69 64 47 34 74 59 32 39 75 64 47 46 70 62 6d 56 79 49 6a 34 38 59 6e 56 30 64 47 39 75 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 77 59 79 31 79 5a 57 5a 31 63 32 55 74 59 57 78 73 4c 57 68 68 62 6d 52 73 5a 58 49 69 50 6c 4a 6c 61 6d 56 6a 64 43 42 42 62 47 77 38 4c 32 4a 31 64 48 52 76 62 6a 34 67 50 47 4a 31 64 48 52 76 62 69 42 6a 62 47 46 7a 63 7a 30 69 63 32 46 32 5a 53 31 77 63 6d 56 6d 5a 58 4a 6c 62 6d 4e 6c 4c 57 4a 30 62 69 31 6f 59 57 35 6b 62 47 56 79 49 47 39 75 5a 58 52 79 64 58 4e 30 4c 57 4e 73 62 33 4e 6c 4c 57 4a 30 62 69 31 6f 59 57 35 6b 62 47 56 79 49 6a 35 54 59 58 5a 6c 49 46 4e 6c 64 48 52 70 62 6d 64 7a 50 43 39 69 64 58 52 30 62 32 34 2b 50 43 39 6b 61 58 59 2b 50 47 52 70 64 Data Ascii: l2IGNsYXNzPSJvdC1idG4tY29udGFpbmVyIj48YnV0dG9uIGNsYXNzPSJvdC1wYy1yZWZ1c2UtYWxsLWhhbmRsZXIiPlJlamVjdCBBbGw8L2J1dHRvbj4gPGJ1dHRvbiBjbGFzcz0ic2F2ZS1wcmVmZXJlbmNlLWJ0bi1oYW5kbGVyIG9uZXRydXN0LWNsb3NlLWJ0bi1oYW5kbGVyIj5TYXZlIFNldHRpbmdzPC9idXR0b24+PC9kaXY+PGRpd
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 70 5a 43 49 2b 50 48 4e 77 59 57 34 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 58 4e 33 61 58 52 6a 61 43 31 75 62 32 49 69 49 47 46 79 61 57 45 74 59 32 68 6c 59 32 74 6c 5a 44 30 69 5a 6d 46 73 63 32 55 69 49 48 4a 76 62 47 55 39 49 6e 4e 33 61 58 52 6a 61 43 49 2b 50 43 39 7a 63 47 46 75 50 69 41 38 63 33 42 68 62 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 62 47 46 69 5a 57 77 74 64 48 68 30 49 6a 35 54 64 32 6c 30 59 32 67 67 54 47 46 69 5a 57 77 38 4c 33 4e 77 59 57 34 2b 50 43 39 73 59 57 4a 6c 62 44 34 67 50 48 4e 77 59 57 34 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 57 78 68 59 6d 56 73 4c 58 4e 30 59 58 52 31 63 79 49 2b 62 47 46 69 5a 57 77 38 4c 33 4e 77 59 57 34 2b 50 43 39 6b 61 58 59 2b 50 43 45 74 4c 53 42 44 61 47 56 6a 61 32 4a 76 65 43 Data Ascii: pZCI+PHNwYW4gY2xhc3M9Im90LXN3aXRjaC1ub2IiIGFyaWEtY2hlY2tlZD0iZmFsc2UiIHJvbGU9InN3aXRjaCI+PC9zcGFuPiA8c3BhbiBjbGFzcz0ib3QtbGFiZWwtdHh0Ij5Td2l0Y2ggTGFiZWw8L3NwYW4+PC9sYWJlbD4gPHNwYW4gY2xhc3M9Im90LWxhYmVsLXN0YXR1cyI+bGFiZWw8L3NwYW4+PC9kaXY+PCEtLSBDaGVja2JveC
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 49 69 42 76 64 43 31 68 59 32 4e 76 63 6d 52 70 62 32 34 39 49 6e 52 79 64 57 55 69 50 6a 77 76 59 6e 56 30 64 47 39 75 50 6a 78 6b 61 58 59 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 57 46 6a 59 79 31 6f 5a 48 49 69 50 6a 77 68 4c 53 30 67 51 57 4e 6a 62 33 4a 6b 61 57 39 75 49 47 68 6c 59 57 52 6c 63 69 42 6a 62 32 35 30 5a 57 35 30 49 43 30 74 50 6a 77 76 5a 47 6c 32 50 6a 78 6b 61 58 59 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 57 46 6a 59 79 31 30 65 48 51 69 50 6a 77 68 4c 53 30 67 51 57 4e 6a 62 33 4a 70 5a 47 39 75 49 47 4e 76 62 6e 52 6c 62 6e 51 67 4c 53 30 2b 50 43 39 6b 61 58 59 2b 50 43 39 6b 61 58 59 2b 50 48 4e 77 59 57 34 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 58 4e 6a 63 6d 34 74 63 6d 52 79 49 69 42 68 63 6d 6c 68 4c 57 46 30 62 32 31 Data Ascii: IiBvdC1hY2NvcmRpb249InRydWUiPjwvYnV0dG9uPjxkaXYgY2xhc3M9Im90LWFjYy1oZHIiPjwhLS0gQWNjb3JkaW9uIGhlYWRlciBjb250ZW50IC0tPjwvZGl2PjxkaXYgY2xhc3M9Im90LWFjYy10eHQiPjwhLS0gQWNjb3JpZG9uIGNvbnRlbnQgLS0+PC9kaXY+PC9kaXY+PHNwYW4gY2xhc3M9Im90LXNjcm4tcmRyIiBhcmlhLWF0b21
2024-05-29 13:26:14 UTC	1369	IN	Data Raw: 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 6f 74 2d 73 6c 69 64 65 2d 69 6e 2d 72 69 67 68 74 3b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 6f 74 2d 73 6c 69 64 65 2d 69 6e 2d 72 69 67 68 74 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 2e 6f 74 50 63 50 61 6e 65 6c 2e 6f 74 2d 73 6c 69 64 65 2d 6f 75 74 2d 6c 65 66 74 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 6f 74 2d 73 6c 69 64 65 2d 6f 75 74 2d 6c 65 66 74 3b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 6f 74 2d 73 6c 69 64 65 2d 6f 75 74 2d 6c 65 66 74 7d 40 6d 65 64 69 61 20 70 72 69 6e 74 2c 28 70 72 65 66 65 72 73 2d 72 65 64 75 63 65 64 2d 6d 6f 74 69 6f 6e 29 7b 2e 6f 74 2d 61 6e 69 6d 61 74 65 64 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 69 6e 69 74 Data Ascii: mation-name:ot-slide-in-right;animation-name:ot-slide-in-right}#onetrust-pc-sdk.otPcPanel.ot-slide-out-left{-webkit-animation-name:ot-slide-out-left;animation-name:ot-slide-out-left}@media print,(prefers-reduced-motion){.ot-animated{-webkit-animation:init

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49826	34.117.223.223	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:14 UTC	571	OUT	POST /v4/receive/json/81 HTTP/1.1 Accept: / Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH Content-Type: text/plain;charset=UTF-8 Origin: https://www.avast.com Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: analytics.ff.avast.com Content-Length: 1094 Connection: Keep-Alive Cache-Control: no-cache
2024-05-29 13:26:14 UTC	1094	OUT	Data Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 22 65 76 65 6e 74 22 3a 7b 22 74 79 70 65 22 3a 38 31 2c 22 73 75 62 74 79 70 65 22 3a 31 2c 22 74 69 6d 65 22 3a 31 37 31 36 39 38 39 31 37 33 34 36 33 7d 2c 22 70 72 6f 64 75 63 74 22 3a 7b 22 69 64 22 3a 32 34 30 2c 22 76 65 72 73 69 6f 6e 5f 67 75 69 22 3a 22 32 30 32 33 2e 30 31 2e 31 33 22 2c 22 76 65 72 73 69 6f 6e 5f 61 70 70 22 3a 22 31 2e 30 2e 30 22 2c 22 65 64 69 74 69 6f 6e 22 3a 32 2c 22 69 70 6d 5f 70 72 6f 64 75 63 74 22 3a 6e 75 6c 6c 7d 2c 22 70 6c 61 74 66 6f 72 6d 22 3a 7b 22 6f 73 22 3a 30 7d 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 73 65 63 63 68 75 61 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 4f 57 36 34 3b 20 54 72 69 64 65 6e 74 2f 37 2e Data Ascii: {"record":[{"event":{"type":81,"subtype":1,"time":1716989173463},"product":{"id":240,"version_gui":"2023.01.13","version_app":"1.0.0","edition":2,"ipm_product":null},"platform":{"os":0},"browser":{"secchua":"Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.
2024-05-29 13:26:14 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 29 May 2024 13:26:14 GMT Content-Type: application/json Content-Length: 19 Access-Control-Allow-Origin: * Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-29 13:26:14 UTC	19	IN	Data Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d Data Ascii: {"processed": true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	49824	216.58.206.34	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:14 UTC	869	OUT	GET /pagead/landing?gcs=G111&gcd=13t3t3t3t5&rnd=566323352.1716989172&url=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi&dma=0&npa=0&gtm=45He45m0n71PZ48F8v71039428za200&auid=1692554832.1716989172 HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Connection: Keep-Alive Host: googleads.g.doubleclick.net
2024-05-29 13:26:14 UTC	791	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Wed, 29 May 2024 13:26:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Wed, 29-May-2024 13:41:14 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-29 13:26:14 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	49829	18.165.183.15	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:15 UTC	490	OUT	GET /modules.7b6d7646601d8cd7fb5f.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: script.hotjar.com Connection: Keep-Alive
2024-05-29 13:26:15 UTC	718	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 227608 Connection: close Date: Tue, 28 May 2024 12:31:07 GMT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: max-age=31536000 Cross-Origin-Resource-Policy: cross-origin ETag: "f50d98fda6fa5cddaa6824ca419470d7" Last-Modified: Tue, 28 May 2024 12:30:49 GMT Strict-Transport-Security: max-age=2592000; includeSubDomains X-Content-Type-Options: nosniff X-Robots-Tag: none Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 841da31399fe7f7e7065c840a22fae0a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ZRH55-P1 X-Amz-Cf-Id: 2NR-5EiRKPqDiSRxT2dZxFNlGjzxGxP2UVT1kiNeRmgzsO1wc_TznA== Age: 89708
2024-05-29 13:26:15 UTC	15666	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6d 6f 64 75 6c 65 73 2e 37 62 36 64 37 36 34 36 36 30 31 64 38 63 64 37 66 62 35 66 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 34 37 38 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 7d 29 3b 63 6f 6e 73 74 20 72 3d 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 7b 49 44 45 4e 54 49 46 59 5f 55 53 45 52 3a 22 69 64 65 6e 74 69 66 79 5f 75 73 65 72 22 2c 41 55 54 4f 54 41 47 5f 52 45 43 4f 52 44 49 4e 47 3a 22 61 75 74 6f 74 61 67 5f 72 65 63 6f Data Ascii: /! For license information please see modules.7b6d7646601d8cd7fb5f.js.LICENSE.txt /!function(){var e={4788:function(e,t,n){"use strict";n.d(t,{s:function(){return r}});const r=Object.freeze({IDENTIFY_USER:"identify_user",AUTOTAG_RECORDING:"autotag_reco
2024-05-29 13:26:15 UTC	16384	IN	Data Raw: 3c 3d 65 7d 29 2c 22 69 64 65 6e 74 69 66 69 65 72 2e 63 6f 6d 70 61 72 65 52 61 74 69 6f 22 29 7d 2c 61 3d 6e 28 34 38 30 38 29 2c 73 3d 5b 22 61 66 22 2c 22 61 72 22 2c 22 62 67 22 2c 22 63 61 22 2c 22 63 73 22 2c 22 63 79 22 2c 22 64 61 22 2c 22 64 65 22 2c 22 65 6c 22 2c 22 65 6e 22 2c 22 65 73 22 2c 22 65 74 22 2c 22 66 61 22 2c 22 66 69 22 2c 22 66 72 22 2c 22 68 65 22 2c 22 68 72 22 2c 22 68 75 22 2c 22 69 64 22 2c 22 69 74 22 2c 22 6a 61 22 2c 22 6b 6f 22 2c 22 6c 74 22 2c 22 6c 76 22 2c 22 6d 69 73 22 2c 22 6e 62 22 2c 22 6e 6c 22 2c 22 70 6c 22 2c 22 70 74 5f 42 52 22 2c 22 70 74 22 2c 22 72 6f 22 2c 22 72 75 22 2c 22 73 6b 22 2c 22 73 6c 22 2c 22 73 71 22 2c 22 73 72 22 2c 22 73 76 22 2c 22 73 77 22 2c 22 74 68 22 2c 22 74 6c 22 2c 22 74 72 22 Data Ascii: <=e}),"identifier.compareRatio")},a=n(4808),s=["af","ar","bg","ca","cs","cy","da","de","el","en","es","et","fa","fi","fr","he","hr","hu","id","it","ja","ko","lt","lv","mis","nb","nl","pl","pt_BR","pt","ro","ru","sk","sl","sq","sr","sv","sw","th","tl","tr"
2024-05-29 13:26:15 UTC	16384	IN	Data Raw: 2e 63 6f 6e 63 61 74 28 65 2e 76 32 2c 22 2f 63 6c 69 65 6e 74 2f 73 69 74 65 73 2f 22 29 2e 63 6f 6e 63 61 74 28 68 6a 2e 73 65 74 74 69 6e 67 73 2e 73 69 74 65 5f 69 64 2c 22 2f 70 6f 6c 6c 2f 22 29 2e 63 6f 6e 63 61 74 28 74 2c 22 2f 72 65 73 70 6f 6e 73 65 2f 22 29 2e 63 6f 6e 63 61 74 28 61 29 2c 6e 2c 6f 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 73 5f 6e 65 77 5f 72 65 73 70 6f 6e 73 65 26 26 68 6a 2e 65 76 65 6e 74 2e 73 69 67 6e 61 6c 28 22 70 6f 6c 6c 2e 73 65 6e 64 22 2c 7b 69 64 3a 74 2c 72 65 73 70 6f 6e 73 65 5f 69 64 3a 65 2e 70 6f 6c 6c 5f 72 65 73 70 6f 6e 73 65 5f 69 64 7d 29 2c 6e 75 6c 6c 3d 3d 69 7c 7c 69 28 65 29 7d 29 29 7d 29 2c 22 64 61 74 61 22 29 2c 74 2e 63 6f 6d 70 6c 65 74 65 50 6f 6c 6c 52 65 73 70 6f 6e 73 65 3d 68 Data Ascii: .concat(e.v2,"/client/sites/").concat(hj.settings.site_id,"/poll/").concat(t,"/response/").concat(a),n,o,(function(e){e.is_new_response&&hj.event.signal("poll.send",{id:t,response_id:e.poll_response_id}),null==i\|\|i(e)}))}),"data"),t.completePollResponse=h
2024-05-29 13:26:15 UTC	16384	IN	Data Raw: 6e 28 65 29 7b 72 65 74 75 72 6e 21 28 76 6f 69 64 20 30 3d 3d 3d 28 65 3d 68 6a 2e 68 71 2e 74 72 69 6d 28 28 65 7c 7c 22 22 29 2e 72 65 70 6c 61 63 65 28 2f 5c 73 5c 73 2b 2f 67 2c 22 20 22 29 29 29 7c 7c 22 22 3d 3d 3d 65 7c 7c 65 2e 69 6e 64 65 78 4f 66 28 22 79 75 69 5f 22 29 3e 2d 31 7c 7c 77 28 65 29 29 26 26 28 65 3d 65 2e 72 65 70 6c 61 63 65 28 72 2c 22 5c 5c 24 31 22 29 2c 65 3d 62 28 65 29 2c 67 28 65 29 29 7d 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 65 3b 76 61 72 20 74 3d 65 2e 63 68 61 72 41 74 28 30 29 3b 72 65 74 75 72 6e 2f 5c 64 2f 2e 74 65 73 74 28 74 29 3f 22 5c 5c 33 22 2b 74 2b 22 20 22 2b 65 2e 73 6c 69 63 65 28 31 29 3a 65 7d 2c 62 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 7c Data Ascii: n(e){return!(void 0===(e=hj.hq.trim((e\|\|"").replace(/\s\s+/g," ")))\|\|""===e\|\|e.indexOf("yui_")>-1\|\|w(e))&&(e=e.replace(r,"\\$1"),e=b(e),g(e))},g=function(e){if(!e)return e;var t=e.charAt(0);return/\d/.test(t)?"\\3"+t+" "+e.slice(1):e},b=function(e){if(!e\|
2024-05-29 13:26:15 UTC	16384	IN	Data Raw: 69 6e 67 45 6e 61 62 6c 65 64 28 21 30 29 2c 7a 2e 79 2e 73 65 74 28 22 61 63 74 69 76 65 22 2c 21 30 29 3b 76 61 72 20 65 3d 68 6a 2e 75 69 2e 67 65 74 57 69 6e 64 6f 77 53 69 7a 65 28 29 2c 74 3d 68 6a 2e 74 69 6d 65 2e 67 65 74 4e 6f 77 28 29 2c 6e 3d 75 2e 66 5f 2e 6e 6f 77 28 29 2c 72 3d 7a 2e 79 2e 67 65 74 28 22 70 61 67 65 56 69 73 69 74 4b 65 79 22 29 3b 59 28 72 2c 72 2c 65 2c 74 2c 6e 2c 74 68 69 73 2e 69 73 54 72 65 65 4d 69 72 72 6f 72 49 6e 69 74 69 61 6c 69 7a 65 64 28 29 29 3b 76 61 72 20 6f 3d 7a 2e 79 2e 67 65 74 28 22 74 61 67 73 54 6f 50 72 6f 63 65 73 73 22 29 3b 6f 2e 6c 65 6e 67 74 68 26 26 28 28 30 2c 63 2e 4e 29 28 69 2e 73 2e 54 41 47 5f 52 45 43 4f 52 44 49 4e 47 2c 6f 2c 21 30 29 2e 66 6c 75 73 68 28 29 2c 7a 2e 79 2e 73 65 74 Data Ascii: ingEnabled(!0),z.y.set("active",!0);var e=hj.ui.getWindowSize(),t=hj.time.getNow(),n=u.f_.now(),r=z.y.get("pageVisitKey");Y(r,r,e,t,n,this.isTreeMirrorInitialized());var o=z.y.get("tagsToProcess");o.length&&((0,c.N)(i.s.TAG_RECORDING,o,!0).flush(),z.y.set
2024-05-29 13:26:15 UTC	16384	IN	Data Raw: 62 75 74 65 4f 6c 64 56 61 6c 75 65 73 29 72 65 74 75 72 6e 20 65 3b 66 6f 72 28 76 61 72 20 74 20 69 6e 20 6e 2e 61 74 74 72 69 62 75 74 65 4f 6c 64 56 61 6c 75 65 73 29 65 2e 70 75 73 68 28 74 29 3b 72 65 74 75 72 6e 20 65 7d 29 2c 22 4e 6f 64 65 43 68 61 6e 67 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 61 6d 65 73 4d 75 74 61 74 65 64 22 29 2c 74 68 69 73 2e 61 74 74 72 69 62 75 74 65 4d 75 74 61 74 65 64 3d 68 6a 2e 74 72 79 43 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 6e 2e 61 74 74 72 69 62 75 74 65 73 3d 21 30 2c 6e 2e 61 74 74 72 69 62 75 74 65 4f 6c 64 56 61 6c 75 65 73 3d 6e 2e 61 74 74 72 69 62 75 74 65 4f 6c 64 56 61 6c 75 65 73 7c 7c 7b 7d 2c 65 20 69 6e 20 6e 2e 61 74 74 72 69 62 75 74 65 4f 6c 64 56 61 6c 75 65 73 7c 7c Data Ascii: buteOldValues)return e;for(var t in n.attributeOldValues)e.push(t);return e}),"NodeChange.getAttributeNamesMutated"),this.attributeMutated=hj.tryCatch((function(e,t){n.attributes=!0,n.attributeOldValues=n.attributeOldValues\|\|{},e in n.attributeOldValues\|\|
2024-05-29 13:26:15 UTC	16384	IN	Data Raw: 65 3b 72 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 69 66 28 74 29 7b 76 61 72 20 6e 3d 69 2e 67 65 74 28 74 29 3b 6e 7c 7c 28 6e 3d 6e 65 77 20 65 65 2c 69 2e 73 65 74 28 74 2c 6e 29 29 2c 6e 2e 73 65 74 28 65 2c 21 30 29 7d 7d 29 29 3b 76 61 72 20 61 3d 5b 5d 3b 72 65 74 75 72 6e 20 69 2e 67 65 74 56 61 6c 75 65 73 28 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 65 2e 6b 65 79 73 28 29 3b 6e 2e 6c 65 6e 67 74 68 3b 29 7b 66 6f 72 28 76 61 72 20 72 3d 6e 5b 30 5d 3b 72 2e 70 72 65 76 69 6f 75 73 53 69 62 6c 69 6e 67 26 26 65 2e 68 61 73 28 72 2e 70 72 65 76 69 6f 75 73 53 69 62 6c 69 6e 67 29 3b 29 72 3d 72 2e 70 72 Data Ascii: e;r.forEach((function(e){var t=e.parentNode;if(t){var n=i.get(t);n\|\|(n=new ee,i.set(t,n)),n.set(e,!0)}}));var a=[];return i.getValues().forEach((function(e){for(var t,n=e.keys();n.length;){for(var r=n[0];r.previousSibling&&e.has(r.previousSibling);)r=r.pr
2024-05-29 13:26:15 UTC	16384	IN	Data Raw: 2e 72 65 67 69 73 74 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6f 2e 70 75 73 68 28 65 29 7d 2c 74 2e 64 65 73 74 72 6f 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 65 26 26 28 43 53 53 53 74 79 6c 65 53 68 65 65 74 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 6c 65 74 65 52 75 6c 65 3d 65 2c 65 3d 6e 75 6c 6c 2c 6e 3d 21 31 29 2c 6f 3d 5b 5d 7d 2c 74 7d 28 29 7d 29 2c 22 68 6a 2e 64 65 6c 65 74 65 64 52 75 6c 65 73 22 29 28 29 7d 2c 33 32 35 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 28 35 34 32 29 2c 6e 28 32 31 39 29 2c 6e 28 32 38 39 29 2c 6e 28 36 33 32 36 29 7d 2c 35 34 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 72 28 74 29 3b 76 61 72 20 72 3d 6e 28 35 35 34 37 29 3b 68 6a 2e 74 72 79 43 Data Ascii: .register=function(e){o.push(e)},t.destroy=function(){e&&(CSSStyleSheet.prototype.deleteRule=e,e=null,n=!1),o=[]},t}()}),"hj.deletedRules")()},3251:function(e,t,n){n(542),n(219),n(289),n(6326)},542:function(e,t,n){"use strict";n.r(t);var r=n(5547);hj.tryC
2024-05-29 13:26:15 UTC	16384	IN	Data Raw: 65 29 7b 70 21 3d 3d 65 26 26 28 70 3d 65 2c 74 28 29 29 2c 53 2e 66 6c 75 73 68 28 29 7d 29 2c 22 64 61 74 61 22 29 2c 77 72 69 74 65 4e 65 77 46 72 61 6d 65 3a 68 6a 2e 74 72 79 43 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 72 65 74 75 72 6e 20 74 28 6e 29 2c 53 2e 77 72 69 74 65 28 65 29 2c 74 28 29 2c 53 7d 29 29 2c 77 72 69 74 65 3a 68 6a 2e 74 72 79 43 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 76 61 72 20 6f 3b 69 66 28 68 6a 2e 69 73 50 72 65 76 69 65 77 29 72 65 74 75 72 6e 20 53 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 3d 62 28 65 29 29 72 65 74 75 72 6e 20 68 6a 2e 68 71 2e 65 61 63 68 28 65 2c 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 53 2e 77 72 69 74 65 28 65 2c 74 2c 21 30 2c 72 29 7d 29 29 Data Ascii: e){p!==e&&(p=e,t()),S.flush()}),"data"),writeNewFrame:hj.tryCatch((function(e,n){return t(n),S.write(e),t(),S})),write:hj.tryCatch((function(e,t,n,r){var o;if(hj.isPreview)return S;if("object"===b(e))return hj.hq.each(e,(function(e,t){S.write(e,t,!0,r)}))
2024-05-29 13:26:15 UTC	16384	IN	Data Raw: 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 21 74 2e 73 65 73 73 69 6f 6e 29 72 65 74 75 72 6e 21 30 3b 76 61 72 20 6e 3d 68 6a 2e 73 74 6f 72 65 2e 73 65 73 73 69 6f 6e 2e 67 65 74 28 22 73 65 73 73 69 6f 6e 2e 63 72 65 61 74 65 64 22 29 3b 69 66 28 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 6e 26 26 72 2e 66 5f 2e 6e 6f 77 28 29 2b 61 3e 6e 2b 69 29 7b 76 61 72 20 6f 3d 69 2d 28 72 2e 66 5f 2e 6e 6f 77 28 29 2d 6e 29 3b 6f 3c 30 26 26 28 6f 3d 30 29 2c 73 65 74 54 69 6d 65 6f 75 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 65 28 29 2c 68 6a 2e 73 74 6f 72 65 2e 73 65 73 73 69 6f 6e 2e 73 65 74 28 22 73 65 73 73 69 6f 6e 22 2c 6e 75 6c 6c 29 2c 68 6a 2e 65 76 65 6e 74 53 74 72 65 61 6d 2e 63 6c 6f 73 65 28 29 2c 68 6a 2e 6d 65 74 72 69 63 73 2e Data Ascii: void 0===t\|\|!t.session)return!0;var n=hj.store.session.get("session.created");if("number"==typeof n&&r.f_.now()+a>n+i){var o=i-(r.f_.now()-n);o<0&&(o=0),setTimeout((function(){try{e(),hj.store.session.set("session",null),hj.eventStream.close(),hj.metrics.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	49810	87.248.119.252	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:15 UTC	476	OUT	GET /wi/config/10156543.json HTTP/1.1 Accept: / Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH Origin: https://www.avast.com Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: s.yimg.com Connection: Keep-Alive
2024-05-29 13:26:15 UTC	780	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method x-amz-request-id: 5HCSD5HBM8TQ5DKT x-amz-id-2: +I5eRs2COJPmOLyOl4AcV9auzsfMTfvxDM+m/RAK2QB0OI+/4FjEdwgdvmjmlWEGDO56c9FkmMTkLElEYytKTA== Content-Type: application/json Date: Wed, 29 May 2024 13:08:12 GMT Server: ATS Referrer-Policy: no-referrer-when-downgrade Cache-Control: public,max-age=3600 Content-Length: 2 Age: 1083 ATS-Carp-Promotion: 1 Connection: close Strict-Transport-Security: max-age=31536000 Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff ATS-Carp-Promotion: 1
2024-05-29 13:26:15 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	49833	172.217.18.6	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:15 UTC	1177	OUT	GET /activityi;src=4711400;type=globa0;cat=avast0;ord=1;num=1850339154548;npa=0;auiddc=1692554832.1716989172;u2=Product;u7=www.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi;u8=;u17=undefined;pscdl=noapi;frm=0;gtm=45fe45m0v9181661103z871039428za201zb71039428;gcs=G111;gcd=13t3t3t3t5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi? HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: 4711400.fls.doubleclick.net Connection: Keep-Alive
2024-05-29 13:26:15 UTC	812	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Wed, 29 May 2024 13:26:15 GMT Expires: Wed, 29 May 2024 13:26:15 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=21600 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Wed, 29-May-2024 13:41:15 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-29 13:26:15 UTC	578	IN	Data Raw: 33 38 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 65 72 76 69 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 64 6d 2f 66 6c 73 2f 7a 2f 73 72 63 3d 34 37 31 31 34 30 30 3b 74 79 70 65 3d 67 6c 6f 62 Data Ascii: 38c<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/src=4711400;type=glob
2024-05-29 13:26:15 UTC	337	IN	Data Raw: 34 35 66 65 34 35 6d 30 76 39 31 38 31 36 36 31 31 30 33 7a 38 37 31 30 33 39 34 32 38 7a 61 32 30 31 7a 62 37 31 30 33 39 34 32 38 3b 67 63 73 3d 47 31 31 31 3b 67 63 64 3d 31 33 74 33 74 33 74 33 74 35 3b 64 6d 61 3d 30 3b 65 70 76 65 72 3d 32 3b 7e 6f 72 65 66 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 61 76 61 73 74 2e 63 6f 6d 25 32 46 69 6d 61 67 65 73 25 32 46 57 58 68 56 53 5f 32 46 41 56 72 55 37 52 4e 51 46 41 4d 46 75 6a 62 25 32 46 61 5a 30 71 6a 36 33 64 44 41 25 32 46 6d 36 6f 6c 78 73 75 6f 39 78 53 42 49 70 36 67 32 25 32 46 41 56 50 68 43 71 43 73 44 44 6e 69 25 32 46 31 35 33 4c 42 61 73 67 6c 47 5a 25 32 46 51 58 36 71 57 4c 36 41 70 4f 6d 5f 32 42 25 32 46 65 49 47 67 4c 33 74 6e 56 4e 6d 49 76 32 6d 6e 66 6c 66 44 54 25 Data Ascii: 45fe45m0v9181661103z871039428za201zb71039428;gcs=G111;gcd=13t3t3t3t5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%
2024-05-29 13:26:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	49837	157.240.252.13	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:15 UTC	479	OUT	GET /en_US/fbevents.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: connect.facebook.net Connection: Keep-Alive
2024-05-29 13:26:15 UTC	1465	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: application/x-javascript; charset=utf-8 timing-allow-origin: * reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-security-policy: default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; document-policy: force-load-at-top
2024-05-29 13:26:15 UTC	1705	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 61 74 74 65 72 79 3d 28 73 65 6c 66 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-heigh
2024-05-29 13:26:15 UTC	1	IN	Data Raw: 2f Data Ascii: /
2024-05-29 13:26:15 UTC	14632	IN	Data Raw: 2a 2a 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 37 2d 70 72 65 73 65 6e 74 2c 20 46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 2a 0a 2a 20 59 6f 75 20 61 72 65 20 68 65 72 65 62 79 20 67 72 61 6e 74 65 64 20 61 20 6e 6f 6e 2d 65 78 63 6c 75 73 69 76 65 2c 20 77 6f 72 6c 64 77 69 64 65 2c 20 72 6f 79 61 6c 74 79 2d 66 72 65 65 20 6c 69 63 65 6e 73 65 20 74 6f 20 75 73 65 2c 0a 2a 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 61 6e 64 20 64 69 73 74 72 69 62 75 74 65 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 69 6e 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 72 20 62 69 6e 61 72 79 20 66 6f 72 6d 20 66 6f 72 20 75 73 65 0a 2a 20 69 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 77 69 74 Data Ascii: * Copyright (c) 2017-present, Facebook, Inc. All rights reserved. You are hereby granted a non-exclusive, worldwide, royalty-free license to use,* copy, modify, and distribute this software in source code or binary form for use* in connection wit
2024-05-29 13:26:15 UTC	16384	IN	Data Raw: 63 74 6f 72 5f 63 6f 6e 66 69 67 3b 69 66 28 61 3d 3d 6e 75 6c 6c 7c 7c 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 22 75 6e 64 65 66 69 6e 65 64 22 3a 69 28 61 29 29 21 3d 3d 22 6f 62 6a 65 63 74 22 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 61 3d 61 2e 70 61 72 61 6d 65 74 65 72 5f 73 65 6c 65 63 74 6f 72 73 3b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 7b 61 3d 63 28 61 2c 68 29 3b 76 61 72 20 64 3d 62 28 61 2c 42 6f 6f 6c 65 61 6e 29 3b 69 66 28 61 2e 6c 65 6e 67 74 68 3d 3d 3d 64 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 7b 70 61 72 61 6d 65 74 65 72 5f 73 65 6c 65 63 74 6f 72 73 3a 64 7d 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 6b 28 61 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 7c 7c 28 74 Data Ascii: ctor_config;if(a==null\|\|(typeof a==="undefined"?"undefined":i(a))!=="object")return null;a=a.parameter_selectors;if(Array.isArray(a)){a=c(a,h);var d=b(a,Boolean);if(a.length===d.length)return{parameter_selectors:d}}return null}function k(a){if(a==null\|\|(t
2024-05-29 13:26:15 UTC	16384	IN	Data Raw: 6e 74 73 55 74 69 6c 73 22 29 2c 72 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 47 65 74 49 73 49 6f 73 49 6e 41 70 70 42 72 6f 77 73 65 72 22 29 2c 73 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 55 52 4c 55 74 69 6c 22 29 2c 74 3d 73 2e 67 65 74 55 52 4c 50 61 72 61 6d 65 74 65 72 2c 75 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 47 65 74 56 61 6c 69 64 55 72 6c 22 29 2c 76 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 52 65 73 6f 6c 76 65 4c 69 6e 6b 22 29 3b 73 3d 66 2e 67 65 74 Data Ascii: ntsUtils"),r=f.getFbeventsModules("signalsFBEventsGetIsIosInAppBrowser"),s=f.getFbeventsModules("SignalsFBEventsURLUtil"),t=s.getURLParameter,u=f.getFbeventsModules("SignalsFBEventsGetValidUrl"),v=f.getFbeventsModules("SignalsFBEventsResolveLink");s=f.get
2024-05-29 13:26:15 UTC	16384	IN	Data Raw: 3b 72 65 74 75 72 6e 20 6b 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 47 65 74 56 61 6c 69 64 55 72 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 66 2c 67 2c 68 2c 69 29 7b 76 61 72 20 6a 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6a 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6a 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 74 72 79 7b 61 3d 6e 65 77 20 55 52 4c 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 63 61 74 63 68 28 61 29 7b 72 Data Ascii: ;return k.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEventsGetValidUrl",function(){return function(f,g,h,i){var j={exports:{}};j.exports;(function(){"use strict";j.exports=function(a){if(a==null)return null;try{a=new URL(a);return a}catch(a){r
2024-05-29 13:26:15 UTC	1751	IN	Data Raw: 74 68 46 69 65 6c 64 73 28 7b 74 61 72 67 65 74 44 6f 6d 61 69 6e 3a 62 2e 61 6c 6c 6f 77 4e 75 6c 6c 28 62 2e 73 74 72 69 6e 67 28 29 29 2c 65 6e 64 70 6f 69 6e 74 3a 62 2e 61 6c 6c 6f 77 4e 75 6c 6c 28 62 2e 73 74 72 69 6e 67 28 29 29 2c 75 73 65 50 61 74 68 43 6f 6f 6b 69 65 3a 62 2e 61 6c 6c 6f 77 4e 75 6c 6c 28 62 5b 22 62 6f 6f 6c 65 61 6e 22 5d 28 29 29 2c 66 61 6c 6c 62 61 63 6b 44 6f 6d 61 69 6e 3a 62 2e 61 6c 6c 6f 77 4e 75 6c 6c 28 62 2e 73 74 72 69 6e 67 28 29 29 7d 29 29 2c 65 76 65 6e 74 73 46 69 6c 74 65 72 3a 62 2e 61 6c 6c 6f 77 4e 75 6c 6c 28 62 2e 6f 62 6a 65 63 74 57 69 74 68 46 69 65 6c 64 73 28 7b 66 69 6c 74 65 72 69 6e 67 4d 6f 64 65 3a 62 2e 61 6c 6c 6f 77 4e 75 6c 6c 28 62 2e 73 74 72 69 6e 67 28 29 29 2c 65 76 65 6e 74 4e 61 6d Data Ascii: thFields({targetDomain:b.allowNull(b.string()),endpoint:b.allowNull(b.string()),usePathCookie:b.allowNull(b["boolean"]()),fallbackDomain:b.allowNull(b.string())})),eventsFilter:b.allowNull(b.objectWithFields({filteringMode:b.allowNull(b.string()),eventNam
2024-05-29 13:26:15 UTC	14633	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 74 68 69 73 2e 5f 6f 70 74 73 5b 61 5d 3b 72 65 74 75 72 6e 20 62 21 3d 6e 75 6c 6c 3f 63 28 64 28 62 29 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 62 5b 61 5d 3d 3d 3d 21 30 7d 29 3a 5b 5d 7d 7d 5d 29 3b 72 65 74 75 72 6e 20 61 7d 28 29 3b 6c 2e 65 78 70 6f 72 74 73 3d 61 7d 29 28 29 3b 72 65 74 75 72 6e 20 6c 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 50 61 72 61 6c 6c 65 6c 46 69 72 65 43 6f 6e 66 69 67 54 79 70 65 64 65 66 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 67 2c 68 2c 69 2c 6a 29 7b 76 Data Ascii: :function(a){var b=this._opts[a];return b!=null?c(d(b),function(a){return b[a]===!0}):[]}}]);return a}();l.exports=a})();return l.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEventsParallelFireConfigTypedef",function(){return function(g,h,i,j){v
2024-05-29 13:26:15 UTC	16384	IN	Data Raw: 73 2e 61 70 70 65 6e 64 28 63 2c 61 5b 63 5d 29 7d 29 7d 29 3b 66 3d 6f 2e 74 72 69 67 67 65 72 28 70 28 62 29 29 3b 66 21 3d 6e 75 6c 6c 26 26 6d 28 66 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 21 3d 6e 75 6c 6c 26 26 6d 28 6e 28 61 29 2c 66 75 6e 63 74 69 6f 6e 28 63 29 7b 62 2e 63 75 73 74 6f 6d 50 61 72 61 6d 73 3d 62 2e 63 75 73 74 6f 6d 50 61 72 61 6d 73 7c 7c 6e 65 77 20 64 28 29 2c 62 2e 63 75 73 74 6f 6d 50 61 72 61 6d 73 2e 61 70 70 65 6e 64 28 63 2c 61 5b 63 5d 29 7d 29 7d 29 3b 69 2e 74 72 69 67 67 65 72 28 62 29 3b 66 3d 65 2e 74 72 69 67 67 65 72 28 62 29 3b 69 66 28 6c 28 66 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7d 29 29 72 65 74 75 72 6e 3b 66 3d 68 2e 74 72 69 67 67 65 72 28 62 29 3b 69 66 28 6c 28 66 2c 66 75 6e Data Ascii: s.append(c,a[c])})});f=o.trigger(p(b));f!=null&&m(f,function(a){a!=null&&m(n(a),function(c){b.customParams=b.customParams\|\|new d(),b.customParams.append(c,a[c])})});i.trigger(b);f=e.trigger(b);if(l(f,function(a){return a}))return;f=h.trigger(b);if(l(f,fun
2024-05-29 13:26:15 UTC	16384	IN	Data Raw: 2c 74 3d 73 2e 6c 65 6e 67 74 68 3b 66 75 6e 63 74 69 6f 6e 20 75 28 61 29 7b 69 66 28 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 22 75 6e 64 65 66 69 6e 65 64 22 3a 69 28 61 29 29 21 3d 3d 22 6f 62 6a 65 63 74 22 26 26 28 74 79 70 65 6f 66 20 61 21 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 7c 7c 61 3d 3d 3d 6e 75 6c 6c 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 4f 62 6a 65 63 74 2e 6b 65 79 73 20 63 61 6c 6c 65 64 20 6f 6e 20 6e 6f 6e 2d 6f 62 6a 65 63 74 22 29 3b 76 61 72 20 62 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 71 2e 63 61 6c 6c 28 61 2c 63 29 26 26 62 2e 70 75 73 68 28 63 29 3b 69 66 28 72 29 66 6f 72 28 63 3d 30 3b 63 3c 74 3b 63 2b 2b 29 71 2e 63 61 6c 6c 28 61 2c 73 5b 63 5d 29 Data Ascii: ,t=s.length;function u(a){if((typeof a==="undefined"?"undefined":i(a))!=="object"&&(typeof a!=="function"\|\|a===null))throw new TypeError("Object.keys called on non-object");var b=[];for(var c in a)q.call(a,c)&&b.push(c);if(r)for(c=0;c<t;c++)q.call(a,s[c])

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	49835	108.139.243.30	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:15 UTC	600	OUT	GET /trustboxes/5419b6ffb0d04a076446a9af/index.html?businessunitId=46d31466000064000500a775&templateId=5419b6ffb0d04a076446a9af HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: widget.trustpilot.com Connection: Keep-Alive
2024-05-29 13:26:15 UTC	650	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 2144 Connection: close Date: Wed, 29 May 2024 13:26:16 GMT Last-Modified: Mon, 08 May 2023 11:44:09 GMT ETag: "1307e3fd5846bacc989c2fd05996f010" x-amz-server-side-encryption: AES256 Cache-Control: max-age=86400 Content-Encoding: gzip Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 bd42f72145cab99230fc54c1c87e968a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MXP63-P3 X-Amz-Cf-Id: 0ZeIuSmBMf7yQaHznVmqr92QYrWAuG7GrNDY1etA7fARvopORC31yg== X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000
2024-05-29 13:26:15 UTC	2144	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 cd 59 6d 8f e3 b6 11 fe 7e bf 82 f1 21 c0 6e 4b ed da de d7 c8 be 43 9b 34 45 02 04 6d 81 04 28 fa 69 41 49 94 c4 5b 4a d4 92 94 77 1d c3 ff 3d 43 8a 92 29 59 b6 77 ef ae 68 e1 db 13 c5 97 e1 33 cf 0c c9 19 6a f9 cd df fe f9 c3 6f ff f9 d7 8f 28 d7 05 ff f8 6e d9 3c 10 5a e6 94 24 a6 00 45 cd 34 a7 1f 7f 93 b5 d2 15 e3 42 a3 1f a0 24 0a f4 6f 96 64 54 2f 2f 9b f6 a6 6f 41 35 41 71 4e a4 a2 fa c3 a4 d6 69 70 3f 41 97 7e 63 49 0a fa 61 22 45 24 b4 9a a0 58 94 9a 96 d0 b5 14 ac 4c e8 cb ae b3 d2 6b 23 d5 00 c2 91 48 d6 38 61 2b ac 2a 52 62 52 55 9c 6a 2c a2 4f 34 d6 98 a5 12 24 e2 7c 86 f3 39 ce af 70 7e 8d f3 1b 9c df e2 0a 47 5c c4 8f 4f b5 d0 14 57 92 62 82 49 14 49 4c 62 29 ca 75 81 49 92 48 aa 14 8e 58 86 63 06 7d 62 91 50 Data Ascii: Ym~!nKC4Em(iAI[Jw=C)Ywh3jo(n<Z$E4B$odT//oA5AqNip?A~cIa"E$XLk#H8a+*RbRUj,O4$\|9p~G\OWbIILb)uIHXc}bP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	58445	104.19.178.52	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:15 UTC	519	OUT	GET /logos/static/powered_by_logo.svg HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: cdn.cookielaw.org Connection: Keep-Alive
2024-05-29 13:26:15 UTC	875	IN	HTTP/1.1 200 OK Date: Wed, 29 May 2024 13:26:15 GMT Content-Type: image/svg+xml Content-Length: 5194 Connection: close Content-MD5: Y+c301RBZNK39PvKQWrIBw== Last-Modified: Mon, 27 May 2024 07:09:02 GMT ETag: 0x8DC7E1BE3847BCA x-ms-request-id: ddbd28b9-f01e-0015-3469-b083f0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * CF-Cache-Status: HIT Age: 12 Expires: Thu, 30 May 2024 13:26:15 GMT Cache-Control: public, max-age=86400 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 88b6d0ab1b9e4402-EWR
2024-05-29 13:26:15 UTC	494	IN	Data Raw: 3c 73 76 67 20 68 65 69 67 68 74 3d 22 31 36 22 20 77 69 64 74 68 3d 22 31 33 36 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 33 36 20 31 34 2e 36 22 3e 3c 64 65 66 73 3e 3c 63 6c 69 70 50 61 74 68 20 69 64 3d 22 61 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 64 3d 22 4d 35 33 2e 37 36 20 30 48 31 33 36 76 31 34 2e 36 48 35 33 2e 37 36 7a 22 2f 3e 3c 2f 63 6c 69 70 50 61 74 68 3e 3c 2f 64 65 66 73 3e 3c 70 61 74 68 20 64 3d 22 4d 30 20 31 32 2e 33 56 35 2e 35 39 68 32 2e 32 37 61 32 2e 36 32 20 32 2e 36 32 20 30 20 30 31 31 2e 32 39 2e 32 38 20 31 2e 38 33 20 31 2e 38 33 20 Data Ascii: <svg height="16" width="136" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 136 14.6"><defs><clipPath id="a"><path fill="none" d="M53.76 0H136v14.6H53.76z"/></clipPath></defs><path d="M0 12.3V5.59h2.27a2.62 2.62 0 011.29.28 1.83 1.83
2024-05-29 13:26:15 UTC	1369	IN	Data Raw: 2e 31 38 48 2e 38 31 76 36 7a 6d 37 2e 37 34 2e 31 61 32 2e 32 39 20 32 2e 32 39 20 30 20 30 31 2d 31 2e 32 2d 2e 33 32 20 32 2e 32 39 20 32 2e 32 39 20 30 20 30 31 2d 2e 38 2d 2e 39 31 20 33 2e 30 36 20 33 2e 30 36 20 30 20 30 31 2d 2e 32 38 2d 31 2e 33 36 20 33 2e 30 37 20 33 2e 30 37 20 30 20 30 31 2e 32 38 2d 31 2e 33 37 20 32 2e 31 34 20 32 2e 31 34 20 30 20 30 31 32 2d 31 2e 32 34 20 32 2e 31 34 20 32 2e 31 34 20 30 20 30 31 32 20 31 2e 32 34 41 33 2e 30 37 20 33 2e 30 37 20 30 20 30 31 31 30 20 39 2e 38 31 61 33 2e 30 36 20 33 2e 30 36 20 30 20 30 31 2d 2e 32 39 20 31 2e 33 36 20 32 2e 31 31 20 32 2e 31 31 20 30 20 30 31 2d 32 20 31 2e 32 33 7a 6d 30 2d 2e 36 39 61 31 2e 33 31 20 31 2e 33 31 20 30 20 30 30 2e 38 35 2d 2e 32 37 20 31 2e 36 20 31 2e Data Ascii: .18H.81v6zm7.74.1a2.29 2.29 0 01-1.2-.32 2.29 2.29 0 01-.8-.91 3.06 3.06 0 01-.28-1.36 3.07 3.07 0 01.28-1.37 2.14 2.14 0 012-1.24 2.14 2.14 0 012 1.24A3.07 3.07 0 0110 9.81a3.06 3.06 0 01-.29 1.36 2.11 2.11 0 01-2 1.23zm0-.69a1.31 1.31 0 00.85-.27 1.6 1.
2024-05-29 13:26:15 UTC	1369	IN	Data Raw: 20 30 31 2d 2e 32 38 2d 31 2e 33 36 41 33 2e 32 34 20 33 2e 32 34 20 30 20 30 31 32 37 20 38 2e 34 36 61 32 2e 31 38 20 32 2e 31 38 20 30 20 30 31 2e 38 2d 2e 39 32 41 32 2e 30 35 20 32 2e 30 35 20 30 20 30 31 32 39 20 37 2e 32 61 32 2e 35 34 20 32 2e 35 34 20 30 20 30 31 2e 37 37 2e 31 33 20 31 2e 39 20 31 2e 39 20 30 20 30 31 2e 37 2e 34 33 20 31 2e 39 34 20 31 2e 39 34 20 30 20 30 31 2e 35 2e 37 37 20 33 2e 31 39 20 33 2e 31 39 20 30 20 30 31 2e 31 39 20 31 2e 31 39 56 31 30 68 2d 33 2e 38 35 76 2d 2e 36 32 68 33 2e 30 39 61 31 2e 35 35 20 31 2e 35 35 20 30 20 30 30 2d 2e 31 37 2d 2e 37 36 20 31 2e 32 38 20 31 2e 32 38 20 30 20 30 30 2d 2e 34 37 2d 2e 35 33 41 31 2e 33 35 20 31 2e 33 35 20 30 20 30 30 32 39 20 37 2e 39 61 31 2e 33 39 20 31 2e 33 39 20 Data Ascii: 01-.28-1.36A3.24 3.24 0 0127 8.46a2.18 2.18 0 01.8-.92A2.05 2.05 0 0129 7.2a2.54 2.54 0 01.77.13 1.9 1.9 0 01.7.43 1.94 1.94 0 01.5.77 3.19 3.19 0 01.19 1.19V10h-3.85v-.62h3.09a1.55 1.55 0 00-.17-.76 1.28 1.28 0 00-.47-.53A1.35 1.35 0 0029 7.9a1.39 1.39
2024-05-29 13:26:15 UTC	1369	IN	Data Raw: 35 20 30 20 30 30 2e 31 37 20 31 20 31 2e 35 20 31 2e 35 20 30 20 30 30 2e 34 39 2e 36 38 20 31 2e 33 39 20 31 2e 33 39 20 30 20 30 30 31 2e 35 39 20 30 20 31 2e 34 36 20 31 2e 34 36 20 30 20 30 30 2e 34 39 2d 2e 36 39 20 32 2e 35 35 20 32 2e 35 35 20 30 20 30 30 2e 31 37 2d 31 20 32 2e 35 39 20 32 2e 35 39 20 30 20 30 30 2d 2e 31 36 2d 2e 39 35 20 31 2e 34 35 20 31 2e 34 35 20 30 20 30 30 2d 2e 34 39 2d 2e 36 38 41 31 2e 32 39 20 31 2e 32 39 20 30 20 30 30 34 33 20 37 2e 39 61 31 2e 33 36 20 31 2e 33 36 20 30 20 30 30 2d 2e 37 39 2e 32 33 20 31 2e 34 37 20 31 2e 34 37 20 30 20 30 30 2d 2e 34 38 2e 36 37 20 32 2e 36 38 20 32 2e 36 38 20 30 20 30 30 2d 2e 31 38 2e 39 38 7a 6d 35 2e 31 38 20 34 2e 34 61 31 2e 39 20 31 2e 39 20 30 20 30 31 2d 2e 33 35 20 30 Data Ascii: 5 0 00.17 1 1.5 1.5 0 00.49.68 1.39 1.39 0 001.59 0 1.46 1.46 0 00.49-.69 2.55 2.55 0 00.17-1 2.59 2.59 0 00-.16-.95 1.45 1.45 0 00-.49-.68A1.29 1.29 0 0043 7.9a1.36 1.36 0 00-.79.23 1.47 1.47 0 00-.48.67 2.68 2.68 0 00-.18.98zm5.18 4.4a1.9 1.9 0 01-.35 0
2024-05-29 13:26:15 UTC	593	IN	Data Raw: 2d 38 2e 34 37 61 32 2e 37 36 20 32 2e 37 36 20 30 20 30 31 32 2e 37 37 20 32 2e 39 33 68 2d 35 2e 36 43 38 31 20 35 2e 34 36 20 38 32 20 34 2e 34 36 20 38 33 2e 35 34 20 34 2e 34 36 7a 4d 31 30 35 2e 35 38 20 33 76 32 2e 33 35 63 2d 2e 37 38 20 30 2d 31 2e 30 39 2d 2e 30 37 2d 31 2e 33 36 2d 2e 30 37 2d 31 2e 36 35 20 30 2d 32 2e 37 31 2e 37 32 2d 33 2e 30 36 20 32 2e 37 38 61 37 2e 38 35 20 37 2e 38 35 20 30 20 30 30 2d 2e 30 39 20 31 2e 31 39 76 35 2e 31 34 68 2d 32 2e 33 33 56 33 68 32 2e 31 32 76 33 2e 35 38 61 31 34 2e 39 20 31 34 2e 39 20 30 20 30 31 2e 37 39 2d 32 41 32 2e 35 39 20 32 2e 35 39 20 30 20 30 31 31 30 34 20 33 7a 6d 32 37 2e 34 39 20 38 2e 38 35 63 30 20 2e 37 35 2e 32 37 20 31 20 31 20 31 68 31 2e 39 31 76 31 2e 34 39 68 2d 32 2e 37 Data Ascii: -8.47a2.76 2.76 0 012.77 2.93h-5.6C81 5.46 82 4.46 83.54 4.46zM105.58 3v2.35c-.78 0-1.09-.07-1.36-.07-1.65 0-2.71.72-3.06 2.78a7.85 7.85 0 00-.09 1.19v5.14h-2.33V3h2.12v3.58a14.9 14.9 0 01.79-2A2.59 2.59 0 01104 3zm27.49 8.85c0 .75.27 1 1 1h1.91v1.49h-2.7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	58443	74.125.206.155	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:15 UTC	635	OUT	GET /g/collect?v=2&tid=G-WZQ6MQ6RF3&cid=716345675.1716989174&gtm=45je45m0v894455947za200zb868619592&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t5&npa=0&frm=0 HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: stats.g.doubleclick.net Connection: Keep-Alive
2024-05-29 13:26:15 UTC	387	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Date: Wed, 29 May 2024 13:26:15 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.9	58446	142.250.184.238	443

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:15 UTC	600	OUT	POST /v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM HTTP/1.1 Accept: / Content-Type: text/plain Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH Origin: https://www.avast.com Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: ampcid.google.com Content-Length: 33 Connection: Keep-Alive Cache-Control: no-cache
2024-05-29 13:26:15 UTC	33	OUT	Data Raw: 7b 22 6f 72 69 67 69 6e 53 63 6f 70 65 22 3a 22 41 4d 50 5f 45 43 49 44 5f 47 4f 4f 47 4c 45 22 7d Data Ascii: {"originScope":"AMP_ECID_GOOGLE"}
2024-05-29 13:26:16 UTC	592	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Content-Type: application/json; charset=UTF-8 Vary: X-Origin Vary: Referer Date: Wed, 29 May 2024 13:26:15 GMT Server: ESF Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Access-Control-Allow-Origin: https://www.avast.com Access-Control-Expose-Headers: vary,vary,vary,content-encoding,date,server,content-length Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Origin,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-29 13:26:16 UTC	8	IN	Data Raw: 33 0d 0a 7b 7d 0a 0d 0a Data Ascii: 3{}
2024-05-29 13:26:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	49836	108.139.243.30	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:15 UTC	459	OUT	GET /trustboxes/5419b6ffb0d04a076446a9af/main.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?businessunitId=46d31466000064000500a775&templateId=5419b6ffb0d04a076446a9af Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: widget.trustpilot.com Connection: Keep-Alive
2024-05-29 13:26:16 UTC	666	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript Content-Length: 17136 Connection: close Date: Wed, 29 May 2024 13:26:16 GMT Last-Modified: Mon, 08 May 2023 11:44:11 GMT ETag: "dc592904280a455012599b68215eae0f" x-amz-server-side-encryption: AES256 Cache-Control: max-age=86400 Content-Encoding: gzip Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 b4a15133db3a2b8a3148547f5267d170.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MXP63-P3 X-Amz-Cf-Id: b8AMzum_WmAKu3ynNk8HmeLLpPpJ7422dVU6Raip_P5jmH3YDPZJvQ== X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000
2024-05-29 13:26:16 UTC	8426	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed bd eb 76 dc 46 96 2e f8 ff 3c 45 0a d5 47 4a 14 91 20 ee 97 a4 d2 6c 59 65 1f a9 0f 65 79 2c d9 dd 63 16 5b 0b cc 04 49 94 33 01 36 80 24 45 93 b9 d6 3c c8 bc c9 f9 71 de 65 5e 60 5e 61 be bd 23 02 97 4c 90 d6 cd 55 9e b5 4a 55 cb 4c 04 02 11 3b f6 7d ef d8 40 fc bf ff eb 7f 3f 3a 5b e7 f3 3a 2b f2 51 39 2e 8c cc 48 f4 db a6 a5 1a d7 46 aa df 66 67 e3 47 d9 71 7d 22 7e 15 fc eb 2a 29 47 f9 4c 53 5d b5 d9 ac be b9 4c 8b b3 51 99 fe d7 3a 2b d3 c7 8f e5 8f 03 7a 06 97 b9 5e a6 f5 ba cc 47 39 06 7d 64 e9 d4 be 54 6d 4b d9 56 5f 94 c5 f5 38 9f e5 e9 f5 e8 9b b2 2c ca b1 f6 3c c9 f3 a2 1e 9d 65 f9 62 b4 2a 16 eb 65 3a 7a a2 ed d5 7b da 13 4d d7 cd 79 b1 48 67 da ab d7 7f f9 f1 e8 9b 77 df bd 7e fb ee db d7 3f 7e f7 17 cd c8 37 Data Ascii: vF.<EGJ lYeey,c[I36$E<qe^`^a#LUJUL;}@?:[:+Q9.HFfgGq}"~)GLS]LQ:+z^G9}dTmKV_8,<ebe:z{MyHgw~?~7
2024-05-29 13:26:16 UTC	8710	IN	Data Raw: 16 12 78 9f b4 14 24 c0 02 25 f2 0d 9b 37 80 43 2a 58 07 08 6d 87 71 49 07 a0 1f 66 75 02 12 7e d7 21 59 80 b8 85 72 72 02 11 ff 88 f3 59 33 01 08 e0 24 22 35 0d 93 11 11 b1 31 98 4b c0 08 fd 3f 69 0c 80 40 cb 44 30 74 a4 06 77 c9 15 71 24 03 4d 84 2d f1 a4 92 57 4a 70 d2 4a 36 d0 e6 07 b6 64 46 b7 85 5c 70 39 38 18 0f 04 81 b4 36 ed f3 b1 6f 09 6d 26 6d 13 78 3f 20 04 08 4d 83 7e 81 1d da 41 73 0d 1d e1 06 e0 6e d2 c3 52 d0 6c a0 d8 63 6c 38 01 f1 11 2e 6d 76 97 b0 bc b0 31 64 ac 80 cd 00 18 71 48 69 f8 36 dc 31 9b e4 c0 25 c5 03 85 41 9c ab 10 c2 8c e1 b3 b6 8e 95 d1 23 7e f6 68 2d 64 1a 6c b2 b5 3e 7a db be 42 1f 8d 46 4a 02 18 e2 99 49 21 80 d6 a1 af 1a 24 8f 82 b5 29 65 81 38 84 04 01 9c 3f 62 b0 42 4c cf 74 92 8a 43 50 dc 63 dd 0a aa 48 06 c3 a5 47 Data Ascii: x$%7C*XmqIfu~!YrrY3$"51K?i@D0twq$M-WJpJ6dF\p986om&mx? M~AsnRlcl8.mv1dqHi61%A#~h-dl>zBFJI!$)e8?bBLtCPcHG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	58450	216.239.36.181	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:15 UTC	1793	OUT	GET /g/collect?v=2&tid=G-WZQ6MQ6RF3&gtm=45je45m0v894455947za200zb868619592&_p=1716989170681&_gaz=1&gcs=G111&gcd=13t3t3t3t5&npa=0&dma=0&cid=716345675.1716989174&ul=en-ch&sr=1280x1024&ir=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1716989174&sct=1&seg=0&dl=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi&dt=404%20Not%20Found&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.admin_gtm_version=GTM-WPC6R3K%7C99%7Cfalse&ep.client_consent=C0001%3A1%2C%20C0003%3A1%2C%20C0002%3A1%2C%20BG270%3A1%2C%20C0004%3A1%2C%20C0005%3A1&ep.client_cid=1735890227.1716989172&ep.screen_src_cookie=999_a8e__null&ep.screen_unlocalized_path=www.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi&ep.server_info=-%7C-%7C-& [TRUNCATED] Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: analytics.google.com Connection: Keep-Alive
2024-05-29 13:26:15 UTC	387	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Date: Wed, 29 May 2024 13:26:15 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	58454	142.250.186.130	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:16 UTC	1692	OUT	GET /ddm/fls/z/src=4711400;type=globa0;cat=avast0;ord=1;num=1850339154548;npa=0;auiddc=;u2=Product;u7=www.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi;u8=;u17=undefined;pscdl=noapi;frm=0;gtm=45fe45m0v9181661103z871039428za201zb71039428;gcs=G111;gcd=13t3t3t3t5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /;q=0.5 Referer: https://4711400.fls.doubleclick.net/activityi;src=4711400;type=globa0;cat=avast0;ord=1;num=1850339154548;npa=0;auiddc=1692554832.1716989172;u2=Product;u7=www.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi;u8=;u17=undefined;pscdl=noapi;frm=0;gtm=45fe45m0v9181661103z871039428za201zb71039428;gcs=G111;gcd=13t3t3t3t5;dma=0;epver=2;~oref=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi? Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: adservice.google.com Connection: Keep-Alive
2024-05-29 13:26:16 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Wed, 29 May 2024 13:26:16 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-29 13:26:16 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	58459	108.139.243.30	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:16 UTC	1146	OUT	GET /stats/TrustboxImpression?cmpName=trustpilot&scrollToList=true&noReviews=hide&stars=1%2C2%2C3%2C4%2C5&theme=light&locale=en-ww&url=https%3A%2F%2Fwww.avast.com%2Fimages%2FWXhVS_2FAVrU7RNQFAMFujb%2FaZ0qj63dDA%2Fm6olxsuo9xSBIp6g2%2FAVPhCqCsDDni%2F153LBasglGZ%2FQX6qWL6ApOm_2B%2FeIGgL3tnVNmIv2mnflfDT%2F3CifOJ8skD8raBuc%2FSAbNMFVGVIBUYBB%2F34bc0VN_2Bo%2FeVngNF.avi%23pc&referrer=&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20WOW64%3B%20Trident%2F7.0%3B%20.NET4.0C%3B%20.NET4.0E%3B%20.NET%20CLR%202.0.50727%3B%20.NET%20CLR%203.0.30729%3B%20.NET%20CLR%203.5.30729%3B%20rv%3A11.0)%20like%20Gecko&language=en-CH&platform=Win32&nosettings=1&businessUnitId=46d31466000064000500a775&widgetId=5419b6ffb0d04a076446a9af HTTP/1.1 Accept: / Content-type: application/x-www-form-urlencoded Referer: https://widget.trustpilot.com/trustboxes/5419b6ffb0d04a076446a9af/index.html?businessunitId=46d31466000064000500a775&templateId=5419b6ffb0d04a076446a9af Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: widget.trustpilot.com Connection: Keep-Alive
2024-05-29 13:26:17 UTC	460	IN	HTTP/1.1 204 No Content Connection: close Cache-Control: no-store,no-cache Date: Wed, 29 May 2024 13:26:16 GMT Pragma: no-cache Server: Kestrel Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 f0c44fcb623b0b5d0059f8c13f9793b0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MXP63-P3 X-Amz-Cf-Id: p-QR_4SvM7fBSB90yBrTOLi0GjVGUs0bY-huWidqEH07IPScjfk9oA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	58442	74.125.206.155	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:17 UTC	749	OUT	POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-58120669-2&cid=716345675.1716989174&jid=593781856&gjid=610409147&_gid=1123961170.1716989175&_u=YDDACUQABAQCACAHKg~&z=1394940328 HTTP/1.1 Accept: / Content-Type: text/plain Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH Origin: https://www.avast.com Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: stats.g.doubleclick.net Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache Cookie: test_cookie=CheckForPermission
2024-05-29 13:26:17 UTC	591	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.avast.com Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Wed, 29 May 2024 13:26:17 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-29 13:26:17 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	49800	142.250.181.228	443	1488	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 13:26:17 UTC	629	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-58120669-2&cid=716345675.1716989174&jid=593781856&_u=YDDACUQABAQCACAHKg~&z=956945421 HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: https://www.avast.com/images/WXhVS_2FAVrU7RNQFAMFujb/aZ0qj63dDA/m6olxsuo9xSBIp6g2/AVPhCqCsDDni/153LBasglGZ/QX6qWL6ApOm_2B/eIGgL3tnVNmIv2mnflfDT/3CifOJ8skD8raBuc/SAbNMFVGVIBUYBB/34bc0VN_2Bo/eVngNF.avi Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.google.com Connection: Keep-Alive
2024-05-29 13:26:17 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Wed, 29 May 2024 13:26:17 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-29 13:26:17 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Target ID:	0
Start time:	09:24:20
Start date:	29/05/2024
Path:	C:\Users\user\Desktop\94.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\94.exe"
Imagebase:	0x690000
File size:	295'656 bytes
MD5 hash:	35EB15DB22E26D961D4151AFEEDBE67A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000002.2556321005.0000000003048000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.1701589948.0000000003048000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.1701204196.0000000003048000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.1701790227.0000000003048000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.1696611759.0000000003048000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.1701331883.0000000003048000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.1695722003.0000000003048000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.2490198024.0000000003048000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.1701872197.0000000003048000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.1701711329.0000000003048000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	09:24:45
Start date:	29/05/2024
Path:	C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x720000
File size:	418'304 bytes
MD5 hash:	64ACA4F48771A5BA50CD50F2410632AD
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:24:46
Start date:	29/05/2024
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
Imagebase:	0x7ff62ee70000
File size:	834'512 bytes
MD5 hash:	CFE2E6942AC1B72981B3105E22D3224E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:24:50
Start date:	29/05/2024
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:17410 /prefetch:2
Imagebase:	0x300000
File size:	828'368 bytes
MD5 hash:	6F0F06D6AB125A99E43335427066A4A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:24:52
Start date:	29/05/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe
Wow64 process (32bit):	true
Commandline:	"C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Imagebase:	0xd40000
File size:	85'632 bytes
MD5 hash:	F9A898A606E7F5A1CD7CFFA8079253A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:25:29
Start date:	29/05/2024
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:3552266 /prefetch:2
Imagebase:	0x300000
File size:	828'368 bytes
MD5 hash:	6F0F06D6AB125A99E43335427066A4A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:25:29
Start date:	29/05/2024
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:3552268 /prefetch:2
Imagebase:	0x300000
File size:	828'368 bytes
MD5 hash:	6F0F06D6AB125A99E43335427066A4A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:25:40
Start date:	29/05/2024
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
Imagebase:	0x7ff62ee70000
File size:	834'512 bytes
MD5 hash:	CFE2E6942AC1B72981B3105E22D3224E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:25:41
Start date:	29/05/2024
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6468 CREDAT:17410 /prefetch:2
Imagebase:	0x300000
File size:	828'368 bytes
MD5 hash:	6F0F06D6AB125A99E43335427066A4A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:26:06
Start date:	29/05/2024
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
Imagebase:	0x7ff62ee70000
File size:	834'512 bytes
MD5 hash:	CFE2E6942AC1B72981B3105E22D3224E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	09:26:06
Start date:	29/05/2024
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1880 CREDAT:17410 /prefetch:2
Imagebase:	0x300000
File size:	828'368 bytes
MD5 hash:	6F0F06D6AB125A99E43335427066A4A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7%
Total number of Nodes:	1215
Total number of Limit Nodes:	42

Executed Functions

Function 00668B75 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,?,?,00000000,?,?,00663049), ref: 00668B9F
RtlAllocateHeap.NTDLL(00000000,?), ref: 00668BB2
HeapFree.KERNEL32(00000000,?,?,?,00663049), ref: 00668BE3
GetComputerNameW.KERNEL32(00000000,?), ref: 00668BF1
RtlAllocateHeap.NTDLL(00000000,?), ref: 00668C08
GetComputerNameW.KERNEL32(00000000,?), ref: 00668C19
HeapFree.KERNEL32(00000000,00000000,?,?,00663049), ref: 00668C3A

Strings

I0f, xrefs: 00668C56

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: Heap$Name$AllocateComputerFree$User
String ID: I0f
API String ID: 1119867290-4221410755
Opcode ID: 5eb53a4b12e32c0bf0f2512144026d6193d5084f4309cfcd1b8d3031f927d92e
Instruction ID: 97560e05cbcc51889b318b739863a150465bd0ce2f44d1aca61e314ecf7dd274
Opcode Fuzzy Hash: 5eb53a4b12e32c0bf0f2512144026d6193d5084f4309cfcd1b8d3031f927d92e
Instruction Fuzzy Hash: 33312BB1A00209EFDB00DFB9DC848BEBBFEFB44354B145569E545D3220E770AE419B60

Function 006C6397 Relevance: 13.8, APIs: 9, Instructions: 331
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00000997,00003000,00000040,00000997,006C5E9E), ref: 006C647B
VirtualAlloc.KERNEL32(00000000,00000288,00003000,00000040,006C5EDD), ref: 006C64B2
VirtualAlloc.KERNEL32(00000000,0000F55C,00003000,00000040), ref: 006C6512
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 006C6548
VirtualProtect.KERNEL32(00690000,00000000,00000004,006C6372), ref: 006C6657
VirtualProtect.KERNEL32(00690000,00001000,00000004,006C6372), ref: 006C667E
VirtualProtect.KERNEL32(00000000,?,00000002,006C6372), ref: 006C6744
VirtualProtect.KERNEL32(00000000,?,00000002,006C6372,?), ref: 006C679A
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 006C67BE

Memory Dump Source

Source File: 00000000.00000002.2555263711.00000000006C5000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5000_94.jbxd

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: 71b75fc3896dd791f40c99055c20bc6c16207d53c5d1fa9156c06c04314de7c8
Instruction ID: c4102ed2f1fb44693c1201840b0eeb394f7a43c35671896f9ba2a68e5056c871
Opcode Fuzzy Hash: 71b75fc3896dd791f40c99055c20bc6c16207d53c5d1fa9156c06c04314de7c8
Instruction Fuzzy Hash: E8D17832100201AFEF118F14C980FA177A6FF4A716B1D5699ED099F7ABD734A861CB6C

Function 006404F9 Relevance: 13.8, APIs: 9, Instructions: 331
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,00000997,00003000,00000040,00000997,00640000), ref: 006405DD
VirtualAlloc.KERNELBASE(00000000,00000288,00003000,00000040,0064003F), ref: 00640614
VirtualAlloc.KERNELBASE(00000000,0000F55C,00003000,00000040), ref: 00640674
VirtualFree.KERNELBASE(00660000,00000000,00008000), ref: 006406AA
VirtualProtect.KERNELBASE(00690000,0000E000,00000004,006404D4), ref: 006407B9
VirtualProtect.KERNEL32(00690000,00001000,00000004,006404D4), ref: 006407E0

Part of subcall function 006403A6: LoadLibraryExA.KERNELBASE(?,00000000,00000000,?), ref: 006403DF

VirtualProtect.KERNEL32(00690000,?,00000002,006404D4), ref: 006408A6
VirtualProtect.KERNELBASE(00690000,?,00000002,006404D4,?), ref: 006408FC
VirtualFree.KERNELBASE(00660000,00000000,00008000), ref: 00640920

Memory Dump Source

Source File: 00000000.00000002.2554778434.0000000000640000.00000040.00001000.00020000.00000000.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_640000_94.jbxd

Similarity

API ID: Virtual$Protect$Alloc$Free$LibraryLoad
String ID:
API String ID: 1732388798-0
Opcode ID: 71b75fc3896dd791f40c99055c20bc6c16207d53c5d1fa9156c06c04314de7c8
Instruction ID: 69e42b58d315e8fad0a5e68234d54620c367dbdcd970542b53ffa87317f867fa
Opcode Fuzzy Hash: 71b75fc3896dd791f40c99055c20bc6c16207d53c5d1fa9156c06c04314de7c8
Instruction Fuzzy Hash: 0BD17B32100201AFFF108F14C980BA177A6FF85716F195299EE099F7ABD774A861CB68

Function 00663105 Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtOpenProcess.NTDLL(?,?,?,?), ref: 0066314C
NtOpenProcessToken.NTDLL(?,00000008,?), ref: 0066315F
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,?,00000000), ref: 0066317B

Part of subcall function 006697E6: RtlAllocateHeap.NTDLL(00000000,?,00661838), ref: 006697F2

NtQueryInformationToken.NTDLL(?,00000001,00000000,?,?,?), ref: 00663198
memcpy.NTDLL(?,00000000,0000001C), ref: 006631A5
NtClose.NTDLL(?), ref: 006631B7
NtClose.NTDLL(?), ref: 006631C1

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: c65750b95b773b291cadfcdc1de6cf56d4880f4dde14009e16fa5963a0859472
Instruction ID: 2a2a1b1caeb4b3afdcb62048f643a9afbc573587e61a081b8415085bdec9934b
Opcode Fuzzy Hash: c65750b95b773b291cadfcdc1de6cf56d4880f4dde14009e16fa5963a0859472
Instruction Fuzzy Hash: 2F21E5B290022CBBDB019F95CC459DEBFBEEB09740F145026F901E6220D7B19B549BA0

Function 00691312 Relevance: 6.0, APIs: 4, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00691CD4: HeapAlloc.KERNEL32(00000000,00000000,0069131B,00000028,?,00000000,006912C1,?,00000000,00000000,?,00691850,?,00000000), ref: 00691CE0

InitializeCriticalSection.KERNEL32(00000000,00000028,?,00000000,006912C1,?,00000000,00000000,?,00691850,?,00000000), ref: 0069132A
TlsAlloc.KERNEL32(?,00000000,006912C1,?,00000000,00000000,?,00691850,?,00000000), ref: 00691330
RtlAddVectoredExceptionHandler.NTDLL(00000001,006910A3,?,00000000,006912C1,?,00000000,00000000,?,00691850,?,00000000), ref: 00691345
GetLastError.KERNEL32(?,00000000,006912C1,?,00000000,00000000,?,00691850,?,00000000), ref: 0069135C

Memory Dump Source

Source File: 00000000.00000002.2555028026.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2554987620.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555093096.0000000000692000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555146640.0000000000696000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_94.jbxd

Similarity

API ID: Alloc$CriticalErrorExceptionHandlerHeapInitializeLastSectionVectored
String ID:
API String ID: 628750512-0
Opcode ID: 443e31938bc496907ee86e5acd6b2128ef4f7db901d4ee27562511d3f04833eb
Instruction ID: 0199d5edd89911b03f7aeb6ddfd46472da75409af2325ccb6a59b616819b79c3
Opcode Fuzzy Hash: 443e31938bc496907ee86e5acd6b2128ef4f7db901d4ee27562511d3f04833eb
Instruction Fuzzy Hash: 1FF0C235641613EBCB315F39EC0868A3ABFAF82B10724022BE155CEE90DB30C945CBA4

Function 006A86D0 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(006DE604), ref: 006A8746

Memory Dump Source

Source File: 00000000.00000002.2555181799.000000000069F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0069F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f000_94.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 43b9359bb6bcd776a0d49f2f3d93ca21b7b6bee5736c88f5b8e5177f55ad5b8c
Instruction ID: fb1fd04b2b72aba53d6f691280108964001a0d86ba8cd10dcd8dca82f1cbc1ff
Opcode Fuzzy Hash: 43b9359bb6bcd776a0d49f2f3d93ca21b7b6bee5736c88f5b8e5177f55ad5b8c
Instruction Fuzzy Hash: 0301BC76905628CFC3009F2AEC448753BA7F76C390314612AE442CB370EAB5AA81CF50

Function 00669ECF Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00669F48
LoadLibraryA.KERNELBASE(?), ref: 00669FC5
GetLastError.KERNEL32 ref: 00669FD1
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 0066A004

Strings

$, xrefs: 00669F1D

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: 7143ece648b137b354beeaaf2c40f1583bbbf86e448a29b2b05603a9909d3bcd
Instruction ID: b7cf1682d8ad6f455f4ce758eea6c9021677c611b1c008743e7b9cb911a615ea
Opcode Fuzzy Hash: 7143ece648b137b354beeaaf2c40f1583bbbf86e448a29b2b05603a9909d3bcd
Instruction Fuzzy Hash: D9812871A00205EFDB10CFA9C980AEEBBF6BB59314F149029E915E7350EBB0A9458F61

Function 00691830 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 115
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006911A6: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00691841,?,00000000), ref: 006911B5
Part of subcall function 006911A6: GetVersion.KERNEL32(?,00000000), ref: 006911C4
Part of subcall function 006911A6: GetCurrentProcessId.KERNEL32(?,00000000), ref: 006911DB
Part of subcall function 006911A6: OpenProcess.KERNEL32(0010047A,00000000,00000000,?,00000000), ref: 006911F4

Part of subcall function 0069121A: GetModuleFileNameW.KERNEL32(?,00000000,00000104,00000208,?,00000000,?,?,?,00691862,?,?,00000000), ref: 00691243

GetLongPathNameW.KERNELBASE(00000000,00000000,00000000), ref: 00691872

Part of subcall function 00691CD4: HeapAlloc.KERNEL32(00000000,00000000,0069131B,00000028,?,00000000,006912C1,?,00000000,00000000,?,00691850,?,00000000), ref: 00691CE0

GetLongPathNameW.KERNELBASE(00000000,00000000,00000000), ref: 00691893

Part of subcall function 00691D5D: HeapFree.KERNEL32(00000000,00000000,00691D57,?,00000000,?,?,0069136E,00000000,?,00000000,006912C1,?,00000000,00000000), ref: 00691D69

GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 006918F8
wsprintfW.USER32 ref: 00691909
lstrlenW.KERNEL32(?), ref: 0069191D
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,?), ref: 0069192E
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 0069193E
lstrcpyW.KERNEL32(00000000), ref: 00691951
UnmapViewOfFile.KERNEL32(00000000), ref: 00691958
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00691971

Strings

s<u, xrefs: 00691909

Memory Dump Source

Source File: 00000000.00000002.2555028026.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2554987620.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555093096.0000000000692000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555146640.0000000000696000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_94.jbxd

Similarity

API ID: File$NameProcess$CreateCurrentHeapLongPathView$AllocErrorEventFreeLastMappingModuleOpenUnmapVersionlstrcpylstrlenwsprintf
String ID: s<u
API String ID: 2931246207-779365171
Opcode ID: 504a8eb36b192fd90c9f71e4d15641cb42710f536c83eae00e105a18c1077591
Instruction ID: 0d8ac14d843137c3dab457a51c13b4deb6db7de24afb168d2df60c4e1cdc2edb
Opcode Fuzzy Hash: 504a8eb36b192fd90c9f71e4d15641cb42710f536c83eae00e105a18c1077591
Instruction Fuzzy Hash: 37319171500207BFDF10AF60DC99DAB77AFEB4A364B20062BF615DAAA0D7318D15CA61

Function 00663BD0 Relevance: 15.2, APIs: 10, Instructions: 206
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00663C77
RtlEnterCriticalSection.NTDLL(0066C2C4), ref: 00663C9A
RtlLeaveCriticalSection.NTDLL(0066C2C4), ref: 00663CB8
StrTrimA.SHLWAPI(00000000,0066B2B8,?,0066C304), ref: 00663CEF
wcstombs.NTDLL ref: 00663DB7

Part of subcall function 00665B91: SysAllocString.OLEAUT32(?), ref: 00665BD2
Part of subcall function 00665B91: IUnknown_QueryInterface_Proxy.RPCRT4(00000008,0066D018,?), ref: 00665C4C
Part of subcall function 00665B91: StrStrIW.KERNELBASE(?,0066D000), ref: 00665C84

Part of subcall function 00665A26: RtlFreeHeap.NTDLL(00000000,?,00661199,00000000,0066D964,?,0066D908), ref: 00665A32

RtlFreeHeap.NTDLL(00000000,?,00000000), ref: 00663DF5
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00663E08
HeapFree.KERNEL32(00000000,00000000,?,0066C304), ref: 00663E16
HeapFree.KERNEL32(00000000,?), ref: 00663E26
RtlFreeHeap.NTDLL(00000000,?), ref: 00663E36

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: Heap$Free$CriticalSection$AllocAllocateEnterInterface_LeaveProxyQueryStringTrimUnknown_wcstombs
String ID:
API String ID: 2876517465-0
Opcode ID: c9f763243e7c51118d591da02ddabad99a52b13faad5f2f84bd355d9505821e2
Instruction ID: ae48c2bc08fa837755bf8293acb5711e60bfef8703550cc303c4d3c3a33f2f83
Opcode Fuzzy Hash: c9f763243e7c51118d591da02ddabad99a52b13faad5f2f84bd355d9505821e2
Instruction Fuzzy Hash: 07719C71A00214EFCB119FA5DC89AAE7FBAEF08364F145419F945D3361CBB29E41DBA0

Function 0069197E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 101
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,?,?,?,?), ref: 006919B0
lstrlenA.KERNEL32(?), ref: 006919C6
memset.NTDLL ref: 006919D0
GetProcAddress.KERNEL32(?,00000002), ref: 00691A33
lstrlenA.KERNEL32(-00000002), ref: 00691A48
memset.NTDLL ref: 00691A52

Strings

~, xrefs: 00691A8B

Memory Dump Source

Source File: 00000000.00000002.2555028026.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2554987620.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555093096.0000000000692000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555146640.0000000000696000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_94.jbxd

Similarity

API ID: lstrlenmemset$AddressLibraryLoadProc
String ID: ~
API String ID: 1986585659-1707062198
Opcode ID: b1a473a0d155d4e8840a40dc74fd20c7204da22074f2b5cf88ebc740f701ff50
Instruction ID: 21b0ff7d7ef16c6006825e7fe3953991307b5bc7366addcf0fd491244a9c3109
Opcode Fuzzy Hash: b1a473a0d155d4e8840a40dc74fd20c7204da22074f2b5cf88ebc740f701ff50
Instruction Fuzzy Hash: 67313C71A02217ABDF24CF59C890BBDB7BABF46304F254069E805EBA50E734EE45CB50

Function 00664F16 Relevance: 10.6, APIs: 7, Instructions: 142
timememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 00664F37
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF), ref: 00664F77
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0066305C,?), ref: 00665023
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,0066305C,?), ref: 00665033
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 0066506D
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?), ref: 00665087
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0066305C,?), ref: 006650A6

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: TimerWaitable$CloseCreateErrorFreeHandleHeapLast_allmul
String ID:
API String ID: 3354623818-0
Opcode ID: 1e3775c4750f1646297a103263623f227b8507e606acf6af560b0cf63ddc7bc3
Instruction ID: 7be8acdf1a1fac09665489260bf43f5fbc55e84cf841f73c543170dca16faf96
Opcode Fuzzy Hash: 1e3775c4750f1646297a103263623f227b8507e606acf6af560b0cf63ddc7bc3
Instruction Fuzzy Hash: D1418071419720AFC720DF65DC45DABBBEEEB89364F105A1EF4A5D22A0D770CA40CB92

Function 00665B91 Relevance: 9.1, APIs: 6, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(?), ref: 00665BD2
IUnknown_QueryInterface_Proxy.RPCRT4(00000008,0066D018,?), ref: 00665C4C
StrStrIW.KERNELBASE(?,0066D000), ref: 00665C84
SysFreeString.OLEAUT32(?), ref: 00665CA6

Part of subcall function 006614BA: SysAllocString.OLEAUT32(0066B2C0), ref: 00661502

SafeArrayDestroy.OLEAUT32(?), ref: 00665CFA
SysFreeString.OLEAUT32(?), ref: 00665D08

Part of subcall function 00662E81: Sleep.KERNELBASE(000001F4,?,?), ref: 00662EC6

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: String$AllocFree$ArrayDestroyInterface_ProxyQuerySafeSleepUnknown_
String ID:
API String ID: 2118684380-0
Opcode ID: 9b1eabfdeeecdab1fcce90e063d4edf3a7aca39a0017cce82597518d426594ed
Instruction ID: c4f762ed0cb79ff3b944b158fd9d98b984e68ddc5a3c07f4f75813e3f06972ea
Opcode Fuzzy Hash: 9b1eabfdeeecdab1fcce90e063d4edf3a7aca39a0017cce82597518d426594ed
Instruction Fuzzy Hash: AC511A7290064AEFCB00DFA8C8858EEB7B7FF88340B15882DE916EB210D771AD45CB50

Function 0069177C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00691CD4: HeapAlloc.KERNEL32(00000000,00000000,0069131B,00000028,?,00000000,006912C1,?,00000000,00000000,?,00691850,?,00000000), ref: 00691CE0

EnterCriticalSection.KERNEL32(00000000,00000000,00000018,?,Jun 12 2019,?,00691AE8,00000000,?,00000000,?,Jun 12 2019,?,FFFFF9B8,?,006912EA), ref: 006917AC
VirtualProtect.KERNELBASE(?,00000001,00000001,0000000C,?,?,00691AE8,00000000,?,00000000,?,Jun 12 2019,?,FFFFF9B8,?,006912EA), ref: 006917DE
GetLastError.KERNEL32(?,00691AE8,00000000,?,00000000,?,Jun 12 2019,?,FFFFF9B8,?,006912EA,FFFFF9B8,?,00000000,?,00000000), ref: 006917FD
LeaveCriticalSection.KERNEL32(00000000,?,00691AE8,00000000,?,00000000,?,Jun 12 2019,?,FFFFF9B8,?,006912EA,FFFFF9B8,?,00000000,?), ref: 00691808

Strings

Jun 12 2019, xrefs: 0069177F

Memory Dump Source

Source File: 00000000.00000002.2555028026.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2554987620.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555093096.0000000000692000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555146640.0000000000696000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_94.jbxd

Similarity

API ID: CriticalSection$AllocEnterErrorHeapLastLeaveProtectVirtual
String ID: Jun 12 2019
API String ID: 1328245997-1134689151
Opcode ID: 906143c1f543a3954aa4be1ba76181d5121f0a76044823633f48e2fbfc861d07
Instruction ID: 787fca88cf8a3bf60bcb3972ae916786c704fbdf3556b22b86546555c42897c3
Opcode Fuzzy Hash: 906143c1f543a3954aa4be1ba76181d5121f0a76044823633f48e2fbfc861d07
Instruction Fuzzy Hash: 0F21A535600606EBDF218F55C840B9A7BEEEF86751F20842AF558CFB10D770D841DBA1

Function 00662EDE Relevance: 7.6, APIs: 5, Instructions: 141
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(0066D10A), ref: 00662EF0
memset.NTDLL ref: 00662FCB
RtlInitializeCriticalSection.NTDLL(0066C2C4), ref: 00662FDC
RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 00663003
wsprintfA.USER32 ref: 0066302B

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: AllocateCriticalHandleHeapInitializeModuleSectionmemsetwsprintf
String ID:
API String ID: 1574608601-0
Opcode ID: 5ae94017c4ebcb49fcdbf13fc4a7327688ca9e96ecf0498fa4ed46d9dd11b10c
Instruction ID: a0d66c78a99654b159d9b20deadff506349775cfbc0f964163a023883294761e
Opcode Fuzzy Hash: 5ae94017c4ebcb49fcdbf13fc4a7327688ca9e96ecf0498fa4ed46d9dd11b10c
Instruction Fuzzy Hash: 8A416CB1A40521AFCB206FA8DC95ABE77B7BB08354F10143DF541E7391E7B18E448790

Function 00691DD2 Relevance: 7.5, APIs: 5, Instructions: 19
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 00691DDC
GetModuleHandleA.KERNEL32(00000000), ref: 00691DEC
GetCommandLineW.KERNEL32 ref: 00691DF7

Part of subcall function 00691830: GetLongPathNameW.KERNELBASE(00000000,00000000,00000000), ref: 00691872
Part of subcall function 00691830: GetLongPathNameW.KERNELBASE(00000000,00000000,00000000), ref: 00691893
Part of subcall function 00691830: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 006918F8
Part of subcall function 00691830: wsprintfW.USER32 ref: 00691909
Part of subcall function 00691830: lstrlenW.KERNEL32(?), ref: 0069191D
Part of subcall function 00691830: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,?), ref: 0069192E
Part of subcall function 00691830: MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 0069193E
Part of subcall function 00691830: lstrcpyW.KERNEL32(00000000), ref: 00691951
Part of subcall function 00691830: UnmapViewOfFile.KERNEL32(00000000), ref: 00691958

HeapDestroy.KERNEL32 ref: 00691E0A
ExitProcess.KERNEL32 ref: 00691E11

Memory Dump Source

Source File: 00000000.00000002.2555028026.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2554987620.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555093096.0000000000692000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555146640.0000000000696000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_94.jbxd

Similarity

API ID: File$CreateHeapLongNamePathProcessView$CommandCurrentDestroyExitHandleLineMappingModuleUnmaplstrcpylstrlenwsprintf
String ID:
API String ID: 1011159145-0
Opcode ID: 7a2c15afb1bc7f52a4a49d91db411c8524f70c5b86d2bbbac4e2e14ca59b0211
Instruction ID: fe64c1337a91fb0f35449028fe571d1d24c9fba50876909c66c6fb2a75eda96e
Opcode Fuzzy Hash: 7a2c15afb1bc7f52a4a49d91db411c8524f70c5b86d2bbbac4e2e14ca59b0211
Instruction Fuzzy Hash: 15E0EC30542232BBD7212F70BC1EB9E3E6FBF067517202417F406D2A60DB354955DBA8

Function 00669996 Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000000C8), ref: 006699C4
lstrlenW.KERNEL32(?), ref: 006699FA
memcpy.NTDLL(00000000,?,?,?), ref: 00669A1B
SysFreeString.OLEAUT32(?), ref: 00669A2F

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 1198164300-0
Opcode ID: 75b503ab0113de71e504d5f726ef5cb780b66d165367918e57a97c58c43d4d92
Instruction ID: d5ee3e93ef724196826827e7573850ed6e10c24f6eb991a493ea0b3a131e297c
Opcode Fuzzy Hash: 75b503ab0113de71e504d5f726ef5cb780b66d165367918e57a97c58c43d4d92
Instruction Fuzzy Hash: 30210C75A00209EFCB11DFA9D9889DEBBFAFF49310B1441A9E905E7310EB709A45CB64

Function 00691000 Relevance: 6.1, APIs: 4, Instructions: 63
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00000000,0069110C,?,00000000), ref: 00691018
VirtualProtect.KERNELBASE(00000000,00000001,0000000C,0000000C,00000000,?,?,?,?,00000000,0069110C,?,00000000), ref: 0069105B
GetLastError.KERNEL32(?,?,?,?,00000000,0069110C,?,00000000), ref: 00691065
LeaveCriticalSection.KERNEL32(?,00000000,?,?,?,?,00000000,0069110C,?,00000000), ref: 00691093

Memory Dump Source

Source File: 00000000.00000002.2555028026.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2554987620.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555093096.0000000000692000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555146640.0000000000696000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_94.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveProtectVirtual
String ID:
API String ID: 3666628472-0
Opcode ID: 593d52402e12734d85eb0127449d9507ccc5dbe570fa0906a374b915131b92f3
Instruction ID: 362a2426aac0096d66eb488e1cfa57240927b334cda2fbd42ab0f57579ab51fc
Opcode Fuzzy Hash: 593d52402e12734d85eb0127449d9507ccc5dbe570fa0906a374b915131b92f3
Instruction Fuzzy Hash: E211D331600206ABDF20CF25CC94BAA77EEEB413A5F204529E41AC7740EB75D984CB50

Function 0066325C Relevance: 6.1, APIs: 4, Instructions: 54memorylibraryloaderCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 00663269
GetTickCount.KERNEL32 ref: 0066327D
GetModuleHandleA.KERNEL32(0066D09F,?,?,?), ref: 006632B4
GetProcAddress.KERNEL32(00000000,0066D8A4), ref: 006632C5

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: AddressCountCreateHandleHeapModuleProcTick
String ID:
API String ID: 4094926805-0
Opcode ID: 429b9225f91629bba81e7472b00b87c4dcb5b1ad033b70913683d74c47438031
Instruction ID: 0bcc877e903daa3cc12464e93930f376ae9355d2a24a930f11a8405958f84a6f
Opcode Fuzzy Hash: 429b9225f91629bba81e7472b00b87c4dcb5b1ad033b70913683d74c47438031
Instruction Fuzzy Hash: 1711C431540610ABCB219FA5DCA59AE7FAFEBC4760B20501AF944C6320E7B19B80CBA4

Function 00665A3B Relevance: 4.6, APIs: 3, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000800,0066B050), ref: 00665A57

Part of subcall function 00663BD0: RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00663C77
Part of subcall function 00663BD0: RtlEnterCriticalSection.NTDLL(0066C2C4), ref: 00663C9A
Part of subcall function 00663BD0: RtlLeaveCriticalSection.NTDLL(0066C2C4), ref: 00663CB8
Part of subcall function 00663BD0: StrTrimA.SHLWAPI(00000000,0066B2B8,?,0066C304), ref: 00663CEF

RtlAllocateHeap.NTDLL(00000000,00000800,0066B050), ref: 00665A85
RtlFreeHeap.NTDLL(00000000,?,?,?,?,00664FEC,00000002,?,?), ref: 00665ACE

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: Heap$Allocate$CriticalSection$EnterFreeLeaveTrim
String ID:
API String ID: 3593199195-0
Opcode ID: 4cc0d23b2cdcda7a94a331df7442d30ec3d1da22e3a132d14dfb5e851fd3cd16
Instruction ID: 35fb870c36d2a576f9b41630691346090fde5b293cb272691d5b0f61406c246a
Opcode Fuzzy Hash: 4cc0d23b2cdcda7a94a331df7442d30ec3d1da22e3a132d14dfb5e851fd3cd16
Instruction Fuzzy Hash: 5B118476240505FBC711DFE4DC81FAB376FAB44790F205225F907D6250DB70DA459BA0

Function 006910A3 Relevance: 3.8, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?,?,00000001), ref: 006910D9
TlsGetValue.KERNEL32(?), ref: 006910FB
TlsSetValue.KERNEL32(?,00000000,?,00000000), ref: 00691113

Part of subcall function 00691000: EnterCriticalSection.KERNEL32(?,?,?,?,?,00000000,0069110C,?,00000000), ref: 00691018
Part of subcall function 00691000: VirtualProtect.KERNELBASE(00000000,00000001,0000000C,0000000C,00000000,?,?,?,?,00000000,0069110C,?,00000000), ref: 0069105B
Part of subcall function 00691000: GetLastError.KERNEL32(?,?,?,?,00000000,0069110C,?,00000000), ref: 00691065
Part of subcall function 00691000: LeaveCriticalSection.KERNEL32(?,00000000,?,?,?,?,00000000,0069110C,?,00000000), ref: 00691093

Memory Dump Source

Source File: 00000000.00000002.2555028026.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2554987620.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555093096.0000000000692000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555146640.0000000000696000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_94.jbxd

Similarity

API ID: Value$CriticalSection$EnterErrorLastLeaveProtectVirtual
String ID:
API String ID: 3047629960-0
Opcode ID: f6ccf2870e046a705267c3d222eedbd8065e0c27583e83b29701ba63c8032c58
Instruction ID: 95b57ca087d8876afb6164766183324852daef5173292cbd3b35c974dfec0225
Opcode Fuzzy Hash: f6ccf2870e046a705267c3d222eedbd8065e0c27583e83b29701ba63c8032c58
Instruction Fuzzy Hash: 1D01B135300106ABEF209F54DD85AA6BBAFEB67354F314119F240DBA26CB62DC80DA50

Function 00662DD1 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(0066C21C), ref: 00662DE6

Part of subcall function 0066325C: HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 00663269

InterlockedDecrement.KERNEL32(0066C21C), ref: 00662E06

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: Interlocked$CreateDecrementHeapIncrement
String ID:
API String ID: 3834848776-0
Opcode ID: 71cb6955bb275f0dc38a6ec41669447e0fb3606c24ffea2f3e4aebd83d4b7af1
Instruction ID: 19b5afb9cf01136371c8e17987e7363f89baeacd4c05465a53ff6faa8c1812f5
Opcode Fuzzy Hash: 71cb6955bb275f0dc38a6ec41669447e0fb3606c24ffea2f3e4aebd83d4b7af1
Instruction Fuzzy Hash: 68E0863124493397CB352BF88C2C7AB6A479F55B94F01543CF981D1151E752CDE282E1

Function 00691125 Relevance: 2.6, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000000,?,?,?,?,00000000,?,?,00691BA6,00000000,?,?,00691967,00000000,?,?), ref: 00691152
memcpy.NTDLL(00000000,?,?,?,00000000), ref: 00691185

Memory Dump Source

Source File: 00000000.00000002.2555028026.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2554987620.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555093096.0000000000692000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555146640.0000000000696000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_94.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: ba7c017050a1cf6b6b791f3ce2489384f8c28bb427a790f06ab07a37712ff772
Instruction ID: 0097953f30963f8b07a3f72650cbb8f3b53f8a962de5e9c805883aba07403cd3
Opcode Fuzzy Hash: ba7c017050a1cf6b6b791f3ce2489384f8c28bb427a790f06ab07a37712ff772
Instruction Fuzzy Hash: E9116D7690010AAFCB50DF99DC81DAAB7FDFF0531472580A9F9089B312E235EA55DBA0

Function 00691B73 Relevance: 2.5, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,00000000,?,00691967,00000000,?,?,?,?,?,00000000), ref: 00691B93

Part of subcall function 00691125: memcpy.NTDLL(00000000,?,?,?,?,00000000,?,?,00691BA6,00000000,?,?,00691967,00000000,?,?), ref: 00691152
Part of subcall function 00691125: memcpy.NTDLL(00000000,?,?,?,00000000), ref: 00691185

Part of subcall function 0069197E: LoadLibraryA.KERNELBASE(?,?,?,?,?,?), ref: 006919B0
Part of subcall function 0069197E: lstrlenA.KERNEL32(?), ref: 006919C6
Part of subcall function 0069197E: memset.NTDLL ref: 006919D0
Part of subcall function 0069197E: GetProcAddress.KERNEL32(?,00000002), ref: 00691A33
Part of subcall function 0069197E: lstrlenA.KERNEL32(-00000002), ref: 00691A48
Part of subcall function 0069197E: memset.NTDLL ref: 00691A52

Part of subcall function 006915B2: VirtualProtect.KERNEL32(00000000,?,00000004,?,?,?,00000000,?), ref: 006915E0
Part of subcall function 006915B2: VirtualProtect.KERNEL32(00000000,?,00000004,?), ref: 00691637
Part of subcall function 006915B2: GetLastError.KERNEL32(?,?), ref: 0069163D

GetLastError.KERNEL32(?,00691967,00000000,?,?,?,?,?,00000000), ref: 00691BD8

Memory Dump Source

Source File: 00000000.00000002.2555028026.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2554987620.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555093096.0000000000692000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555146640.0000000000696000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_94.jbxd

Similarity

API ID: Virtual$ErrorLastProtectlstrlenmemcpymemset$AddressAllocLibraryLoadProc
String ID:
API String ID: 1427402392-0
Opcode ID: c0ac5d6e8a76a0461c3aa8652829a6a8b6c5457968c607158c3d29aabd94599e
Instruction ID: 16f2cd1d2c89b11c5b3baac0c9c93aef0fee03ab5be51dfcd7863ac35d6e141a
Opcode Fuzzy Hash: c0ac5d6e8a76a0461c3aa8652829a6a8b6c5457968c607158c3d29aabd94599e
Instruction Fuzzy Hash: B5F0C2B27046137BEB601AB58C81F77319F9F06385F250164BE02DBB59F690ED0081E4

Function 006403A6 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNELBASE(?,00000000,00000000,?), ref: 006403DF

Memory Dump Source

Source File: 00000000.00000002.2554778434.0000000000640000.00000040.00001000.00020000.00000000.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_640000_94.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c1a17069605dab7d48ac39e7c644e9b5868b307e3d54936d315e395ad9e50ff5
Instruction ID: f3ff4b0e0e0df8c859c5ce097181994b8164fe18c907afc2c81a69b0916a096f
Opcode Fuzzy Hash: c1a17069605dab7d48ac39e7c644e9b5868b307e3d54936d315e395ad9e50ff5
Instruction Fuzzy Hash: 0701FC73A04126ABF7218E18DC00BAB779BEFD5720F29C525EF06EB341D674DC0241A0

Function 006A8707 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(006DE604), ref: 006A8746

Memory Dump Source

Source File: 00000000.00000002.2555181799.000000000069F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0069F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f000_94.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 7803ad53a102181b719addd910cc41878caa52d030f18eb8bd87888c924c5227
Instruction ID: f07ca6590dedeaf04b8a8cd36461c7fba4d5053ee42314d45fbbb9e420c1f05c
Opcode Fuzzy Hash: 7803ad53a102181b719addd910cc41878caa52d030f18eb8bd87888c924c5227
Instruction Fuzzy Hash: EFF06776A016588FC714AF29ED44568B7A3F7A8351B10621AD442CB260EA71A9818F40

Function 00665A26 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,?,00661199,00000000,0066D964,?,0066D908), ref: 00665A32

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 9e093baac8f75c4fc4ec88ee364e92359ec5403c3a0ff8df8f2fbece29779167
Instruction ID: 0298f5285db41cb8e7663ad8f27ad318c8fa4bb58b68253150d07bf72dddb4ec
Opcode Fuzzy Hash: 9e093baac8f75c4fc4ec88ee364e92359ec5403c3a0ff8df8f2fbece29779167
Instruction Fuzzy Hash: 8DB01271140100FBCB114B80DE04F0A7E23A750704F016011F344400B083B20460FF15

Function 00662E81 Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4,?,?), ref: 00662EC6

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c028964a6993294336784a2757ddbd3ace8a791c1a89ed4efcad76e08b06b372
Instruction ID: bb505e5fa251d97db9f5c6f6fc9ea23ae27d58e3e96b125366b1e9b213db2ab3
Opcode Fuzzy Hash: c028964a6993294336784a2757ddbd3ace8a791c1a89ed4efcad76e08b06b372
Instruction Fuzzy Hash: 7AF04F71D00219EFDB00DB94C598AEDB7B8EF04314F1441BAE512A7280D3B55B80DB51

Non-executed Functions

Function 00662E1B Relevance: 6.0, APIs: 4, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006697E6: RtlAllocateHeap.NTDLL(00000000,?,00661838), ref: 006697F2

RtlInitializeCriticalSection.NTDLL(00000000), ref: 00662E33
TlsAlloc.KERNEL32(?,00663A9A,?,?), ref: 00662E39
RtlAddVectoredExceptionHandler.NTDLL(00000001,00664CD5), ref: 00662E4E
GetLastError.KERNEL32(?,00663A9A,?,?), ref: 00662E65

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: AllocAllocateCriticalErrorExceptionHandlerHeapInitializeLastSectionVectored
String ID:
API String ID: 1951604812-0
Opcode ID: 9dba83eabc9ea719b3a55d2ed329670cfd3d8abb66846acaeb9c68dd82fcabcd
Instruction ID: 6c386e75fcb71dd0add4825c4de4e7e67db975c379c5223cf09bee4363538e6d
Opcode Fuzzy Hash: 9dba83eabc9ea719b3a55d2ed329670cfd3d8abb66846acaeb9c68dd82fcabcd
Instruction Fuzzy Hash: 4FF09635641F119BC3306F3A9C1968B7EEBBF84710B112239F666C6292EFB1D845CB60

Function 006911A6 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00691841,?,00000000), ref: 006911B5
GetVersion.KERNEL32(?,00000000), ref: 006911C4
GetCurrentProcessId.KERNEL32(?,00000000), ref: 006911DB
OpenProcess.KERNEL32(0010047A,00000000,00000000,?,00000000), ref: 006911F4

Memory Dump Source

Source File: 00000000.00000002.2555028026.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2554987620.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555093096.0000000000692000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555146640.0000000000696000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_94.jbxd

Similarity

API ID: Process$CreateCurrentEventOpenVersion
String ID:
API String ID: 845504543-0
Opcode ID: 642e9cd6597bc3fd5e1def88a4f801608831423a0132a48448d77df2317f8473
Instruction ID: c90bcf4b6a922fd4f6493748545860aaf00f5793ea9a554d4564b998f992faf9
Opcode Fuzzy Hash: 642e9cd6597bc3fd5e1def88a4f801608831423a0132a48448d77df2317f8473
Instruction Fuzzy Hash: 4CF04471640322AADB209F657D16BD53B6FA706711F105117E615CABE0E3604682DB18

Function 00661397 Relevance: 3.0, APIs: 2, Instructions: 48memorytimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00664237: lstrlen.KERNEL32(?,?,00000000,80000002,00663616,?), ref: 00664240
Part of subcall function 00664237: mbstowcs.NTDLL ref: 00664267
Part of subcall function 00664237: memset.NTDLL ref: 00664279

GetSystemTimeAsFileTime.KERNEL32(?,?,00000000,?), ref: 006613CD

Part of subcall function 00661034: SafeArrayCreate.OLEAUT32(00000011,00000001,?), ref: 0066105C
Part of subcall function 00661034: SafeArrayDestroy.OLEAUT32(?), ref: 006610A2

HeapFree.KERNEL32(00000000,00000000,?,00000000,?), ref: 006613FD

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: ArraySafeTime$CreateDestroyFileFreeHeapSystemlstrlenmbstowcsmemset
String ID:
API String ID: 378363407-0
Opcode ID: 103226378e14aa5947476c241b2d16fe54382762682fddc6da1b5827abe7cddc
Instruction ID: 88808512836a060d78754a70e36ddd1bb1158ceb86a238494560fd016d4cf87b
Opcode Fuzzy Hash: 103226378e14aa5947476c241b2d16fe54382762682fddc6da1b5827abe7cddc
Instruction Fuzzy Hash: 5501263260020AFBDF216FA98C45F9B7BBEEB81305F104429FA00DA161EBB2D955C760

Function 00668FFC Relevance: .6, Instructions: 610COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beedc4fac195a60894e90b7125da2d6bd5f658941b2ffd4f0d9af531cc40a63a
Instruction ID: 47c090b1b049d1dd1cc1b70ab1dd3d03a0fcc2b48cd6ea7f1a6925d94f9075b7
Opcode Fuzzy Hash: beedc4fac195a60894e90b7125da2d6bd5f658941b2ffd4f0d9af531cc40a63a
Instruction Fuzzy Hash: 8A22937BE516169BDB08CA95CC805E9B3E3BBC832471F9179C919E3305EE797A0786C0

Function 0066A29C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction ID: 0e036f63df3c7ffa34c61592e336ac3505ca7fdca787e4955a05ec303a86c89e
Opcode Fuzzy Hash: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction Fuzzy Hash: DB21B8729002049FCB14DFA8CC849ABBBE6FF45350B098559E956EB345DB30F915CBE1

Function 006C5F69 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2555263711.00000000006C5000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5000_94.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538cd7daa44cb0be5c709bed46d95b701850ced07307e9b00aac71a02e345600
Instruction ID: f311390ddba74b0af79b84ca64282b1846eb7e7f343417ca954d1c656ed67258
Opcode Fuzzy Hash: 538cd7daa44cb0be5c709bed46d95b701850ced07307e9b00aac71a02e345600
Instruction Fuzzy Hash: 38117F733405009FD754DE59EC81FA2B3EAEB88330B29816EED15CB715E675E842CB60

Function 006400CB Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2554778434.0000000000640000.00000040.00001000.00020000.00000000.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_640000_94.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538cd7daa44cb0be5c709bed46d95b701850ced07307e9b00aac71a02e345600
Instruction ID: 82b39d6c617a5d630ae6667030015a5369a7bef396626162cb6ba55b70c8fc07
Opcode Fuzzy Hash: 538cd7daa44cb0be5c709bed46d95b701850ced07307e9b00aac71a02e345600
Instruction Fuzzy Hash: 071193733401109FE754DE99EC91FA6B3DAEB98330B298066EE04CB301D676EC42C7A0

Function 00668847 Relevance: 18.2, APIs: 12, Instructions: 217filememorytimeCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 006688AE
CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 006688E0
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 006688F4
CloseHandle.KERNEL32(?), ref: 0066890B
lstrcat.KERNEL32(?,0066D6CB), ref: 00668951
FindNextFileA.KERNEL32(0066B050,?), ref: 00668999
StrChrA.SHLWAPI(?,0000002E), ref: 00668A07
memcpy.NTDLL(?,?,00000000), ref: 00668A40
FindNextFileA.KERNEL32(0066B050,?), ref: 00668A55
CompareFileTime.KERNEL32(?,?), ref: 00668A7E
HeapFree.KERNEL32(00000000,?), ref: 00668AC5
HeapFree.KERNEL32(00000000,?), ref: 00668AD5

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: File$FindFreeHeapNextTime$CloseCompareCreateHandlelstrcatmemcpymemset
String ID:
API String ID: 293928577-0
Opcode ID: 44afbc23aee9dafb414540d726f6b2454b762b5723566260e95d16f1e01b76cc
Instruction ID: 70a372f10b4e7968fda95ad267c37127423f94e1f8e352b72753d4bda729d2cb
Opcode Fuzzy Hash: 44afbc23aee9dafb414540d726f6b2454b762b5723566260e95d16f1e01b76cc
Instruction Fuzzy Hash: 93814C71D00109EFDF119FA5DC84AEEBBBAFB44300F14526AE515E3260EB719A85CF60

Function 00664289 Relevance: 16.7, APIs: 11, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0066429F

Part of subcall function 006637A8: WaitForSingleObject.KERNEL32(00000000,0066B0D0,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0066385A

RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00664362
GetTickCount.KERNEL32 ref: 00664372
RtlEnterCriticalSection.NTDLL(0066C2C4), ref: 00664386
RtlLeaveCriticalSection.NTDLL(0066C2C4), ref: 006643A4
StrTrimA.SHLWAPI(00000000,0066B2B8,?,0066C304), ref: 006643D6
HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 0066443E
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0066444E
HeapFree.KERNEL32(00000000,00000000,?,0066C304), ref: 0066445C
HeapFree.KERNEL32(00000000,?), ref: 0066446D
HeapFree.KERNEL32(00000000,?), ref: 0066447B

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: Heap$Free$CountCriticalSectionTick$AllocateEnterLeaveObjectSingleTrimWait
String ID:
API String ID: 448949543-0
Opcode ID: 44c3ded7af5e9c7aaaa39c1de617d2b91d165a110a54beaf094abcbc0075168c
Instruction ID: 0c0678fb6ae110fde654d4b4c00e4cd5fbc672fb0a6be966da2b36c721c2dd1e
Opcode Fuzzy Hash: 44c3ded7af5e9c7aaaa39c1de617d2b91d165a110a54beaf094abcbc0075168c
Instruction Fuzzy Hash: BC51F371600600FFC3119FA9EC49E6B7BAFEB88724B152518F585D2270CBB69940CBA1

Function 006A46FB Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 370COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 006A4957
__aulldiv.LIBCMT ref: 006A4979
_write_multi_char.LIBCMTD ref: 006A4A80
_write_multi_char.LIBCMTD ref: 006A4ACB
_wctomb_s.LIBCMTD ref: 006A4B48

Strings

-, xrefs: 006A4A20
9, xrefs: 006A498A

Memory Dump Source

Source File: 00000000.00000002.2555181799.000000000069F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0069F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f000_94.jbxd

Similarity

API ID: _write_multi_char$__aulldiv__aullrem_wctomb_s
String ID: -$9
API String ID: 1184596759-1631151375
Opcode ID: ffb13a6f644cc8b34b5257167d25313ec954d9ec21d01041a89dd7a460e39164
Instruction ID: bb24b7746e0b7a2a7724eecd7690cccc87d14ccc06856118f6cade443b85cb29
Opcode Fuzzy Hash: ffb13a6f644cc8b34b5257167d25313ec954d9ec21d01041a89dd7a460e39164
Instruction Fuzzy Hash: 60F137B1D012299FDB64EF58CD99BEEB7B6BB85300F1081D9E019A7241DB749E80CF54

Function 006A634D Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 367COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 006A65B2
__aulldiv.LIBCMT ref: 006A65D4
_write_multi_char.LIBCMTD ref: 006A66ED
_write_multi_char.LIBCMTD ref: 006A6738
__mbtowc_l.LIBCMTD ref: 006A67A7

Strings

9, xrefs: 006A65E5

Memory Dump Source

Source File: 00000000.00000002.2555181799.000000000069F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0069F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f000_94.jbxd

Similarity

API ID: _write_multi_char$__aulldiv__aullrem__mbtowc_l
String ID: 9
API String ID: 1567110664-2366072709
Opcode ID: b9c9099d13181edc2bc9fb6b5cdc2abe39216e3eb21f222af1754ce409e969ad
Instruction ID: de3ad8664445c936612a7acd8deecef88eb15d4b872c16bde081984cdc40750c
Opcode Fuzzy Hash: b9c9099d13181edc2bc9fb6b5cdc2abe39216e3eb21f222af1754ce409e969ad
Instruction Fuzzy Hash: 46F139B1D002199FDF24DF54C895BEEB7B6FB86304F188199E20AAB241D7349E84CF59

Function 006A445F Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 006A4471
_write_multi_char.LIBCMTD ref: 006A4A80
_write_multi_char.LIBCMTD ref: 006A4ACB
_wctomb_s.LIBCMTD ref: 006A4B48

Strings

-, xrefs: 006A4A20

Memory Dump Source

Source File: 00000000.00000002.2555181799.000000000069F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0069F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f000_94.jbxd

Similarity

API ID: _write_multi_char$__get_printf_count_output_wctomb_s
String ID: -
API String ID: 1423328474-2547889144
Opcode ID: e571ba2d84dadc1e8d1400c7d44aec53f292fded7dfb7b1b64f92de13f7b4a62
Instruction ID: dd23b2215377c8b2e71133c75bb4605c2c094c84a7fb33a493d836b26f8c1478
Opcode Fuzzy Hash: e571ba2d84dadc1e8d1400c7d44aec53f292fded7dfb7b1b64f92de13f7b4a62
Instruction Fuzzy Hash: B2A16A70D002299BDF60EF54CC89BEEB7B6AF86304F1441D9E4096A281DBB49E80CF58

Function 0066448E Relevance: 10.7, APIs: 7, Instructions: 194filesynchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(0066C284,00000001,00000000,00000000,0066D71A,00000001,?), ref: 006645DB

Part of subcall function 00664B72: memset.NTDLL ref: 00664BE8
Part of subcall function 00664B72: memcpy.NTDLL(00000000,00000000,?,?,?,00000000,?,0066B050,00000000,0066B054), ref: 00664BFE
Part of subcall function 00664B72: memcpy.NTDLL(76F92E90,00000000,?,?,?,?,?,?,00000000,?,0066B050,00000000,0066B054), ref: 00664C32

Part of subcall function 0066126A: WaitForSingleObject.KERNEL32(00000000,?,?,?,?,?,?), ref: 00661344

WaitForSingleObject.KERNEL32(?,00004E20), ref: 0066461B
CloseHandle.KERNEL32(?), ref: 00664647
GetCurrentProcessId.KERNEL32(?,0066B050,00000000,0066B054), ref: 00664650
OpenFileMappingW.KERNEL32(00000004,00000000,?), ref: 00664670
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00664682
CloseHandle.KERNEL32(00000000), ref: 00664690

Part of subcall function 00664C5E: lstrlen.KERNEL32(00000000,00000000,0066B050,00000027,?,?,00000000,00000000,?,0066B050,00000000,0066B054), ref: 00664C94
Part of subcall function 00664C5E: lstrcpy.KERNEL32(00000000,00000000), ref: 00664CB8
Part of subcall function 00664C5E: lstrcat.KERNEL32(00000000,00000000), ref: 00664CC0

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: CloseFileHandleObjectSingleWaitmemcpy$CreateCurrentEventMappingOpenProcessViewlstrcatlstrcpylstrlenmemset
String ID:
API String ID: 1558403215-0
Opcode ID: a307403ba8195277da7f41fe5be36db1937c6e239a4cefc79c632b82dc980dda
Instruction ID: ddc8b649da545070d4c01159aed09b8475232482ab3331048a85bb6020aef2f9
Opcode Fuzzy Hash: a307403ba8195277da7f41fe5be36db1937c6e239a4cefc79c632b82dc980dda
Instruction Fuzzy Hash: DB516071900208EFCF10AFA4CC85AEE7BBBEF49394B158429F906E7250DF719E858B54

Function 00661AC3 Relevance: 9.1, APIs: 6, Instructions: 83memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0066D8B3,00000000,?), ref: 00661AFF
RtlAllocateHeap.NTDLL(00000000,0066D8B3), ref: 00661B2F
memcpy.NTDLL(00000000,?,00000000,?,0066D8B3), ref: 00661B41
memcpy.NTDLL(0000000B,?,0066D8B3,00000000,?,00000000,?,0066D8B3), ref: 00661B52
memcpy.NTDLL(00000000,00000000,?,0000000B,?,0066D8B3,00000000,?,00000000,?,0066D8B3), ref: 00661B6C
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,0066D8B3), ref: 00661B7D

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: memcpy$Heap$AllocateFreelstrlen
String ID:
API String ID: 1753103609-0
Opcode ID: 405f22c8be1bd184e788d90a5b869b1e85009bc6574a6ebc1090c25fe609de73
Instruction ID: e57cc25f2bb8128f08e7dbcc9d5a0cdffc983a22b369241bbeda2de50e4062dc
Opcode Fuzzy Hash: 405f22c8be1bd184e788d90a5b869b1e85009bc6574a6ebc1090c25fe609de73
Instruction Fuzzy Hash: 20317476A00208AFCB11CFA9CC88B9EBFFAEF89754F184059F844AB351D7719945CB60

Function 006A42AD Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMTD ref: 006A4A80
_write_multi_char.LIBCMTD ref: 006A4ACB
_wctomb_s.LIBCMTD ref: 006A4B48

Strings

-, xrefs: 006A4A20

Memory Dump Source

Source File: 00000000.00000002.2555181799.000000000069F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0069F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f000_94.jbxd

Similarity

API ID: _write_multi_char$_wctomb_s
String ID: -
API String ID: 3444263793-2547889144
Opcode ID: c7699d5ec420fdd9a5b9258cae8b8c27c845d100ec9d9822d0e6d09fdc9f843a
Instruction ID: 75ab949e2b3b7f5eaa3db6fce0091a149d1e2fcd129d2bf95a5def8f752aae03
Opcode Fuzzy Hash: c7699d5ec420fdd9a5b9258cae8b8c27c845d100ec9d9822d0e6d09fdc9f843a
Instruction Fuzzy Hash: 07A146B0D002299FDF64EB54CC89BEDB7B6BB86304F1481D9E419AB281DB749E80CF54

Function 00663581 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168stringCOMMON

Download Yara Rule

APIs

StrChrA.SHLWAPI(?,0000005F,00000000,00000000,00000104), ref: 006635B8
memcpy.NTDLL(?,?,?), ref: 006635CF
lstrcpy.KERNEL32(?), ref: 006635E2

Part of subcall function 00664237: lstrlen.KERNEL32(?,?,00000000,80000002,00663616,?), ref: 00664240
Part of subcall function 00664237: mbstowcs.NTDLL ref: 00664267
Part of subcall function 00664237: memset.NTDLL ref: 00664279

Part of subcall function 00668673: SysAllocString.OLEAUT32(?), ref: 0066868D
Part of subcall function 00668673: SysFreeString.OLEAUT32(00000000), ref: 006686C4

Part of subcall function 00665A26: RtlFreeHeap.NTDLL(00000000,?,00661199,00000000,0066D964,?,0066D908), ref: 00665A32

lstrcpy.KERNEL32(?,00000000), ref: 006635FF

Strings

\, xrefs: 006635E8

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: FreeStringlstrcpy$AllocHeaplstrlenmbstowcsmemcpymemset
String ID: \
API String ID: 594908551-2967466578
Opcode ID: bf144dec02cea733ba23c7b1ef9ad0527a496ef9ee70a076c4d0cb4eb1a01352
Instruction ID: d45122a785971dd9ead1d6c437d2c903d91425f6e979127fedb11e5262569ac0
Opcode Fuzzy Hash: bf144dec02cea733ba23c7b1ef9ad0527a496ef9ee70a076c4d0cb4eb1a01352
Instruction Fuzzy Hash: D9519CB2104302BFCB11AF60DD45E6BBBFBEB98350F00491CF59192361DB31DA149B66

Function 006A4729 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 006A4957
__aulldiv.LIBCMT ref: 006A4979

Strings

', xrefs: 006A4729
0, xrefs: 006A4745
9, xrefs: 006A498A

Memory Dump Source

Source File: 00000000.00000002.2555181799.000000000069F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0069F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f000_94.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: '$0$9
API String ID: 3839614884-269856862
Opcode ID: 1619b95e80393e4cf57bf18e2b8fe7153045fa5e83259dc93894880c6563bf75
Instruction ID: cd24cdde56636e8c082504ac4650f8c6f678aa526395c09eacbd2577f31a4031
Opcode Fuzzy Hash: 1619b95e80393e4cf57bf18e2b8fe7153045fa5e83259dc93894880c6563bf75
Instruction Fuzzy Hash: D341D371D062699FEB64EF48DD99BEEB7B2BB85300F1081D8D009A7255CB749E85CF40

Function 006A60B2 Relevance: 7.7, APIs: 5, Instructions: 240COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 006A60C4
_write_multi_char.LIBCMTD ref: 006A66ED
_write_multi_char.LIBCMTD ref: 006A6738
__mbtowc_l.LIBCMTD ref: 006A67A7

Memory Dump Source

Source File: 00000000.00000002.2555181799.000000000069F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0069F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f000_94.jbxd

Similarity

API ID: _write_multi_char$__get_printf_count_output__mbtowc_l
String ID:
API String ID: 3098527170-0
Opcode ID: dea443ea19b22a80678532036f8630cb6e998368856ea8521c262fab9fb8be03
Instruction ID: c9e1c0d6eed0c10e49ed0aee2a3b2cf05a475880334db775c97b82cdd044357d
Opcode Fuzzy Hash: dea443ea19b22a80678532036f8630cb6e998368856ea8521c262fab9fb8be03
Instruction Fuzzy Hash: F2A170B1D002189BDF24EF54CC95BEEB37AEF46304F144199E61A6B282D774AE84CF58

Function 006631E9 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00663290,?), ref: 006631F1
GetVersion.KERNEL32 ref: 00663200
GetCurrentProcessId.KERNEL32 ref: 00663217
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 00663234
GetLastError.KERNEL32 ref: 00663253

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: 4f4afb1134e1d3299f2a335f2eeaee40fcb1717f33b36293082e80dbbb812165
Instruction ID: 2831719e0b016572525e13ba66539d37f710e1426a20f935c25363e08c4227ef
Opcode Fuzzy Hash: 4f4afb1134e1d3299f2a335f2eeaee40fcb1717f33b36293082e80dbbb812165
Instruction Fuzzy Hash: B1F02270681311DFD7208F64AC68B253F6BE704B30F107015EA5AC53E0D3F14B818B14

Function 006A4716 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 006A4957
__aulldiv.LIBCMT ref: 006A4979

Strings

0, xrefs: 006A4745
9, xrefs: 006A498A

Memory Dump Source

Source File: 00000000.00000002.2555181799.000000000069F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0069F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f000_94.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 0$9
API String ID: 3839614884-1975997740
Opcode ID: 297f1af10412b3dc510e4ae35461679c164a06ab90b753febeaedca91d18a38e
Instruction ID: ec2a14900ef918af83364aae6bb4368ea499e007e64cfb0ab9bf6624820eeb44
Opcode Fuzzy Hash: 297f1af10412b3dc510e4ae35461679c164a06ab90b753febeaedca91d18a38e
Instruction Fuzzy Hash: 1141E371D062699FEB64EF48DD99BEEB7B2BB85300F1081D8D009A7245CBB49E85CF40

Function 006A637B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 006A65B2
__aulldiv.LIBCMT ref: 006A65D4

Strings

9, xrefs: 006A65E5
', xrefs: 006A637B

Memory Dump Source

Source File: 00000000.00000002.2555181799.000000000069F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0069F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f000_94.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: '$9
API String ID: 3839614884-1823400153
Opcode ID: 3e1b546819ff2bb1691d5e82a3ea849a974340fd1a06157a8a321916c78181c2
Instruction ID: 1f4d8a8ed6189fc187661d418bea0bd5ea9d8fae5724c18ff4c6343519c604b4
Opcode Fuzzy Hash: 3e1b546819ff2bb1691d5e82a3ea849a974340fd1a06157a8a321916c78181c2
Instruction Fuzzy Hash: E341E3B1D002299FDB64DF48C891BAEB7B2FF46314F1881A9E249A7244D3349E85CF49

Function 006A5EDC Relevance: 6.2, APIs: 4, Instructions: 224COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMTD ref: 006A66ED
_write_multi_char.LIBCMTD ref: 006A6738
__mbtowc_l.LIBCMTD ref: 006A67A7

Memory Dump Source

Source File: 00000000.00000002.2555181799.000000000069F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0069F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f000_94.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l
String ID:
API String ID: 4180812461-0
Opcode ID: 56ecc1497aef7dee6e2a5ca07bb616766cadb71e4d0e5a0bf21ee0f7f74c5d67
Instruction ID: 118b3e33a0ba621bd3370199ad3d45185a0102514cfd61ed3254f7f79f26a65a
Opcode Fuzzy Hash: 56ecc1497aef7dee6e2a5ca07bb616766cadb71e4d0e5a0bf21ee0f7f74c5d67
Instruction Fuzzy Hash: B4A17CB0D002189BDF24EF54CC85BEDB3BAFB45304F148199E61AAB242D734AE84CF58

Function 00663382 Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 0066342F
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 00663445
memset.NTDLL ref: 006634E5
memset.NTDLL ref: 006634F5

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: 12f43152e5929366d9fd1aea6f574e457af515e712280fe0e2dc4a3f06b9bb16
Instruction ID: c0d52b8998af01e1af12862db4633244868eeb41008731c58c73a1ce19757848
Opcode Fuzzy Hash: 12f43152e5929366d9fd1aea6f574e457af515e712280fe0e2dc4a3f06b9bb16
Instruction Fuzzy Hash: 8941B631A00259ABDB51DFA8DC81BEEB7B6EF55310F108529F916EB381DB70AE44CB50

Function 00669AEF Relevance: 6.1, APIs: 4, Instructions: 124stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000008,0066B060), ref: 00669B01

Part of subcall function 006697E6: RtlAllocateHeap.NTDLL(00000000,?,00661838), ref: 006697F2

ResetEvent.KERNEL32(?), ref: 00669B75
GetLastError.KERNEL32 ref: 00669B98
GetLastError.KERNEL32 ref: 00669C37

Part of subcall function 00665A26: RtlFreeHeap.NTDLL(00000000,?,00661199,00000000,0066D964,?,0066D908), ref: 00665A32

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
String ID:
API String ID: 943265810-0
Opcode ID: d54a2c7ace8e3a416c0c6efdd19db092e3b620dc601a00102ddbc61b9ccd92b5
Instruction ID: 0df10e2ee722d9a8abdb11677bd0d8fdac12fae3d4c2f5427e20d04944d241e6
Opcode Fuzzy Hash: d54a2c7ace8e3a416c0c6efdd19db092e3b620dc601a00102ddbc61b9ccd92b5
Instruction Fuzzy Hash: DB418E71500608FBD7319F66DD89EABBBFEEB55740F100929F942E11A1E7709D44DA30

Function 00661C28 Relevance: 6.1, APIs: 4, Instructions: 92synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00661C3F
SetEvent.KERNEL32(?), ref: 00661C4F
GetLastError.KERNEL32 ref: 00661CD8

Part of subcall function 0066739C: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,?,?,?,?,00661CFA,0000EA60), ref: 006673B7

Part of subcall function 00665A26: RtlFreeHeap.NTDLL(00000000,?,00661199,00000000,0066D964,?,0066D908), ref: 00665A32

GetLastError.KERNEL32(00000000), ref: 00661D0D

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 602384898-0
Opcode ID: 5ceccf983a178bf0c413d5df8d41f3cfbf3664caaeab12aeb52106cf86fd6aff
Instruction ID: 18dc229f4c8fd3daeb9d540c47bc1e6ae8f3a36337edf6c96400177ffdffe002
Opcode Fuzzy Hash: 5ceccf983a178bf0c413d5df8d41f3cfbf3664caaeab12aeb52106cf86fd6aff
Instruction Fuzzy Hash: 53311E7190030DEFDB20DFA5C8819AEBBBABF05344F24456AE542E6651D7709A49DF20

Function 00665D18 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006697E6: RtlAllocateHeap.NTDLL(00000000,?,00661838), ref: 006697F2

RtlEnterCriticalSection.NTDLL(?), ref: 00665D48
VirtualProtect.KERNEL32(?,00000001,00000001,0000000C,?,?,?,?,00662D5F,?,?,?), ref: 00665D7A
GetLastError.KERNEL32(?,?,?,00662D5F,?,?,?), ref: 00665D99
RtlLeaveCriticalSection.NTDLL(?), ref: 00665DA4

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: CriticalSection$AllocateEnterErrorHeapLastLeaveProtectVirtual
String ID:
API String ID: 2359371767-0
Opcode ID: d66c3e913bf702393058b84ef2f3107e1a0cef8b5c54d04f4f47a6249664d730
Instruction ID: 013fe7939dded28410a8f606c88a1cb0b5b99c353380a1e58178dd59f1724004
Opcode Fuzzy Hash: d66c3e913bf702393058b84ef2f3107e1a0cef8b5c54d04f4f47a6249664d730
Instruction Fuzzy Hash: 2E21B432600B04EFCB208F55C885B9A7BEAFF84750F14842AF55ACB390DBB0D841CB95

Function 00661411 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00661429
VirtualProtect.KERNEL32(?,00000001,0000000C,0000000C,?), ref: 0066146C
GetLastError.KERNEL32 ref: 00661476
RtlLeaveCriticalSection.NTDLL(?), ref: 006614AA

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveProtectVirtual
String ID:
API String ID: 3666628472-0
Opcode ID: 09ca83c1482bcad7d0537c4c418d8a0d8072ae6a7d4777b98041af9b70faef1b
Instruction ID: 279aae9c1bf6e9b2e415be78ccee1954476d239270f7f159aa2116ab727e3146
Opcode Fuzzy Hash: 09ca83c1482bcad7d0537c4c418d8a0d8072ae6a7d4777b98041af9b70faef1b
Instruction Fuzzy Hash: D1118132600304AFDB308F65CC84B9A7BEAFF45365F049528F829CB290DBB5D844CB50

Function 0066172E Relevance: 6.1, APIs: 4, Instructions: 61memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32 ref: 00661739
RtlAllocateHeap.NTDLL(00000000,?), ref: 00661751
memcpy.NTDLL(00000000,?,-00000008), ref: 00661795
memcpy.NTDLL(00000001,?,00000001), ref: 006617B6

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: 776ca96ce488c5a0e226996d10fb0520b42cea52330edc004db351f79e63ffbb
Instruction ID: 6bff42b0545028c007eb4a2ed726ea38385cc5fe3a55378fdf0dae869148e146
Opcode Fuzzy Hash: 776ca96ce488c5a0e226996d10fb0520b42cea52330edc004db351f79e63ffbb
Instruction Fuzzy Hash: AB11EC72A00218BFC7108F6ADC84D9E7FEFEB91360B090176F904D7250E7719E0597A0

Function 00665471 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlRemoveVectoredExceptionHandler.NTDLL(00663A9A), ref: 00665480
TlsFree.KERNEL32(?,00000000,?,?,00662E77,00000000,?,00663A9A,?,?), ref: 0066548E
RtlDeleteCriticalSection.NTDLL(?), ref: 0066549B
VirtualProtect.KERNEL32(?,00000001,0000000C,0000000C,00000000,00000000,?,?,00662E77,00000000,?,00663A9A,?,?), ref: 006654C8

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: CriticalDeleteExceptionFreeHandlerProtectRemoveSectionVectoredVirtual
String ID:
API String ID: 2089334682-0
Opcode ID: 02b203209063237168a6da20cc78ffed3b7ec9a431eca556f5df6ed77c07cae4
Instruction ID: 0b301f03bc5204cbb5a45937135f750ccc7b04cfe6bbf35085d574adfdef8ed4
Opcode Fuzzy Hash: 02b203209063237168a6da20cc78ffed3b7ec9a431eca556f5df6ed77c07cae4
Instruction Fuzzy Hash: 2E015E76601608AFCB209F64C889E9B7BEEFF48311F049159F91AD3310DB71EC80CA60

Function 00691CE9 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RemoveVectoredExceptionHandler.KERNEL32(?,00000000,?,?,0069136E,00000000,?,00000000,006912C1,?,00000000,00000000,?,00691850,?,00000000), ref: 00691CF8
TlsFree.KERNEL32(?,00000000,?,?,0069136E,00000000,?,00000000,006912C1,?,00000000,00000000,?,00691850,?,00000000), ref: 00691D06
DeleteCriticalSection.KERNEL32(?,00000000,?,?,0069136E,00000000,?,00000000,006912C1,?,00000000,00000000,?,00691850,?,00000000), ref: 00691D13
VirtualProtect.KERNEL32(?,00000001,0000000C,0000000C,00000000,00000000,?,?,0069136E,00000000,?,00000000,006912C1,?,00000000,00000000), ref: 00691D40

Memory Dump Source

Source File: 00000000.00000002.2555028026.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2554987620.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555093096.0000000000692000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2555146640.0000000000696000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_94.jbxd

Similarity

API ID: CriticalDeleteExceptionFreeHandlerProtectRemoveSectionVectoredVirtual
String ID:
API String ID: 2089334682-0
Opcode ID: 5730d1a41f9126238e0d6391c0fbbd3529550633396094665aa713e0ee0c77ea
Instruction ID: 195a716a423704d13225522d6d7d37a2edbf91fd136bf1d4a46506b7577644e1
Opcode Fuzzy Hash: 5730d1a41f9126238e0d6391c0fbbd3529550633396094665aa713e0ee0c77ea
Instruction Fuzzy Hash: F901217620020AEFCB109F54D888E9A77AEEF4A315B21851AF915D7B11C735EC45CB60

Function 006611A0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 33stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(N0f,00000000,0066C0F8,?,00664123,00000000,?,0066C00C,00000000,?,?,0066C280,?,?,0066C280), ref: 006611A9
memcpy.NTDLL(00000000,?,00000000,00000001,?,?,?,0066304E), ref: 006611CC
memset.NTDLL ref: 006611DB

Strings

N0f, xrefs: 006611A3

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: lstrlenmemcpymemset
String ID: N0f
API String ID: 4042389641-4275211078
Opcode ID: 96dd29ad0fd9066793f8273b8b7822a5bf2a4f3e15492a58ee5498b59217a96b
Instruction ID: 1d9fa9b77d90faf88e357de122951080d1f5ebedf37b26e7f03c32d19d3b3211
Opcode Fuzzy Hash: 96dd29ad0fd9066793f8273b8b7822a5bf2a4f3e15492a58ee5498b59217a96b
Instruction Fuzzy Hash: 62E0E57750435167C7306AB59C89D8B6EDEEBD6350B04052AFE05D7201E525CA04C2B0

Function 006646AC Relevance: 6.0, APIs: 4, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(0066C24C,00000001,00662E15), ref: 006646B7
SleepEx.KERNEL32(00000064,00000001), ref: 006646C6
CloseHandle.KERNEL32(0066C24C), ref: 006646E7
HeapDestroy.KERNEL32(0066C218), ref: 006646F7

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: 119f06bb9be8c5a842b5745f62776a43a9ee0e3dac5216c4a10bb19d1341d9d4
Instruction ID: 408d09dee8bff1cf19b6e88b32707c7dc04ff54bef14a47993abe8242bee0efd
Opcode Fuzzy Hash: 119f06bb9be8c5a842b5745f62776a43a9ee0e3dac5216c4a10bb19d1341d9d4
Instruction Fuzzy Hash: EEF03071B027169BD720ABBADC5CF973BAFAB05B61B052110FC51D33A0DFA0DD448650

Function 00663996 Relevance: 6.0, APIs: 4, Instructions: 29sleepmemoryCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(0066C2C4), ref: 0066399F
Sleep.KERNEL32(0000000A,?,?,?,0066304E), ref: 006639A9
HeapFree.KERNEL32(00000000,00000000,?,?,?,0066304E), ref: 006639D1
RtlLeaveCriticalSection.NTDLL(0066C2C4), ref: 006639ED

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: a9570c1b7c89b8432a8b44c2c737ee61411fc917cb30d9810b343a408a21b080
Instruction ID: 7698b84e010dbeb98f6cdad60680a5e9b9083855389ddf1a094311bbc74a7f96
Opcode Fuzzy Hash: a9570c1b7c89b8432a8b44c2c737ee61411fc917cb30d9810b343a408a21b080
Instruction Fuzzy Hash: 13F05871300A80EFDB109F68DD49F2A3BABAB10344B046508F586D6362D7B0EE80CF65

Function 00663B71 Relevance: 6.0, APIs: 4, Instructions: 28sleepmemoryCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(0066C2C4), ref: 00663B7A
Sleep.KERNEL32(0000000A,?,?,?,0066304E), ref: 00663B84
HeapFree.KERNEL32(00000000,?,?,?,?,0066304E), ref: 00663BB2
RtlLeaveCriticalSection.NTDLL(0066C2C4), ref: 00663BC7

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: c83c3bb7ba74bbb10b0f46ac189c56611ba4021ebea274661f7e2733ffa3c3f0
Instruction ID: 67f156b7d3f8984af28691445da6d3b0fffc94195abcbf44b775e3ccf61c4803
Opcode Fuzzy Hash: c83c3bb7ba74bbb10b0f46ac189c56611ba4021ebea274661f7e2733ffa3c3f0
Instruction Fuzzy Hash: D1F0F875300601EFE7188F64ED89F2A3BA7AB24711B04601CE946DB3B1CBB4AE80CE50

Function 006A6368 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 006A65B2
__aulldiv.LIBCMT ref: 006A65D4

Strings

9, xrefs: 006A65E5

Memory Dump Source

Source File: 00000000.00000002.2555181799.000000000069F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0069F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f000_94.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 1abf7ce866ae5b50c81bad13d0e58c943b290e4d320ca693cfd599c5d19f895f
Instruction ID: 7ef8ffbff042249e89a8fc42901d5196a61f389a83aa1f61681ba34986237bf5
Opcode Fuzzy Hash: 1abf7ce866ae5b50c81bad13d0e58c943b290e4d320ca693cfd599c5d19f895f
Instruction Fuzzy Hash: A241D2B1D002299FDB64DF48C891BAEB7B2FF46314F1881A9E249A7244D7349E85CF49

Function 006A475E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 006A4957
__aulldiv.LIBCMT ref: 006A4979

Strings

9, xrefs: 006A498A

Memory Dump Source

Source File: 00000000.00000002.2555181799.000000000069F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0069F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f000_94.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 269c20f4ebe0440cae4cd6e0363efc5a3a594f9c8f858a41e9babffe2c57fa9e
Instruction ID: 08412b6b8dbaccb69de9633ac5544101f2efa8b9e63ed9558f63dc6d4f7a6fcb
Opcode Fuzzy Hash: 269c20f4ebe0440cae4cd6e0363efc5a3a594f9c8f858a41e9babffe2c57fa9e
Instruction Fuzzy Hash: A441D371D026699FEB64EF48DD99BEEB7B2BB85300F1081D8E009A7255CB749E81CF40

Function 006A63B6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 006A65B2
__aulldiv.LIBCMT ref: 006A65D4

Strings

9, xrefs: 006A65E5

Memory Dump Source

Source File: 00000000.00000002.2555181799.000000000069F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0069F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f000_94.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 0d4587149ab467dd71229e360c947471e7a5a73046b3f055c09ea81032c9c3a1
Instruction ID: d4c150a39b27b4bf9d3955146ebde5dae0c94d6705b950ee4f1bc5aa00e5af18
Opcode Fuzzy Hash: 0d4587149ab467dd71229e360c947471e7a5a73046b3f055c09ea81032c9c3a1
Instruction Fuzzy Hash: 3141E8B1D002299FDF64DF48C8817EEB7B2FB86314F1885A9E149A7244D3349E85CF49

Function 006A635F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 006A65B2
__aulldiv.LIBCMT ref: 006A65D4

Strings

9, xrefs: 006A65E5

Memory Dump Source

Source File: 00000000.00000002.2555181799.000000000069F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0069F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f000_94.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: c92a94ea83471cb06c6987702d05a8003d3546a3be9e19f7155074bf782fd3b3
Instruction ID: 79a6022a1bc979b383c22ba0105ad7e4db3ffc6771fb0f9462967448f21adf2f
Opcode Fuzzy Hash: c92a94ea83471cb06c6987702d05a8003d3546a3be9e19f7155074bf782fd3b3
Instruction Fuzzy Hash: E841E7B1D002699FDF64DF48C8817EEB7B2FB46314F1885A9E249A7244D3349E85CF09

Function 006A470D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 006A4957
__aulldiv.LIBCMT ref: 006A4979

Strings

9, xrefs: 006A498A

Memory Dump Source

Source File: 00000000.00000002.2555181799.000000000069F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0069F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f000_94.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 7532ccd5f8c9cdcae252df4ace37a735533dd9ad4109f761545829c7e0e84cba
Instruction ID: d6a8fbcfd2172b6ede91af9950dd3825c9ad8b2a22445d85805ff60a4db41dfd
Opcode Fuzzy Hash: 7532ccd5f8c9cdcae252df4ace37a735533dd9ad4109f761545829c7e0e84cba
Instruction Fuzzy Hash: 4141D471D062699FEB64EF48DD99BEEB7B2BB85300F1081D8E009A7245CB749E81CF40

Function 00663300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

StrTrimA.SHLWAPI(?,0066B2B4,00000002,?,?,?,006639E1,0066C300,?,?,?,0066304E), ref: 00663339
StrTrimA.SHLWAPI(00000001,0066B2B4,?,?,?,006639E1,0066C300,?,?,?,0066304E), ref: 00663356

Strings

N0f, xrefs: 0066335C, 0066336E

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: Trim
String ID: N0f
API String ID: 3043112668-4275211078
Opcode ID: 361fff6a0475b4f359fff2f9d9dd62e1df54e98dcad91da9c5be867e2a6ccfda
Instruction ID: 96699df84df2de9cb9848618f6d381ffd6a3f41942f722f8ba555ecccf32302e
Opcode Fuzzy Hash: 361fff6a0475b4f359fff2f9d9dd62e1df54e98dcad91da9c5be867e2a6ccfda
Instruction Fuzzy Hash: C501B1716453A1ABD3208F698C48F7BBEDEEB89BA4F121519F981D7340DFA1C90186A4

Function 0066195D Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 00661969

Part of subcall function 006697E6: RtlAllocateHeap.NTDLL(00000000,?,00661838), ref: 006697F2

memcpy.NTDLL(00000000,?,?,?,00000001,00000001), ref: 006619C7
lstrcpy.KERNEL32(00000000,?), ref: 006619D7
lstrcpy.KERNEL32(00000000,?), ref: 006619E3

Memory Dump Source

Source File: 00000000.00000002.2554862039.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00661000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_661000_94.jbxd

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: c40cceec21b4d2c16b7f5dcfa4dc4b2f9ea7d897fb8fb79c63b01b72615a7400
Instruction ID: bda8e3757ffb8aa94e28b4a2d4b8bd0ddf3f669a14090de3486fea2015854cf0
Opcode Fuzzy Hash: c40cceec21b4d2c16b7f5dcfa4dc4b2f9ea7d897fb8fb79c63b01b72615a7400
Instruction Fuzzy Hash: 5221DF72504255FFCB02AFA9CC44A9F7FEB9F16380B095154F9049F202EB34DA00C7A0

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 94.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Ursnif

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\9L0M3N8I\www.avast[1].xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{006CCD91-1DBF-11EF-8C2C-ECF4BB45F69D}.dat

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D0D8C526-1DBE-11EF-8C2C-ECF4BB45F69D}.dat

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F13A0E4B-1DBE-11EF-8C2C-ECF4BB45F69D}.dat

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{006CCD93-1DBF-11EF-8C2C-ECF4BB45F69D}.dat

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D0D8C528-1DBE-11EF-8C2C-ECF4BB45F69D}.dat

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F13A0E4D-1DBE-11EF-8C2C-ECF4BB45F69D}.dat

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-314712940\msapplication.xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml

Windows Analysis Report
94.exe